analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://pianogiaretphcm.com/wp-snapshots/qcTilRKePEJSGkQegx/

Full analysis: https://app.any.run/tasks/1f164014-86be-48e8-a4ba-0bd5b15f2c71
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: May 24, 2019, 06:59:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
emotet
Indicators:
MD5:

75D0D5083D559A9A0F558860CBA603E4

SHA1:

C0DA7D3F37CC74E0F9927357D6E64291A78B8C89

SHA256:

4E2F4F83E16E6224E671959965C04C6A3929048D8464B6B1F88107247A5002D7

SSDEEP:

3:N1KOME9WNfQfEVWNK/aCI:COF9WRQscKSV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes settings of System certificates

      • WScript.exe (PID: 2976)

    • Application was dropped or rewritten from another process

      • soundser.exe (PID: 3644)
      • h42qg3oe5.exe (PID: 1140)
      • h42qg3oe5.exe (PID: 2152)
      • soundser.exe (PID: 2652)

    • Emotet process was detected

      • soundser.exe (PID: 3644)

  • SUSPICIOUS

    • Creates files in the user directory

      • WScript.exe (PID: 2976)

    • Executes scripts

      • WinRAR.exe (PID: 3100)

    • Executable content was dropped or overwritten

      • WScript.exe (PID: 2976)
      • h42qg3oe5.exe (PID: 2152)

    • Adds / modifies Windows certificates

      • WScript.exe (PID: 2976)

    • Starts itself from another location

      • h42qg3oe5.exe (PID: 2152)

    • Application launched itself

      • soundser.exe (PID: 3644)

    • Connects to server without host name

      • soundser.exe (PID: 2652)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 880)

    • Creates files in the user directory

      • iexplore.exe (PID: 936)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 936)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 880)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 880)

    • Changes settings of System certificates

      • iexplore.exe (PID: 880)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
8
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start iexplore.exe iexplore.exe winrar.exe no specs wscript.exe h42qg3oe5.exe no specs h42qg3oe5.exe #EMOTET soundser.exe no specs soundser.exe

Process information

PID
CMD
Path
Indicators
Parent process
880"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
936"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:880 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3100"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GF1CO757\DOC_58319654019US_May_24_2019[1].zip"C:\Program Files\WinRAR\WinRAR.exe—iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2976"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa3100.20701\DOC_58319654019US_May_24_2019.js" C:\Windows\System32\WScript.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
1140"C:\Users\admin\AppData\Local\Temp\h42qg3oe5.exe" C:\Users\admin\AppData\Local\Temp\h42qg3oe5.exe—WScript.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2152--b5b3418cC:\Users\admin\AppData\Local\Temp\h42qg3oe5.exe
h42qg3oe5.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3644"C:\Users\admin\AppData\Local\soundser\soundser.exe"C:\Users\admin\AppData\Local\soundser\soundser.exe
h42qg3oe5.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2652--3ab57678C:\Users\admin\AppData\Local\soundser\soundser.exe
soundser.exe
User:
admin
Integrity Level:
MEDIUM
Total events
1 548
Read events
1 429
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
13
Unknown types
3

Dropped files

PID
Process
Filename
Type
880iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico —
MD5:—
SHA256:—
880iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
880iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFBC3D94A3D511DFBD.TMP —
MD5:—
SHA256:—
880iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF314C4D844949BFCC.TMP —
MD5:—
SHA256:—
880iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{832EEB15-7DF1-11E9-B63D-5254004A04AF}.dat —
MD5:—
SHA256:—
936iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.datdat
MD5:ACF577BB170D389B50D7F62F0229105C
SHA256:A9AF0590B32758FD8E62BF2E842C467816DDF209BA924118F2C6669DDFD1D3AA
936iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@pianogiaretphcm[1].txttext
MD5:A87E4DEDA45CEB7B6854D8421DFA1865
SHA256:25B5FCBA6CD492B359C2C6FAC3C7963879F5529B640ABB6E8D0A321A85B6FCDC
936iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:C019B0180B8B67FCD0312273A0935274
SHA256:59DEEF0A35733D1EFAB017E2FBCD7EFC839B9334E3C89EDE1FE756AA3C4B930A
936iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
936iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:55B98B0597A91CF2CC131927D8D7DDE4
SHA256:699A2B2F3F2B43B3A21809A982598787BE81F6B61E9DBD4D85A547ED2B379E64
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
4
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2652
soundser.exe
POST
—
76.86.20.103:80
http://76.86.20.103/forced/sess/ringin/merge/
US
—
—
malicious
936
iexplore.exe
GET
200
210.211.121.143:80
http://pianogiaretphcm.com/wp-snapshots/qcTilRKePEJSGkQegx/
VN
compressed
1.47 Kb
unknown
880
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
880
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2976
WScript.exe
51.38.185.91:443
dnmartin.net
—
GB
unknown
2652
soundser.exe
76.86.20.103:80
—
Time Warner Cable Internet LLC
US
malicious
936
iexplore.exe
210.211.121.143:80
pianogiaretphcm.com
CHT Compamy Ltd
VN
unknown

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
pianogiaretphcm.com
  • 210.211.121.143
unknown
dnmartin.net
  • 51.38.185.91
unknown

Threats

PID
Process
Class
Message
936
iexplore.exe
Misc activity
ET INFO SUSPICIOUS Single JS file inside of ZIP Download (Observed as lure in malspam campaigns)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://pianogiaretphcm.com/wp-snapshots/qcTilRKePEJSGkQegx/