Analysis
-
max time kernel
24s -
max time network
50s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2023, 04:32
General
-
Target
I19984860741841252_202303081146.doc
-
Size
516.3MB
-
MD5
c2ba98ea49f3d5f5b04d7980ed36b75d
-
SHA1
0b66f823f6edf03c3992d9265a43aa5ffa24938a
-
SHA256
1e041bead6abf833504e173d6b1026ee766bfef84635a7d222e520a673d8896c
-
SHA512
108011d99c013c97e462cb1792a8e5de1a1ebdccd5073acc2c5ac08dc8fcca0acd20eb0bfd37850721a46dffdf54d88bfac59aca6399dda8e4ee53434796e365
-
SSDEEP
6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x
Malware Config
Extracted
emotet
Epoch4
129.232.188.93:443
164.90.222.65:443
159.65.88.10:8080
172.105.226.75:8080
115.68.227.76:8080
187.63.160.88:80
169.57.156.166:8080
185.4.135.165:8080
153.126.146.25:7080
197.242.150.244:8080
139.59.126.41:443
186.194.240.217:443
103.132.242.26:8080
206.189.28.199:8080
163.44.196.120:8080
95.217.221.146:8080
159.89.202.34:443
119.59.103.152:8080
183.111.227.137:8080
201.94.166.162:443
103.75.201.2:443
149.56.131.28:8080
79.137.35.198:8080
5.135.159.50:443
66.228.32.31:7080
91.121.146.47:8080
153.92.5.27:8080
45.235.8.30:8080
72.15.201.15:8080
107.170.39.149:8080
45.176.232.124:443
82.223.21.224:8080
167.172.199.165:8080
213.239.212.5:443
202.129.205.3:8080
94.23.45.86:4143
147.139.166.154:8080
167.172.253.162:8080
91.207.28.33:8080
188.44.20.25:443
104.168.155.143:8080
110.232.117.186:8080
164.68.99.3:8080
1.234.2.232:8080
173.212.193.249:8080
182.162.143.56:443
160.16.142.56:8080
101.50.0.91:8080
103.43.75.120:443
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 4160 4260 regsvr32.exe 82 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 35 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4260 WINWORD.EXE 4260 WINWORD.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4260 WINWORD.EXE 4260 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4260 WINWORD.EXE 4260 WINWORD.EXE 4260 WINWORD.EXE 4260 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\I19984860741841252_202303081146.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4260 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\053330.tmp"2⤵
- Process spawned unexpected child process
PID:4160 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\JQdMFtdJGOoPDhg\Wkce.dll"3⤵PID:2516
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68.8MB
MD5fd97c79f31def5eef4e156f2e220bf0c
SHA13b9b7161b4658b02870cd521833aeae2d3596fe9
SHA256fa0a19e065f08f430430a2ffe9c40e2e3b6bd50490459f1c3ebe457740e9f209
SHA512e063e5962009c04ed3c21ee473385654968d39f48df9621241c995bffec2d761450565890f83ffa040b8744e287bbb2ae8771b9247caf870da62fc3ac81e124d
-
Filesize
71.4MB
MD5e70864474c83c98aa509b9697cfd9ea9
SHA1c35cc65d7c1a8a72b21ad343f52c501b978d3605
SHA256ab419f82d140705042fa2e3bdf0d1522540c6f7dfc95d5943c003430e3e4f56e
SHA512396475516a40d85a2cafc981ebb8d6d777813abe37eb33a37268bf2815274964a639a0b40d6561de29fe982c00803c413021302f1c2cfccef151aaa0dcb3945d
-
Filesize
865KB
MD5f722207b3e742ae5b5aeb999bfdb35f0
SHA10dd46925311e4f7b9ffba1839e3990c586f08456
SHA256289b313d6977527c3d3a9e1235da66982be9bdf3ff00bc0f91cac2785a7eba52
SHA512e85d98636e4da0bce8daea6ce16d721ff25b63e80c262e05309ba3ee7563ca216a6d5fbf9b192a9b0270d3a3d621cb9e33e9cc570745b233c9dd1dca5261d882
-
Filesize
60.1MB
MD548c45c6b9c3cb926acd4223826d3a32b
SHA14494baa4cc1151304c06e43abed7003f585b162c
SHA2566382d809ee65f1f98253b46a0291ae3ecddc5aae080f2dfbd74afb9b33e7dade
SHA5124eb07de0fd1e118c5ad09ada04a9232ddce9e1c0a70ac1930d6ec4ab2ab41f2ad00531940434608a5dbb0a847fae81dca0634657fe2ed772b4f7c1529b25e6c3