analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Aravind Ekanath shared a recording with you.eml

Full analysis: https://app.any.run/tasks/ae67e594-cad9-436d-8541-fd1b2f9e4998
Verdict: Malicious activity
Analysis date: March 31, 2023, 19:50:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: message/rfc822
File info: SMTP mail, ASCII text, with CRLF line terminators
MD5:

8B9C21D1371F6852B41C4251F45889C3

SHA1:

8DF73735BBE38874A146814CD11CA605E1DE57DF

SHA256:

E8FAFED4DBE6AB6CCDBD7D973C606358B3C1D1DB70A3803466E88A18B1CDE1ED

SSDEEP:

384:hjmLxTn5aBLofyGQfN+CWxo/8OfzGEy4+pba:hCLx1ado6qsfqJa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Searches for installed software

      • OUTLOOK.EXE (PID: 1048)

    • Reads the Internet Settings

      • OUTLOOK.EXE (PID: 1048)

    • Reads settings of System Certificates

      • OUTLOOK.EXE (PID: 1048)

    • Reads security settings of Internet Explorer

      • OUTLOOK.EXE (PID: 1048)

    • Checks Windows Trust Settings

      • OUTLOOK.EXE (PID: 1048)

  • INFO

    • Checks supported languages

      • OUTLOOK.EXE (PID: 1048)

    • Reads the computer name

      • OUTLOOK.EXE (PID: 1048)

    • Reads the machine GUID from the registry

      • OUTLOOK.EXE (PID: 1048)

    • The process checks LSA protection

      • OUTLOOK.EXE (PID: 1048)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 1048)

    • Create files in a temporary directory

      • OUTLOOK.EXE (PID: 1048)
      • iexplore.exe (PID: 2996)
      • iexplore.exe (PID: 3000)

    • Checks proxy server information

      • OUTLOOK.EXE (PID: 1048)

    • Process checks computer location settings

      • OUTLOOK.EXE (PID: 1048)

    • Application launched itself

      • iexplore.exe (PID: 2996)

    • Creates files or folders in the user directory

      • OUTLOOK.EXE (PID: 1048)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 7) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe iexplore.exe iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1048"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\Aravind Ekanath shared a recording with you.eml"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\version.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\gdi32.dll
2996"C:\Program Files\Internet Explorer\iexplore.exe" https://zoom.us/C:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3000"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2996 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3164"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2996 CREDAT:2430230 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
110 510
Read events
90 188
Write events
17 059
Delete events
42

Modification events

(PID) Process:(1048) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(1048) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(1048) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(1048) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
(PID) Process:(1048) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
On
(PID) Process:(1048) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
On
(PID) Process:(1048) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
On
(PID) Process:(1048) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
On
(PID) Process:(1048) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
On
(PID) Process:(1048) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1055
Value:
On
Executable files
0
Suspicious files
94
Text files
348
Unknown types
80

Dropped files

PID
Process
Filename
Type
1048OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRF657.tmp.cvr —
MD5:—
SHA256:—
1048OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst —
MD5:—
SHA256:—
1048OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:255FB0E952C34726114EA346EEFB90A6
SHA256:3C5DA1A9BC75E7085FB48C8042824A63695462936EFE18647CDC2CDCDBFFC44C
3000iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:A8AFA3FF73227FA5E81438AE5ED2C561
SHA256:6618EB46BCA76AD5ECC2A72331019114ED372DEBB359D0BDCEB7EDACADFB0D76
1048OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:E58FC15CF467D5CDFCCD3B9AC54EBBFE
SHA256:9990074CE1BC7E1E0EB2CE90C44E394F38C32F3C5F238D3EA97AD180AB4B9845
1048OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_AvailabilityOptions_2_217548752A92074DA51C241E8EC8B6FD.datxml
MD5:EEAA832C12F20DE6AAAA9C7B77626E72
SHA256:C4C9A90F2C961D9EE79CF08FBEE647ED7DE0202288E876C7BAAD00F4CA29CA16
3000iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\1UKHRFM3.txttext
MD5:FA95CFC8E99DD037FEFEB13D1F1C4561
SHA256:9310EBF118877D80A4C362E94FE3784A748E32BE40115914C8A7B8CE505DB429
3000iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04der
MD5:21ED9CA0F4579A63723066FAB3CDB1E9
SHA256:818A6653F6011A83D251998208826644FE68D228A739C87EC14E470E10817889
3000iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\327BDKJ4.txttext
MD5:A823D529E303A73AFBB1C5915244D22E
SHA256:DE5572BF664ABBF0B04E22C859276623FE70C821B99D11ACF46EA5601DC75ADA
3000iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:579DE1AE581A7E128E4968CEE40A767B
SHA256:EAE0811C3AC5EB6BB61514BFE02B2F9D1A8CA54C503A428D20B5ED30048FE3EF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
86
DNS requests
36
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3000
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAhflMAthXvozBT%2FU%2B2iPio%3D
US
der
471 b
whitelisted
3000
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAbCsehAv%2FkAxBfkV5KvfLI%3D
US
der
471 b
whitelisted
3000
iexplore.exe
GET
—
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
—
—
whitelisted
3000
iexplore.exe
GET
—
108.138.2.173:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
—
—
whitelisted
3000
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
1.47 Kb
whitelisted
3000
iexplore.exe
GET
200
142.250.186.67:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
2996
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
der
471 b
whitelisted
2996
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
3000
iexplore.exe
GET
200
2.16.241.8:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgSL5xDeyFaWgexwXgBdzNvJDA%3D%3D
unknown
der
503 b
shared
3000
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?40acdd04377037e7
US
compressed
61.1 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1048
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3000
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3000
iexplore.exe
170.114.52.2:443
zoom.us
—
US
suspicious
3000
iexplore.exe
8.241.122.126:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
3000
iexplore.exe
52.84.151.14:443
file-paa.zoom.us
AMAZON-02
US
unknown
3000
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
3000
iexplore.exe
18.66.130.242:443
st3.zoom.us
AMAZON-02
US
unknown
3000
iexplore.exe
104.19.187.97:443
cdn.cookielaw.org
CLOUDFLARENET
—
unknown
3000
iexplore.exe
13.32.216.250:443
explore.zoom.us
AMAZON-02
US
unknown
3000
iexplore.exe
18.66.147.113:443
static.ada.support
AMAZON-02
US
suspicious

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
zoom.us
  • 170.114.52.2
whitelisted
ctldl.windowsupdate.com
  • 8.241.122.126
  • 8.238.191.126
  • 8.238.189.126
  • 8.238.190.126
  • 8.248.131.254
  • 209.197.3.8
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
st3.zoom.us
  • 18.66.130.242
whitelisted
explore.zoom.us
  • 13.32.216.250
whitelisted
st1.zoom.us
  • 18.66.130.242
whitelisted
st2.zoom.us
  • 18.66.130.242
whitelisted
cdn.cookielaw.org
  • 104.19.187.97
  • 104.19.188.97
whitelisted
file-paa.zoom.us
  • 52.84.151.14
  • 52.84.151.22
  • 52.84.151.27
  • 52.84.151.20
suspicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Aravind Ekanath shared a recording with you.eml