Analysis
-
max time kernel
99s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
27-03-2023 14:06
Behavioral task
behavioral1
Sample
c0d6ce9f755fadce4e9ac0d6139a0951d7e580cb7c766f28961727fa4f2f1058.doc
Resource
win10-20230220-en
General
-
Target
c0d6ce9f755fadce4e9ac0d6139a0951d7e580cb7c766f28961727fa4f2f1058.doc
-
Size
198KB
-
MD5
de206a63a9ea15176d24174d05c0b300
-
SHA1
7c6f56da4be237e074b478315d078a91cee47352
-
SHA256
c0d6ce9f755fadce4e9ac0d6139a0951d7e580cb7c766f28961727fa4f2f1058
-
SHA512
20f5b2f079f48863195ef0634d72513ab9af881f9eb09748cb15dd2208e60180b212a02f7d0319d31223a46de27b686a07b6ae99f4828d454c8502e08d073745
-
SSDEEP
3072:P34n9zzXLLaqu0JKnKSYOLvVtKbmVnSCgoJIWkbDTf:w93XL2qut3zV4b6XZwDT
Malware Config
Extracted
emotet
Epoch4
213.239.212.5:443
129.232.188.93:443
103.43.75.120:443
197.242.150.244:8080
1.234.2.232:8080
110.232.117.186:8080
95.217.221.146:8080
159.89.202.34:443
159.65.88.10:8080
82.223.21.224:8080
169.57.156.166:8080
45.176.232.124:443
45.235.8.30:8080
173.212.193.249:8080
107.170.39.149:8080
119.59.103.152:8080
167.172.199.165:8080
91.207.28.33:8080
185.4.135.165:8080
104.168.155.143:8080
206.189.28.199:8080
79.137.35.198:8080
103.132.242.26:8080
202.129.205.3:8080
103.75.201.2:443
149.56.131.28:8080
5.135.159.50:443
172.105.226.75:8080
201.94.166.162:443
115.68.227.76:8080
164.90.222.65:443
186.194.240.217:443
153.126.146.25:7080
187.63.160.88:80
209.126.85.32:8080
72.15.201.15:8080
153.92.5.27:8080
167.172.253.162:8080
147.139.166.154:8080
163.44.196.120:8080
183.111.227.137:8080
139.59.126.41:443
164.68.99.3:8080
188.44.20.25:443
94.23.45.86:4143
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 4084 3044 regsvr32.exe WINWORD.EXE -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 4084 regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 8 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3044 WINWORD.EXE 3044 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 4084 regsvr32.exe 4084 regsvr32.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
WINWORD.EXEpid process 3044 WINWORD.EXE 3044 WINWORD.EXE 3044 WINWORD.EXE 3044 WINWORD.EXE 3044 WINWORD.EXE 3044 WINWORD.EXE 3044 WINWORD.EXE 3044 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
WINWORD.EXEregsvr32.exedescription pid process target process PID 3044 wrote to memory of 4084 3044 WINWORD.EXE regsvr32.exe PID 3044 wrote to memory of 4084 3044 WINWORD.EXE regsvr32.exe PID 4084 wrote to memory of 1636 4084 regsvr32.exe regsvr32.exe PID 4084 wrote to memory of 1636 4084 regsvr32.exe regsvr32.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\c0d6ce9f755fadce4e9ac0d6139a0951d7e580cb7c766f28961727fa4f2f1058.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\160701.tmp"2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\JGZvU\gRZdsRiykU.dll"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\160701.tmpFilesize
524.9MB
MD5ff14f5983720d3a0719665f174cdc7e7
SHA15529ebd6ad63c08a3a8c90630962507f596df0ea
SHA25607ede4c95537089919aefd6f78d7f56c6705ac003c623c740d27e243ea9941d4
SHA5127bc87878bf17e196ff7c2113508e5bee6d4d8b8d84f5f0d069e8088b63a3d2593712bc177fd1f1c254ad427a9da71fca1e724d7ddbbbd08ab7ecc97457170140
-
C:\Users\Admin\AppData\Local\Temp\160704.zipFilesize
964KB
MD53d9ca8961ebac662ffc2fb66d357f8bc
SHA14de9cea19e297fa30726ea7fa476b5f964ba9c92
SHA256b32df19c78d2ce007415a4273871922b5177b9f09d1508449d39d08ebee57586
SHA512c9a2389e34e30f03e579b3246c1d473e86d0f7e8eae1ab59f22ed039f40104c1990afc9643db64e7c2595a4e979a4a2dc22bcd964b40f0a7cfd7063ecdbad19c
-
\Users\Admin\AppData\Local\Temp\160701.tmpFilesize
524.9MB
MD5ff14f5983720d3a0719665f174cdc7e7
SHA15529ebd6ad63c08a3a8c90630962507f596df0ea
SHA25607ede4c95537089919aefd6f78d7f56c6705ac003c623c740d27e243ea9941d4
SHA5127bc87878bf17e196ff7c2113508e5bee6d4d8b8d84f5f0d069e8088b63a3d2593712bc177fd1f1c254ad427a9da71fca1e724d7ddbbbd08ab7ecc97457170140
-
memory/3044-124-0x00007FFE75800000-0x00007FFE75810000-memory.dmpFilesize
64KB
-
memory/3044-127-0x00007FFE71CE0000-0x00007FFE71CF0000-memory.dmpFilesize
64KB
-
memory/3044-130-0x00007FFE71CE0000-0x00007FFE71CF0000-memory.dmpFilesize
64KB
-
memory/3044-123-0x00007FFE75800000-0x00007FFE75810000-memory.dmpFilesize
64KB
-
memory/3044-122-0x00007FFE75800000-0x00007FFE75810000-memory.dmpFilesize
64KB
-
memory/3044-121-0x00007FFE75800000-0x00007FFE75810000-memory.dmpFilesize
64KB
-
memory/3044-446-0x00007FFE75800000-0x00007FFE75810000-memory.dmpFilesize
64KB
-
memory/3044-448-0x00007FFE75800000-0x00007FFE75810000-memory.dmpFilesize
64KB
-
memory/3044-447-0x00007FFE75800000-0x00007FFE75810000-memory.dmpFilesize
64KB
-
memory/3044-449-0x00007FFE75800000-0x00007FFE75810000-memory.dmpFilesize
64KB
-
memory/4084-334-0x0000000002180000-0x00000000021DA000-memory.dmpFilesize
360KB
-
memory/4084-340-0x0000000000880000-0x0000000000881000-memory.dmpFilesize
4KB