URL:

http://www.wujingwei.com/yis24.com/NH0/

Full analysis: https://app.any.run/tasks/1002b2d6-30fe-4721-9da7-7ae55bc6ab3b
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: March 14, 2019, 13:35:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
emotet
opendir
trojan
feodo
Indicators:
MD5:

496E8637D48BF009A98B08EE5696A467

SHA1:

BBFE8711F8B18100642718B12EAC04274C56E765

SHA256:

8EE1613475AEED5272ECED642D6AB2C2153ABAA900D031CC89CD03FEAE03EBF7

SSDEEP:

3:N1KJS4nGutdIKrtVKn:Cc4nzz3+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Emotet process was detected

      • wabmetagen.exe (PID: 900)

    • Application was dropped or rewritten from another process

      • wabmetagen.exe (PID: 900)
      • wabmetagen.exe (PID: 1088)
      • L7VjF.exe (PID: 3184)
      • L7VjF.exe (PID: 1348)

    • EMOTET was detected

      • wabmetagen.exe (PID: 1088)

    • Connects to CnC server

      • wabmetagen.exe (PID: 1088)

    • Changes the autorun value in the registry

      • wabmetagen.exe (PID: 1088)

    • Downloads executable files from the Internet

      • chrome.exe (PID: 2996)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2996)
      • L7VjF.exe (PID: 1348)

    • Application launched itself

      • L7VjF.exe (PID: 3184)
      • wabmetagen.exe (PID: 900)

    • Cleans NTFS data-stream (Zone Identifier)

      • L7VjF.exe (PID: 1348)

    • Starts itself from another location

      • L7VjF.exe (PID: 1348)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 2996)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 2996)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
14
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs l7vjf.exe no specs l7vjf.exe chrome.exe no specs #EMOTET wabmetagen.exe no specs #EMOTET wabmetagen.exe chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
900"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe
L7VjF.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® HTML Help Executable
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\wabmetagen\wabmetagen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1088"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe
wabmetagen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® HTML Help Executable
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\wabmetagen\wabmetagen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1348"C:\Users\admin\Downloads\L7VjF.exe"C:\Users\admin\Downloads\L7VjF.exe
L7VjF.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® HTML Help Executable
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\downloads\l7vjf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2160"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=964,242606157672125368,8062065844879851193,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=D24AAD625AB16B6FA0E38663173B429A --mojo-platform-channel-handle=1032 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2456"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=964,242606157672125368,8062065844879851193,131072 --enable-features=PasswordImport --disable-gpu-sandbox --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=141ACB5A75AC8087FDB299DB0E9D8695 --mojo-platform-channel-handle=3512 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2644"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=964,242606157672125368,8062065844879851193,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=CFA54807F2F4BDEBC95EE5EAFC2E0827 --mojo-platform-channel-handle=516 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2648"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=964,242606157672125368,8062065844879851193,131072 --enable-features=PasswordImport --service-pipe-token=CD0217BAD264DA8D76ECA4608A9A894F --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=CD0217BAD264DA8D76ECA4608A9A894F --renderer-client-id=4 --mojo-platform-channel-handle=1900 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2988"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3000 --on-initialized-event-handle=304 --parent-handle=308 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2996"C:\Program Files\Google\Chrome\Application\chrome.exe" http://www.wujingwei.com/yis24.com/NH0/C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3184"C:\Users\admin\Downloads\L7VjF.exe" C:\Users\admin\Downloads\L7VjF.exe—chrome.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® HTML Help Executable
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\downloads\l7vjf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
Total events
956
Read events
869
Write events
83
Delete events
4

Modification events

(PID) Process:(2996) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2996) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2996) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2988) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:2996-13197044168290375
Value:
259
(PID) Process:(2996) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(2996) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(2996) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3516-13180984670829101
Value:
0
(PID) Process:(2996) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(2996) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:2996-13197044168290375
Value:
259
(PID) Process:(2996) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid
Value:
Executable files
4
Suspicious files
37
Text files
131
Unknown types
3

