2d2fa291...85b4 | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Downloader

emotet_e2_2d2fa29185ad0f48f665f9c93cc8282d3eeca9c848543453cd223333ea2485b4_2019-03-15__142003.doc

Word Document

Created at 2019-04-14T14:36:00

...

Indicators

File (24)
»
Filename Hash Operations Source
C:\ - Access
C:\Users\aETAdzjz - Access
C:\Users\aETAdzjz\48.exe - Access, Write
C:\Users\aETAdzjz\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 - Access
C:\Users\aETAdzjz\Documents\WindowsPowerShell\profile.ps1 - Access
C:\Windows - Access
C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll - Access
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config - Access, Read
C:\Windows\system32 - Access
C:\Windows\System32\WindowsPowerShell\v1.0 - Access
C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml - Access, Read
C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml - Access, Read
C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml - Access
C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml - Access
C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml - Access, Read
C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml - Access
C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1 - Access
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.config - Access
C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml - Access
C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml - Access
C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1 - Access
C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml - Access
C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml - Access
C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml - Access
Registry (75)
»
Registry Key Name Operations
HKEY_CLASSES_ROOT\Licenses Access
HKEY_CLASSES_ROOT\Licenses\8804558B-B773-11d1-BC3E-0000F87552E7 Read
HKEY_CLASSES_ROOT\TypeLib Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64 Access, Read
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046} Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7 Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\0\win64 Access, Read
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\409 Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\9 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\win64 Access, Read
HKEY_CURRENT_USER Access
HKEY_CURRENT_USER\Environment Access
HKEY_CURRENT_USER\Environment\PSMODULEPATH Read
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Access
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common Access
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BackGroundCompile Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BreakOnAllErrors Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BreakOnServerErrors Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\CompileOnDemand Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\NotifyUserBeforeStateLoss Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\RequireDeclaration Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\VbaCapability Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell\path Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\PipelineMaxStackSizeMB Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\StackVersion Read
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\First Counter Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\IsMultiInstance Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\Library Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\CategoryOptions Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\Counter Names Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\FileMappingSize Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell Access
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell Access
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine Access
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine\ApplicationBase Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Scripting Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Scripting\Default Impersonation Level Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Scripting\Default Namespace Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\InstallationType Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment Access
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment\PSMODULEPATH Read
HKEY_PERFORMANCE_DATA Access
Mutex (1)
»
Mutex Name Operations
Global\.net clr networking Access, Delete
Domain (14)
»
Domain Sources
nieuwhoftegelwerken.nl PCAP, Function Log
uninortediverso.com PCAP, Function Log
forexproservice.com PCAP, Function Log
lesserassociates.com PCAP, Function Log, Embedded
vigor-dragon.com PCAP, Function Log
