Analysis
-
max time kernel
1190s -
max time network
864s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
28-03-2023 15:29
Static task
static1
Behavioral task
behavioral1
Sample
Dokumente.one
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
Dokumente.one
Resource
win7-20230220-en
General
-
Target
Dokumente.one
-
Size
262KB
-
MD5
54c98ea83c1b432f425ab201c5c43b29
-
SHA1
e44c5e8fa31b64f8e486d80ffcd154c4230bd93f
-
SHA256
ac8f0db9fd6a91a765aeeed5eafd7a19ad2e37362f6d3468a386ee8a9f4dc7e5
-
SHA512
62422b565c6f1715fcfae52183b00f942e8e9f006b407e399d8c88635ded2d57f94faef9320c2d498203bb6d6955ec98591b9c5b8da37169bb9221eac071fc80
-
SSDEEP
3072:kNjcvQx377FjDDRX4UzUfxJ3mY2IsGllOb3HPWaBtOzUfxJ3mY2IsGllOb3HPWa3:kmvQp1DRXKXm5ZGa3vRXm5ZGa3vuV0
Malware Config
Extracted
emotet
Epoch4
213.239.212.5:443
129.232.188.93:443
103.43.75.120:443
197.242.150.244:8080
1.234.2.232:8080
110.232.117.186:8080
95.217.221.146:8080
159.89.202.34:443
159.65.88.10:8080
82.223.21.224:8080
169.57.156.166:8080
45.176.232.124:443
45.235.8.30:8080
173.212.193.249:8080
107.170.39.149:8080
119.59.103.152:8080
167.172.199.165:8080
91.207.28.33:8080
185.4.135.165:8080
104.168.155.143:8080
206.189.28.199:8080
79.137.35.198:8080
103.132.242.26:8080
202.129.205.3:8080
103.75.201.2:443
149.56.131.28:8080
5.135.159.50:443
172.105.226.75:8080
201.94.166.162:443
115.68.227.76:8080
164.90.222.65:443
186.194.240.217:443
153.126.146.25:7080
187.63.160.88:80
209.126.85.32:8080
72.15.201.15:8080
153.92.5.27:8080
167.172.253.162:8080
147.139.166.154:8080
163.44.196.120:8080
183.111.227.137:8080
139.59.126.41:443
164.68.99.3:8080
188.44.20.25:443
94.23.45.86:4143
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
WScript.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE is not expected to spawn this process 4440 3664 WScript.exe ONENOTE.EXE -
Blocklisted process makes network request 1 IoCs
Processes:
wscript.exeflow pid process 24 3708 wscript.exe -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 5052 regsvr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ONENOTE.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
ONENOTE.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 24 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
ONENOTE.EXEpid process 3664 ONENOTE.EXE 3664 ONENOTE.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
ONENOTE.EXEregsvr32.exepid process 3664 ONENOTE.EXE 3664 ONENOTE.EXE 5052 regsvr32.exe 5052 regsvr32.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
ONENOTE.EXEpid process 3664 ONENOTE.EXE 3664 ONENOTE.EXE 3664 ONENOTE.EXE 3664 ONENOTE.EXE 3664 ONENOTE.EXE 3664 ONENOTE.EXE 3664 ONENOTE.EXE 3664 ONENOTE.EXE 3664 ONENOTE.EXE 3664 ONENOTE.EXE 3664 ONENOTE.EXE 3664 ONENOTE.EXE 3664 ONENOTE.EXE 3664 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
ONENOTE.EXEWScript.exewscript.exeregsvr32.exedescription pid process target process PID 3664 wrote to memory of 4440 3664 ONENOTE.EXE WScript.exe PID 3664 wrote to memory of 4440 3664 ONENOTE.EXE WScript.exe PID 4440 wrote to memory of 3708 4440 WScript.exe wscript.exe PID 4440 wrote to memory of 3708 4440 WScript.exe wscript.exe PID 3708 wrote to memory of 5052 3708 wscript.exe regsvr32.exe PID 3708 wrote to memory of 5052 3708 wscript.exe regsvr32.exe PID 5052 wrote to memory of 4936 5052 regsvr32.exe regsvr32.exe PID 5052 wrote to memory of 4936 5052 regsvr32.exe regsvr32.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "C:\Users\Admin\AppData\Local\Temp\Dokumente.one"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{DFF7EEA4-A33D-4CA1-92DA-CB753D68AE5B}\NT\0\press to unblock document.vbs"2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //E:vbscript C:\Users\Admin\AppData\Local\Temp\rad0A1A0BBC6darrad71C8E6E72dar.txt3⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" "C:\Users\Admin\AppData\Local\Temp\rad05D661D1Ddar\I7BUGMOAp1mnW79z5M0bLi0WI5oFMy2wIqc.dll"4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\HlAGuDf\cFKvvwf.dll"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BL.binFilesize
