File name: | email (4).eml |
Full analysis: | https://app.any.run/tasks/277baef7-803b-4313-898c-abc33d1cb4f6 |
Verdict: | Malicious activity |
Analysis date: | December 05, 2022, 18:22:50 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | message/rfc822 |
File info: | RFC 822 mail, ASCII text, with CRLF line terminators |
MD5: | 70AB4CB616C1F2392030B5F22992F487 |
SHA1: | 7E9D99AA339240D8907B5DF6865805DBDA1739F5 |
SHA256: | 64BE230349F892F3D3D02CDF7284B7B27C4F9D6221F897B41112E68EBEF8D479 |
SSDEEP: | 768:SNbR6Y38EXpEHh+GzbvAdDguSuMxQwG/v2w0JdK3:SNbR6GvpEHh+GX3HtQwrs |
.eml | | | E-Mail message (Var. 5) (100) |
---|
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1328 | "C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\email (4).eml" | C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 Modules
| |||||||||||||||
2536 | "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\31YCE9NM\Truist Payment Advice.htm | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
2456 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2536 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
1328 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRF87E.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1328 | OUTLOOK.EXE | C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst | — | |
MD5:— | SHA256:— | |||
1328 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.log | text | |
MD5:C0A61D11344F4D025422EDB9AA8858D6 | SHA256:CEF889A537C8CE40C6156C375DB0262181C8043FE4024638BB68026E29655F4B | |||
1328 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\31YCE9NM\Truist Payment Advice (2).htm | html | |
MD5:03C55369F66AF127AAC5E7FF71E8598D | SHA256:97210E45560A552845601832D6E30E5B503CABA65B8E38F222CAE704CD370778 | |||
1328 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:D760F7DFE07DF66D60820764AD2BFD8C | SHA256:A721E8B762C09E394F285899E5677FE2100D809E13E77B0C83A3723F4D875CC5 | |||
1328 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\31YCE9NM\Truist Payment Advice.htm | html | |
MD5:03C55369F66AF127AAC5E7FF71E8598D | SHA256:97210E45560A552845601832D6E30E5B503CABA65B8E38F222CAE704CD370778 | |||
2456 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 | der | |
MD5:D5D82C08E6FD869FBAAAAF1765526E41 | SHA256:FEB7A9E2A2E668C38CA21A509C6F235AFB74F9576B24F69942F6EFD3261DB142 | |||
2536 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:CFEA7F284F982729593DB2C3CF6D70F7 | SHA256:9E2E9C1FEABFDE45062763F45CCF96C4E3CBD1D5CAEDA743AD84C106A73B7CA6 | |||
2456 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_33E6263BAF1D93C3B754E2140B85CB43 | der | |
MD5:59DA8DAF13EA0303198679DAEAF4985D | SHA256:8A37BFBE7584D0A5D3F27CFC8E3E026F92C1C7D42096236193335B60CA8FE7FB | |||
2456 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 | binary | |
MD5:87BC6149D02E452A9DF681FDD2351965 | SHA256:5529AA77C612591C9BBBF2A62F66A4B9CF83EE76B8E61A3C8560B9994E9D5ADF |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2456 | iexplore.exe | GET | 200 | 104.18.32.68:80 | http://crl.comodoca.com/AAACertificateServices.crl | US | der | 506 b | whitelisted |
2456 | iexplore.exe | GET | — | 104.18.32.68:80 | http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D | US | — | — | whitelisted |
2456 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D | US | der | 1.47 Kb | whitelisted |
2456 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEA9w47FDRKm6Ehu8Jb0wAzw%3D | US | der | 279 b | whitelisted |
2536 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://crl3.digicert.com/Omniroot2025.crl | US | der | 7.78 Kb | whitelisted |
2456 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEAeUlGwhjB3IjoQEM6EMQaE%3D | US | der | 280 b | whitelisted |
2536 | iexplore.exe | GET | 200 | 8.248.119.254:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?412cb654f4b75597 | US | compressed | 4.70 Kb | whitelisted |
2456 | iexplore.exe | GET | 200 | 172.64.155.188:80 | http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D | US | der | 1.42 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1328 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
2456 | iexplore.exe | 104.16.87.20:443 | cdn.jsdelivr.net | CLOUDFLARENET | — | shared |
2536 | iexplore.exe | 204.79.197.200:443 | www.bing.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
2456 | iexplore.exe | 69.16.175.42:443 | code.jquery.com | STACKPATH-CDN | US | malicious |
2456 | iexplore.exe | 104.21.235.181:443 | www.linkpicture.com | CLOUDFLARENET | — | suspicious |
— | — | 8.248.119.254:80 | ctldl.windowsupdate.com | LEVEL3 | US | suspicious |
2536 | iexplore.exe | 8.248.119.254:80 | ctldl.windowsupdate.com | LEVEL3 | US | suspicious |
— | — | 104.21.235.182:443 | www.linkpicture.com | CLOUDFLARENET | — | suspicious |
2536 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | EDGECAST | GB | whitelisted |
2456 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | EDGECAST | GB | whitelisted |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
cdn.jsdelivr.net |
| whitelisted |
code.jquery.com |
| whitelisted |
www.linkpicture.com |
| suspicious |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
ocsp.comodoca.com |
| whitelisted |
crl3.digicert.com |
| whitelisted |