analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Fw_ Remittance Advice 001-ADEG001.eml

Full analysis: https://app.any.run/tasks/2731a725-a4df-44b5-8b3d-ab2ed869de5e
Verdict: Malicious activity
Analysis date: July 13, 2020, 06:11:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
autoit
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines
MD5:

66654871A24237A87DD3C68196A9B983

SHA1:

597C70A476918FB76F5D5469ACA117D342E596D8

SHA256:

F4A7BDDCFDC3B7331A4B0899ED2BD1CAEC230229E51DF3353673DC402F691041

SSDEEP:

24576:1ZixPBJu+6vla8tMz0L9VEbeY0GvnDBrZoZa0QrTIx+ZV5u:na8x+eUvDFZ2a5TIxf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Remittance Advice001-ADEG001#pdf.exe (PID: 3624)
      • qtghch.pif (PID: 2924)
      • RegSvcs.exe (PID: 1748)
      • Remittance Advice001-ADEG001#pdf.exe (PID: 4092)
      • RegSvcs.exe (PID: 2072)
      • qtghch.pif (PID: 3116)

    • Changes the autorun value in the registry

      • qtghch.pif (PID: 2924)
      • qtghch.pif (PID: 3116)

    • Actions looks like stealing of personal data

      • RegSvcs.exe (PID: 2072)

    • Changes settings of System certificates

      • RegSvcs.exe (PID: 2072)

  • SUSPICIOUS

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 1336)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 1336)
      • Remittance Advice001-ADEG001#pdf.exe (PID: 3624)
      • Remittance Advice001-ADEG001#pdf.exe (PID: 4092)
      • RegSvcs.exe (PID: 2072)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2664)
      • Remittance Advice001-ADEG001#pdf.exe (PID: 3624)
      • qtghch.pif (PID: 2924)

    • Drop AutoIt3 executable file

      • Remittance Advice001-ADEG001#pdf.exe (PID: 3624)

    • Starts application with an unusual extension

      • Remittance Advice001-ADEG001#pdf.exe (PID: 3624)
      • Remittance Advice001-ADEG001#pdf.exe (PID: 4092)

    • Reads Environment values

      • RegSvcs.exe (PID: 2072)

    • Reads the cookies of Google Chrome

      • RegSvcs.exe (PID: 2072)

    • Reads the cookies of Mozilla Firefox

      • RegSvcs.exe (PID: 2072)

    • Adds / modifies Windows certificates

      • RegSvcs.exe (PID: 2072)

  • INFO

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 1336)

    • Dropped object may contain Bitcoin addresses

      • Remittance Advice001-ADEG001#pdf.exe (PID: 3624)

    • Manual execution by user

      • Remittance Advice001-ADEG001#pdf.exe (PID: 4092)

    • Reads settings of System Certificates

      • RegSvcs.exe (PID: 2072)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 3) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
8
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start outlook.exe winrar.exe remittance advice001-adeg001#pdf.exe qtghch.pif regsvcs.exe no specs remittance advice001-adeg001#pdf.exe qtghch.pif regsvcs.exe

Process information

PID
CMD
Path
Indicators
Parent process
1336"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\Fw_ Remittance Advice 001-ADEG001.eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
2664"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\8KOTGNOD\Remittance Advice001-ADEG001#pdf.rar"C:\Program Files\WinRAR\WinRAR.exe
OUTLOOK.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3624"C:\Users\admin\AppData\Local\Temp\Rar$EXa2664.8272\Remittance Advice001-ADEG001#pdf.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2664.8272\Remittance Advice001-ADEG001#pdf.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2924"C:\Users\admin\AppData\Roaming\04013055\qtghch.pif" kbixi.rvgC:\Users\admin\AppData\Roaming\04013055\qtghch.pif
Remittance Advice001-ADEG001#pdf.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Version:
3, 3, 8, 1
1748"C:\Users\admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\admin\AppData\Local\Temp\RegSvcs.exe—qtghch.pif
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
4294967295
Version:
4.7.3062.0 built by: NET472REL1
4092"C:\Users\admin\Desktop\Remittance Advice001-ADEG001#pdf.exe" C:\Users\admin\Desktop\Remittance Advice001-ADEG001#pdf.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
10
3116"C:\Users\admin\AppData\Roaming\04013055\qtghch.pif" kbixi.rvgC:\Users\admin\AppData\Roaming\04013055\qtghch.pif
Remittance Advice001-ADEG001#pdf.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
HIGH
Description:
AutoIt v3 Script
Version:
3, 3, 8, 1
2072"C:\Users\admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\admin\AppData\Local\Temp\RegSvcs.exe
qtghch.pif
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Services Installation Utility
Version:
4.7.3062.0 built by: NET472REL1
Total events
4 263
Read events
2 494
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
2
Text files
51
Unknown types
1

Dropped files

PID
Process
Filename
Type
1336OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR6B92.tmp.cvr —
MD5:—
SHA256:—
1336OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\tmp6E13.tmp —
MD5:—
SHA256:—
1336OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\8KOTGNOD\Remittance Advice001-ADEG001#pdf (2).rar\:Zone.Identifier:$DATA —
MD5:—
SHA256:—
3624Remittance Advice001-ADEG001#pdf.exeC:\Users\admin\AppData\Roaming\04013055\kbixi.rvg —
MD5:—
SHA256:—
1336OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:F7BDEF551F6E8EE13AF5666859769B95
SHA256:8CAC895F1A080B6904F5A86A6DDCC1C75586F4F2B83A8EDA3B95F9C15961F859
3624Remittance Advice001-ADEG001#pdf.exeC:\Users\admin\AppData\Roaming\04013055\kaqlniv.xlstext
MD5:371B26B9B76BEB56839A27510DB3348D
SHA256:4F56766614AB091047333288FDAE21EEF21E7594F6C79D774C77FD089F95E03F
1336OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\8KOTGNOD\Remittance Advice001-ADEG001#pdf (2).rarcompressed
MD5:81715FA39C04E51D0E9D38BC060ABF34
SHA256:E4C3936A377DA5367FA413516641F7C4528D6DC7DD13A14E272F410AB7E7E350
1336OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\8KOTGNOD\Remittance Advice001-ADEG001#pdf.rarcompressed
MD5:81715FA39C04E51D0E9D38BC060ABF34
SHA256:E4C3936A377DA5367FA413516641F7C4528D6DC7DD13A14E272F410AB7E7E350
1336OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:621895D33A3DCFFB36A56236D8534081
SHA256:5D12EAFF33057687741878D8D0D364B2A88D145F9DB34C3182D94CD5163CE382
3624Remittance Advice001-ADEG001#pdf.exeC:\Users\admin\AppData\Roaming\04013055\cksi.dattext
MD5:9226BA7CA633BF82BA8F0C5D3C6FFB10
SHA256:E94F5C9A182CF5D670874C98F0FDBBE519E3CD3437DCC01D71C1BE6EA5990437
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1336
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1336
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
2072
RegSvcs.exe
77.88.21.158:587
smtp.yandex.com
YANDEX LLC
RU
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
smtp.yandex.com
  • 77.88.21.158
shared

Threats

PID
Process
Class
Message
2072
RegSvcs.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2072
RegSvcs.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Fw_ Remittance Advice 001-ADEG001.eml