analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

phish_alert_sp2_2.0.0.0.eml

Full analysis: https://app.any.run/tasks/924a5451-ebaa-40ae-b754-7217e30433be
Verdict: Malicious activity
Analysis date: August 12, 2022, 20:15:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: message/rfc822
File info: RFC 822 mail, ASCII text, with very long lines, with CRLF line terminators
MD5:

06A4680F66A1E56424CC647C4D1BA22D

SHA1:

53E3034FD746BEC4F567B73A801F9446E39881AF

SHA256:

9E55739120616D9527355CCE5C2B33FCBBC2C6057814B35594E6F25D94843159

SSDEEP:

6144:nmKbz1Tggk0r87PI/EUl0H8GU1aRgjU7fIjSg1Nk:nmKbuT0yPId48nf8f41Nk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • chrome.exe (PID: 300)
      • chrome.exe (PID: 3156)
      • BraveUpdateSetup.exe (PID: 3116)
      • BraveBrowserSetup32.exe (PID: 3292)
      • BraveUpdate.exe (PID: 1800)
      • brave_installer-ia32.exe (PID: 2376)
      • setup.exe (PID: 3968)
      • chrome.exe (PID: 3388)

    • Application was dropped or rewritten from another process

      • BraveBrowserSetup32.exe (PID: 3292)
      • BraveUpdate.exe (PID: 3352)
      • BraveUpdate.exe (PID: 1800)
      • BraveUpdateSetup.exe (PID: 3116)
      • BraveUpdate.exe (PID: 3488)
      • BraveUpdate.exe (PID: 3672)
      • BraveUpdate.exe (PID: 2088)
      • BraveUpdate.exe (PID: 2972)
      • BraveUpdate.exe (PID: 868)
      • setup.exe (PID: 3968)
      • setup.exe (PID: 2140)
      • setup.exe (PID: 3388)
      • setup.exe (PID: 3552)
      • BraveUpdate.exe (PID: 3492)
      • BraveUpdateOnDemand.exe (PID: 2408)
      • BraveUpdate.exe (PID: 3556)
      • brave.exe (PID: 3896)
      • brave.exe (PID: 3200)
      • brave.exe (PID: 2324)
      • brave.exe (PID: 3252)
      • brave.exe (PID: 3996)
      • brave.exe (PID: 124)
      • brave.exe (PID: 476)
      • brave.exe (PID: 3712)
      • brave.exe (PID: 2952)
      • brave.exe (PID: 2104)
      • brave.exe (PID: 968)
      • chrmstp.exe (PID: 2192)
      • chrmstp.exe (PID: 396)
      • brave.exe (PID: 2088)
      • chrmstp.exe (PID: 3968)
      • brave.exe (PID: 580)
      • brave.exe (PID: 3924)
      • brave.exe (PID: 1872)
      • brave.exe (PID: 1648)
      • brave.exe (PID: 2832)
      • chrmstp.exe (PID: 760)
      • brave.exe (PID: 2496)
      • brave.exe (PID: 3336)
      • brave.exe (PID: 3936)

    • Loads dropped or rewritten executable

      • BraveUpdate.exe (PID: 3352)
      • BraveUpdate.exe (PID: 1800)
      • BraveUpdate.exe (PID: 3672)
      • BraveUpdate.exe (PID: 3488)
      • BraveUpdate.exe (PID: 2972)
      • BraveUpdate.exe (PID: 2088)
      • BraveUpdate.exe (PID: 868)
      • BraveUpdate.exe (PID: 3556)
      • BraveUpdate.exe (PID: 3492)
      • svchost.exe (PID: 1708)

