Find similar analyses in TI Lookup

Analysis date (UTC): 16 September 2019, 12:30Analysis environment: Windows 7 Pro, build 7601, x86

emo.doc

MD5:8AEE20CC6CD439B9883EF182711DAB21

SHA1:B70D0E04B649BCC10EF71BAF1AB9B89EE6D4F449

SHA256:2371AE80A0950E3299F6CD079E2993E7504D9F2FA9BC459C87EE5452B21834F7

Analysis result

Threat level:Malicious activity

Tags:

macrosmacros-on-opengenerated-docemotet-docemotettrojanevasion

Full analysis:Analysis emo.doc (MD5: 8AEE20CC6CD439B9883EF182711DAB21) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

768.exe (PID: 3256)
768.exe (PID: 2676)
768.exe (PID: 2168)
768.exe (PID: 2384)
easywindow.exe (PID: 3376)
easywindow.exe (PID: 3504)
easywindow.exe (PID: 2404)
easywindow.exe (PID: 2128)

Emotet process was detected

768.exe (PID: 3256)

EMOTET was detected

easywindow.exe (PID: 2128)

Connects to CnC server

easywindow.exe (PID: 2128)

Changes the autorun value in the registry

easywindow.exe (PID: 2128)

SUSPICIOUS

Executable content was dropped or overwritten

768.exe (PID: 3256)
powershell.exe (PID: 3280)

Application launched itself

easywindow.exe (PID: 2404)
768.exe (PID: 2384)

Starts itself from another location

768.exe (PID: 3256)

Creates files in the user directory

powershell.exe (PID: 3280)

PowerShell script executed

powershell.exe (PID: 3280)

Executed via WMI

powershell.exe (PID: 3280)

INFO

Reads Microsoft Office registry keys

WINWORD.EXE (PID: 2860)

Creates files in the user directory

WINWORD.EXE (PID: 2860)

Threats

PID	Process	Class	Message
2128	easywindow.exe	A Network Trojan was detected	AV TROJAN W32/Emotet CnC Checkin (Apr 2019)
2128	easywindow.exe	A Network Trojan was detected	MALWARE [PTsecurity] Feodo/Emotet
2128	easywindow.exe	Potentially Bad Traffic	ET POLICY HTTP traffic on port 443 (POST)
2128	easywindow.exe	A Network Trojan was detected	MALWARE [PTsecurity] Feodo/Emotet
2128	easywindow.exe	Potentially Bad Traffic	ET POLICY HTTP traffic on port 443 (POST)