analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Costco has a BIG surprise for you.eml

Full analysis: https://app.any.run/tasks/76a1ce48-ec6d-46d1-9ba7-a1e86361a4f3
Verdict: Malicious activity
Analysis date: November 16, 2019, 11:44:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: message/rfc822
File info: SMTP mail, ASCII text, with very long lines
MD5:

88953133C3C904E7F2D4CCD65F1C7678

SHA1:

5AD9A03144ED1A2151757DCBF6914AEC485B9A11

SHA256:

DD20A9A5AC18E51AFFD34A5D5D4F8E3BD1D5C03CFAF914A51B9C793A00111B3C

SSDEEP:

384:PetiqLQ7RpJOzo5z5jbWrDLrCWHsavL0OOOOOOOOO1vtFnrY0RL:QiqLQ7RpEzCz5erX+sVj0OOOOOOOOO1P

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads internet explorer settings

      • OUTLOOK.EXE (PID: 2408)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2408)

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 2408)

    • Creates files in the program directory

      • firefox.exe (PID: 960)

    • Executed via COM

      • OUTLOOK.EXE (PID: 932)

  • INFO

    • Reads CPU info

      • firefox.exe (PID: 960)

    • Application launched itself

      • firefox.exe (PID: 960)

    • Manual execution by user

      • firefox.exe (PID: 272)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 932)
      • OUTLOOK.EXE (PID: 2408)

    • Dropped object may contain Bitcoin addresses

      • firefox.exe (PID: 960)

    • Creates files in the user directory

      • firefox.exe (PID: 960)

    • Reads Internet Cache Settings

      • firefox.exe (PID: 960)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 7) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
9
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe outlook.exe no specs pingsender.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2408"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\Costco has a BIG surprise for you.eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\progra~1\micros~1\office14\outlook.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
272"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
960"C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
1928"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="960.0.558216684\1964618645" -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 960 "\\.\pipe\gecko-crash-server-pipe.960" 1180 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
3600"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="960.3.1759937084\502757513" -childID 1 -isForBrowser -prefsHandle 844 -prefMapHandle 1680 -prefsLen 1 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 960 "\\.\pipe\gecko-crash-server-pipe.960" 1336 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2896"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="960.13.1001368091\1486630601" -childID 2 -isForBrowser -prefsHandle 2784 -prefMapHandle 2788 -prefsLen 5996 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 960 "\\.\pipe\gecko-crash-server-pipe.960" 2800 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
3788"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="960.20.572535737\587770115" -childID 3 -isForBrowser -prefsHandle 3796 -prefMapHandle 3800 -prefsLen 7297 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 960 "\\.\pipe\gecko-crash-server-pipe.960" 3812 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
932"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" -EmbeddingC:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\progra~1\micros~1\office14\outlook.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3316"C:\Program Files\Mozilla Firefox\pingsender.exe" https://incoming.telemetry.mozilla.org/submit/telemetry/8f1718c5-2970-44a9-a42d-cac9d1799ff2/main/Firefox/68.0.1/release/20190717172542?v=4 C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\8f1718c5-2970-44a9-a42d-cac9d1799ff2C:\Program Files\Mozilla Firefox\pingsender.exe—firefox.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
MEDIUM
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\pingsender.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
Total events
2 318
Read events
1 688
Write events
601
Delete events
29

Modification events

(PID) Process:(2408) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2408) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(2408) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(2408) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(2408) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(2408) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(2408) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(2408) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(2408) OUTLOOK.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1332740276
(PID) Process:(2408) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources
Operation:writeName:UISnapshot
Value:
1033;1046;1036;1031;1040;1041;1049;3082;1042;1055
Executable files
0
Suspicious files
135
Text files
114
Unknown types
74

