analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | Kerrie_Loveluck_is_inviting_you_to_collaborate_on_NSWPO8522_approval_request.eml |
| Full analysis: | https://app.any.run/tasks/3d8fd6a5-dbeb-4cf3-8f22-ad346a858f06 |
| Verdict: | Malicious activity |
| Analysis date: | July 17, 2019, 02:28:08 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | message/rfc822 |
| File info: | RFC 822 mail, ASCII text, with very long lines, with CRLF line terminators |
| MD5: | F4DA90BF6E87E777AAED07BDA01C288D |
| SHA1: | F5AF8792396926DDE172EE56675323BE4C5BE70B |
| SHA256: | 90D162661328F387CED69BB28587592FE673EFAE7DEC4A0C0199E726A997BDFD |
| SSDEEP: | 1536:XBW2y7AMFeap3HQPBYYIHigUUh3oT7/IiY4A:xmHigfiP/4 |
MALICIOUS
No malicious indicators.SUSPICIOUS
Creates files in the user directory
- OUTLOOK.EXE (PID: 3796)
Starts Internet Explorer
- OUTLOOK.EXE (PID: 3796)
Reads Internet Cache Settings
- OUTLOOK.EXE (PID: 3796)
Executed via COM
- OUTLOOK.EXE (PID: 3224)
Modifies files in Chrome extension folder
- chrome.exe (PID: 3260)
INFO
Reads Microsoft Office registry keys
- OUTLOOK.EXE (PID: 3224)
- OUTLOOK.EXE (PID: 3796)
Creates files in the user directory
- iexplore.exe (PID: 2116)
- iexplore.exe (PID: 3308)
Application launched itself
- iexplore.exe (PID: 3308)
- chrome.exe (PID: 3260)
Changes internet zones settings
- iexplore.exe (PID: 3308)
Reads internet explorer settings
- iexplore.exe (PID: 2116)
Reads settings of System Certificates
- iexplore.exe (PID: 3308)
Dropped object may contain Bitcoin addresses
- iexplore.exe (PID: 2116)
Reads Internet Cache Settings
- iexplore.exe (PID: 2116)
Modifies the open verb of a shell class
- chrome.exe (PID: 3260)
Manual execution by user
- chrome.exe (PID: 3260)
Changes settings of System certificates
- iexplore.exe (PID: 3308)
Adds / modifies Windows certificates
- iexplore.exe (PID: 3308)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .eml | | | E-Mail message (Var. 5) (100) |
|---|
Total processes
71
Monitored processes
33
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 3796 | "C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\Kerrie_Loveluck_is_inviting_you_to_collaborate_on_NSWPO8522_approval_request.eml" | C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
| 3224 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Exit code: 0 Version: 14.0.6025.1000 | ||||
| 3308 | "C:\Program Files\Internet Explorer\iexplore.exe" https://studentmountcarmeltasedu-my.sharepoint.com/:b:/g/personal/loveluck_mountcarmel_tas_edu_au/EZ6nInTQoAxNsYcUzdgTvXIBuOuVRCe9W6bA5GKATWHQhw?e=4%3a0cO8xV&at=9 | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 2116 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3308 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 3260 | "C:\Program Files\Google\Chrome\Application\chrome.exe" | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | |
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 75.0.3770.100 | ||||
| 2168 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x60a0a9d0,0x60a0a9e0,0x60a0a9ec | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 75.0.3770.100 | ||||
| 1700 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3312 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 75.0.3770.100 | ||||
| 3824 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1000,7427482293635950747,11697465360734995494,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=15601662027422518759 --mojo-platform-channel-handle=1028 --ignored=" --type=renderer " /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Version: 75.0.3770.100 | ||||
| 3624 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1000,7427482293635950747,11697465360734995494,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=15153027810422218332 --mojo-platform-channel-handle=1636 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe | |
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 75.0.3770.100 | ||||
| 3900 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1000,7427482293635950747,11697465360734995494,131072 --enable-features=PasswordImport --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=11983236420320725015 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2232 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Version: 75.0.3770.100 | ||||
Total events
2 527
Read events
1 874
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
79
Text files
253
Unknown types
11
