analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

New information available.eml

Full analysis: https://app.any.run/tasks/3af972fa-dc7e-44ea-b8f6-45a276dd8e81
Verdict: Malicious activity
Analysis date: January 24, 2022, 17:27:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: message/rfc822
File info: RFC 822 mail, ASCII text, with very long lines, with CRLF line terminators
MD5:

74C319719C2861E492AE2444B9722B36

SHA1:

E95327FA35317A83A6AD8BCE75DB3A4CB64ADAC9

SHA256:

7379E5331B75BD9EE4975C226C46ECED9EA0CEC5B3788209634D7BC34E3E5D78

SSDEEP:

384:iuL/ZZaLNiri3CMHYLlS3H1EtMShVRYSBoDN1K8mYS+laNnO+NZ3/:dZgSMCM4LZjV0a8maaNn3v3/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Checks supported languages

      • OUTLOOK.EXE (PID: 2760)

    • Reads the computer name

      • OUTLOOK.EXE (PID: 2760)

    • Searches for installed software

      • OUTLOOK.EXE (PID: 2760)

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 2760)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2760)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 976)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 2408)
      • iexplore.exe (PID: 976)

    • Checks supported languages

      • iexplore.exe (PID: 2408)
      • iexplore.exe (PID: 976)

    • Application launched itself

      • iexplore.exe (PID: 2408)

    • Changes internet zones settings

      • iexplore.exe (PID: 2408)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 976)
      • iexplore.exe (PID: 2408)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 976)
      • iexplore.exe (PID: 2408)

    • Reads internet explorer settings

      • iexplore.exe (PID: 976)

    • Creates files in the user directory

      • iexplore.exe (PID: 976)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2760)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 5) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2760"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\New information available.eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2408"C:\Program Files\Internet Explorer\iexplore.exe" http://trk.webmdhealth.com/c/7/eyJhaSI6NjAyNzc2NjIsImUiOiJjYXJsb3MuZmVybmFuZGVzQGZhYS5nb3YiLCJyaSI6IjM3Y2I0NzEzLWNhN2MtZWMxMS04MTRjLTAwNTA1Njg2NWRiMCIsInJxIjoiMDItdDIyMDIzLWFhMTZiOWNmYzBiNzRmOTI5MGI0Nzc3MWU5NmViMDQyIiwicGgiOm51bGwsIm0iOmZhbHNlLCJ1aSI6IjAiLCJ1biI6IiIsInUiOiJodHRwczovL2ZlcGJsdWUud2VibWRoZWFsdGguY29tL2UuYXNweD9yZWRpcmVjdD00MGUyNEE2R1ZWTFozSUVlOEFyQmxvSnRTWkRZdmU3bHFGcEdxYTNSb3dDc1ltNEhpYzRwNHk2NHFzcTY3c3RJeDNMbTduVEsxVWJXdzRwNHA0eTB3VVRhYTFzMllKNVJxcFI0cXBLTmIyV09idTlMSVk0cU56YWp3UkpKb1dZbFQyU3pTTURTbkhUaWlPZ2k2ZEpkSE4mcXM9c3RhcnRpZCUzZDU4Jm1yZGlkPTM3Y2I0NzEzY2E3Y2VjMTE4MTRjMDA1MDU2ODY1ZGIwIn0/_HbDQYuFbU2EnSAX3l2qtwC:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
976"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2408 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
19 319
Read events
18 619
Write events
680
Delete events
20

Modification events

(PID) Process:(2760) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2760) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(2760) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(2760) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(2760) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(2760) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(2760) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(2760) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(2760) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
Off
(PID) Process:(2760) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1055
Value:
Off
Executable files
0
Suspicious files
18
Text files
99
Unknown types
20

