analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

email (35).eml

Full analysis: https://app.any.run/tasks/2a70e4af-0cf1-4d53-b23e-75a6cd787118
Verdict: Malicious activity
Analysis date: March 31, 2023, 20:45:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
MIME: message/rfc822
File info: RFC 822 mail, ASCII text, with CRLF line terminators
MD5:

53F94A013AE3E728CB716DBDAD91B969

SHA1:

31F98537D9FEEC880D3DA1260DBDA0A8331FC4DC

SHA256:

35F3C5F2FF52D0B30768BFF371A25655C98D87E6244C12159622986FF02949DC

SSDEEP:

768:SBPyU5ZWRtcHgZkTAmKNLrqOYFmKBbrcKReWD3V4kAq5ii4yKYXQq:SBPyU5QTwgOTkLqFmKtrNe0Gqg+gq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Searches for installed software

      • OUTLOOK.EXE (PID: 2672)

    • Reads the Internet Settings

      • OUTLOOK.EXE (PID: 2672)

  • INFO

    • Checks supported languages

      • OUTLOOK.EXE (PID: 2672)

    • The process checks LSA protection

      • OUTLOOK.EXE (PID: 2672)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2672)

    • Reads the computer name

      • OUTLOOK.EXE (PID: 2672)

    • Create files in a temporary directory

      • OUTLOOK.EXE (PID: 2672)

    • Reads the machine GUID from the registry

      • OUTLOOK.EXE (PID: 2672)

    • Checks proxy server information

      • OUTLOOK.EXE (PID: 2672)

    • Process checks computer location settings

      • OUTLOOK.EXE (PID: 2672)

    • Creates files or folders in the user directory

      • OUTLOOK.EXE (PID: 2672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 5) (100)
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe

Process information

PID
CMD
Path
Indicators
Parent process
2672"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\email (35).eml"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
Modules
Images
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
Total events
7 802
Read events
7 008
Write events
756
Delete events
38

Modification events

(PID) Process:(2672) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(2672) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(2672) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(2672) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
(PID) Process:(2672) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
On
(PID) Process:(2672) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
On
(PID) Process:(2672) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
On
(PID) Process:(2672) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
On
(PID) Process:(2672) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
On
(PID) Process:(2672) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1055
Value:
On
Executable files
0
Suspicious files
0
Text files
24
Unknown types
2

Dropped files

PID
Process
Filename
Type
2672OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRF6E4.tmp.cvr —
MD5:—
SHA256:—
2672OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst —
MD5:—
SHA256:—
2672OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B71C31B4.datimage
MD5:4AB0BB466A11BA1A90563EB5A6F0E518
SHA256:C1119260FAAF53D81AE9A7CB6C2B257935951660EDF5BA0160BEF6D0BECF7EFF
2672OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\62D03E25.datimage
MD5:26CBB8CFF56945AF49961F2A3B824DE4
SHA256:837A9D46417E086402E4120A85AE2C520BF3DDE2C02F7033B9C6B8A6194F83EB
2672OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:94104C0DA647D01CF7CEF4183FA490A8
SHA256:77D4E735519B61AEE5EA603BED1C535904D15E46B3D802B10C33645E01B76B67
2672OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:B3423FFA81202B95042BB81A1B22E642
SHA256:3E29128A216BC12B4EDC5847475FBCA47F980B4F8E6FFE841D8D661911EC744B
2672OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inftext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
2672OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_BDAE33005EC45D4FB5258D02D19877DB.datxml
MD5:B21ED3BD946332FF6EBC41A87776C6BB
SHA256:B1AAC4E817CD10670B785EF8E5523C4A883F44138E50486987DC73054A46F6F4
2672OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_RssRule_2_82166543FC8FA8498873CC6AE5B511EB.datxml
MD5:D8B37ED0410FB241C283F72B76987F18
SHA256:31E68049F6B7F21511E70CD7F2D95B9CF1354CF54603E8F47C1FC40F40B7A114
2672OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{B88291CA-5EBB-4333-AC80-6116C715C27B}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.pngimage
MD5:4C61C12EDBC453D7AE184976E95258E1
SHA256:296526F9A716C1AA91BA5D6F69F0EB92FDF79C2CB2CFCF0CEB22B7CCBC27035F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2672
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
64.4.26.155:80
config.messenger.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
email (35).eml