Analysis
- max time kernel
3s - max time network
6s - platform
windows10_x64 - resource
win10v20201028 - submitted
23/12/2020, 02:59
Static task
static1
Behavioral task
behavioral1
Sample
emotet_e2_168fe6ffe9e78f01a7f784833ba9306ef1edad3ccea334df35937424ef0220bc_2020-12-23__025519486874._doc.doc
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
emotet_e2_168fe6ffe9e78f01a7f784833ba9306ef1edad3ccea334df35937424ef0220bc_2020-12-23__025519486874._doc.doc
Resource
win10v20201028
0 signatures
0 seconds
General
- Target emotet_e2_168fe6ffe9e78f01a7f784833ba9306ef1edad3ccea334df35937424ef0220bc_2020-12-23__025519486874._doc.doc
- Size 209KB
- Sample201223-13465rt2ts
- SHA256 168fe6ffe9e78f01a7f784833ba9306ef1edad3ccea334df35937424ef0220bc
- MD5 bc74cf80d4c8fc1e74838925fb080e62
- SHA1 7baec8bc4a45289dba4b5c5b03ece41eff7f73d4
- SHA512 ef91d8368ed8c34c83acfae5366d15fe9c03c87a72d53f2d62fed23277691e63643116471be29565b62d1bfbfc945c6215b203dddcc6afd705c93650e483b659
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4712 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_168fe6ffe9e78f01a7f784833ba9306ef1edad3ccea334df35937424ef0220bc_2020-12-23__025519486874._doc.doc" /o ""1⤵
- Suspicious use of SetWindowsHookEx
PID:4712