Dropped files

PID
Process
Filename
Type
2408OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRA802.tmp.cvr —
MD5:—
SHA256:—
960firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
960firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm —
MD5:—
SHA256:—
960firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js —
MD5:—
SHA256:—
960firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp —
MD5:—
SHA256:—
2408OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:BE2741FDFF729BC0D0292CF46AD1D440
SHA256:E3E7C91AADE3ECBE09DE867649F2D12BAC21BFBFC4563EE8780B0C4C3E05FCC2
2408OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:DDF725CEE6D3BE7ED7610294BE43B779
SHA256:8717852DD1A540229FBD4FC9097B7448B889E359CA41E43CD255CFFEF9A62AB2
2408OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_AvailabilityOptions_2_E2C90DD529B0EF4F91AFC7E7FF236D79.datxml
MD5:EEAA832C12F20DE6AAAA9C7B77626E72
SHA256:C4C9A90F2C961D9EE79CF08FBEE647ED7DE0202288E876C7BAAD00F4CA29CA16
2408OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inftext
MD5:48DD6CAE43CE26B992C35799FCD76898
SHA256:7BFE1F3691E2B4FB4D61FBF5E9F7782FBE49DA1342DBD32201C2CC8E540DBD1A
960firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:DE9496ACA551ADE408EF6466A11833A1
SHA256:8F9C7FDB3E0BC01024E43A8E242468FC4DD4F74C725E32A883571635203DC10A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
46
DNS requests
106
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
960
firefox.exe
GET
200
2.16.186.50:80
http://detectportal.firefox.com/success.txt
unknown
text
8 b
whitelisted
960
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
960
firefox.exe
POST
200
216.58.206.3:80
http://ocsp.pki.goog/gts1o1
US
der
471 b
whitelisted
960
firefox.exe
POST
200
216.58.206.3:80
http://ocsp.pki.goog/gts1o1
US
der
471 b
whitelisted
960
firefox.exe
POST
200
216.58.206.3:80
http://ocsp.pki.goog/gts1o1
US
der
471 b
whitelisted
960
firefox.exe
POST
200
216.58.206.3:80
http://ocsp.pki.goog/gts1o1
US
der
472 b
whitelisted
960
firefox.exe
POST
200
216.58.206.3:80
http://ocsp.pki.goog/gts1o1
US
der
472 b
whitelisted
960
firefox.exe
POST
200
216.58.206.3:80
http://ocsp.pki.goog/gts1o1
US
der
471 b
whitelisted
960
firefox.exe
POST
200
216.58.206.3:80
http://ocsp.pki.goog/gts1o1
US
der
471 b
whitelisted
960
firefox.exe
POST
200
216.58.206.3:80
http://ocsp.pki.goog/gts1o1
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
960
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2408
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
960
firefox.exe
2.16.186.50:80
detectportal.firefox.com
Akamai International B.V.
—
whitelisted
960
firefox.exe
143.204.214.118:443
snippets.cdn.mozilla.net
—
US
suspicious
960
firefox.exe
52.88.123.140:443
push.services.mozilla.com
Amazon.com, Inc.
US
unknown
960
firefox.exe
52.35.182.58:443
search.services.mozilla.com
Amazon.com, Inc.
US
unknown
960
firefox.exe
34.223.160.244:443
tiles.services.mozilla.com
Amazon.com, Inc.
US
unknown
960
firefox.exe
172.217.21.206:443
www.youtube.com
Google Inc.
US
whitelisted
960
firefox.exe
172.217.18.170:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
960
firefox.exe
13.35.253.78:443
content-signature-2.cdn.mozilla.net
—
US
malicious

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared
detectportal.firefox.com
  • 2.16.186.50
  • 2.16.186.112
whitelisted
a1089.dscd.akamai.net
  • 2.16.186.112
  • 2.16.186.50
whitelisted
search.services.mozilla.com
  • 52.35.182.58
  • 35.164.109.147
  • 52.89.218.39
whitelisted
search.r53-2.services.mozilla.com
  • 52.89.218.39
  • 35.164.109.147
  • 52.35.182.58
whitelisted
push.services.mozilla.com
  • 52.88.123.140
whitelisted
autopush.prod.mozaws.net
  • 52.88.123.140
whitelisted
snippets.cdn.mozilla.net
  • 143.204.214.118
  • 143.204.214.5
  • 143.204.214.11
  • 143.204.214.95
whitelisted
d228z91au11ukj.cloudfront.net
  • 143.204.214.95
  • 143.204.214.11
  • 143.204.214.5
  • 143.204.214.118
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Costco has a BIG surprise for you.eml