Dropped files

PID
Process
Filename
Type
2996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\1f26b8eb-87d5-4a32-b245-296b04b7c2a1.tmp —
MD5:—
SHA256:—
2996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\000016.dbtmp —
MD5:—
SHA256:—
2996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000016.dbtmp —
MD5:—
SHA256:—
2996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\39d8439f-6832-4d9f-bcb0-b50d598ab004.tmp —
MD5:—
SHA256:—
2996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:—
SHA256:—
2996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
2996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF198c77.TMPtext
MD5:—
SHA256:—
2996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:—
SHA256:—
2996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG.oldtext
MD5:—
SHA256:—
2996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF198c96.TMPtext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
96
TCP/UDP connections
48
DNS requests
24
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2996
chrome.exe
GET
200
123.108.109.129:80
http://www.wujingwei.com/yis24.com/NH0/
HK
executable
180 Kb
suspicious
2996
chrome.exe
GET
200
123.108.109.129:80
http://www.wujingwei.com/
HK
html
10.1 Kb
suspicious
2996
chrome.exe
GET
200
123.108.109.129:80
http://www.wujingwei.com/wjw-blog/wp-content/themes/baja-%E5%A4%87%E4%BB%BD/style.css
HK
text
1.41 Kb
suspicious
2996
chrome.exe
GET
200
123.108.109.129:80
http://www.wujingwei.com/wjw-blog/wp-content/plugins/wp-zan/static/js/wp-zan-0.0.10.js?ver=0.0.10
HK
text
2.06 Kb
suspicious
2996
chrome.exe
GET
200
123.108.109.129:80
http://www.wujingwei.com/wjw-blog/wp-content/themes/baja-%E5%A4%87%E4%BB%BD/css/bootstrap.css
HK
text
22.5 Kb
suspicious
2996
chrome.exe
GET
200
123.108.109.129:80
http://www.wujingwei.com/wjw-blog/wp-content/plugins/lets-kill-ie6/lets-kill-ie6.js?ver=4.9.3
HK
html
1.21 Kb
suspicious
2996
chrome.exe
GET
200
123.108.109.129:80
http://www.wujingwei.com/wjw-blog/wp-content/plugins/wp-zan/static/css/wp-zan-0.0.10.css?ver=0.0.10
HK
text
816 b
suspicious
2996
chrome.exe
GET
200
123.108.109.129:80
http://www.wujingwei.com/wjw-blog/wp-content/uploads/2018/03/%E4%B8%9C%E6%88%90%E8%A5%BF%E5%B0%B1.jpg
HK
image
106 Kb
suspicious
2996
chrome.exe
GET
200
123.108.109.129:80
http://www.wujingwei.com/wjw-blog/wp-content/themes/maskitto-light/css/font-awesome.min.css
HK
text
7.32 Kb
suspicious
2996
chrome.exe
GET
200
123.108.109.129:80
http://www.wujingwei.com/wjw-blog/wp-content/plugins/smartideo/static/smartideo.css?ver=2.5.2
HK
text
441 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2996
chrome.exe
216.58.210.3:443
www.gstatic.com
Google Inc.
US
whitelisted
2996
chrome.exe
172.217.22.99:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2996
chrome.exe
123.108.109.129:80
www.wujingwei.com
Cloudie Limited
HK
suspicious
2996
chrome.exe
172.217.16.141:443
accounts.google.com
Google Inc.
US
suspicious
2996
chrome.exe
172.217.23.131:443
www.google.no
Google Inc.
US
whitelisted
1088
wabmetagen.exe
187.233.152.78:443
—
Uninet S.A. de C.V.
MX
malicious
2996
chrome.exe
172.217.22.42:443
translate.googleapis.com
Google Inc.
US
whitelisted
2996
chrome.exe
216.58.208.46:443
clients1.google.com
Google Inc.
US
whitelisted
2996
chrome.exe
172.217.21.238:80
translate.google.com
Google Inc.
US
whitelisted
2996
chrome.exe
216.58.205.238:443
sb-ssl.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 172.217.22.99
whitelisted
www.gstatic.com
  • 216.58.210.3
  • 216.58.206.3
whitelisted
www.wujingwei.com
  • 123.108.109.129
suspicious
accounts.google.com
  • 172.217.16.141
shared
sb-ssl.google.com
  • 216.58.205.238
whitelisted
ssl.gstatic.com
  • 172.217.22.99
whitelisted
safebrowsing.google.com
  • 216.58.205.238
whitelisted
www.google.de
  • 216.58.207.67
whitelisted
www.google.com
  • 216.58.206.4
malicious
www.google.no
  • 172.217.23.131
whitelisted

Threats

PID
Process
Class
Message
2996
chrome.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2996
chrome.exe
Misc activity
ET INFO EXE - Served Attached HTTP
1088
wabmetagen.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo HTTP request
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://www.wujingwei.com/yis24.com/NH0/