88KB
MD59eae6f49a02d6eb9f75af7bbf4349808
SHA12caf7ddeb9fc1d6076558661ef69b9638cfd2e7b
SHA25631fb4bf411dcd7fcb860bdb1db26859290b047b39b94638a7d4fd2a46d323e98
SHA51237b45c58efd8c2bee66c30bca4a3777d5b6ba39e97d34baa8e7bc27fb083397d818a2708cbcf7d4704398fdfff4cbc17abff68b33294292413527702c1ad7eef
-
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BM.binFilesize
75KB
MD5f776dd0f1ae059fcf295ade6c5495080
SHA1ed270bfe2edb7e571ba4acf4b4088aa2a111e57e
SHA2562130a3bc8050310a7474be0b17a4ea8584e2105cb17316cb463d732665745749
SHA5122558ab6465af8a782ad02295744cd2d554d03c1ee7aa1689f13e3507a0cec4e73b9f86d1ec9aef346b831ab58758285a8ceda63dc0f834e1378dfa0504490f65
-
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BN.binFilesize
567B
MD5d055ce625528e448c61315eaaef5bb71
SHA1029df4c872b1c154f32e7fe94f434547c3ba6192
SHA25685bf1e672b4e86e9af0c7874681ec9620dfdc78e0335b83eef38c17d813b6705
SHA512705b6b729e967fa946469571109aa892f5cb55a01c74d40ae02140d10cbf9b65dd5e511c06ebfe494e407742f8c6f4fbbe88664b78b37abfb2f19db1f66f4247
-
C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{DFF7EEA4-A33D-4CA1-92DA-CB753D68AE5B}\NT\0\press to unblock document.vbsFilesize
88KB
MD59eae6f49a02d6eb9f75af7bbf4349808
SHA12caf7ddeb9fc1d6076558661ef69b9638cfd2e7b
SHA25631fb4bf411dcd7fcb860bdb1db26859290b047b39b94638a7d4fd2a46d323e98
SHA51237b45c58efd8c2bee66c30bca4a3777d5b6ba39e97d34baa8e7bc27fb083397d818a2708cbcf7d4704398fdfff4cbc17abff68b33294292413527702c1ad7eef
-
C:\Users\Admin\AppData\Local\Temp\rad05D661D1Ddar\I7BUGMOAp1mnW79z5M0bLi0WI5oFMy2wIqc.dllFilesize
518.9MB
MD58d4ae113a4228abb787118fa7f080f07
SHA106484d09a45370765db7eec6a2998551215806f2
SHA2565418335875ee09905dc49a03b4b38dbfa70c5902ec022814d45ec028be3b2975
SHA5120944be85227173360689b18cc6bc58b7cc7017bba6291ad1ea696ecbc95f9d829d2e43e545ae9ecbb62159145f2e589bf463e553e1341fbc2d98cacdb6dde116
-
C:\Users\Admin\AppData\Local\Temp\rad0A1A0BBC6darrad71C8E6E72dar.txtFilesize
61KB
MD51aa67b0b904cd763bc3818467b021b3c
SHA1687946e6661f96d332b8e57cab5ab2e84ca17071
SHA2560fc30c263b4e947d2b4f7ca5e1ee57e2aa4a4e885796f15cd3e16fb03f255716
SHA5129f8d53567998c8beb7977c470e09d4ad1a41da2555d6b7ca0b7525f70f6bba5f818aaf9a5dcbb57c7b9842e937eb5a7a64f45394f42afb2a78b09dee1493a7be
-
C:\Users\Admin\AppData\Local\Temp\rad6B6B5.tmp.zipFilesize
958KB
MD5cde1a4983674221e32035465ff72c577
SHA1b25512e978cd4b0f700f655caff2923a4c77fdba
SHA256b030f4ef75c8ef13e944f87ec7b700799b5f2906f4f3cb262c0fb1daa3b41865
SHA51247fc2200061cbd576f324534ab61f67bb32518372fecd370f0bfaab114adc3bdf7cafccbc34f724c59f77ad2d046985ff049903692104ca58289c4ec4e978d26
-
\Users\Admin\AppData\Local\Temp\rad05D661D1Ddar\I7BUGMOAp1mnW79z5M0bLi0WI5oFMy2wIqc.dllFilesize
518.9MB
MD58d4ae113a4228abb787118fa7f080f07
SHA106484d09a45370765db7eec6a2998551215806f2
SHA2565418335875ee09905dc49a03b4b38dbfa70c5902ec022814d45ec028be3b2975
SHA5120944be85227173360689b18cc6bc58b7cc7017bba6291ad1ea696ecbc95f9d829d2e43e545ae9ecbb62159145f2e589bf463e553e1341fbc2d98cacdb6dde116
-
memory/3664-126-0x00007FFEA9420000-0x00007FFEA9430000-memory.dmpFilesize
64KB
-
memory/3664-125-0x00007FFEA9420000-0x00007FFEA9430000-memory.dmpFilesize
64KB
-
memory/3664-621-0x000001B3928F0000-0x000001B392A38000-memory.dmpFilesize
1.3MB
-
memory/3664-122-0x00007FFEACF40000-0x00007FFEACF50000-memory.dmpFilesize
64KB
-
memory/3664-121-0x00007FFEACF40000-0x00007FFEACF50000-memory.dmpFilesize
64KB
-
memory/3664-119-0x00007FFEACF40000-0x00007FFEACF50000-memory.dmpFilesize
64KB
-
memory/3664-120-0x00007FFEACF40000-0x00007FFEACF50000-memory.dmpFilesize
64KB
-
memory/5052-674-0x0000000002420000-0x000000000247A000-memory.dmpFilesize
360KB
-
memory/5052-678-0x0000000000A40000-0x0000000000A41000-memory.dmpFilesize
4KB