    • Actions looks like stealing of personal data

      • brave_installer-ia32.exe (PID: 2376)
      • setup.exe (PID: 3388)
      • BraveUpdate.exe (PID: 3556)
      • brave.exe (PID: 3200)
      • brave.exe (PID: 3252)
      • brave.exe (PID: 124)
      • brave.exe (PID: 2324)
      • brave.exe (PID: 3712)
      • brave.exe (PID: 476)
      • brave.exe (PID: 3996)
      • setup.exe (PID: 3968)
      • brave.exe (PID: 2104)
      • brave.exe (PID: 2952)
      • brave.exe (PID: 968)
      • chrmstp.exe (PID: 396)
      • chrmstp.exe (PID: 3968)
      • brave.exe (PID: 580)
      • brave.exe (PID: 3924)
      • chrmstp.exe (PID: 2192)
      • brave.exe (PID: 2088)
      • brave.exe (PID: 1648)
      • chrmstp.exe (PID: 760)
      • brave.exe (PID: 1872)
      • brave.exe (PID: 2832)
      • brave.exe (PID: 3336)
      • brave.exe (PID: 2496)
      • brave.exe (PID: 3936)
      • brave.exe (PID: 3896)

    • Changes the autorun value in the registry

      • setup.exe (PID: 3968)

    • Steals credentials from Web Browsers

      • brave.exe (PID: 3896)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3928)

    • Reads the computer name

      • OUTLOOK.EXE (PID: 2176)
      • BraveUpdate.exe (PID: 1800)
      • BraveUpdate.exe (PID: 3352)
      • BraveUpdate.exe (PID: 3488)
      • BraveUpdate.exe (PID: 3672)
      • BraveUpdate.exe (PID: 2088)
      • BraveUpdate.exe (PID: 2972)
      • BraveUpdate.exe (PID: 868)
      • brave_installer-ia32.exe (PID: 2376)
      • setup.exe (PID: 3968)
      • setup.exe (PID: 3388)
      • BraveUpdate.exe (PID: 3492)
      • BraveUpdate.exe (PID: 3556)
      • brave.exe (PID: 3896)
      • brave.exe (PID: 2324)
      • brave.exe (PID: 2104)
      • brave.exe (PID: 2952)
      • chrmstp.exe (PID: 2192)
      • chrmstp.exe (PID: 760)
      • brave.exe (PID: 2088)

    • Searches for installed software

      • OUTLOOK.EXE (PID: 2176)

    • Checks supported languages

      • OUTLOOK.EXE (PID: 2176)
      • BraveBrowserSetup32.exe (PID: 3292)
      • BraveUpdate.exe (PID: 3352)
      • BraveUpdateSetup.exe (PID: 3116)
      • BraveUpdate.exe (PID: 1800)
      • BraveUpdate.exe (PID: 2088)
      • BraveUpdate.exe (PID: 3672)
      • BraveUpdate.exe (PID: 3488)
      • BraveUpdate.exe (PID: 2972)
      • BraveUpdate.exe (PID: 868)
      • brave_installer-ia32.exe (PID: 2376)
      • setup.exe (PID: 2140)
      • setup.exe (PID: 3968)
      • setup.exe (PID: 3388)
      • setup.exe (PID: 3552)
      • BraveUpdateOnDemand.exe (PID: 2408)
      • BraveUpdate.exe (PID: 3492)
      • BraveUpdate.exe (PID: 3556)
      • brave.exe (PID: 3896)
      • brave.exe (PID: 2104)
      • brave.exe (PID: 3996)
      • brave.exe (PID: 3252)
      • brave.exe (PID: 124)
      • brave.exe (PID: 2324)
      • brave.exe (PID: 476)
      • brave.exe (PID: 3200)
      • brave.exe (PID: 3712)
      • brave.exe (PID: 2952)
      • brave.exe (PID: 968)
      • chrmstp.exe (PID: 396)
      • chrmstp.exe (PID: 2192)
      • chrmstp.exe (PID: 760)
      • chrmstp.exe (PID: 3968)
      • brave.exe (PID: 2088)
      • brave.exe (PID: 580)
      • brave.exe (PID: 1872)
      • brave.exe (PID: 3924)
      • brave.exe (PID: 1648)
      • brave.exe (PID: 2832)
      • brave.exe (PID: 2496)
      • brave.exe (PID: 3336)
      • brave.exe (PID: 3936)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 300)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 300)
      • chrome.exe (PID: 3156)
      • BraveBrowserSetup32.exe (PID: 3292)
      • BraveUpdateSetup.exe (PID: 3116)
      • BraveUpdate.exe (PID: 1800)
      • brave_installer-ia32.exe (PID: 2376)
      • setup.exe (PID: 3968)
      • chrome.exe (PID: 3388)

