91df3e9a9690c149ae4587d46020b21ab675cfd5afa6a5809637d4686cfff6c7

General

Target

emotet_e2_91df3e9a9690c149ae4587d46020b21ab675cfd5afa6a5809637d4686cfff6c7_2021-01-13__015717102344._doc
Size

157KB
Sample

210113-dtfwn1zgbe
MD5

40a12acab6ed6f7c9d5d785bebc49a67
SHA1

9d258b8cd155ad63013cd7190be5100b4fbb18c1
SHA256

91df3e9a9690c149ae4587d46020b21ab675cfd5afa6a5809637d4686cfff6c7
SHA512

6a7cb60b2d53bd233cbccf00944c1a22cee97a693934f19daf39c59acd61361e09d8a9e53c828005a4b61c5264abcb0c9bacab10b4bc4d58f440aab89b164b51

Score

10^/10

macro

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://altrashift.com/wp-includes/I/

exe.dropper

https://ojodetigremezcal.com/wp/i62s/

exe.dropper

https://snowremoval-services.com/wp-content/P3Z/

exe.dropper

http://kitsunecomplements.com/too-much-phppq/n65U/

exe.dropper

https://imperioone.com/content/WOBq/

exe.dropper

http://www.autoeck-baden.at/wp-content/w0Vb/

exe.dropper

https://shop.animewho.com/content/Tj/

Targets

- Target
  
  emotet_e2_91df3e9a9690c149ae4587d46020b21ab675cfd5afa6a5809637d4686cfff6c7_2021-01-13__015717102344._doc
- Size
  
  157KB
- MD5
  
  40a12acab6ed6f7c9d5d785bebc49a67
- SHA1
  
  9d258b8cd155ad63013cd7190be5100b4fbb18c1
- SHA256
  
  91df3e9a9690c149ae4587d46020b21ab675cfd5afa6a5809637d4686cfff6c7
- SHA512
  
  6a7cb60b2d53bd233cbccf00944c1a22cee97a693934f19daf39c59acd61361e09d8a9e53c828005a4b61c5264abcb0c9bacab10b4bc4d58f440aab89b164b51
Score

10^/10
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Process spawned unexpected child process

Blocklisted process makes network request

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2