Overview

overview

10

Static

static

1

emotet_v6

windows10-1703-x64

8

emotet_doc

windows10-1703-x64

10

Analysis

  • max time kernel
    53s
  • max time network
    55s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    23-03-2023 00:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    af0c7d355bb6a495d038fd05217209054107d31aa6199c491b74ae3d24b11c7e.wsf

  • Size

    61KB

  • MD5

    45282862aeb428ffb5d4986704a8f4d5

  • SHA1

    fa2b0a82f3ca6bc7c00704556c9494b303613972

  • SHA256

    af0c7d355bb6a495d038fd05217209054107d31aa6199c491b74ae3d24b11c7e

  • SHA512

    db6457af502f45665ce4cc6573c5746607d8ffc661f0dcb224beceed93886f6c6194561cacc0efa543f0b2f62db976742f42c6c8102c5b11b65329757110b1db

  • SSDEEP

    768:6hKs7p4MAPEQbhh/8avllsFEaN3K19Z5zkzCIi5:6L7p4MafVLYEaN3K19ZWzCn5

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 12 IoCs
  • Script User-Agent 12 IoCs

    Uses user-agent string associated with script host/environment.

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\af0c7d355bb6a495d038fd05217209054107d31aa6199c491b74ae3d24b11c7e.wsf"
    1⤵
    • Blocklisted process makes network request
    PID:4148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\rad478B9.tmp.dll
    Filesize

    10B

    MD5

    7605968e79d0ca095ab1231486d2b814

    SHA1

    a007b420d19ceefa840f0373e050e3b51a4ab480

    SHA256

    493fda53120050f85836032324409be6c6484f90a0755ae0c6a673ba7626818b

    SHA512

    769249da7ed6c6bf5671bbc2371a6453b433226ceb8c4c2aa3604000d66647bcec83dee1ab64c0262fa40f923d77e23bad2c47274d339effc51d904ce77072a6

    Download Submit