    • Drops a file with a compile date too recent

      • chrome.exe (PID: 300)
      • chrome.exe (PID: 3156)
      • BraveUpdateSetup.exe (PID: 3116)
      • BraveBrowserSetup32.exe (PID: 3292)
      • BraveUpdate.exe (PID: 1800)
      • brave_installer-ia32.exe (PID: 2376)
      • setup.exe (PID: 3968)
      • chrome.exe (PID: 3388)

    • Creates a directory in Program Files

      • BraveUpdateSetup.exe (PID: 3116)
      • BraveUpdate.exe (PID: 1800)
      • BraveUpdate.exe (PID: 868)
      • brave_installer-ia32.exe (PID: 2376)
      • setup.exe (PID: 3968)

    • Creates files in the program directory

      • BraveUpdateSetup.exe (PID: 3116)
      • BraveUpdate.exe (PID: 1800)
      • BraveUpdate.exe (PID: 868)
      • brave_installer-ia32.exe (PID: 2376)
      • setup.exe (PID: 3388)
      • setup.exe (PID: 3968)

    • Disables SEHOP

      • BraveUpdate.exe (PID: 1800)

    • Starts itself from another location

      • BraveUpdate.exe (PID: 1800)

    • Creates/Modifies COM task schedule object

      • BraveUpdate.exe (PID: 3672)

    • Executed as Windows Service

      • BraveUpdate.exe (PID: 868)

    • Application launched itself

      • setup.exe (PID: 3968)
      • setup.exe (PID: 3388)
      • BraveUpdate.exe (PID: 868)
      • brave.exe (PID: 3896)
      • chrmstp.exe (PID: 2192)
      • chrmstp.exe (PID: 760)

    • Creates a software uninstall entry

      • setup.exe (PID: 3968)

    • Reads the date of Windows installation

      • setup.exe (PID: 3388)
      • chrmstp.exe (PID: 760)

    • Changes default file association

      • setup.exe (PID: 3968)
      • brave.exe (PID: 3896)

    • Executed via COM

      • BraveUpdateOnDemand.exe (PID: 2408)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 2456)
      • svchost.exe (PID: 1708)
      • iexplore.exe (PID: 3928)
      • chrome.exe (PID: 2428)
      • chrome.exe (PID: 2916)
      • chrome.exe (PID: 300)
      • chrome.exe (PID: 3156)
      • chrome.exe (PID: 3912)
      • chrome.exe (PID: 3444)
      • chrome.exe (PID: 3556)
      • chrome.exe (PID: 3752)
      • chrome.exe (PID: 3884)
      • chrome.exe (PID: 508)
      • chrome.exe (PID: 3548)
      • chrome.exe (PID: 4032)
      • chrome.exe (PID: 3692)
      • chrome.exe (PID: 2848)
      • chrome.exe (PID: 3568)
      • chrome.exe (PID: 2624)
      • chrome.exe (PID: 3268)
      • chrome.exe (PID: 2008)
      • chrome.exe (PID: 3372)
      • chrome.exe (PID: 3632)
      • chrome.exe (PID: 2388)
      • chrome.exe (PID: 3488)
      • chrome.exe (PID: 3552)
      • chrome.exe (PID: 760)
      • chrome.exe (PID: 2856)
      • chrome.exe (PID: 2068)
      • chrome.exe (PID: 2716)
      • chrome.exe (PID: 3916)
      • chrome.exe (PID: 2556)
      • chrome.exe (PID: 3344)
      • chrome.exe (PID: 3620)
      • chrome.exe (PID: 3388)

