analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Order List (PO# 081928).eml

Full analysis: https://app.any.run/tasks/36c8170d-16cf-4996-8d68-fa76818dcf3b
Verdict: Malicious activity
Analysis date: September 30, 2020, 10:28:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: message/rfc822
File info: SMTP mail, ASCII text
MD5:

5181C6D9DC4E7BFCEB83A6A511E1D0CE

SHA1:

818C57DD33D76A2618E3B9C77953946BFB067282

SHA256:

F333D80934E39A0CD2E773DC6C6A47F3D37A62AB8D4B1BF29B579F3D98BA9BFB

SSDEEP:

12288:3xfYbhBEy+YmMyivt3vSvnb+K+OxfYbhBEy+YmMyivt3vSvnP:Ri4Sci+b+dAi4Sci+P

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Order_List_PO# 081928.pdf.exe (PID: 184)
      • mrsscncui.exe (PID: 1480)
      • mrsscncui.exe (PID: 2912)
      • mrsscncui.exe (PID: 2720)
      • mrsscncui.exe (PID: 2488)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3504)
      • schtasks.exe (PID: 3368)
      • schtasks.exe (PID: 1920)
      • schtasks.exe (PID: 1708)
      • schtasks.exe (PID: 2920)
      • schtasks.exe (PID: 3560)

    • Uses Task Scheduler to run other applications

      • Order_List_PO# 081928.pdf.exe (PID: 184)
      • mrsscncui.exe (PID: 1480)
      • mrsscncui.exe (PID: 2720)
      • mrsscncui.exe (PID: 2912)
      • mrsscncui.exe (PID: 2488)

  • SUSPICIOUS

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 628)

    • Executable content was dropped or overwritten

      • Order_List_PO# 081928.pdf.exe (PID: 184)

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 628)

    • Executed via Task Scheduler

      • mrsscncui.exe (PID: 1480)
      • mrsscncui.exe (PID: 2720)
      • mrsscncui.exe (PID: 2912)
      • mrsscncui.exe (PID: 2488)

  • INFO

    • Manual execution by user

      • WinRAR.exe (PID: 820)
      • Order_List_PO# 081928.pdf.exe (PID: 184)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 1) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
60
Monitored processes
17
Malicious processes
2
Suspicious processes
3

Behavior graph

Click at the process to see the details
start outlook.exe winrar.exe no specs order_list_po# 081928.pdf.exe schtasks.exe no specs schtasks.exe no specs mrsscncui.exe no specs schtasks.exe no specs regasm.exe regasm.exe no specs mrsscncui.exe no specs schtasks.exe no specs regasm.exe no specs mrsscncui.exe no specs schtasks.exe no specs regasm.exe no specs mrsscncui.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
628"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\Order List (PO# 081928).eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
820"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Order_List_PO# 081928.pdf.z"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
184"C:\Users\admin\Desktop\Order_List_PO# 081928.pdf.exe" C:\Users\admin\Desktop\Order_List_PO# 081928.pdf.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3504"schtasks.exe" /queryC:\Windows\system32\schtasks.exe—Order_List_PO# 081928.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3368"schtasks.exe" /create /sc MINUTE /tn windowspolicyc /MO 1 /tr C:\Users\admin\mrsscncui.exeC:\Windows\system32\schtasks.exe—Order_List_PO# 081928.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1480C:\Users\admin\mrsscncui.exe C:\Users\admin\mrsscncui.exe—taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1920"schtasks.exe" /queryC:\Windows\system32\schtasks.exe—mrsscncui.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2592"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Order_List_PO# 081928.pdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
4.7.3062.0 built by: NET472REL1
2372"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe—mrsscncui.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
2720C:\Users\admin\mrsscncui.exe C:\Users\admin\mrsscncui.exe—taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Total events
1 724
Read events
1 143
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
2
Text files
28
Unknown types
1

Dropped files

PID
Process
Filename
Type
628OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRAF03.tmp.cvr —
MD5:—
SHA256:—
628OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\tmpB136.tmp —
MD5:—
SHA256:—
628OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\tmpB137.tmp —
MD5:—
SHA256:—
628OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\3EYI5OR0\Order_List_PO# 081928 pdf (2).z\:Zone.Identifier:$DATA —
MD5:—
SHA256:—
820WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa820.10651\Order_List_PO# 081928.pdf.exe —
MD5:—
SHA256:—
628OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:9291ED3D0E6B2DECB8A98E76FDDE7103
SHA256:DC5DA17A31CB406A1E6D2EDCD0D5D726173D7B1D029D5C8C6701649C3817BD4E
628OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CCCBF109.datimage
MD5:03ABA903E94DD3F31C79BA4FC9CEECBF
SHA256:5C013A72EB046CDDDAB003D179E4063F330EA5247CFA3C89BB260DADA07E4741
628OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:58E4AB88AEF25381257EAE2A2B4E696A
SHA256:5F56278F52AA73A33D4B4777B2FE2BFB0AAED432873FBB782DAC00FF26ECA260
628OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_AFCED6AA791EE343BC8912E79C6FFD26.datxml
MD5:B21ED3BD946332FF6EBC41A87776C6BB
SHA256:B1AAC4E817CD10670B785EF8E5523C4A883F44138E50486987DC73054A46F6F4
628OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ContactPrefs_2_AD58F096E01CB34E806141F811E20DA7.datxml
MD5:BBCF400BD7AE536EB03054021D6A6398
SHA256:383020065C1F31F4FB09F448599A6D5E532C390AF4E5B8AF0771FE17A23222AD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
9
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
628
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
628
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
2592
RegAsm.exe
185.157.162.81:9980
—
Obenetwork AB
SE
suspicious
2592
RegAsm.exe
104.23.99.190:443
pastebin.com
Cloudflare Inc
US
malicious

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
pastebin.com
  • 104.23.99.190
  • 104.23.98.190
shared
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Order List (PO# 081928).eml