Analysis
-
max time kernel
14s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2023, 08:03
Behavioral task
behavioral1
Sample
Dat_8NWR9UK2ORB.doc
Resource
win7-20230220-en
General
-
Target
Dat_8NWR9UK2ORB.doc
-
Size
522.3MB
-
MD5
2148a6a2bef5a35ce5665cbc12d5e474
-
SHA1
2e87b33309c888ab7d655e92a45a31f15753fdee
-
SHA256
f616da0ebb4f984aecd40da922c0cdf70987643a86afadc969aa76598120cd5d
-
SHA512
fb232985018569cdbba001273278a6128af1395e1dc4631b023a0c49fefffd43a93dd6b0332c2cc634aa87d850ea2866614cacb6b064e57f4d48c7b41b60ea4c
-
SSDEEP
6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x
Malware Config
Extracted
emotet
Epoch4
129.232.188.93:443
164.90.222.65:443
159.65.88.10:8080
172.105.226.75:8080
115.68.227.76:8080
187.63.160.88:80
169.57.156.166:8080
185.4.135.165:8080
153.126.146.25:7080
197.242.150.244:8080
139.59.126.41:443
186.194.240.217:443
103.132.242.26:8080
206.189.28.199:8080
163.44.196.120:8080
95.217.221.146:8080
159.89.202.34:443
119.59.103.152:8080
183.111.227.137:8080
201.94.166.162:443
103.75.201.2:443
149.56.131.28:8080
79.137.35.198:8080
5.135.159.50:443
66.228.32.31:7080
91.121.146.47:8080
153.92.5.27:8080
45.235.8.30:8080
72.15.201.15:8080
107.170.39.149:8080
45.176.232.124:443
82.223.21.224:8080
167.172.199.165:8080
213.239.212.5:443
202.129.205.3:8080
94.23.45.86:4143
147.139.166.154:8080
167.172.253.162:8080
91.207.28.33:8080
188.44.20.25:443
104.168.155.143:8080
110.232.117.186:8080
164.68.99.3:8080
1.234.2.232:8080
173.212.193.249:8080
182.162.143.56:443
160.16.142.56:8080
101.50.0.91:8080
103.43.75.120:443
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 1612 2664 regsvr32.exe 84 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 30 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2664 WINWORD.EXE 2664 WINWORD.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2664 WINWORD.EXE 2664 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2664 WINWORD.EXE 2664 WINWORD.EXE 2664 WINWORD.EXE 2664 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Dat_8NWR9UK2ORB.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2664 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\090459.tmp"2⤵
- Process spawned unexpected child process
PID:1612 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\OsIvcJGjWQdT\dAPOUwKvZvStJITW.dll"3⤵PID:4864
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
423.9MB
MD5e7aec5d74b56b7c838da008347773f3b
SHA10c3769ff83bd69c3fb8d3462618b7c161f0f6b3e
SHA256547fcaa035adc635c4d8cf367cfb8fc0b7bf80eb8ebffffe0644d5213d6a9ede
SHA512c90e5e5983431011a29b340ab1bdaa0d605e6bf02041da85cec99d9379baad712617b1b4bb2158c00aed3e8f9e1e0542ff639addfb997ac7d914cba22f232c39
-
Filesize
452.7MB
MD5d34257bfb904226b88971189a96744ef
SHA14f5b72fdc31e507d033008c4d5def42cba936d01
SHA2562ca46d1f638e42b1d50043215ef6d7edcb5f75af5fc26eeda5010374c188da18
SHA51246152195bbfae9aa4dd1530f517c3e2a700f9be20766f77d49ca73b122c2b6e53e85e94f9b83d7bc3d2506aee3af3f42ee1a1c828764757e9303d960c78ec475
-
Filesize
423.7MB
MD5ef368ce37d25f25af5ec1561e3926ac6
SHA14133b5ab2e07e4998704b917267a94dce65d89f2
SHA256eabfbaf087a3ef8859b0ca9aeb31ddad4c09a690d427847ec47065246bcb5261
SHA512318c410ba9bac8c72189527b39e5bfdef556a1b0ee2a6b89ed33ef77eae3fa51b6ff8443a933dfabe1d1b480d875e372559372a330c6bb7e12ba721b75262d9b
-
Filesize
867KB
MD5909549241403bb8529a01fb67601e799
SHA145bd807feed98f9b73c1470930b26db429ecdc66
SHA256f51c81ec5c615651109c343acc8f7a712a78801b83fabd0b0925a2abde9629ff
SHA512186d29c7fa1dc39a8b6a61e40b45af740b1dcbde0609ab397ff6d94745342f288ed71e4db1b051e060b30371a97deb3e37882782b2942103819360d6c7a43a75
-
Filesize
398.4MB
MD51300dfad652942a602b9b703e3e98dbd
SHA1ed716e78b3fd7f12796b61fa25f924001b7723c8
SHA2566d34cd0f58973f834b41104d4b210d53a9d99622b609ef93c753ece346f2b4f2
SHA5123e311fb24667653638d846b74f4e23aefdc6fbb5f3cdb0127ecbdd6ea6632e2a1adc83526790689c207773032376ecc9e8637c5478d05d13f366c933edec0b12
-
Filesize
384.6MB
MD5d2c6731f5b0e0022d44d3042ce6846ad
SHA16702b746d248046a4051547dfa4dedf4aa526152
SHA2561960bdfd534aa2ebc618eb78ad7e460b5ae4dee4d486a820c738b7f495c4ac4d
SHA5124bb7297c1f2c8fcba6971430cac241a13e016cddf4ceb1816de375ae417ee56e7edd33361a89ced3ec012976b63a9201de0d47797a6c9a22a39554853b21e6eb