a4b2c79223d87bc6523817efc6ae96ddb3a517b509a0907f5aa47ed93cf1bd78

General

Target

emotet_e2_a4b2c79223d87bc6523817efc6ae96ddb3a517b509a0907f5aa47ed93cf1bd78_2021-01-13__024805623483._doc
Size

157KB
Sample

210113-pzsywk5jee
MD5

11324fee608dd57ff40000afcdbf2c89
SHA1

a7d9cdc7d4e64f135ad97ed6d3e48d71c5cb6e8d
SHA256

a4b2c79223d87bc6523817efc6ae96ddb3a517b509a0907f5aa47ed93cf1bd78
SHA512

ce62c34a469c090f1ddb41d6718b887aecd3e4d3c26882840b93a56570be8067fa1e85602bd4b6e654d3838531d78418e3ffe421386ee9db66256dfe988615c3

Score

10^/10

macro

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://altrashift.com/wp-includes/I/

exe.dropper

https://ojodetigremezcal.com/wp/i62s/

exe.dropper

https://snowremoval-services.com/wp-content/P3Z/

exe.dropper

http://kitsunecomplements.com/too-much-phppq/n65U/

exe.dropper

https://imperioone.com/content/WOBq/

exe.dropper

http://www.autoeck-baden.at/wp-content/w0Vb/

exe.dropper

https://shop.animewho.com/content/Tj/

Targets

- Target
  
  emotet_e2_a4b2c79223d87bc6523817efc6ae96ddb3a517b509a0907f5aa47ed93cf1bd78_2021-01-13__024805623483._doc
- Size
  
  157KB
- MD5
  
  11324fee608dd57ff40000afcdbf2c89
- SHA1
  
  a7d9cdc7d4e64f135ad97ed6d3e48d71c5cb6e8d
- SHA256
  
  a4b2c79223d87bc6523817efc6ae96ddb3a517b509a0907f5aa47ed93cf1bd78
- SHA512
  
  ce62c34a469c090f1ddb41d6718b887aecd3e4d3c26882840b93a56570be8067fa1e85602bd4b6e654d3838531d78418e3ffe421386ee9db66256dfe988615c3
Score

10^/10
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Process spawned unexpected child process

Blocklisted process makes network request

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2