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3796 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRF712.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 3796 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\575CD4B1.dat | image | |
MD5:185ED87AA82CF1D546304BD1089336F4 | SHA256:397958D125E218E32F6C4F218EECDBCCAF1F547EB938F2A9833B65DAD94F6461 | |||
| 3224 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR2A48.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 3796 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\76896AE7.dat | image | |
MD5:C71C37D68448B58953FA6DE6CBBDDFE7 | SHA256:4C72656C7D0CD2AAFE46F927D2BC862E244D7A3C1309F8318B79D87CC58E6CB7 | |||
| 3796 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:0D7FE706712452131E290FA772AB1B92 | SHA256:232A2D11193C7C6EA00F192029A2ECB2D61AE993E6886F1251D1226AEDC98D1B | |||
| 3796 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8E611894.dat | image | |
MD5:185ED87AA82CF1D546304BD1089336F4 | SHA256:397958D125E218E32F6C4F218EECDBCCAF1F547EB938F2A9833B65DAD94F6461 | |||
| 3796 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CEEB946B.dat | image | |
MD5:1E13EE0ED09C4AF1ADFB6C0D280879B0 | SHA256:E2395FBA25D3FB8A971345CA65D144F7D9C9D933F70409165446E63D18C0958D | |||
| 3796 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DD8C2B70.dat | image | |
MD5:6811830E193D140545686069D050EF87 | SHA256:75EE8A0BC3C8019D91DDD0FCFF20E31432ABBBF73860DBBF0F72D2E2AE22F9D6 | |||
| 3796 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8F67CFC2.dat | image | |
MD5:C71C37D68448B58953FA6DE6CBBDDFE7 | SHA256:4C72656C7D0CD2AAFE46F927D2BC862E244D7A3C1309F8318B79D87CC58E6CB7 | |||
| 3796 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_AvailabilityOptions_2_F7835F48BEEBA8439BF935FE1918AE98.dat | xml | |
MD5:EEAA832C12F20DE6AAAA9C7B77626E72 | SHA256:C4C9A90F2C961D9EE79CF08FBEE647ED7DE0202288E876C7BAAD00F4CA29CA16 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
55
DNS requests
30
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3796 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
3624 | chrome.exe | GET | 301 | 104.24.108.1:80 | http://baardegem.top/3_3_3_3_3_3_3/+_3@+_3@+_3@+_3@+_3@+_3@+_3@/ | US | — | — | suspicious |
3796 | OUTLOOK.EXE | GET | 302 | 103.67.177.33:80 | http://downloads.mountcarmel.tas.edu.au/files/MCC_email_logo.jpg | AU | html | 249 b | unknown |
3796 | OUTLOOK.EXE | GET | 302 | 103.67.177.33:80 | http://downloads.mountcarmel.tas.edu.au/files/MCCEmailFooter.jpg | AU | html | 249 b | unknown |
3624 | chrome.exe | GET | 302 | 172.217.16.174:80 | http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx | US | html | 514 b | whitelisted |
3624 | chrome.exe | GET | 200 | 172.217.132.73:80 | http://r4---sn-5hne6nsr.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mip=82.102.22.109&mm=28&mn=sn-5hne6nsr&ms=nvh&mt=1563330439&mv=m&mvi=3&pl=24&shardbypass=yes | US | crx | 862 Kb | whitelisted |
3308 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3796 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
3796 | OUTLOOK.EXE | 103.67.177.33:443 | downloads.mountcarmel.tas.edu.au | Jeanneret Electrical Technologies P/L | AU | unknown |
3308 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2116 | iexplore.exe | 2.19.34.64:443 | static.sharepointonline.com | Akamai International B.V. | — | whitelisted |
3796 | OUTLOOK.EXE | 103.67.177.33:80 | downloads.mountcarmel.tas.edu.au | Jeanneret Electrical Technologies P/L | AU | unknown |
2116 | iexplore.exe | 13.107.136.9:443 | studentmountcarmeltasedu-my.sharepoint.com | Microsoft Corporation | US | whitelisted |
3796 | OUTLOOK.EXE | 13.107.136.13:443 | australiasoutheastr-notifyp.svc.ms | Microsoft Corporation | US | suspicious |
3624 | chrome.exe | 216.58.208.35:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
3624 | chrome.exe | 172.217.18.109:443 | accounts.google.com | Google Inc. | US | suspicious |
3624 | chrome.exe | 172.217.22.99:443 | www.gstatic.com | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
config.messenger.msn.com |
| whitelisted |
australiasoutheastr-notifyp.svc.ms |
| suspicious |
downloads.mountcarmel.tas.edu.au |
| unknown |
studentmountcarmeltasedu-my.sharepoint.com |
| suspicious |
www.bing.com |
| whitelisted |
static.sharepointonline.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
www.google.com.ua |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
3624 | chrome.exe | Potentially Bad Traffic | ET INFO HTTP Request to a *.top domain |