analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Dok-2019-09- 18-DE86183144.doc

Full analysis: https://app.any.run/tasks/a6fc444f-6aa3-4063-820d-672733396b48
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: September 18, 2019, 17:37:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
emotet-doc
emotet
generated-doc
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Infrastructure global, Subject: Wooden, Author: Zelda McKenzie, Comments: Developer, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Sep 18 07:34:00 2019, Last Saved Time/Date: Wed Sep 18 07:34:00 2019, Number of Pages: 1, Number of Words: 95, Number of Characters: 547, Security: 0
MD5:

2E0B461D8661F4E5537BE79EE343CB88

SHA1:

499EEF0B5809956C807776BAFA383340797CC481

SHA256:

9941068247170666F2F276797D730FEAB1E985F2772C61FBC953A9302349DE87

SSDEEP:

6144:1StPLkI07NSU4jJntATfDvTJcfbE0o801pbOkY5NjY:18X07NSU4VePvTJcfbE0o801pbOkY5Nk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3552)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3552)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: Infrastructure global
Subject: Wooden
Author: Zelda McKenzie
Keywords: -
Comments: Developer
Template: Normal.dotm
LastModifiedBy: -
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2019:09:18 06:34:00
ModifyDate: 2019:09:18 06:34:00
Pages: 1
Words: 95
Characters: 547
Security: None
CodePage: Windows Latin 1 (Western European)
Company: Ebert - Kirlin
Lines: 4
Paragraphs: 1
CharCountWithSpaces: 641
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
Manager: Dicki
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
1
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3552"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Dok-2019-09- 18-DE86183144.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
Total events
1 152
Read events
756
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
43

Dropped files

PID
Process
Filename
Type
3552WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR9B0C.tmp.cvr —
MD5:—
SHA256:—
3552WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\985240D.wmfwmf
MD5:5701F1C79A05DCB8E9AFFC4DE9D9183C
SHA256:DECB92C43FA2E069DB52DC4B93A026F4C1AF9D930D2C36DE48EB26641A82DF04
3552WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exdtlb
MD5:0452A05ED58EADD4F666FA7EF2222B11
SHA256:C75BE887B572A54D46F1B7BC753667D09BF52DC303CF1B1CDF9BED9F632D7FC4
3552WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8A58DD3C.wmfwmf
MD5:B7E0D00256D06D111EA437F2F706C8A5
SHA256:4FB089059FADBE9F0CCC5E53C8FBB406CE25536E6F4A26242204A4DE2F99BDE6
3552WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\200E8667.wmfwmf
MD5:7ACBEEC139B6086CAC42605BB6D34455
SHA256:9B5A1E1CADA113B5BB8B06CA8EF2FACACC30949208DEF7B9988CFEA62E64FF7E
3552WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CDB0F3A9.wmfwmf
MD5:B319EB6DE010E9696157132E81C1A1E3
SHA256:E8CE70F6E4D203A95716A0F3AD485A063C0253E4D9D547805E4CEA2D7EE7B686
3552WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DC91F2A0.wmfwmf
MD5:92D69B22C0DAFAFB3353F5296A512E60
SHA256:BC392AC6292C1AD3C1BB21B50AF7FBB6558371C092524FB8B1D4EE2374AF7638
3552WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\33740142.wmfwmf
MD5:2DB62F2D4C8F9CD59C794E206D13E42D
SHA256:E24C8FEC81E7DF29BC8FD938A0B763A427DC0CB45ACE4DFD106F7F04FA45E9CE
3552WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BB052E14.wmfwmf
MD5:06A432B5C1706DB542F6526B518BF129
SHA256:8682F77B02ECA85A71134CEFF0815BCF5D63C1867C2C9622EC09215DADC43577
3552WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$k-2019-09- 18-DE86183144.docpgc
MD5:9B423902BE95C214B5D6352169749683
SHA256:F6F3154DE83CAAD04A04FA23B0D5C3EF7B971380717337499280264419E0C135
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Dok-2019-09- 18-DE86183144.doc