Extracted

• • Target
    emotet_e1_2be3530ff6d9e0f4b458a86e11feb81aa3d930a3708a0018a6b7205d08046aa6_2020-10-29__210824601478._doc
  • Size 291KB
  • SHA256 2be3530ff6d9e0f4b458a86e11feb81aa3d930a3708a0018a6b7205d08046aa6
  • MD5 5dca9bc613fbb97b7e8e0630e26de40c
  • SHA1 1949772a6ca4e8d5a3d8ac921e10311c8d89bdfa
  • SHA512 2880c966610c2ba3bf0310c21c9541420241c4fd60920c045535c43e384dd377e6481f13e6d07861cd7ee4907c9d2c85dc6b9d591183753e0239d8758e0914f5
  • MD5 SHA1 SHA512

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request

  • Drops file in System32 directory

  behavioral1behavioral2