File name: | x1 |
Full analysis: | https://app.any.run/tasks/1967fcf3-0098-45b8-b97b-c34b566f3268 |
Verdict: | Malicious activity |
Analysis date: | April 15, 2019, 04:45:13 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | message/rfc822 |
File info: | RFC 822 mail, ASCII text |
MD5: | 95157C4AB79C8CD7E41855E53B443964 |
SHA1: | 64E6A4405ED5B52C6D35BADF8992702C071A321C |
SHA256: | 58FFA13DA69757570A2BC81A3F17A1424E04A651E52D0C6AC70EBC9CE3EE1F2C |
SSDEEP: | 12288:r6IcRA033iF7ydum+/UlG47AaXPk5GnOXnBAK5ql+6+0bHeQQMv:mpXiF7u1+/UXNXP54BAcI+6jHeQDv |
.eml | | | E-Mail message (Var. 5) (100) |
---|
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1512 | "C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\Desktop\x1.eml" | C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 Modules
| |||||||||||||||
3252 | "C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\invoices .iso" C:\Users\admin\Desktop\ | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
2000 | "C:\Users\admin\Desktop\invoices .exe" | C:\Users\admin\Desktop\invoices .exe | explorer.exe | ||||||||||||
User: admin Company: howell Integrity Level: HIGH Exit code: 0 Version: 1.01.0009 Modules
| |||||||||||||||
3828 | "C:\Users\admin\Desktop\invoices .exe" | C:\Users\admin\Desktop\invoices .exe | explorer.exe | ||||||||||||
User: admin Company: howell Integrity Level: HIGH Version: 1.01.0009 Modules
| |||||||||||||||
2344 | "C:\Users\admin\Desktop\invoices .exe" | C:\Users\admin\Desktop\invoices .exe | explorer.exe | ||||||||||||
User: admin Company: howell Integrity Level: HIGH Version: 1.01.0009 Modules
| |||||||||||||||
3436 | C:\Users\admin\Desktop\invoices .exe" | C:\Users\admin\Desktop\invoices .exe | — | invoices .exe | |||||||||||
User: admin Company: howell Integrity Level: HIGH Version: 1.01.0009 Modules
|
(PID) Process: | (1512) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: Off | |||
(PID) Process: | (1512) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: On | |||
(PID) Process: | (1512) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Resiliency\StartupItems |
Operation: | write | Name: | ;.4 |
Value: 3B2E3400E8050000010000000000000000000000 | |||
(PID) Process: | (1512) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook |
Operation: | write | Name: | MTTT |
Value: E8050000FA5D3A0D46F3D40100000000 | |||
(PID) Process: | (1512) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\SQM |
Operation: | write | Name: | SQMSessionNumber |
Value: 0 | |||
(PID) Process: | (1512) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\SQM |
Operation: | write | Name: | SQMSessionDate |
Value: 219996000 | |||
(PID) Process: | (1512) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\0a0d020000000000c000000000000046 |
Operation: | write | Name: | 00030429 |
Value: 03000000 | |||
(PID) Process: | (1512) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\9375CFF0413111d3B88A00104B2A6676 |
Operation: | write | Name: | {ED475418-B0D6-11D2-8C3B-00104B2A6676} |
Value: | |||
(PID) Process: | (1512) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\9375CFF0413111d3B88A00104B2A6676 |
Operation: | write | Name: | LastChangeVer |
Value: 1200000000000000 | |||
(PID) Process: | (1512) OUTLOOK.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109A10090400000000000F01FEC\Usage |
Operation: | write | Name: | OutlookMAPI2Intl_1033 |
Value: 1317994517 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1512 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR667C.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1512 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\tmp692D.tmp | — | |
MD5:— | SHA256:— | |||
1512 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:BE53DA32C3095A24AD97C48BDA55653B | SHA256:C249568B0BAFE372E0BD5651BA931F525C0DEB098596598C164885FC66FD5D5C | |||
1512 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\GDO71KO5\invoices .iso | compressed | |
MD5:1FCE1EEFC17618C5F07E9A8D880950B7 | SHA256:DA228D8D00296DB20AF8D9D3A6D632D6AED5863E23F1268B1202713254796DC4 | |||
3252 | WinRAR.exe | C:\Users\admin\Desktop\invoices .exe | executable | |
MD5:243E3AAE71FE0A827D38BC41F065E726 | SHA256:F55CAAE54B82C3106176977110D11C6C945FF264EF4E4AFDC3358EFE45718D5E | |||
1512 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inf | text | |
MD5:48DD6CAE43CE26B992C35799FCD76898 | SHA256:7BFE1F3691E2B4FB4D61FBF5E9F7782FBE49DA1342DBD32201C2CC8E540DBD1A | |||
1512 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_WorkHours_1_E14EFE3745EEF94080E68A8BC842C9F0.dat | xml | |
MD5:807EF0FC900FEB3DA82927990083D6E7 | SHA256:4411E7DC978011222764943081500FFF0E43CBF7CCD44264BD1AB6306CA68913 | |||
1512 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_AvailabilityOptions_2_B04022DD1D58874E9D37470356627C74.dat | xml | |
MD5:EEAA832C12F20DE6AAAA9C7B77626E72 | SHA256:C4C9A90F2C961D9EE79CF08FBEE647ED7DE0202288E876C7BAAD00F4CA29CA16 | |||
1512 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\GDO71KO5\invoices .iso:Zone.Identifier | text | |
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B | SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913 | |||
1512 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_98D8C656F772F94F8CCA15DB04A7EE25.dat | xml | |
MD5:B21ED3BD946332FF6EBC41A87776C6BB | SHA256:B1AAC4E817CD10670B785EF8E5523C4A883F44138E50486987DC73054A46F6F4 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1512 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
dns.msftncsi.com |
| shared |