Analysis
- max time kernel
3s - max time network
2s - platform
windows10_x64 - resource
win10v20201028 - submitted
22/12/2020, 15:58
Static task
static1
Behavioral task
behavioral1
Sample
emotet_e2_af92a129d35b30bd55269f49ba230a5702cee5b9b18634c2f4829d052d208089_2020-12-22__155527510303._doc.doc
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
emotet_e2_af92a129d35b30bd55269f49ba230a5702cee5b9b18634c2f4829d052d208089_2020-12-22__155527510303._doc.doc
Resource
win10v20201028
0 signatures
0 seconds
General
- Target emotet_e2_af92a129d35b30bd55269f49ba230a5702cee5b9b18634c2f4829d052d208089_2020-12-22__155527510303._doc.doc
- Size 205KB
- Sample201222-x6sd2sncja
- SHA256 af92a129d35b30bd55269f49ba230a5702cee5b9b18634c2f4829d052d208089
- MD5 f705344b1039aff6e3eccb661c454f2b
- SHA1 5e5fe87ce0a026b088b5c3e949390fcc5895e8f7
- SHA512 1e75ff55191487a57bdc6e17ef84930ad1f37be1e59b8c5f01199fe19c3a2656d1271c473120887195e13a11fa0fb65c20146c82e3243dd31e9e8c2764505c11
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4804 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_af92a129d35b30bd55269f49ba230a5702cee5b9b18634c2f4829d052d208089_2020-12-22__155527510303._doc.doc" /o ""1⤵
- Suspicious use of SetWindowsHookEx
PID:4804