Analysis Overview
SHA256
6d7aff70a84d9237bde3b149ff04532cafb29b6f358886b5038a737af5934d1f
Threat Level: Known bad
The file 2019-05-01-Emotet-binary-updated-after-initial-infection-1-of-2.exe was found to be: Known bad.
Malicious Activity Summary
Emotet
Drops file in System32 directory
Drops file in Windows directory
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Checks processor information in registry
Suspicious use of WriteProcessMemory
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: RenamesItself
Modifies data under HKEY_USERS
Suspicious use of UnmapMainImage
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Enumerates system info in registry
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2023-02-15 09:52
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2023-02-15 09:52
Reported
2023-02-15 09:55
Platform
win7-20220812-en
Max time kernel
141s
Max time network
147s
Command Line
Signatures
Emotet
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat | C:\Windows\SysWOW64\cycletexture.exe | N/A |
Enumerates physical storage devices
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings | C:\Windows\SysWOW64\cycletexture.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | C:\Windows\SysWOW64\cycletexture.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E4EFB8A7-5546-48E8-BBF4-C3EB977E3DBD}\WpadDecisionTime = 30c3d8af2b41d901 | C:\Windows\SysWOW64\cycletexture.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-a0-d6-8b-32-10\WpadDecisionTime = 30c3d8af2b41d901 | C:\Windows\SysWOW64\cycletexture.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-a0-d6-8b-32-10\WpadDecision = "0" | C:\Windows\SysWOW64\cycletexture.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E4EFB8A7-5546-48E8-BBF4-C3EB977E3DBD}\WpadDecisionReason = "1" | C:\Windows\SysWOW64\cycletexture.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E4EFB8A7-5546-48E8-BBF4-C3EB977E3DBD}\WpadDecision = "0" | C:\Windows\SysWOW64\cycletexture.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-a0-d6-8b-32-10 | C:\Windows\SysWOW64\cycletexture.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix | C:\Windows\SysWOW64\cycletexture.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" | C:\Windows\SysWOW64\cycletexture.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | C:\Windows\SysWOW64\cycletexture.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad | C:\Windows\SysWOW64\cycletexture.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E4EFB8A7-5546-48E8-BBF4-C3EB977E3DBD} | C:\Windows\SysWOW64\cycletexture.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | C:\Windows\SysWOW64\cycletexture.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-a0-d6-8b-32-10\WpadDecisionReason = "1" | C:\Windows\SysWOW64\cycletexture.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E4EFB8A7-5546-48E8-BBF4-C3EB977E3DBD}\d2-a0-d6-8b-32-10 | C:\Windows\SysWOW64\cycletexture.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections | C:\Windows\SysWOW64\cycletexture.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" | C:\Windows\SysWOW64\cycletexture.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | C:\Windows\SysWOW64\cycletexture.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" | C:\Windows\SysWOW64\cycletexture.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E4EFB8A7-5546-48E8-BBF4-C3EB977E3DBD}\WpadNetworkName = "Network 3" | C:\Windows\SysWOW64\cycletexture.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cycletexture.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cycletexture.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cycletexture.exe | N/A |
Suspicious behavior: RenamesItself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2019-05-01-Emotet-binary-updated-after-initial-infection-1-of-2.exe | N/A |
