| URL: | http://haine1.webrevolutionfactory.com/EN_en/New_invoice/aWkH-ttM2y_NIjQshFAQ-Sh |
| Full analysis: | https://app.any.run/tasks/8e583177-3c47-41d9-a09a-e307dbcc0969 |
| Verdict: | Malicious activity |
| Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
| Analysis date: | February 06, 2019, 20:05:47 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 6A745BAD2BF23412179EFCCBC0CD070B |
| SHA1: | 5804F2989FBE2D6B2924995EDCB72F64973C3752 |
| SHA256: | DE4150AB1CF84BE442F0003922B748EC485357522AB5BB927018B3432C4E3EB5 |
| SSDEEP: | 3:N1KWEKNrXAeQMcyGQ1uXKlP0Dq:CWFoMIq |
MALICIOUS
Unusual execution from Microsoft Office
- WINWORD.EXE (PID: 2364)
Application was dropped or rewritten from another process
- 123.exe (PID: 3088)
- 123.exe (PID: 3820)
- wabmetagen.exe (PID: 2132)
- wabmetagen.exe (PID: 2872)
Executes PowerShell scripts
- WINWORD.EXE (PID: 2364)
Downloads executable files from the Internet
- PoWersheLL.exe (PID: 3628)
Emotet process was detected
- wabmetagen.exe (PID: 2132)
Changes the autorun value in the registry
- wabmetagen.exe (PID: 2872)
EMOTET was detected
- wabmetagen.exe (PID: 2872)
Connects to CnC server
- wabmetagen.exe (PID: 2872)
SUSPICIOUS
Starts Microsoft Office Application
- chrome.exe (PID: 3020)
- WINWORD.EXE (PID: 2364)
Application launched itself
- WINWORD.EXE (PID: 2364)
Creates files in the user directory
- PoWersheLL.exe (PID: 3628)
Executable content was dropped or overwritten
- PoWersheLL.exe (PID: 3628)
- 123.exe (PID: 3820)
Starts itself from another location
- 123.exe (PID: 3820)
Connects to unusual port
- wabmetagen.exe (PID: 2872)
INFO
Application launched itself
- chrome.exe (PID: 3020)
Creates files in the user directory
- WINWORD.EXE (PID: 2364)
Dropped object may contain Bitcoin addresses
- WINWORD.EXE (PID: 2364)
- chrome.exe (PID: 3020)
Reads Internet Cache Settings
- chrome.exe (PID: 3020)
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 2364)
- WINWORD.EXE (PID: 3968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
48
Monitored processes
17
Malicious processes
7
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 284 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=964,14314600984727484759,16689743019633329455,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=B2E1C1888076D473A6BDD1020AE4BD29 --mojo-platform-channel-handle=996 --ignored=" --type=renderer " /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 692 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=964,14314600984727484759,16689743019633329455,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=832FC6A98573B60F22B2D2E52CCFB8CD --mojo-platform-channel-handle=3780 --ignored=" --type=renderer " /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2132 | "C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe" | C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe | 123.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Icelandic Keyboard Layout Exit code: 0 Version: 5.1.2600.0 (xpclient.010817-1148) Modules
| |||||||||||||||
| 2364 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Downloads\PAY86874721356.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | chrome.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
| 2872 | "C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe" | C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe | wabmetagen.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Icelandic Keyboard Layout Exit code: 0 Version: 5.1.2600.0 (xpclient.010817-1148) Modules
| |||||||||||||||
| 2880 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=964,14314600984727484759,16689743019633329455,131072 --enable-features=PasswordImport --lang=en-US --no-sandbox --service-request-channel-token=A883F0E4B9F7CBFA8A6506992678ED3F --mojo-platform-channel-handle=2404 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2904 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=964,14314600984727484759,16689743019633329455,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=6FD47D947331F717917993044880FF44 --mojo-platform-channel-handle=1124 --ignored=" --type=renderer " /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2936 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=964,14314600984727484759,16689743019633329455,131072 --enable-features=PasswordImport --service-pipe-token=B9455384F4EF6E8F385C1B9E92958DF9 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=B9455384F4EF6E8F385C1B9E92958DF9 --renderer-client-id=4 --mojo-platform-channel-handle=1896 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2996 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3024 --on-initialized-event-handle=304 --parent-handle=308 /prefetch:6 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 3020 | "C:\Program Files\Google\Chrome\Application\chrome.exe" http://haine1.webrevolutionfactory.com/EN_en/New_invoice/aWkH-ttM2y_NIjQshFAQ-Sh | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | ||||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
Total events
3 295
Read events
2 745
Write events
536
Delete events
14
Modification events
| (PID) Process: | (2996) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | write | Name: | 3020-13193957163250250 |
Value: 259 | |||
| (PID) Process: | (3020) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (3020) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (3020) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (3020) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (3020) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
| Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
| (PID) Process: | (3020) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | delete value | Name: | 3516-13180984670829101 |
Value: 0 | |||
| (PID) Process: | (3020) chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
| Operation: | write | Name: | usagestats |
Value: 0 | |||
| (PID) Process: | (3020) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | delete value | Name: | 3020-13193957163250250 |
Value: 259 | |||
| (PID) Process: | (3020) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | metricsid |
Value: | |||
Executable files
2
Suspicious files
24
Text files
66
Unknown types
4
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3020 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\06d7c33a-d8ea-4a2e-8af5-3f1b2ae58bc3.tmp | — | |
MD5:— | SHA256:— | |||
| 3020 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\000016.dbtmp | — | |
MD5:— | SHA256:— | |||
| 3020 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000016.dbtmp | — | |
MD5:— | SHA256:— | |||
| 3020 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\f8c0b924-103b-4562-8b35-9411deff379f.tmp | — | |
MD5:— | SHA256:— | |||
| 3020 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old | text | |
MD5:— | SHA256:— | |||
| 3020 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\10fac924-6fcf-482e-b5ce-8e3161744389.tmp | — | |
MD5:— | SHA256:— | |||
| 3020 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old | text | |
MD5:— | SHA256:— | |||
| 3020 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF246b2e.TMP | text | |
MD5:— | SHA256:— | |||
| 3020 | chrome.exe | C:\Users\admin\Downloads\PAY86874721356.doc.crdownload | — | |
MD5:— | SHA256:— | |||
| 3020 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF246b3e.TMP | text | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
19
DNS requests
13
Threats
10
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3020 | chrome.exe | GET | 200 | 93.174.166.95:80 | http://haine1.webrevolutionfactory.com/EN_en/New_invoice/aWkH-ttM2y_NIjQshFAQ-Sh/ | RO | xml | 150 Kb | malicious |
2872 | wabmetagen.exe | GET | — | 24.232.118.175:80 | http://24.232.118.175/ | AR | — | — | malicious |
3628 | PoWersheLL.exe | GET | 200 | 61.14.237.12:80 | http://muathangnhom.com/6DOpkmOL9_yfO/ | VN | executable | 148 Kb | malicious |
3628 | PoWersheLL.exe | GET | 301 | 61.14.237.12:80 | http://muathangnhom.com/6DOpkmOL9_yfO | VN | html | 246 b | malicious |
2872 | wabmetagen.exe | GET | — | 71.78.24.146:80 | http://71.78.24.146/ | US | — | — | malicious |
3020 | chrome.exe | GET | 301 | 93.174.166.95:80 | http://haine1.webrevolutionfactory.com/EN_en/New_invoice/aWkH-ttM2y_NIjQshFAQ-Sh | RO | html | 617 b | malicious |
2872 | wabmetagen.exe | GET | 200 | 67.238.131.194:8080 | http://67.238.131.194:8080/ | US | binary | 132 b | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3020 | chrome.exe | 172.217.23.163:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
3020 | chrome.exe | 93.174.166.95:80 | haine1.webrevolutionfactory.com | Space Ro Srl | RO | malicious |
3020 | chrome.exe | 172.217.18.3:443 | www.gstatic.com | Google Inc. | US | whitelisted |
3020 | chrome.exe | 216.58.205.227:443 | ssl.gstatic.com | Google Inc. | US | whitelisted |
3628 | PoWersheLL.exe | 61.14.237.12:80 | muathangnhom.com | TIEN PHAT TECHNOLOGY CORPORATION | VN | suspicious |
2872 | wabmetagen.exe | 216.119.181.170:995 | — | BCI Mississippi Broadband,LLC | US | malicious |
2872 | wabmetagen.exe | 71.78.24.146:80 | — | Time Warner Cable Internet LLC | US | malicious |
3020 | chrome.exe | 172.217.16.138:443 | safebrowsing.googleapis.com | Google Inc. | US | whitelisted |
3020 | chrome.exe | 216.58.205.238:443 | clients1.google.com | Google Inc. | US | whitelisted |
2872 | wabmetagen.exe | 24.189.222.181:995 | — | Cablevision Systems Corp. | US | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.gstatic.com |
| whitelisted |
haine1.webrevolutionfactory.com |
| unknown |
clientservices.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
ssl.gstatic.com |
| whitelisted |
muathangnhom.com |
| malicious |
dns.msftncsi.com |
| shared |
safebrowsing.googleapis.com |
| whitelisted |
clients1.google.com |
| whitelisted |
clients2.google.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3020 | chrome.exe | A Network Trojan was detected | ET TROJAN Possible malicious Office doc hidden in XML file |
3628 | PoWersheLL.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
3628 | PoWersheLL.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
3628 | PoWersheLL.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
2872 | wabmetagen.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo HTTP request |
2872 | wabmetagen.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo HTTP request |
2872 | wabmetagen.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo HTTP request |
3 ETPRO signatures available at the full report