Analysis Overview
SHA256
e64549e88b14c5d72ce5c38e58c6fc8277eb913e10e5b34380cbd40fdc2833d9
Threat Level: Known bad
The file e64549e88b14c5d72ce5c38e58c6fc8277eb913e10e5b34380cbd40fdc2833d9.xls was found to be: Known bad.
Malicious Activity Summary
Emotet
Process spawned unexpected child process
Downloads MZ/PE file
Suspicious Office macro
Loads dropped DLL
Adds Run key to start application
Suspicious use of WriteProcessMemory
Suspicious use of FindShellTrayWindow
Checks processor information in registry
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Enumerates system info in registry
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-11-10 10:40
Signatures
Suspicious Office macro
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2022-11-10 10:40
Reported
2022-11-10 10:43
Platform
win10-20220812-en
Max time kernel
145s
Max time network
147s
Command Line
Signatures
Emotet
Process spawned unexpected child process
| Description | Indicator | Process | Target |
| Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process | N/A | C:\Windows\System32\regsvr32.exe | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE |
| Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process | N/A | C:\Windows\System32\regsvr32.exe | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE |
| Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process | N/A | C:\Windows\System32\regsvr32.exe | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE |
| Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process | N/A | C:\Windows\System32\regsvr32.exe | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE |
Downloads MZ/PE file
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\System32\regsvr32.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wIPFhlPKR.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\WuEsWxctaFEVP\\wIPFhlPKR.dll\"" | C:\Windows\system32\regsvr32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | C:\Windows\system32\regsvr32.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WLlHyppMMNNSMkx.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\IbQKDtnCi\\WLlHyppMMNNSMkx.dll\"" | C:\Windows\system32\regsvr32.exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\BIOS | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\System32\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\system32\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\system32\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\system32\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\system32\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\System32\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\System32\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\system32\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\system32\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\system32\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\system32\regsvr32.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e64549e88b14c5d72ce5c38e58c6fc8277eb913e10e5b34380cbd40fdc2833d9.xls"
C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx
C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WuEsWxctaFEVP\wIPFhlPKR.dll"
C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx
C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IbQKDtnCi\WLlHyppMMNNSMkx.dll"
C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx
C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | bosny.com | udp |
| TH | 203.151.59.20:443 | bosny.com | tcp |
| US | 8.8.8.8:53 | navylin.com | udp |
| CN | 47.92.133.65:80 | navylin.com | tcp |
| US | 20.189.173.15:443 | tcp | |
| US | 8.8.8.8:53 | asrani.garudaputih.com | udp |
| SG | 51.79.133.157:80 | asrani.garudaputih.com | tcp |
| US | 8.8.8.8:53 | db.rikaz.tech | udp |
| DE | 135.125.230.197:80 | db.rikaz.tech | tcp |
| ID | 115.178.55.22:80 | 115.178.55.22 | tcp |
| ID | 115.178.55.22:80 | 115.178.55.22 | tcp |
Files
memory/4328-118-0x00007FF83D3A0000-0x00007FF83D3B0000-memory.dmp
memory/4328-119-0x00007FF83D3A0000-0x00007FF83D3B0000-memory.dmp
memory/4328-120-0x00007FF83D3A0000-0x00007FF83D3B0000-memory.dmp
memory/4328-121-0x00007FF83D3A0000-0x00007FF83D3B0000-memory.dmp
memory/4328-130-0x00007FF839DB0000-0x00007FF839DC0000-memory.dmp
memory/4328-131-0x00007FF839DB0000-0x00007FF839DC0000-memory.dmp
memory/892-283-0x0000000000000000-mapping.dmp