host-services.com PCAP, Function Log, Embedded
www.bankofcanada.ca Embedded
fonts.googleapis.com Embedded
economics.td.com Embedded
s.w.org Embedded
www.rbc.com Embedded
www.activebranding.co.il Embedded
economics.bmocapitalmarkets.com Embedded
economics.cibccm.com Embedded
URL (44)
»
URL Operations Sources
nieuwhoftegelwerken.nl/g9A/Wj/ GET PCAP, Function Log
forexproservice.com/wp-content/tW/ GET PCAP, Function Log
lesserassociates.com/wp-content/E8h/ GET PCAP, Function Log
http://lesserassociates.com/wp-content/plugins/js_composer/assets/css/js_composer.min.css?ver=5.2.1 GET Embedded
http://lesserassociates.com/wp-content/themes/fortuna/stylesheets/grid.css?ver=2b5cb08d4bc26e2c4cef655c1db857a3 GET Embedded
http://lesserassociates.com/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=2b5cb08d4bc26e2c4cef655c1db857a3 GET Embedded
http://lesserassociates.com/wp-content/themes/fortuna/stylesheets/animations.css?ver=2b5cb08d4bc26e2c4cef655c1db857a3 GET Embedded
http://lesserassociates.com/wp-includes/js/wp-embed.min.js?ver=2b5cb08d4bc26e2c4cef655c1db857a3 GET Embedded
http://lesserassociates.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1 GET Embedded
http://lesserassociates.com/wp-content/plugins/revslider/public/assets/js/jquery.themepunch.tools.min.js?ver=5.4.5.2 GET Embedded
http://lesserassociates.com/wp-includes/css/dist/block-library/style.min.css?ver=2b5cb08d4bc26e2c4cef655c1db857a3 GET Embedded
http://lesserassociates.com/wp-content/themes/fortuna/stylesheets/icons.css?ver=2b5cb08d4bc26e2c4cef655c1db857a3 GET Embedded
http://lesserassociates.com/wp-content/themes/fortuna/images/favicon.png GET Embedded
http://lesserassociates.com/wp-content/plugins/revslider/public/assets/js/jquery.themepunch.revolution.min.js?ver=5.4.5.2 GET Embedded
http://lesserassociates.com/wp-content/themes/fortuna/js/common.js?ver=2b5cb08d4bc26e2c4cef655c1db857a3 GET Embedded
http://lesserassociates.com/wp-includes/js/jquery/jquery.js?ver=1.12.4 GET Embedded
http://lesserassociates.com/wp-content/themes/fortuna/js/libs.min.js?ver=2b5cb08d4bc26e2c4cef655c1db857a3 GET Embedded
http://lesserassociates.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=2b5cb08d4bc26e2c4cef655c1db857a3 GET Embedded
http://lesserassociates.com/wp-content/plugins/revslider/public/assets/css/settings.css?ver=5.4.5.2 GET Embedded
http://lesserassociates.com/wp-content/themes/fortuna/js/jquery.smoothscroll.js?ver=2b5cb08d4bc26e2c4cef655c1db857a3 GET Embedded
http://lesserassociates.com/wp-content/themes/fortuna/stylesheets/grid_responsive.css?ver=2b5cb08d4bc26e2c4cef655c1db857a3 GET Embedded
http://lesserassociates.com/wp-content/themes/fortuna-child/style.css?ver=2b5cb08d4bc26e2c4cef655c1db857a3 GET Embedded
https://lesserassociates.com/feed/ GET Embedded
https://lesserassociates.com/our-strengths/ GET Embedded
https://lesserassociates.com/transaction-highlights_2/ GET Embedded
https://lesserassociates.com/ GET Embedded
https://lesserassociates.com/wp-content/uploads/2017/12/logo_color.png GET Embedded
https://lesserassociates.com/our-expertise/ GET Embedded
https://lesserassociates.com/wp-content/uploads/2017/12/logo_colorFULL.png GET Embedded
https://lesserassociates.com/contact-2/ GET Embedded
https://lesserassociates.com/wp-json/ GET Embedded
host-services.com/suspended/ GET PCAP, Function Log, Embedded
https://www.bankofcanada.ca/rates/interest-rates/canadian-bonds/ GET Embedded
https://www.bankofcanada.ca/rates/interest-rates/lookup-bond-yields/ GET Embedded
//fonts.googleapis.com GET Embedded
//fonts.googleapis.com/css?family=Roboto:100,300,regular,500,700 GET Embedded
//fonts.googleapis.com/css?family=Droid+Serif%3A400%2C700%2C400italic%2C700italic%7CLato%3A300%2C400%2C700%2C400italic%7CMontserrat%3A400%2C700&ver=1.0.0 GET Embedded
https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i GET Embedded
https://economics.td.com/domains/economics.td.com/documents/reports/qef/2017-dec/Can_Rates.htm GET Embedded
//s.w.org GET Embedded
http://www.rbc.com/economics/economic-data/ GET Embedded
http://www.activebranding.co.il GET Embedded
https://economics.bmocapitalmarkets.com/economics/forecast/ GET Embedded
https://economics.cibccm.com/economicsweb/EconomicsHome GET Embedded
IP (8)
»
IP Protocols Sources
192.168.0.1 UDP PCAP
195.8.208.98 DNS, HTTP, TCP PCAP, Function Log
104.31.93.251 DNS, TCP PCAP, Function Log
104.31.92.251 DNS, TCP PCAP, Function Log
80.172.234.15 DNS, HTTP, TCP PCAP, Function Log
192.115.76.18 DNS, HTTP, HTTPS, TCP PCAP, Function Log, Embedded
47.89.211.238 DNS, TCP PCAP, Function Log
194.8.30.20 DNS, HTTP, TCP PCAP, Function Log, Embedded
Export to TXT Export to JSON
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image