| File name: | 1j4pqc3p.eml |
| Full analysis: | https://app.any.run/tasks/b0ad2cd4-de43-4fc5-9e87-712599f4340b |
| Verdict: | Malicious activity |
| Analysis date: | December 06, 2018, 13:49:09 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | message/rfc822 |
| File info: | RFC 822 mail, ASCII text, with CRLF line terminators |
| MD5: | A57EDE3881493A6D4B565AA861318300 |
| SHA1: | DF069B6B160EFCE9B3EF1C0AF1EFA6F1FB6D3920 |
| SHA256: | 0E4D043CDC738D20B01B8E93606D505BF090E7F508C196597636560BAE8E1C6E |
| SSDEEP: | 192:8Wsnif0pikk1mP8O85Gr5M4qg9eYMapKb0AdH3nunayMXps/ZkpltnlS+lQ:AifYik2WP5jkHewNlbS+lQ |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts Internet Explorer
- OUTLOOK.EXE (PID: 2984)
Reads Internet Cache Settings
- OUTLOOK.EXE (PID: 2984)
Creates files in the user directory
- OUTLOOK.EXE (PID: 2984)
INFO
Application launched itself
- iexplore.exe (PID: 2440)
Creates files in the user directory
- iexplore.exe (PID: 3176)
- iexplore.exe (PID: 2440)
Reads Internet Cache Settings
- iexplore.exe (PID: 3176)
Reads internet explorer settings
- iexplore.exe (PID: 3176)
Reads Microsoft Office registry keys
- OUTLOOK.EXE (PID: 2984)
Changes internet zones settings
- iexplore.exe (PID: 2440)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .eml | | | E-Mail message (Var. 5) (100) |
|---|
Total processes
34
Monitored processes
3
Malicious processes
0
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2440 | "C:\Program Files\Internet Explorer\iexplore.exe" https://protect-us.mimecast.com/s/I-TeCzp9R6fRONBKs4Dt67?domain=briza.io | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2984 | "C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\1j4pqc3p.eml" | C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Exit code: 0 Version: 14.0.6025.1000 Modules
| |||||||||||||||
| 3176 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2440 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
1 785
Read events
1 299
Write events
462
Delete events
24
Modification events
| (PID) Process: | (2984) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
| (PID) Process: | (2984) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: On | |||
| (PID) Process: | (2984) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Resiliency\StartupItems |
| Operation: | write | Name: | xt? |
Value: 78743F00A80B0000010000000000000000000000 | |||
| (PID) Process: | (2984) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook |
| Operation: | write | Name: | MTTT |
Value: A80B00005868C47F6A8DD40100000000 | |||
| (PID) Process: | (2984) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\SQM |
| Operation: | write | Name: | SQMSessionNumber |
Value: 0 | |||
| (PID) Process: | (2984) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\SQM |
| Operation: | write | Name: | SQMSessionDate |
Value: 219808800 | |||
| (PID) Process: | (2984) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\0a0d020000000000c000000000000046 |
| Operation: | write | Name: | 00030429 |
Value: 03000000 | |||
| (PID) Process: | (2984) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\9375CFF0413111d3B88A00104B2A6676 |
| Operation: | write | Name: | {ED475418-B0D6-11D2-8C3B-00104B2A6676} |
Value: | |||
| (PID) Process: | (2984) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\9375CFF0413111d3B88A00104B2A6676 |
| Operation: | write | Name: | LastChangeVer |
Value: 1200000000000000 | |||
| (PID) Process: | (2984) OUTLOOK.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109A10090400000000000F01FEC\Usage |
| Operation: | write | Name: | OutlookMAPI2Intl_1033 |
Value: 1300627477 | |||
Executable files
0
Suspicious files
7
Text files
50
Unknown types
8
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2984 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRA878.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 2440 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 2440 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 3176 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\CabDC0B.tmp | — | |
MD5:— | SHA256:— | |||
| 3176 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\TarDC0C.tmp | — | |
MD5:— | SHA256:— | |||
| 3176 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\CabDC1D.tmp | — | |
MD5:— | SHA256:— | |||
| 3176 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\TarDC1E.tmp | — | |
MD5:— | SHA256:— | |||
| 3176 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\CabDC9C.tmp | — | |
MD5:— | SHA256:— | |||
| 3176 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\TarDC9D.tmp | — | |
MD5:— | SHA256:— | |||
| 2984 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
31
TCP/UDP connections
15
DNS requests
9
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2984 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
3176 | iexplore.exe | GET | 301 | 52.218.248.123:80 | http://www.briza.io/ | US | — | — | unknown |
3176 | iexplore.exe | GET | 200 | 52.218.196.227:80 | http://briza.io.s3-website-us-west-2.amazonaws.com/ | US | html | 19.0 Kb | shared |
3176 | iexplore.exe | GET | 200 | 52.218.196.227:80 | http://briza.io.s3-website-us-west-2.amazonaws.com/img/square_ugh.jpg | US | image | 768 Kb | shared |
3176 | iexplore.exe | GET | 200 | 52.218.196.227:80 | http://briza.io.s3-website-us-west-2.amazonaws.com/img/square_frustrated.jpg | US | image | 426 Kb | shared |
3176 | iexplore.exe | GET | 302 | 162.255.119.41:80 | http://briza.io/ | US | html | 43 b | whitelisted |
3176 | iexplore.exe | GET | 200 | 52.218.196.227:80 | http://briza.io.s3-website-us-west-2.amazonaws.com/dist/toolkit-startup.css | US | text | 231 Kb | shared |
3176 | iexplore.exe | GET | 200 | 52.218.196.227:80 | http://briza.io.s3-website-us-west-2.amazonaws.com/img/logo_white.svg | US | image | 6.39 Kb | shared |
3176 | iexplore.exe | GET | 200 | 52.218.196.227:80 | http://briza.io.s3-website-us-west-2.amazonaws.com/img/speed.svg | US | image | 1.07 Kb | shared |
3176 | iexplore.exe | GET | 200 | 52.218.196.227:80 | http://briza.io.s3-website-us-west-2.amazonaws.com/img/diagram_tall.png | US | image | 155 Kb | shared |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2984 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
2440 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3176 | iexplore.exe | 162.255.119.41:80 | briza.io | Namecheap, Inc. | US | suspicious |
3176 | iexplore.exe | 13.107.4.50:80 | www.download.windowsupdate.com | Microsoft Corporation | US | whitelisted |
3176 | iexplore.exe | 52.218.248.123:80 | www.briza.io | Amazon.com, Inc. | US | unknown |
3176 | iexplore.exe | 52.218.196.227:80 | briza.io.s3-website-us-west-2.amazonaws.com | Amazon.com, Inc. | US | shared |
3176 | iexplore.exe | 216.58.215.234:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
2440 | iexplore.exe | 52.218.196.227:80 | briza.io.s3-website-us-west-2.amazonaws.com | Amazon.com, Inc. | US | shared |
3176 | iexplore.exe | 216.58.215.227:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
3176 | iexplore.exe | 207.211.31.106:443 | protect-us.mimecast.com | Navisite, Inc. | US | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
config.messenger.msn.com |
| whitelisted |
protect-us.mimecast.com |
| whitelisted |
www.bing.com |
| whitelisted |
www.download.windowsupdate.com |
| whitelisted |
briza.io |
| whitelisted |
www.briza.io |
| unknown |
briza.io.s3-website-us-west-2.amazonaws.com |
| shared |
fonts.googleapis.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |