Analysis Overview
SHA256
036cde54fd48f9b47f182385f5b22286816b35bf834a18d741822511f19eb2c4
Threat Level: Known bad
The file 036cde54fd48f9b47f182385f5b22286816b35bf834a18d741822511f19eb2c4.xls was found to be: Known bad.
Malicious Activity Summary
Emotet
Process spawned unexpected child process
Downloads MZ/PE file
Suspicious Office macro
Loads dropped DLL
Adds Run key to start application
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious use of FindShellTrayWindow
Suspicious behavior: EnumeratesProcesses
Checks processor information in registry
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-11-10 10:56
Signatures
Suspicious Office macro
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2022-11-10 10:56
Reported
2022-11-10 10:59
Platform
win10-20220812-en
Max time kernel
145s
Max time network
147s
Command Line
Signatures
Emotet
Process spawned unexpected child process
| Description | Indicator | Process | Target |
| Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process | N/A | C:\Windows\System32\regsvr32.exe | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE |
| Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process | N/A | C:\Windows\System32\regsvr32.exe | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE |
| Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process | N/A | C:\Windows\System32\regsvr32.exe | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE |
| Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process | N/A | C:\Windows\System32\regsvr32.exe | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE |
Downloads MZ/PE file
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\System32\regsvr32.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EWmjjEMsMT.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\ZPBDQrEvWoMJO\\EWmjjEMsMT.dll\"" | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puPNsD.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\DyzEMZBMcj\\puPNsD.dll\"" | C:\Windows\system32\regsvr32.exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\BIOS | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\System32\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\system32\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\system32\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\system32\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\system32\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\System32\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\System32\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\system32\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\system32\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\system32\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\system32\regsvr32.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\036cde54fd48f9b47f182385f5b22286816b35bf834a18d741822511f19eb2c4.xls"
C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx
C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZPBDQrEvWoMJO\EWmjjEMsMT.dll"
C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx
C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\DyzEMZBMcj\puPNsD.dll"
C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx
C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx
Network
| Country | Destination | Domain | Proto |
| FR | 2.16.119.157:443 | tcp | |
| US | 8.8.8.8:53 | bosny.com | udp |
| TH | 203.151.59.20:443 | bosny.com | tcp |
| US | 20.42.65.90:443 | tcp | |
| US | 8.8.8.8:53 | navylin.com | udp |
| CN | 47.92.133.65:80 | navylin.com | tcp |
| ID | 115.178.55.22:80 | 115.178.55.22 | tcp |
| US | 8.8.8.8:53 | asrani.garudaputih.com | udp |
| SG | 51.79.133.157:80 | asrani.garudaputih.com | tcp |
