Resubmissions

15/02/2023, 09:52

230215-lv6d1aba3x 10

15/02/2023, 09:50

230215-ltxepsbc55 10

Analysis

  • max time kernel
    140s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    15/02/2023, 09:50

General

  • Target

    2019-05-01-Emotet-binary-updated-after-initial-infection-1-of-2.exe

  • Size

    168KB

  • MD5

    1cc91941efd6d3da54a1054d9c9d870f

  • SHA1

    b6531c99b2fb0c51941ac3a636c5c3cf69073f65

  • SHA256

    6d7aff70a84d9237bde3b149ff04532cafb29b6f358886b5038a737af5934d1f

  • SHA512

    bade1e20f1a892e33d20535235f0ed45b625ef8cdd1ba9a391f074d3b77f971fb63f68f6d0f97e51fa48ef211fa7bea76a56da9deb88c85dbd0aa892ae78ed69

  • SSDEEP

    3072:5JYzFEhjHHIUjCgArLEZXApH3UHE360ESYUspf:r4FeHIU2Y9KEHE36FS2pf

Score
10/10

Malware Config

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies data under HKEY_USERS 21 IoCs
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of UnmapMainImage 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2019-05-01-Emotet-binary-updated-after-initial-infection-1-of-2.exe
    "C:\Users\Admin\AppData\Local\Temp\2019-05-01-Emotet-binary-updated-after-initial-infection-1-of-2.exe"
    1⤵
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1652
    • C:\Users\Admin\AppData\Local\Temp\2019-05-01-Emotet-binary-updated-after-initial-infection-1-of-2.exe
      --a1bda328
      2⤵
      • Suspicious behavior: RenamesItself
      • Suspicious use of UnmapMainImage
      PID:976
  • C:\Windows\SysWOW64\matrixtitle.exe
    "C:\Windows\SysWOW64\matrixtitle.exe"
    1⤵
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1900
    • C:\Windows\SysWOW64\matrixtitle.exe
      --eab533ad
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      PID:936
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\OutInvoke.wps
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1208
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\OutInvoke.wps"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:884
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\EnterAssert.ps1xml
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:1720
  • C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RequestSplit.mov"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1908

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/884-77-0x0000000070B1D000-0x0000000070B28000-memory.dmp

          Filesize

          44KB

        • memory/884-76-0x000000005FFF0000-0x0000000060000000-memory.dmp

          Filesize

          64KB

        • memory/884-75-0x0000000070B1D000-0x0000000070B28000-memory.dmp

          Filesize

          44KB

        • memory/884-73-0x0000000070B1D000-0x0000000070B28000-memory.dmp

          Filesize

          44KB

        • memory/884-71-0x000000005FFF0000-0x0000000060000000-memory.dmp

          Filesize

          64KB

        • memory/884-70-0x000000006FB31000-0x000000006FB33000-memory.dmp

          Filesize

          8KB

        • memory/884-69-0x00000000720B1000-0x00000000720B4000-memory.dmp

          Filesize

          12KB

        • memory/936-65-0x0000000000400000-0x000000000042C000-memory.dmp

          Filesize

          176KB

        • memory/936-74-0x0000000000400000-0x000000000042C000-memory.dmp

          Filesize

          176KB

        • memory/976-64-0x0000000000400000-0x0000000000414000-memory.dmp

          Filesize

          80KB

        • memory/976-60-0x0000000000400000-0x000000000042C000-memory.dmp

          Filesize

          176KB

        • memory/976-59-0x00000000001C0000-0x00000000001EC000-memory.dmp

          Filesize

          176KB

        • memory/1208-66-0x000007FEFB761000-0x000007FEFB763000-memory.dmp

          Filesize

          8KB

        • memory/1652-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

          Filesize

          8KB

        • memory/1652-58-0x0000000000400000-0x0000000000414000-memory.dmp

          Filesize

          80KB

        • memory/1652-56-0x00000000002C0000-0x00000000002CD000-memory.dmp

          Filesize

          52KB

        • memory/1900-63-0x0000000000220000-0x0000000000231000-memory.dmp

          Filesize

          68KB

        • memory/1900-61-0x0000000000220000-0x0000000000231000-memory.dmp

          Filesize

          68KB