File name: | 1j4pqc3p.eml |
Full analysis: | https://app.any.run/tasks/b0ad2cd4-de43-4fc5-9e87-712599f4340b |
Verdict: | Malicious activity |
Analysis date: | December 06, 2018, 13:49:09 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | message/rfc822 |
File info: | RFC 822 mail, ASCII text, with CRLF line terminators |
MD5: | A57EDE3881493A6D4B565AA861318300 |
SHA1: | DF069B6B160EFCE9B3EF1C0AF1EFA6F1FB6D3920 |
SHA256: | 0E4D043CDC738D20B01B8E93606D505BF090E7F508C196597636560BAE8E1C6E |
SSDEEP: | 192:8Wsnif0pikk1mP8O85Gr5M4qg9eYMapKb0AdH3nunayMXps/ZkpltnlS+lQ:AifYik2WP5jkHewNlbS+lQ |
.eml | | | E-Mail message (Var. 5) (100) |
---|
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2984 | "C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\1j4pqc3p.eml" | C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Exit code: 0 Version: 14.0.6025.1000 Modules
| |||||||||||||||
2440 | "C:\Program Files\Internet Explorer\iexplore.exe" https://protect-us.mimecast.com/s/I-TeCzp9R6fRONBKs4Dt67?domain=briza.io | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3176 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2440 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
|
(PID) Process: | (2984) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: Off | |||
(PID) Process: | (2984) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: On | |||
(PID) Process: | (2984) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Resiliency\StartupItems |
Operation: | write | Name: | xt? |
Value: 78743F00A80B0000010000000000000000000000 | |||
(PID) Process: | (2984) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook |
Operation: | write | Name: | MTTT |
Value: A80B00005868C47F6A8DD40100000000 | |||
(PID) Process: | (2984) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\SQM |
Operation: | write | Name: | SQMSessionNumber |
Value: 0 | |||
(PID) Process: | (2984) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\SQM |
Operation: | write | Name: | SQMSessionDate |
Value: 219808800 | |||
(PID) Process: | (2984) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\0a0d020000000000c000000000000046 |
Operation: | write | Name: | 00030429 |
Value: 03000000 | |||
(PID) Process: | (2984) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\9375CFF0413111d3B88A00104B2A6676 |
Operation: | write | Name: | {ED475418-B0D6-11D2-8C3B-00104B2A6676} |
Value: | |||
(PID) Process: | (2984) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\9375CFF0413111d3B88A00104B2A6676 |
Operation: | write | Name: | LastChangeVer |
Value: 1200000000000000 | |||
(PID) Process: | (2984) OUTLOOK.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109A10090400000000000F01FEC\Usage |
Operation: | write | Name: | OutlookMAPI2Intl_1033 |
Value: 1300627477 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2984 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRA878.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2440 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
2440 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
3176 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\CabDC0B.tmp | — | |
MD5:— | SHA256:— | |||
3176 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\TarDC0C.tmp | — | |
MD5:— | SHA256:— | |||
3176 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\CabDC1D.tmp | — | |
MD5:— | SHA256:— | |||
3176 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\TarDC1E.tmp | — | |
MD5:— | SHA256:— | |||
3176 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\CabDC9C.tmp | — | |
MD5:— | SHA256:— | |||
3176 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\TarDC9D.tmp | — | |
MD5:— | SHA256:— | |||
2984 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:390F288F729EA31E173C8FDD85539867 | SHA256:B739D29C1741F62061CAE8D75337371DB033C0A8624A04B01C90C99104AB1A18 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3176 | iexplore.exe | GET | 301 | 52.218.248.123:80 | http://www.briza.io/ | US | — | — | unknown |
2984 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
3176 | iexplore.exe | GET | 200 | 52.218.196.227:80 | http://briza.io.s3-website-us-west-2.amazonaws.com/ | US | html | 19.0 Kb | shared |
3176 | iexplore.exe | GET | 200 | 52.218.196.227:80 | http://briza.io.s3-website-us-west-2.amazonaws.com/img/square_frustrated.jpg | US | image | 426 Kb | shared |
3176 | iexplore.exe | GET | 200 | 13.107.4.50:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | US | compressed | 55.2 Kb | whitelisted |
3176 | iexplore.exe | GET | 200 | 52.218.196.227:80 | http://briza.io.s3-website-us-west-2.amazonaws.com/img/square_broker.jpg | US | image | 608 Kb | shared |
3176 | iexplore.exe | GET | 200 | 52.218.196.227:80 | http://briza.io.s3-website-us-west-2.amazonaws.com/img/square_ugh.jpg | US | image | 768 Kb | shared |
3176 | iexplore.exe | GET | 200 | 52.218.196.227:80 | http://briza.io.s3-website-us-west-2.amazonaws.com/img/control.svg | US | image | 5.27 Kb | shared |
3176 | iexplore.exe | GET | 200 | 52.218.196.227:80 | http://briza.io.s3-website-us-west-2.amazonaws.com/img/diagram.png | US | image | 132 Kb | shared |
3176 | iexplore.exe | GET | 200 | 52.218.196.227:80 | http://briza.io.s3-website-us-west-2.amazonaws.com/img/timely.svg | US | image | 1.45 Kb | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2440 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3176 | iexplore.exe | 216.58.215.234:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
3176 | iexplore.exe | 162.255.119.41:80 | briza.io | Namecheap, Inc. | US | suspicious |
3176 | iexplore.exe | 52.218.196.227:80 | briza.io.s3-website-us-west-2.amazonaws.com | Amazon.com, Inc. | US | shared |
3176 | iexplore.exe | 207.211.31.106:443 | protect-us.mimecast.com | Navisite, Inc. | US | suspicious |
3176 | iexplore.exe | 52.218.248.123:80 | www.briza.io | Amazon.com, Inc. | US | unknown |
3176 | iexplore.exe | 13.107.4.50:80 | www.download.windowsupdate.com | Microsoft Corporation | US | whitelisted |
2984 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
2440 | iexplore.exe | 52.218.196.227:80 | briza.io.s3-website-us-west-2.amazonaws.com | Amazon.com, Inc. | US | shared |
3176 | iexplore.exe | 216.58.215.227:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
protect-us.mimecast.com |
| whitelisted |
www.bing.com |
| whitelisted |
www.download.windowsupdate.com |
| whitelisted |
briza.io |
| whitelisted |
www.briza.io |
| unknown |
briza.io.s3-website-us-west-2.amazonaws.com |
| shared |
fonts.googleapis.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |