File name: | phish_alert_sp2_2.0.0.0.eml |
Full analysis: | https://app.any.run/tasks/ab72745a-36bc-4e08-a875-22fed0cbdd82 |
Verdict: | Malicious activity |
Analysis date: | March 31, 2023, 22:13:41 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | message/rfc822 |
File info: | RFC 822 mail, ASCII text, with very long lines, with CRLF line terminators |
MD5: | 10E7468E15DBA6C26BB964C899A9E6F1 |
SHA1: | 00F4ED1530ACA34806F967B9760BC793CED4C49C |
SHA256: | 94CD18A28FBC7E02D63AFAD65CA0F8AD41B18BB4D489794773729B52B574DBC4 |
SSDEEP: | 384:1clMCer3yWKTlKphfyWP0cuoTC/T9Rw1Wf8/DH57:QMLrCW5DfyWMRoTQkWfgHd |
.eml | | | E-Mail message (Var. 5) (100) |
---|
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2368 | "C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\phish_alert_sp2_2.0.0.0.eml" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 Modules
| |||||||||||||||
2460 | "C:\Program Files\Internet Explorer\iexplore.exe" https://urldefense.proofpoint.com/v2/url?u=https-3A__links.getpostman.com_ls_click-3Fupn-3D3y7nOEZSJOF1v-2D2Fv7UyshsKYUegQ-2D2FC6hQcfExkvtFxOCQSmun8mCf7tKlvebS-2D2FAbE-2D2F8Qk0J5DROuWHOuvU5MXcm9g-2D2Fc7NXWboDyqL3CsqCsLM1rzLeSyvz7c-2D2FIWvrzB5GyjF3-5FP2CVbZ7VEZW3OJwvfm-2D2FmVgcnRROM69QAuJZ9vDHvX7genKlOTKFjgF-2D2BA56cy-2D2B08vJXg4wFuTmXNc9zAUeTgRDWRH8tm-2D2BYiGAleggKVmc0j2XdlUemLNhv6Spu8GFG5XcyrUqo0Xcnh8cnjbUmKe-2D2FRTvMv4P56kG9GiD25NiUyucUef3466uZDssjw-2D2Fd6vG8mNNk3BQ-2D2FP77sokHW4Hl0dUelLMqj60BCBahYFqwy-2D2BmaAT8VjTk0dIXU-2D2FRo8BYeybjelFv06yfHqZZo5NQ7cDwjKm8bybpEzfBcL7SsCuw4UEZCzwKnUnElp504CEBJjjrGBqcr0NP11NwO5MbZ0UGpz0TShx1YhsXB8tixZk7MSs-2D3D&d=DwMFAw&c=tuuk6YS91SuQukMhvUXrnA&r=BF4JyU0Y1oQZJQTsc_wInLSEwNpwPZdQqCv27lGbiDE&m=eu6dgvh87SMyqGg6bwMXXjR78gyNdkvHtzKHaYNp4oN6cqktXPFiZ5OkZcYHvkZS&s=LDQkHk0lyVJKiyg7jc5PXpqvSTDL4UKSb07Z36zxKfM&e= | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3224 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2460 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
664 | "C:\Program Files\Internet Explorer\iexplore.exe" https://urldefense.proofpoint.com/v2/url?u=https-3A__links.getpostman.com_ls_click-3Fupn-3D3y7nOEZSJOF1v-2D2Fv7UyshsA0slPDVAWp38fB5IEChtheu3bOEbgreuzlgz5zViNwH1dRA-5FP2CVbZ7VEZW3OJwvfm-2D2FmVgcnRROM69QAuJZ9vDHvX7genKlOTKFjgF-2D2BA56cy-2D2B08vJXg4wFuTmXNc9zAUeTgRDWRH8tm-2D2BYiGAleggKVmc0j2XdlUemLNhv6Spu8GFG5XcyrUqo0Xcnh8cnjbUmKe-2D2FRWYVzMXgRhTFoKN-2D2B4Pca-2D2Bp1SwOYdxVj1SnptnziGxExvaNrML-2D2F0TvtfFH0K-2D2F3AgrgMaacY-2D2B1ANimb2hAbZEpaZp4CE0QY-2D2Bam-2D2FeU9OIMJRX3wo8XuswnysftCY9FY99AG5I2T2CvbOrLvnw0eUNg7YazR2TJmwocIpXZvem2hV5PuOE-2D2BM4RZJm-2D2BYDI4oBzV9c7jfY8sdnK9yEKxDP7ezU6dY-2D3D&d=DwMFAw&c=tuuk6YS91SuQukMhvUXrnA&r=BF4JyU0Y1oQZJQTsc_wInLSEwNpwPZdQqCv27lGbiDE&m=eu6dgvh87SMyqGg6bwMXXjR78gyNdkvHtzKHaYNp4oN6cqktXPFiZ5OkZcYHvkZS&s=LxudsAMMOXXbB9HAdKsu3alG7SNe1gGFAfm9Ng6VyYI&e= | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
2900 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:664 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3712 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:664 CREDAT:660768 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
(PID) Process: | (2368) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: On | |||
(PID) Process: | (2368) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1041 |
Value: On | |||
(PID) Process: | (2368) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1046 |
Value: On | |||
(PID) Process: | (2368) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1036 |
Value: On | |||
(PID) Process: | (2368) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1031 |
Value: On | |||
(PID) Process: | (2368) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1040 |
Value: On | |||
(PID) Process: | (2368) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1049 |
Value: On | |||
(PID) Process: | (2368) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 3082 |
Value: On | |||
(PID) Process: | (2368) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1042 |
Value: On | |||
(PID) Process: | (2368) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1055 |
Value: On |
PID | Process | Filename | Type | |
---|---|---|---|---|
2368 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRFD4C.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2368 | OUTLOOK.EXE | C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst | — | |
MD5:— | SHA256:— | |||
2368 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:A1AF165243647DDA8B3D4B9A8B8C973C | SHA256:4B76695E3317D92FE474DB16B00B1D4DD2F1266CCF7879E4428A53EAC85FE29C | |||