Suspicious use of UnmapMainImage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2019-05-01-Emotet-binary-updated-after-initial-infection-1-of-2.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2019-05-01-Emotet-binary-updated-after-initial-infection-1-of-2.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cycletexture.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cycletexture.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\2019-05-01-Emotet-binary-updated-after-initial-infection-1-of-2.exe
"C:\Users\Admin\AppData\Local\Temp\2019-05-01-Emotet-binary-updated-after-initial-infection-1-of-2.exe"
C:\Users\Admin\AppData\Local\Temp\2019-05-01-Emotet-binary-updated-after-initial-infection-1-of-2.exe
--a1bda328
C:\Windows\SysWOW64\cycletexture.exe
"C:\Windows\SysWOW64\cycletexture.exe"
C:\Windows\SysWOW64\cycletexture.exe
--fdc559c7
Network
| Country | Destination | Domain | Proto |
| BO | 200.58.171.51:80 | tcp | |
| BO | 200.58.171.51:80 | tcp | |
| MX | 189.196.140.187:80 | tcp | |
| MX | 189.196.140.187:80 | tcp | |
| KR | 222.104.222.145:443 | tcp |
Files
memory/1884-54-0x0000000075E31000-0x0000000075E33000-memory.dmp
memory/1204-55-0x0000000000000000-mapping.dmp
memory/1884-56-0x0000000000230000-0x000000000023D000-memory.dmp
memory/1884-57-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1204-59-0x0000000000230000-0x000000000025C000-memory.dmp
memory/1204-60-0x0000000000400000-0x000000000042C000-memory.dmp
memory/2036-61-0x0000000000000000-mapping.dmp
memory/1204-63-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2024-62-0x0000000000220000-0x0000000000231000-memory.dmp
memory/2036-64-0x0000000000400000-0x000000000042C000-memory.dmp
memory/2036-66-0x0000000000400000-0x000000000042C000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-02-15 09:52
Reported
2023-02-15 09:55
Platform
win10v2004-20220812-en
Max time kernel
148s
Max time network
152s
Command Line
Signatures
Emotet
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 | C:\Windows\SysWOW64\nisboxes.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE | C:\Windows\SysWOW64\nisboxes.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies | C:\Windows\SysWOW64\nisboxes.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 | C:\Windows\SysWOW64\nisboxes.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\Debug\WIA\wiatrace.log | C:\Windows\system32\mspaint.exe | N/A |
| File opened for modification | C:\Windows\Debug\WIA\wiatrace.log | C:\Windows\system32\mspaint.exe | N/A |
Enumerates physical storage devices
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\BIOS | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 801091e12b41d901 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31015211" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3736571715" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31015211" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fc1cb26e42627543897680db7b55642000000000020000000000106600000001000020000000c5cc01b38dbdd703f00c5818dff8b2bee7d477a809f6304980f7cada04825f20000000000e8000000002000020000000e7dc25f4049eee9bca4591c71b2671103f69fc2b1bce430e6e4e189d627f4dcc200000008233164a4a18ffded9711fa9bc4e41802490f75c1f61bfe475c1b80a2269fbbd400000003d3c0f5e75e4da3fbc80a6b0e8581e4fa7c49d1a734d00b6dfc0fcbbc79b5d33944d3e921600f9bc6d6d4fdfff8377148acbf8d59fa2c18ed432114aa0239249 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\MINIE | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fc1cb26e42627543897680db7b55642000000000020000000000106600000001000020000000a038928be3d7afdc1b2cc68dc73a3cfaa4a79095665186601a612464224061c6000000000e80000000020000200000008097064dd64b2bf2705517883abe48858556eed900a1b5ac73710925866d354e20000000d6727fcfd9b9b6e09c3f46adf7cad9f199bfe8643e3999ba312479a45bafc28a4000000072ed0efdb73e99b5709eaae54d2e8fef6627b3ee3fb14c7605daa666e1b120dd4f9605b09d91dce47c9b078f70a1146c84ebd388cf5daec789e22f1449244866 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f79ce12b41d901 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3736571715" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{09BDA4E9-AD1F-11ED-B696-CA2A13AD51D0} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix | C:\Windows\SysWOW64\nisboxes.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" | C:\Windows\SysWOW64\nisboxes.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" | C:\Windows\SysWOW64\nisboxes.exe | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\nisboxes.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\nisboxes.exe | N/A |