C:\Users\Admin\elv1.ooocccxxx
| MD5 | d91b16ead21c4a8468e0e411b4104b8b |
| SHA1 | e014b2034b852c53ff4528f7ae80cd2dd7c0e8d7 |
| SHA256 | d96d07555698b46be58865d8f65d0553b6a64bffae36072507291175b23876ca |
| SHA512 | 18c0d7831717f87c300cede2cffffcc002a33ded4b48fb19fc9225c0553c185cadef7eeab2d41248ed6b7b66be95b170f9bb482f1d2720daf982f0ca4790674a |
\Users\Admin\elv1.ooocccxxx
| MD5 | d91b16ead21c4a8468e0e411b4104b8b |
| SHA1 | e014b2034b852c53ff4528f7ae80cd2dd7c0e8d7 |
| SHA256 | d96d07555698b46be58865d8f65d0553b6a64bffae36072507291175b23876ca |
| SHA512 | 18c0d7831717f87c300cede2cffffcc002a33ded4b48fb19fc9225c0553c185cadef7eeab2d41248ed6b7b66be95b170f9bb482f1d2720daf982f0ca4790674a |
memory/2684-291-0x0000000000000000-mapping.dmp
memory/2684-292-0x0000000002A70000-0x0000000002A9E000-memory.dmp
memory/1820-297-0x0000000000000000-mapping.dmp
C:\Users\Admin\elv2.ooocccxxx
| MD5 | d8d225350e7e511598ca5e62139ab35b |
| SHA1 | 9840cf8f5a2d06c74ac3986f62c8c951c87c99cc |
| SHA256 | e5d587bc2bffd9e7c7508bc09518aa67ee8c05286ebd09bbbe1323c4fb560966 |
| SHA512 | 751a6bfc41d086e6327b895f2f06bb3fa4653919e1280dc0786fb4ff989304b03baeaee6dc65533870e1653a46979a70e26851893b9e41c146242adf7862307f |
\Users\Admin\elv2.ooocccxxx
| MD5 | d8d225350e7e511598ca5e62139ab35b |
| SHA1 | 9840cf8f5a2d06c74ac3986f62c8c951c87c99cc |
| SHA256 | e5d587bc2bffd9e7c7508bc09518aa67ee8c05286ebd09bbbe1323c4fb560966 |
| SHA512 | 751a6bfc41d086e6327b895f2f06bb3fa4653919e1280dc0786fb4ff989304b03baeaee6dc65533870e1653a46979a70e26851893b9e41c146242adf7862307f |
memory/308-305-0x0000000000000000-mapping.dmp
memory/3344-311-0x0000000000000000-mapping.dmp
memory/188-312-0x0000000000000000-mapping.dmp
memory/4328-334-0x00007FF83D3A0000-0x00007FF83D3B0000-memory.dmp
memory/4328-335-0x00007FF83D3A0000-0x00007FF83D3B0000-memory.dmp
memory/4328-336-0x00007FF83D3A0000-0x00007FF83D3B0000-memory.dmp
memory/4328-337-0x00007FF83D3A0000-0x00007FF83D3B0000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2022-11-10 10:40
Reported
2022-11-10 10:43
Platform
win10-20220812-en
Max time kernel
127s
Max time network
147s
Command Line
Signatures
Process spawned unexpected child process
| Description | Indicator | Process | Target |
| Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process | N/A | C:\Windows\System32\regsvr32.exe | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE |
| Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process | N/A | C:\Windows\System32\regsvr32.exe | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE |
| Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process | N/A | C:\Windows\System32\regsvr32.exe | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE |
| Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process | N/A | C:\Windows\System32\regsvr32.exe | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\BIOS | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e64549e88b14c5d72ce5c38e58c6fc8277eb913e10e5b34380cbd40fdc2833d9.xls"
C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx
C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx
C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx
C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | bosny.com | udp |
| N/A | 100.82.237.243:443 | bosny.com | tcp |
| US | 8.8.8.8:53 | navylin.com | udp |
| N/A | 100.106.41.147:80 | navylin.com | tcp |
| US | 8.8.8.8:53 | asrani.garudaputih.com | udp |
| N/A | 100.118.42.28:80 | asrani.garudaputih.com | tcp |
| US | 8.8.8.8:53 | db.rikaz.tech | udp |
| N/A | 100.80.155.116:80 | db.rikaz.tech | tcp |
Files
memory/3984-119-0x00007FFD2BB70000-0x00007FFD2BB80000-memory.dmp
memory/3984-120-0x00007FFD2BB70000-0x00007FFD2BB80000-memory.dmp
memory/3984-121-0x00007FFD2BB70000-0x00007FFD2BB80000-memory.dmp
memory/3984-122-0x00007FFD2BB70000-0x00007FFD2BB80000-memory.dmp
memory/3984-131-0x00007FFD28D90000-0x00007FFD28DA0000-memory.dmp
memory/3984-132-0x00007FFD28D90000-0x00007FFD28DA0000-memory.dmp
memory/3336-255-0x0000000000000000-mapping.dmp
memory/3848-256-0x0000000000000000-mapping.dmp
memory/4688-257-0x0000000000000000-mapping.dmp
memory/4524-258-0x0000000000000000-mapping.dmp
memory/3984-297-0x00007FFD2BB70000-0x00007FFD2BB80000-memory.dmp
memory/3984-298-0x00007FFD2BB70000-0x00007FFD2BB80000-memory.dmp
memory/3984-299-0x00007FFD2BB70000-0x00007FFD2BB80000-memory.dmp
memory/3984-300-0x00007FFD2BB70000-0x00007FFD2BB80000-memory.dmp