    • Reads the computer name

      • iexplore.exe (PID: 2456)
      • iexplore.exe (PID: 3928)
      • chrome.exe (PID: 300)
      • chrome.exe (PID: 3156)
      • chrome.exe (PID: 2916)
      • chrome.exe (PID: 508)
      • chrome.exe (PID: 3752)
      • chrome.exe (PID: 3632)
      • chrome.exe (PID: 3268)
      • chrome.exe (PID: 760)
      • chrome.exe (PID: 3552)
      • chrome.exe (PID: 2068)

    • Reads Microsoft Office registry keys

      • svchost.exe (PID: 1708)
      • OUTLOOK.EXE (PID: 2176)

    • Changes internet zones settings

      • iexplore.exe (PID: 2456)

    • Application launched itself

      • iexplore.exe (PID: 2456)
      • chrome.exe (PID: 300)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3928)
      • iexplore.exe (PID: 2456)
      • chrome.exe (PID: 300)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3928)
      • iexplore.exe (PID: 2456)
      • chrome.exe (PID: 3156)
      • chrome.exe (PID: 300)
      • BraveUpdate.exe (PID: 868)
      • BraveUpdate.exe (PID: 2088)
      • BraveUpdate.exe (PID: 3492)
      • brave.exe (PID: 3896)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3928)

    • Manual execution by user

      • chrome.exe (PID: 300)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 2456)
      • chrome.exe (PID: 760)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 5) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
121
Monitored processes
77
Malicious processes
44
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start outlook.exe iexplore.exe iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs bravebrowsersetup32.exe braveupdate.exe no specs braveupdatesetup.exe braveupdate.exe braveupdate.exe no specs braveupdate.exe no specs braveupdate.exe braveupdate.exe no specs braveupdate.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs brave_installer-ia32.exe setup.exe setup.exe no specs chrome.exe no specs setup.exe setup.exe no specs braveupdate.exe braveupdateondemand.exe no specs braveupdate.exe svchost.exe no specs brave.exe brave.exe brave.exe brave.exe brave.exe brave.exe brave.exe brave.exe brave.exe brave.exe chrome.exe brave.exe chrmstp.exe chrmstp.exe chrmstp.exe chrmstp.exe brave.exe brave.exe brave.exe brave.exe brave.exe brave.exe brave.exe brave.exe brave.exe

Process information

PID
CMD
Path
Indicators
Parent process
2176"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\phish_alert_sp2_2.0.0.0.eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\version.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2456"C:\Program Files\Internet Explorer\iexplore.exe" https://mso.8agroup.click/?C:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3928"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2456 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
300"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
Explorer.EXE
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
2428"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x672ed988,0x672ed998,0x672ed9a4C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
2916"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1048,16813580231221841337,5355498346689388146,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1076 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3156"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1048,16813580231221841337,5355498346689388146,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1344 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3444"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1048,16813580231221841337,5355498346689388146,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1848 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3556"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1048,16813580231221841337,5355498346689388146,131072 --enable-features=PasswordImport --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1964 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3912"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1048,16813580231221841337,5355498346689388146,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2276 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
Total events
54 288
Read events
50 474
Write events
0
Delete events
0

Modification events

No data
Executable files
215
Suspicious files
594
Text files
368
Unknown types
75

