d93333dbffefb763131024dffc1c0723d897a65c7b8d2701f5fa5bc9498ae89f

General

Target

emotet_e2_d93333dbffefb763131024dffc1c0723d897a65c7b8d2701f5fa5bc9498ae89f_2021-01-13__004525795509._doc
Size

157KB
Sample

210113-7n3kq9g6kn
MD5

27338ce76921e33926002d9c3a2a6f32
SHA1

06be46d6389c48f72e8526161bb8c36cce2834ef
SHA256

d93333dbffefb763131024dffc1c0723d897a65c7b8d2701f5fa5bc9498ae89f
SHA512

7f6caf26fdaecba9f44eff5906b5a0596b8fa774047ae1a6c1f009f139a846084da2f0e0d994e665233a5b7eb22948a4fc1f4a90411ecef3a14f4d69c48c9671

Score

10^/10

macro

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://altrashift.com/wp-includes/I/

exe.dropper

https://ojodetigremezcal.com/wp/i62s/

exe.dropper

https://snowremoval-services.com/wp-content/P3Z/

exe.dropper

http://kitsunecomplements.com/too-much-phppq/n65U/

exe.dropper

https://imperioone.com/content/WOBq/

exe.dropper

http://www.autoeck-baden.at/wp-content/w0Vb/

exe.dropper

https://shop.animewho.com/content/Tj/

Targets

- Target
  
  emotet_e2_d93333dbffefb763131024dffc1c0723d897a65c7b8d2701f5fa5bc9498ae89f_2021-01-13__004525795509._doc
- Size
  
  157KB
- MD5
  
  27338ce76921e33926002d9c3a2a6f32
- SHA1
  
  06be46d6389c48f72e8526161bb8c36cce2834ef
- SHA256
  
  d93333dbffefb763131024dffc1c0723d897a65c7b8d2701f5fa5bc9498ae89f
- SHA512
  
  7f6caf26fdaecba9f44eff5906b5a0596b8fa774047ae1a6c1f009f139a846084da2f0e0d994e665233a5b7eb22948a4fc1f4a90411ecef3a14f4d69c48c9671
Score

10^/10
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Process spawned unexpected child process

Blocklisted process makes network request

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2