analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

umowa 103916299 20 09 2019.doc

Full analysis: https://app.any.run/tasks/7c3531dd-b63b-49b2-9aa4-851aef26619e
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: October 09, 2019, 17:45:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
emotet-doc
emotet
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Fern Halvorson, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri Sep 20 07:27:00 2019, Last Saved Time/Date: Fri Sep 20 07:27:00 2019, Number of Pages: 1, Number of Words: 95, Number of Characters: 547, Security: 0
MD5:

02A166D869C56FC585D5D221D79F3352

SHA1:

3168D33210C69BA90158813D5BB02B5B734610BB

SHA256:

8322031E652553C2BDA6B6CB35946109DA7991168197565F669EA70AB5C86E6C

SSDEEP:

6144:ayGj85XuWpTEW1kKMJQqKahTUPLkI47NSU4jJntATfD:ayGj85XuWpTEW1kKMJQqKah6X47NSU44

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2924)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2924)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserType: Microsoft Word 97-2003 Document
CompObjUserTypeLen: 32
HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 641
Paragraphs: 1
Lines: 4
Company: -
CodePage: Windows Latin 1 (Western European)
Security: None
Characters: 547
Words: 95
Pages: 1
ModifyDate: 2019:09:20 06:27:00
CreateDate: 2019:09:20 06:27:00
TotalEditTime: -
Software: Microsoft Office Word
RevisionNumber: 1
LastModifiedBy: -
Template: Normal.dotm
Comments: -
Keywords: -
Author: Fern Halvorson
Subject: -
Title: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
1
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2924"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\umowa 103916299 20 09 2019.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
Total events
1 172
Read events
760
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
43

Dropped files

PID
Process
Filename
Type
2924WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR6472.tmp.cvr —
MD5:—
SHA256:—
2924WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5DA7EEC6.wmfwmf
MD5:44461853C2DD1ACBC300EBE0D0701A59
SHA256:4136D1404C61619B9730C7B0E252516AD1A57C0D189EBBF5680C16C86C62F8B9
2924WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\ED5B1713.wmfwmf
MD5:33EC0E6D654E006541C1FA63A27F1D00
SHA256:CBF36E498481F989EC4FA051AA18F973605E86CE5B18494266749B22B22F5144
2924WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F8E387EC.wmfwmf
MD5:042B212DD221D4F2AFC634BAD1A5EACC
SHA256:1F28E6E1A46E3E5F9B223F30CB9A9EAF00C74C21D21064921995C56075E3791F
2924WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\99ACBDF8.wmfwmf
MD5:CAFF405F321B1D65E85C2264A86C866E
SHA256:CDA9EE02C1E013B923C03EAD2F195C1AFF8DD12E4F34CB409A58A416BC960DAB
2924WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\99D977F5.wmfwmf
MD5:3F12E8CC863D8A8F613EC9F010497E9A
SHA256:D00D2D4F3F6037BBF2920CC70B250D582E5F70D5FF02CD9337040B87A602C5ED
2924WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FC00040F.wmfwmf
MD5:41FE45973C5808A1D32624178EF8A3EF
SHA256:F2DED5DD4E9E66C653DE6D880A73EA70065B69544E718E2299E06B8FAD3BD434
2924WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FAB4FAE.wmfwmf
MD5:F8D94EC98E920539A564CF73BF7E308F
SHA256:EC4A84FB696E54491E92A65C214CA9B1BB09BD3E491CFAFC711FDCAAB77C3336
2924WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4F97C821.wmfwmf
MD5:6822F687B3A727C5BD97A3DE8B6BB3A1
SHA256:7550E2F49E6BA0598A80C853D2C2A0C9B37E28BF5ED74BB72C4620FF0933DA95
2924WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F85DA2CB.wmfwmf
MD5:6B5AF5011B14F07D94115ACED6F539FC
SHA256:2169A1D78564358673D514629795B3A68AC03777C38F35CE95497D5A10B6C7FB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
umowa 103916299 20 09 2019.doc