7232bb05a7e765ec62dfdf1dbf29a4a6260d804c9850305969e4363e10215734

General

Target

emotet_e2_7232bb05a7e765ec62dfdf1dbf29a4a6260d804c9850305969e4363e10215734_2021-01-12__234635591825._doc
Size

157KB
Sample

210112-9yagk9rhva
MD5

88142d108e74217ad8e854516f5758de
SHA1

633d67731e14dcf8dd632252c2cc2659aa1f9b04
SHA256

7232bb05a7e765ec62dfdf1dbf29a4a6260d804c9850305969e4363e10215734
SHA512

8918abb184b9b56409d6a10ea7bee990b8201b5976730b7755bcab0b6305a60f383741fa8a5c9a9a30640861f2cf28e89fd7b2c98322de23a8b03d9e25f94108

Score

10^/10

macro

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://altrashift.com/wp-includes/I/

exe.dropper

https://ojodetigremezcal.com/wp/i62s/

exe.dropper

https://snowremoval-services.com/wp-content/P3Z/

exe.dropper

http://kitsunecomplements.com/too-much-phppq/n65U/

exe.dropper

https://imperioone.com/content/WOBq/

exe.dropper

http://www.autoeck-baden.at/wp-content/w0Vb/

exe.dropper

https://shop.animewho.com/content/Tj/

Targets

- Target
  
  emotet_e2_7232bb05a7e765ec62dfdf1dbf29a4a6260d804c9850305969e4363e10215734_2021-01-12__234635591825._doc
- Size
  
  157KB
- MD5
  
  88142d108e74217ad8e854516f5758de
- SHA1
  
  633d67731e14dcf8dd632252c2cc2659aa1f9b04
- SHA256
  
  7232bb05a7e765ec62dfdf1dbf29a4a6260d804c9850305969e4363e10215734
- SHA512
  
  8918abb184b9b56409d6a10ea7bee990b8201b5976730b7755bcab0b6305a60f383741fa8a5c9a9a30640861f2cf28e89fd7b2c98322de23a8b03d9e25f94108
Score

10^/10
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Process spawned unexpected child process

Blocklisted process makes network request

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2