| US | 8.8.8.8:53 | db.rikaz.tech | udp |
| DE | 135.125.230.197:80 | db.rikaz.tech | tcp |
| ID | 115.178.55.22:80 | 115.178.55.22 | tcp |
Files
memory/1892-116-0x00007FFE7FCC0000-0x00007FFE7FCD0000-memory.dmp
memory/1892-117-0x00007FFE7FCC0000-0x00007FFE7FCD0000-memory.dmp
memory/1892-118-0x00007FFE7FCC0000-0x00007FFE7FCD0000-memory.dmp
memory/1892-119-0x00007FFE7FCC0000-0x00007FFE7FCD0000-memory.dmp
memory/1892-128-0x00007FFE7C260000-0x00007FFE7C270000-memory.dmp
memory/1892-129-0x00007FFE7C260000-0x00007FFE7C270000-memory.dmp
memory/4776-272-0x0000000000000000-mapping.dmp
C:\Users\Admin\elv1.ooocccxxx
| MD5 | 83b59fb810300c2dbddf3f7d739d25a4 |
| SHA1 | aa67e33414d97d297a3b86871dd6a9275fdb71d1 |
| SHA256 | 6b2be1e6753c8b1d69abec430562268775c00784b0a2f4cf2c5e499f98a7bfdf |
| SHA512 | c32ee574b86086d986b7177bbc011da11ad647ca8e3edbb76a6901a92fbc197d987f63b45c923aa273023ff070548caf712578e26a84f85c2eeea781ca55661a |
\Users\Admin\elv1.ooocccxxx
| MD5 | 83b59fb810300c2dbddf3f7d739d25a4 |
| SHA1 | aa67e33414d97d297a3b86871dd6a9275fdb71d1 |
| SHA256 | 6b2be1e6753c8b1d69abec430562268775c00784b0a2f4cf2c5e499f98a7bfdf |
| SHA512 | c32ee574b86086d986b7177bbc011da11ad647ca8e3edbb76a6901a92fbc197d987f63b45c923aa273023ff070548caf712578e26a84f85c2eeea781ca55661a |
memory/4776-275-0x00000000008F0000-0x000000000091E000-memory.dmp
memory/1040-283-0x0000000000000000-mapping.dmp
memory/420-289-0x0000000000000000-mapping.dmp
C:\Users\Admin\elv2.ooocccxxx
| MD5 | aeb676d2fa1854a89f970736dbb6ebf7 |
| SHA1 | f937c2cd80d116c535113c9a1d85528de0df94ad |
| SHA256 | 5ae9ca3c9d45304810d3c3eb599a2e33e749e08984941b119ff0a85b8350dd7a |
| SHA512 | 9f4d0f94b84f299253a8014f9aef49391363e8a620cfecda87e20974190f24b318dfe48bde6ec09a4d63669655063552a6ed837e0f487cb4a373566684c66884 |
\Users\Admin\elv2.ooocccxxx
| MD5 | aeb676d2fa1854a89f970736dbb6ebf7 |
| SHA1 | f937c2cd80d116c535113c9a1d85528de0df94ad |
| SHA256 | 5ae9ca3c9d45304810d3c3eb599a2e33e749e08984941b119ff0a85b8350dd7a |
| SHA512 | 9f4d0f94b84f299253a8014f9aef49391363e8a620cfecda87e20974190f24b318dfe48bde6ec09a4d63669655063552a6ed837e0f487cb4a373566684c66884 |
memory/3304-297-0x0000000000000000-mapping.dmp
memory/2368-303-0x0000000000000000-mapping.dmp
memory/2272-304-0x0000000000000000-mapping.dmp
memory/1892-327-0x00007FFE7FCC0000-0x00007FFE7FCD0000-memory.dmp
memory/1892-328-0x00007FFE7FCC0000-0x00007FFE7FCD0000-memory.dmp
memory/1892-329-0x00007FFE7FCC0000-0x00007FFE7FCD0000-memory.dmp
memory/1892-330-0x00007FFE7FCC0000-0x00007FFE7FCD0000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2022-11-10 10:56
Reported
2022-11-10 10:59
Platform
win10-20220812-en
Max time kernel
133s
Max time network
148s
Command Line
Signatures
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\BIOS | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Processes
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\036cde54fd48f9b47f182385f5b22286816b35bf834a18d741822511f19eb2c4.xls"
Network
| Country | Destination | Domain | Proto |
| US | 52.168.112.66:443 | tcp | |
| NL | 104.110.191.140:80 | tcp |
Files
memory/2656-120-0x00007FF939B40000-0x00007FF939B50000-memory.dmp
memory/2656-121-0x00007FF939B40000-0x00007FF939B50000-memory.dmp
memory/2656-122-0x00007FF939B40000-0x00007FF939B50000-memory.dmp
memory/2656-123-0x00007FF939B40000-0x00007FF939B50000-memory.dmp
memory/2656-132-0x00007FF936FF0000-0x00007FF937000000-memory.dmp
memory/2656-133-0x00007FF936FF0000-0x00007FF937000000-memory.dmp
memory/2656-289-0x00007FF939B40000-0x00007FF939B50000-memory.dmp
memory/2656-290-0x00007FF939B40000-0x00007FF939B50000-memory.dmp
memory/2656-291-0x00007FF939B40000-0x00007FF939B50000-memory.dmp
memory/2656-292-0x00007FF939B40000-0x00007FF939B50000-memory.dmp