File name:

Costco has a BIG surprise for you.eml

Full analysis: https://app.any.run/tasks/76a1ce48-ec6d-46d1-9ba7-a1e86361a4f3
Verdict: Malicious activity
Analysis date: November 16, 2019, 11:44:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: message/rfc822
File info: SMTP mail, ASCII text, with very long lines
MD5:

88953133C3C904E7F2D4CCD65F1C7678

SHA1:

5AD9A03144ED1A2151757DCBF6914AEC485B9A11

SHA256:

DD20A9A5AC18E51AFFD34A5D5D4F8E3BD1D5C03CFAF914A51B9C793A00111B3C

SSDEEP:

384:PetiqLQ7RpJOzo5z5jbWrDLrCWHsavL0OOOOOOOOO1vtFnrY0RL:QiqLQ7RpEzCz5erX+sVj0OOOOOOOOO1P

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2408)

    • Executed via COM

      • OUTLOOK.EXE (PID: 932)

    • Reads internet explorer settings

      • OUTLOOK.EXE (PID: 2408)

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 2408)

    • Creates files in the program directory

      • firefox.exe (PID: 960)

  • INFO

    • Manual execution by user

      • firefox.exe (PID: 272)

    • Reads Internet Cache Settings

      • firefox.exe (PID: 960)

    • Reads CPU info

      • firefox.exe (PID: 960)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 932)
      • OUTLOOK.EXE (PID: 2408)

    • Application launched itself

      • firefox.exe (PID: 960)

    • Dropped object may contain Bitcoin addresses

      • firefox.exe (PID: 960)

    • Creates files in the user directory

      • firefox.exe (PID: 960)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 7) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
9
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe outlook.exe no specs pingsender.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
272"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
932"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" -EmbeddingC:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\progra~1\micros~1\office14\outlook.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
960"C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
1928"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="960.0.558216684\1964618645" -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 960 "\\.\pipe\gecko-crash-server-pipe.960" 1180 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2408"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\Costco has a BIG surprise for you.eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\progra~1\micros~1\office14\outlook.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2896"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="960.13.1001368091\1486630601" -childID 2 -isForBrowser -prefsHandle 2784 -prefMapHandle 2788 -prefsLen 5996 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 960 "\\.\pipe\gecko-crash-server-pipe.960" 2800 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
3316"C:\Program Files\Mozilla Firefox\pingsender.exe" https://incoming.telemetry.mozilla.org/submit/telemetry/8f1718c5-2970-44a9-a42d-cac9d1799ff2/main/Firefox/68.0.1/release/20190717172542?v=4 C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\8f1718c5-2970-44a9-a42d-cac9d1799ff2C:\Program Files\Mozilla Firefox\pingsender.exe—firefox.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
MEDIUM
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\pingsender.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
3600"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="960.3.1759937084\502757513" -childID 1 -isForBrowser -prefsHandle 844 -prefMapHandle 1680 -prefsLen 1 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 960 "\\.\pipe\gecko-crash-server-pipe.960" 1336 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
3788"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="960.20.572535737\587770115" -childID 3 -isForBrowser -prefsHandle 3796 -prefMapHandle 3800 -prefsLen 7297 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 960 "\\.\pipe\gecko-crash-server-pipe.960" 3812 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
Total events
2 318
Read events
1 688
Write events
601
Delete events
29

Modification events

(PID) Process:(2408) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2408) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(2408) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(2408) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(2408) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(2408) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(2408) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(2408) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(2408) OUTLOOK.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1332740276
(PID) Process:(2408) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources
Operation:writeName:UISnapshot
Value:
1033;1046;1036;1031;1040;1041;1049;3082;1042;1055
Executable files
0
Suspicious files
135
Text files
114
Unknown types
74

Dropped files

PID
Process
Filename
Type
2408OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRA802.tmp.cvr —
MD5:—
SHA256:—
960firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
960firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm —
MD5:—
SHA256:—
960firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js —
MD5:—
SHA256:—
960firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp —
MD5:—
SHA256:—
2408OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:—
SHA256:—
2408OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:—
SHA256:—
2408OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\StructuredQuery.logtext
MD5:—
SHA256:—
960firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.jstext
MD5:—
SHA256:—
960firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
46
DNS requests
106
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
960
firefox.exe
POST
200
216.58.206.3:80
http://ocsp.pki.goog/gts1o1
US
der
471 b
whitelisted
960
firefox.exe
POST
200
216.58.206.3:80
http://ocsp.pki.goog/gts1o1
US
der
472 b
whitelisted
960
firefox.exe
POST
200
216.58.206.3:80
http://ocsp.pki.goog/gts1o1
US
der
471 b
whitelisted
960
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
960
firefox.exe
POST
200
216.58.206.3:80
http://ocsp.pki.goog/gts1o1
US
der
471 b
whitelisted
960
firefox.exe
POST
200
216.58.206.3:80
http://ocsp.pki.goog/gts1o1
US
der
471 b
whitelisted
960
firefox.exe
POST
200
216.58.206.3:80
http://ocsp.pki.goog/gts1o1
US
der
471 b
whitelisted
960
firefox.exe
POST
200
216.58.206.3:80
http://ocsp.pki.goog/gts1o1
US
der
472 b
whitelisted
960
firefox.exe
POST
200
216.58.206.3:80
http://ocsp.pki.goog/gts1o1
US
der
471 b
whitelisted
960
firefox.exe
POST
200
216.58.206.3:80
http://ocsp.pki.goog/gts1o1
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
960
firefox.exe
52.88.123.140:443
push.services.mozilla.com
Amazon.com, Inc.
US
unknown
960
firefox.exe
2.16.186.50:80
detectportal.firefox.com
Akamai International B.V.
—
whitelisted
960
firefox.exe
143.204.214.118:443
snippets.cdn.mozilla.net
—
US
suspicious
960
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2408
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
960
firefox.exe
52.35.182.58:443
search.services.mozilla.com
Amazon.com, Inc.
US
unknown
960
firefox.exe
34.223.160.244:443
tiles.services.mozilla.com
Amazon.com, Inc.
US
unknown
960
firefox.exe
13.35.253.78:443
content-signature-2.cdn.mozilla.net
—
US
malicious
960
firefox.exe
216.58.206.3:80
ocsp.pki.goog
Google Inc.
US
whitelisted
960
firefox.exe
143.204.214.77:443
firefox.settings.services.mozilla.com
—
US
suspicious

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared
detectportal.firefox.com
  • 2.16.186.50
  • 2.16.186.112
whitelisted
a1089.dscd.akamai.net
  • 2.16.186.112
  • 2.16.186.50
whitelisted
search.services.mozilla.com
  • 52.35.182.58
  • 35.164.109.147
  • 52.89.218.39
whitelisted
search.r53-2.services.mozilla.com
  • 52.89.218.39
  • 35.164.109.147
  • 52.35.182.58
whitelisted
push.services.mozilla.com
  • 52.88.123.140
whitelisted
autopush.prod.mozaws.net
  • 52.88.123.140
whitelisted
snippets.cdn.mozilla.net
  • 143.204.214.118
  • 143.204.214.5
  • 143.204.214.11
  • 143.204.214.95
whitelisted
d228z91au11ukj.cloudfront.net
  • 143.204.214.95
  • 143.204.214.11
  • 143.204.214.5
  • 143.204.214.118
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
1080
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Costco has a BIG surprise for you.eml