| N/A | N/A | C:\Windows\system32\mspaint.exe | N/A |
| N/A | N/A | C:\Windows\system32\mspaint.exe | N/A |
| N/A | N/A | C:\Windows\system32\mspaint.exe | N/A |
| N/A | N/A | C:\Windows\system32\mspaint.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\nisboxes.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\nisboxes.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\nisboxes.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\nisboxes.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\nisboxes.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\nisboxes.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\nisboxes.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\nisboxes.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\nisboxes.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\nisboxes.exe | N/A |
Suspicious behavior: RenamesItself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2019-05-01-Emotet-binary-updated-after-initial-infection-1-of-2.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\2019-05-01-Emotet-binary-updated-after-initial-infection-1-of-2.exe
"C:\Users\Admin\AppData\Local\Temp\2019-05-01-Emotet-binary-updated-after-initial-infection-1-of-2.exe"
C:\Users\Admin\AppData\Local\Temp\2019-05-01-Emotet-binary-updated-after-initial-infection-1-of-2.exe
--a1bda328
C:\Windows\SysWOW64\nisboxes.exe
"C:\Windows\SysWOW64\nisboxes.exe"
C:\Windows\SysWOW64\nisboxes.exe
--f1c91253
C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ExpandRevoke.emf"
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ExpandRevoke.emf"
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\ConvertToSplit.xlsm"
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -nohome
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:208 CREDAT:17410 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| BO | 200.58.171.51:80 | tcp | |
| US | 52.182.141.63:443 | tcp | |
| MX | 189.196.140.187:80 | tcp | |
| KR | 222.104.222.145:443 | tcp | |
| MY | 115.132.227.247:443 | tcp | |
| CO | 190.85.206.228:80 | tcp | |
| DE | 159.69.211.211:8080 | tcp |
Files
memory/4756-132-0x00000000005C0000-0x00000000005D1000-memory.dmp
memory/4756-133-0x0000000000400000-0x000000000042C000-memory.dmp
memory/3800-134-0x0000000000000000-mapping.dmp
memory/4756-136-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4756-135-0x00000000005C0000-0x00000000005D1000-memory.dmp
memory/3800-137-0x0000000000400000-0x000000000042C000-memory.dmp
memory/1960-138-0x0000000000000000-mapping.dmp
memory/3800-139-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1960-140-0x0000000000400000-0x000000000042C000-memory.dmp
memory/1960-141-0x0000000000400000-0x000000000042C000-memory.dmp
C:\Windows\Debug\WIA\wiatrace.log
| MD5 | 80ab2f22e320c95f387181e49b5632bb |
| SHA1 | 7647fb55e9380c4ea83a61186dd286806c38ef8b |
| SHA256 | f0cb3f935622e8d5a12595edcc7f06b4aaa964c4c56090ae2f76baa83d2b5fd4 |
| SHA512 | c689c9eec42ab895bb3cd3d434412cd2198018c466eb25a73e2e626a7e8cfa6fec4c3735cc5ddaca7c4d7f745372b6860f0cb40eb19bb1b1651c3471c29ed7a2 |
memory/3580-143-0x00007FFB70CF0000-0x00007FFB70D00000-memory.dmp
memory/3580-145-0x00007FFB70CF0000-0x00007FFB70D00000-memory.dmp
memory/3580-144-0x00007FFB70CF0000-0x00007FFB70D00000-memory.dmp
memory/3580-146-0x00007FFB70CF0000-0x00007FFB70D00000-memory.dmp
memory/3580-147-0x00007FFB70CF0000-0x00007FFB70D00000-memory.dmp
memory/3580-148-0x00007FFB6E6B0000-0x00007FFB6E6C0000-memory.dmp
memory/3580-149-0x00007FFB6E6B0000-0x00007FFB6E6C0000-memory.dmp
memory/3580-151-0x00007FFB70CF0000-0x00007FFB70D00000-memory.dmp
memory/3580-153-0x00007FFB70CF0000-0x00007FFB70D00000-memory.dmp
memory/3580-152-0x00007FFB70CF0000-0x00007FFB70D00000-memory.dmp
memory/3580-154-0x00007FFB70CF0000-0x00007FFB70D00000-memory.dmp