Dropped files

PID
Process
Filename
Type
2176OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR7F91.tmp.cvr —
MD5:—
SHA256:—
2176OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst —
MD5:—
SHA256:—
3928iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:7F57297919825D23C2228CE65F497021
SHA256:BDBD0538A502AF1BE7FB667C4FF3BCC81FF83EB631EEE5670F54651BA91995A0
2176OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\69188E25.datimage
MD5:C223589BE98B5030F5B767EC90694D8E
SHA256:964B107446D1FB0006A0B1C640982B3B471EE0BB2C61CA9FE0C889E0794E2108
2176OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:76B271CF0423AD106FDBD1901815D4F5
SHA256:181CB7CC04215288C1E1618D32E36EEEFD3F6A2C778883D36B7030376A534FCF
3928iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:34CA913F2B6DFBBC4BE6246305DD48E2
SHA256:40BA50F98676973E467871F20E7F5891E7B102CD23338EE5D4C0EEC12641FDB4
2176OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\tmp80CA.tmpbinary
MD5:3839832B15F3A38288CB45E23F9D75D6
SHA256:59303E9234BCEC51B2988D06B5A1A3453269084E6DAB3BB4D6EDBA98A381B28F
3928iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabB297.tmpcompressed
MD5:589C442FC7A0C70DCA927115A700D41E
SHA256:2E5CB72E9EB43BAAFB6C6BFCC573AAC92F49A8064C483F9D378A9E8E781A526A
2176OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:BD0E376CC1EB726B44037E908B91ABB4
SHA256:F8539B93A6471CAB2A4DA444F5BA426D4025A9B2E658304502EEF43EC2A5158F
3928iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:589C442FC7A0C70DCA927115A700D41E
SHA256:2E5CB72E9EB43BAAFB6C6BFCC573AAC92F49A8064C483F9D378A9E8E781A526A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
33
TCP/UDP connections
81
DNS requests
50
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2176
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
3928
iexplore.exe
GET
200
18.155.152.226:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
3928
iexplore.exe
GET
200
18.155.139.181:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D
US
der
1.39 Kb
shared
2456
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3928
iexplore.exe
GET
200
52.222.250.185:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
3928
iexplore.exe
GET
200
18.66.121.29:80
http://ocsp.sca1b.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEA8D5QeEOMSYIvOoUuvAIlQ%3D
US
der
471 b
whitelisted
3928
iexplore.exe
GET
200
104.110.191.133:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c09da86dee0c6f02
US
compressed
60.2 Kb
whitelisted
2456
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3928
iexplore.exe
GET
200
104.125.75.233:80
http://x1.c.lencr.org/
NL
der
717 b
whitelisted
876
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvODJiQUFYYVJaZ0k5di1hUFlXS1prX2xDZw/1.0.0.13_llkgjffcdpffmhiakmfcdcblohccpfmo.crx
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2456
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3928
iexplore.exe
185.189.151.13:443
mso.8agroup.click
SOFTplus Entwicklungen GmbH
CH
unknown
3928
iexplore.exe
2.22.117.227:80
r3.o.lencr.org
Akamai International B.V.
GB
suspicious
3928
iexplore.exe
104.110.191.133:80
ctldl.windowsupdate.com
Akamai Technologies, Inc.
US
unknown
2176
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
3928
iexplore.exe
18.155.139.181:80
ocsp.rootca1.amazontrust.com
Massachusetts Institute of Technology
US
unknown
2456
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3928
iexplore.exe
65.9.95.90:443
brave.com
AT&T Services, Inc.
US
unknown
2456
iexplore.exe
65.9.95.90:443
brave.com
AT&T Services, Inc.
US
unknown
3156
chrome.exe
172.217.18.109:443
accounts.google.com
Google Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
mso.8agroup.click
  • 185.189.151.13
unknown
ctldl.windowsupdate.com
  • 104.110.191.133
  • 104.110.191.140
whitelisted
x1.c.lencr.org
  • 104.125.75.233
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 13.107.21.200
  • 204.79.197.200
whitelisted
r3.o.lencr.org
  • 2.22.117.227
  • 2.22.118.162
shared
brave.com
  • 65.9.95.90
  • 65.9.95.45
  • 65.9.95.40
  • 65.9.95.120
whitelisted
o.ss2.us
  • 18.155.152.226
  • 18.155.152.48
  • 18.155.152.66
  • 18.155.152.117
whitelisted
ocsp.rootg2.amazontrust.com
  • 52.222.250.185
  • 52.222.250.174
  • 52.222.250.42
  • 52.222.250.112
whitelisted

Threats

PID
Process
Class
Message
876
svchost.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
876
svchost.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
Process
Message
brave.exe
[0812/211741.305:ERROR:crash_report_database_win.cc(613)] CreateDirectory C:\Users\admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crashpad: The system cannot find the path specified. (0x3)
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
phish_alert_sp2_2.0.0.0.eml