analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

62b94316d26bae001b05e813.eml

Full analysis: https://app.any.run/tasks/89b79372-9234-4a37-84ac-4de310911e09
Verdict: Malicious activity
Analysis date: June 27, 2022, 08:59:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: message/rfc822
File info: SMTP mail, UTF-8 Unicode text, with CRLF line terminators
MD5:

6C4312B1F08745AC6FE4870F3AAC6482

SHA1:

0B24A6CB27CF54A98F83E322097DB6463B840261

SHA256:

46ECF695E26D24F910FE07DA6BCD9C1965D9E80A179B5E33F88E4ABFA45ABACA

SSDEEP:

96:o472fuRfDdcR8N6Dieu6PpSRBKSRBcg/Ee5RvuvZdDNgwAwFwAw0yTwAw0IAFwAt:XRJqe6zu6KrmvHDZs6q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Reads the computer name

      • OUTLOOK.EXE (PID: 3056)
    • Checks supported languages

      • OUTLOOK.EXE (PID: 3056)
    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 3056)
    • Searches for installed software

      • OUTLOOK.EXE (PID: 3056)
  • INFO

    • Checks supported languages

      • NOTEPAD.EXE (PID: 1056)
    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 3056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 7) (100)
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3056"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\62b94316d26bae001b05e813.eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
1056"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\7TGDVHTE\Malware Alert Text.txtC:\Windows\system32\NOTEPAD.EXEOUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
4 964
Read events
4 371
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
14
Unknown types
1

Dropped files

PID
Process
Filename
Type
3056OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR4922.tmp.cvr
MD5:
SHA256:
3056OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst
MD5:
SHA256:
3056OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:3B16063AE11B58E6517D875E9B89BCE0
SHA256:E4B99FACF69AE3DE858A41533888945F6333AA5742001FBFB754A99EC345E7F3
3056OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:5AAB73C6C5A2B1DCC6A0E0B9BC262B79
SHA256:25A904C8AF5036A9EFDE354C20DB1DC4B5EC11AA663568AD9BDFA9E7D4F2132D
3056OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\7TGDVHTE\Malware Alert Text.txttext
MD5:4008CE2650560DD54B0CF294CA294DC4
SHA256:8D02457F84107DC5F7126EBEA7557D500EB96A5609EEFC4867ECFB3878B5D654
3056OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\7TGDVHTE\Malware Alert Text (2).txttext
MD5:4008CE2650560DD54B0CF294CA294DC4
SHA256:8D02457F84107DC5F7126EBEA7557D500EB96A5609EEFC4867ECFB3878B5D654
3056OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inftext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
3056OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{803979E9-E737-4998-9B83-7DF6EFCEA210}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.pngimage
MD5:4C61C12EDBC453D7AE184976E95258E1
SHA256:296526F9A716C1AA91BA5D6F69F0EB92FDF79C2CB2CFCF0CEB22B7CCBC27035F
3056OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_RssRule_2_F3E505BE580A5D46803A79015575AD06.datxml
MD5:D8B37ED0410FB241C283F72B76987F18
SHA256:31E68049F6B7F21511E70CD7F2D95B9CF1354CF54603E8F47C1FC40F40B7A114
3056OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_C0370B5AEC69174D814FFD0A18D73966.datxml
MD5:B21ED3BD946332FF6EBC41A87776C6BB
SHA256:B1AAC4E817CD10670B785EF8E5523C4A883F44138E50486987DC73054A46F6F4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3056
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info