Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
08/03/2023, 04:25
General
-
Target
I19984860741841252_202303081146.doc
-
Size
516.3MB
-
MD5
c2ba98ea49f3d5f5b04d7980ed36b75d
-
SHA1
0b66f823f6edf03c3992d9265a43aa5ffa24938a
-
SHA256
1e041bead6abf833504e173d6b1026ee766bfef84635a7d222e520a673d8896c
-
SHA512
108011d99c013c97e462cb1792a8e5de1a1ebdccd5073acc2c5ac08dc8fcca0acd20eb0bfd37850721a46dffdf54d88bfac59aca6399dda8e4ee53434796e365
-
SSDEEP
6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x
Malware Config
Extracted
emotet
Epoch4
129.232.188.93:443
164.90.222.65:443
159.65.88.10:8080
172.105.226.75:8080
115.68.227.76:8080
187.63.160.88:80
169.57.156.166:8080
185.4.135.165:8080
153.126.146.25:7080
197.242.150.244:8080
139.59.126.41:443
186.194.240.217:443
103.132.242.26:8080
206.189.28.199:8080
163.44.196.120:8080
95.217.221.146:8080
159.89.202.34:443
119.59.103.152:8080
183.111.227.137:8080
201.94.166.162:443
103.75.201.2:443
149.56.131.28:8080
79.137.35.198:8080
5.135.159.50:443
66.228.32.31:7080
91.121.146.47:8080
153.92.5.27:8080
45.235.8.30:8080
72.15.201.15:8080
107.170.39.149:8080
45.176.232.124:443
82.223.21.224:8080
167.172.199.165:8080
213.239.212.5:443
202.129.205.3:8080
94.23.45.86:4143
147.139.166.154:8080
167.172.253.162:8080
91.207.28.33:8080
188.44.20.25:443
104.168.155.143:8080
110.232.117.186:8080
164.68.99.3:8080
1.234.2.232:8080
173.212.193.249:8080
182.162.143.56:443
160.16.142.56:8080
101.50.0.91:8080
103.43.75.120:443
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 4424 352 regsvr32.exe 60 -
Loads dropped DLL 2 IoCs
pid Process 4424 regsvr32.exe 4424 regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 7 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 352 WINWORD.EXE 352 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4424 regsvr32.exe 4424 regsvr32.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 352 WINWORD.EXE 352 WINWORD.EXE 352 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 352 WINWORD.EXE 352 WINWORD.EXE 352 WINWORD.EXE 352 WINWORD.EXE 352 WINWORD.EXE 352 WINWORD.EXE 352 WINWORD.EXE 352 WINWORD.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 352 wrote to memory of 4424 352 WINWORD.EXE 68 PID 352 wrote to memory of 4424 352 WINWORD.EXE 68 PID 4424 wrote to memory of 1364 4424 regsvr32.exe 69 PID 4424 wrote to memory of 1364 4424 regsvr32.exe 69 PID 352 wrote to memory of 1212 352 WINWORD.EXE 70 PID 352 wrote to memory of 1212 352 WINWORD.EXE 70 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\I19984860741841252_202303081146.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:352 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\052709.tmp"2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\TqpjeRquNIjkUh\MoxKQmnrix.dll"3⤵PID:1364
-
-
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1212
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
529.7MB
MD5851c375861d36292311383733358ff80
SHA135884c49e55cfa7541ad99bd383873841f483d0a
SHA256b0412b6bf2bf2ea874ef2a7f0967956d20f6fe5aa75604755dd234b71faaba6a
SHA51254d85257637e1d78ed5d2708b68fdc808df0b8a246916539b4691b257af1fe00dd286eb6f03b6feb0654a7e1bf93ed9a61fc7fd04e345944b69af22ab4e5cbe3
-
Filesize
865KB
MD5f722207b3e742ae5b5aeb999bfdb35f0
SHA10dd46925311e4f7b9ffba1839e3990c586f08456
SHA256289b313d6977527c3d3a9e1235da66982be9bdf3ff00bc0f91cac2785a7eba52
SHA512e85d98636e4da0bce8daea6ce16d721ff25b63e80c262e05309ba3ee7563ca216a6d5fbf9b192a9b0270d3a3d621cb9e33e9cc570745b233c9dd1dca5261d882
-
Filesize
529.7MB
MD5851c375861d36292311383733358ff80
SHA135884c49e55cfa7541ad99bd383873841f483d0a
SHA256b0412b6bf2bf2ea874ef2a7f0967956d20f6fe5aa75604755dd234b71faaba6a
SHA51254d85257637e1d78ed5d2708b68fdc808df0b8a246916539b4691b257af1fe00dd286eb6f03b6feb0654a7e1bf93ed9a61fc7fd04e345944b69af22ab4e5cbe3
-
Filesize
529.7MB
MD5851c375861d36292311383733358ff80
SHA135884c49e55cfa7541ad99bd383873841f483d0a
SHA256b0412b6bf2bf2ea874ef2a7f0967956d20f6fe5aa75604755dd234b71faaba6a
SHA51254d85257637e1d78ed5d2708b68fdc808df0b8a246916539b4691b257af1fe00dd286eb6f03b6feb0654a7e1bf93ed9a61fc7fd04e345944b69af22ab4e5cbe3