2368 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.log | text | |
MD5:6DDFF2FB27AE4526BF4889E867090668 | SHA256:EFE598D13DE0004897ED3FCE8D6310CD74DCA868116390F97D0636354BB5C09C | |||
2368 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ConversationPrefs_2_DF8FF95431521B4A83E7FC805C8732E5.dat | xml | |
MD5:57F30B1BCA811C2FCB81F4C13F6A927B | SHA256:612BAD93621991CB09C347FF01EC600B46617247D5C041311FF459E247D8C2D3 | |||
2368 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_WorkHours_1_E93876B551243045BFF0537063356CB6.dat | xml | |
MD5:807EF0FC900FEB3DA82927990083D6E7 | SHA256:4411E7DC978011222764943081500FFF0E43CBF7CCD44264BD1AB6306CA68913 | |||
3224 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:B3C0013B489E13CAC1841905A4F58EB3 | SHA256:82CB426280A04B013EDF4FC566A4C52E15A6558A2CD40CDF728C9059451AABF0 | |||
2368 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_FCB33BF515F70B4A846763DBAE946C8B.dat | xml | |
MD5:B21ED3BD946332FF6EBC41A87776C6BB | SHA256:B1AAC4E817CD10670B785EF8E5523C4A883F44138E50486987DC73054A46F6F4 | |||
2368 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_RssRule_2_82166543FC8FA8498873CC6AE5B511EB.dat | xml | |
MD5:D8B37ED0410FB241C283F72B76987F18 | SHA256:31E68049F6B7F21511E70CD7F2D95B9CF1354CF54603E8F47C1FC40F40B7A114 | |||
3224 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\72BA427A91F50409B9EAC87F2B59B951_18D8250F5E1D1DBAEAB4E72BAAD07C16 | der | |
MD5:883152D87B3C5FDB9C704EC34BFC285B | SHA256:C571BAEFA9063CF6E78AFED5C2C185CBA9470420C486C61C13E8AB0BE800656C |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2368 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
3224 | iexplore.exe | GET | 200 | 104.18.32.68:80 | http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEBN9U5yqfDGppDNwGWiEeo0%3D | US | der | 2.18 Kb | whitelisted |
3224 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D | US | der | 1.47 Kb | whitelisted |
3224 | iexplore.exe | GET | 200 | 108.138.2.173:80 | http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D | US | der | 1.70 Kb | whitelisted |
3224 | iexplore.exe | GET | 200 | 104.18.32.68:80 | http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D | US | der | 1.42 Kb | whitelisted |
3224 | iexplore.exe | GET | 200 | 172.64.155.188:80 | http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEAtkAeQNBc8Mrt%2B1FY0cY%2Bg%3D | US | der | 471 b | whitelisted |
3224 | iexplore.exe | GET | 200 | 52.222.226.205:80 | http://ocsp.r2m02.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAO2%2FCXty0krWayEwEKjsAQ%3D | US | der | 471 b | whitelisted |
2900 | iexplore.exe | GET | 200 | 52.222.226.205:80 | http://ocsp.r2m02.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEA5lV5%2FJdwsdaivGBcBMPn8%3D | US | der | 471 b | whitelisted |
3224 | iexplore.exe | GET | 200 | 142.250.186.131:80 | http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDTHapPXttJahK0MpJdGmyD | US | der | 472 b | whitelisted |
3224 | iexplore.exe | GET | 200 | 52.222.250.42:80 | http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D | US | der | 1.39 Kb | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2368 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
3224 | iexplore.exe | 34.194.89.64:443 | links.getpostman.com | AMAZON-AES | US | unknown |
3224 | iexplore.exe | 172.64.155.188:80 | ocsp.comodoca.com | CLOUDFLARENET | US | suspicious |
3224 | iexplore.exe | 67.231.146.66:443 | urldefense.proofpoint.com | PROOFPOINT-ASN-US-WEST | US | suspicious |
3224 | iexplore.exe | 108.138.2.173:80 | o.ss2.us | AMAZON-02 | US | unknown |
3224 | iexplore.exe | 104.18.32.68:80 | ocsp.comodoca.com | CLOUDFLARENET | — | suspicious |
3224 | iexplore.exe | 93.184.221.240:80 | ctldl.windowsupdate.com | EDGECAST | GB | whitelisted |
3224 | iexplore.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
3224 | iexplore.exe | 104.18.24.175:443 | identity.getpostman.com | CLOUDFLARENET | — | unknown |
3224 | iexplore.exe | 52.222.226.205:80 | ocsp.r2m02.amazontrust.com | AMAZON-02 | US | unknown |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
urldefense.proofpoint.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.comodoca.com |
| whitelisted |
ocsp.usertrust.com |
| whitelisted |
ocsp.sectigo.com |
| whitelisted |
links.getpostman.com |
| unknown |
o.ss2.us |
| whitelisted |
ocsp.rootg2.amazontrust.com |
| whitelisted |
ocsp.rootca1.amazontrust.com |
| shared |