analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

umowa 103916299 20 09 2019.doc

Full analysis: https://app.any.run/tasks/b7bdc88a-6528-4c4c-8667-1f8cc3254ce5
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: October 09, 2019, 18:30:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
emotet-doc
emotet
generated-doc
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Fern Halvorson, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri Sep 20 07:27:00 2019, Last Saved Time/Date: Fri Sep 20 07:27:00 2019, Number of Pages: 1, Number of Words: 95, Number of Characters: 547, Security: 0
MD5:

02A166D869C56FC585D5D221D79F3352

SHA1:

3168D33210C69BA90158813D5BB02B5B734610BB

SHA256:

8322031E652553C2BDA6B6CB35946109DA7991168197565F669EA70AB5C86E6C

SSDEEP:

6144:ayGj85XuWpTEW1kKMJQqKahTUPLkI47NSU4jJntATfD:ayGj85XuWpTEW1kKMJQqKah6X47NSU44

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2268)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserType: Microsoft Word 97-2003 Document
CompObjUserTypeLen: 32
HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 641
Paragraphs: 1
Lines: 4
Company: -
CodePage: Windows Latin 1 (Western European)
Security: None
Characters: 547
Words: 95
Pages: 1
ModifyDate: 2019:09:20 06:27:00
CreateDate: 2019:09:20 06:27:00
TotalEditTime: -
Software: Microsoft Office Word
RevisionNumber: 1
LastModifiedBy: -
Template: Normal.dotm
Comments: -
Keywords: -
Author: Fern Halvorson
Subject: -
Title: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
1
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2268"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\umowa 103916299 20 09 2019.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
Total events
2 441
Read events
2 000
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
2
Unknown types
45

Dropped files

PID
Process
Filename
Type
2268WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR64C0.tmp.cvr —
MD5:—
SHA256:—
2268WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\286FD31C.wmfwmf
MD5:DA140D919A511BA11F1B86C2600450AB
SHA256:DA65E2EC588257DDA1FC6CDEBB044F6DD093A6756DC49043C926503DD3F1F4C3
2268WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\308AE0D0.wmfwmf
MD5:6822F687B3A727C5BD97A3DE8B6BB3A1
SHA256:7550E2F49E6BA0598A80C853D2C2A0C9B37E28BF5ED74BB72C4620FF0933DA95
2268WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:411BE7D2A044ECFE4B36F107E6FEF666
SHA256:4BD519A86B1C444DFE388ED0F3E402FD2E53EDA7B1B112548658D1941392E8EE
2268WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:236A5B013E0C0A530DFC8CB356246350
SHA256:7A1B1040CF315213BF4432B06265B1A77F8A2373BF309F77BE71140CF7EBD1B9
2268WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\93E9D38A.wmfwmf
MD5:33EC0E6D654E006541C1FA63A27F1D00
SHA256:CBF36E498481F989EC4FA051AA18F973605E86CE5B18494266749B22B22F5144
2268WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\70DADFF4.wmfwmf
MD5:3F12E8CC863D8A8F613EC9F010497E9A
SHA256:D00D2D4F3F6037BBF2920CC70B250D582E5F70D5FF02CD9337040B87A602C5ED
2268WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\umowa 103916299 20 09 2019.doc.LNKlnk
MD5:BAA220D70865184457B0B32A894EF43C
SHA256:83B14FE188DC33C9ECAAFC7250AAF85D03DAC350B1D2BBCC639F7CA12809D291
2268WINWORD.EXEC:\Users\admin\~$owa 103916299 20 09 2019.docpgc
MD5:3A86F6986FB233CBA610F793D1546F1B
SHA256:3D61E7F1E29E7EB731CB870916106AE752EE04E0F55B0D4F837FFE4577565A7E
2268WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C0F04A91.wmfwmf
MD5:CE50E20791EEFABBBFD1725DF12B12D8
SHA256:A0C73CADB831F406DF870AB97A011B50E8B21038C87A5DF8E9CB8173F7A60E3D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
umowa 103916299 20 09 2019.doc