Dropped files

PID
Process
Filename
Type
2760OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR2E60.tmp.cvr —
MD5:—
SHA256:—
2760OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst —
MD5:—
SHA256:—
2760OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:7069084A7184B209ABA827F6CE349125
SHA256:54D2CCCF474107CC3D25C28A58AE60F82C293A2E10529A665A07511CD56F6FDE
976iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_A30EA9B4E1BC5DBF09A8EF399E086D27binary
MD5:E6817AF81ECA3302B451532A21D7C289
SHA256:A51F8C16CBA49478152ADB0899159BED6A3E7F561C315FFEEE629A36C596D297
976iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5B3BCDA4F252B606121609C103A3A1EE_A9945D292101728FB2CED41BB152BEA0binary
MD5:4DD36BCA168B2BCE15BC3F5079BF89D3
SHA256:4EC2D032B9E25B76E50B33F119CF763E97F81C2B43648342CE7FE954E674FE9F
2760OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:FC4EDD28E3EE4368F4BBB82E8CAD7B14
SHA256:BCE8A36F8D7AA3DC4FAB0A09EB60FF3D922C3A02003510CFAF66FCE56F69F17B
976iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\Z7R2KU8G.txttext
MD5:41F0BA544E165763C71D2E7B8B0DC0DB
SHA256:B7FF7B55FE0D8BC20A8D831C096F01E87947B8396F7373A130A860168E7DB378
2760OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{BD24FC26-46F0-449A-B00B-1500ACC56432}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.pngimage
MD5:4C61C12EDBC453D7AE184976E95258E1
SHA256:296526F9A716C1AA91BA5D6F69F0EB92FDF79C2CB2CFCF0CEB22B7CCBC27035F
976iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6der
MD5:D94C08EB9C2992C5D8CFE12C5E185A6B
SHA256:56B861E5117B8E08800AFD24DB0133D298E11E478ADB1D17DFE7654DBA08D5A5
976iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_A30EA9B4E1BC5DBF09A8EF399E086D27der
MD5:CD160FB2083E2B8319C2BC34F34919BC
SHA256:6D954523FA5A003ADE3E8BAFC8ECA4B3455979882B64C2C83A23DF5B1514004F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
53
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
976
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
976
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAmjwcg9dHYstle5YC4ws0k%3D
US
der
471 b
whitelisted
976
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAo1CNVcKSsBffitZcAP9%2BQ%3D
US
der
471 b
whitelisted
976
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
976
iexplore.exe
GET
302
54.156.17.231:80
http://trk.webmdhealth.com/c/7/eyJhaSI6NjAyNzc2NjIsImUiOiJjYXJsb3MuZmVybmFuZGVzQGZhYS5nb3YiLCJyaSI6IjM3Y2I0NzEzLWNhN2MtZWMxMS04MTRjLTAwNTA1Njg2NWRiMCIsInJxIjoiMDItdDIyMDIzLWFhMTZiOWNmYzBiNzRmOTI5MGI0Nzc3MWU5NmViMDQyIiwicGgiOm51bGwsIm0iOmZhbHNlLCJ1aSI6IjAiLCJ1biI6IiIsInUiOiJodHRwczovL2ZlcGJsdWUud2VibWRoZWFsdGguY29tL2UuYXNweD9yZWRpcmVjdD00MGUyNEE2R1ZWTFozSUVlOEFyQmxvSnRTWkRZdmU3bHFGcEdxYTNSb3dDc1ltNEhpYzRwNHk2NHFzcTY3c3RJeDNMbTduVEsxVWJXdzRwNHA0eTB3VVRhYTFzMllKNVJxcFI0cXBLTmIyV09idTlMSVk0cU56YWp3UkpKb1dZbFQyU3pTTURTbkhUaWlPZ2k2ZEpkSE4mcXM9c3RhcnRpZCUzZDU4Jm1yZGlkPTM3Y2I0NzEzY2E3Y2VjMTE4MTRjMDA1MDU2ODY1ZGIwIn0/_HbDQYuFbU2EnSAX3l2qtw
US
—
—
unknown
976
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
976
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
976
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCrvyQ4GllugQoAAAABK4Az
US
der
472 b
whitelisted
976
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEArQnML7pp4Z1853VF3EYBA%3D
US
der
471 b
whitelisted
2408
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
13.107.22.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
976
iexplore.exe
64.113.30.139:443
fepblue.webmdhealth.com
Visionary Communications, Inc.
US
unknown
976
iexplore.exe
54.156.17.231:80
trk.webmdhealth.com
Amazon.com, Inc.
US
unknown
976
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
976
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2760
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
2408
iexplore.exe
64.113.30.139:443
fepblue.webmdhealth.com
Visionary Communications, Inc.
US
unknown
2408
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
976
iexplore.exe
23.36.162.85:443
sso.fepblue.org
CW Vodafone Group PLC
NL
suspicious
976
iexplore.exe
2.16.186.160:443
www.fepblue.org
Akamai International B.V.
—
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
trk.webmdhealth.com
  • 54.156.17.231
  • 3.222.60.233
  • 54.210.83.202
unknown
fepblue.webmdhealth.com
  • 64.113.30.139
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 13.107.22.200
  • 131.253.33.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
sso.fepblue.org
  • 23.36.162.85
  • 23.36.162.89
suspicious
www.fepblue.org
  • 2.16.186.160
  • 2.16.186.129
suspicious
ssl.o.webmd.com
  • 15.188.95.229
  • 13.36.218.177
  • 15.236.176.210
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
New information available.eml