File name:

Fw_ Remittance Advice 001-ADEG001.eml

Full analysis: https://app.any.run/tasks/2731a725-a4df-44b5-8b3d-ab2ed869de5e
Verdict: Malicious activity
Analysis date: July 13, 2020, 06:11:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
autoit
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines
MD5:

66654871A24237A87DD3C68196A9B983

SHA1:

597C70A476918FB76F5D5469ACA117D342E596D8

SHA256:

F4A7BDDCFDC3B7331A4B0899ED2BD1CAEC230229E51DF3353673DC402F691041

SSDEEP:

24576:1ZixPBJu+6vla8tMz0L9VEbeY0GvnDBrZoZa0QrTIx+ZV5u:na8x+eUvDFZ2a5TIxf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • RegSvcs.exe (PID: 1748)
      • Remittance Advice001-ADEG001#pdf.exe (PID: 3624)
      • qtghch.pif (PID: 2924)
      • Remittance Advice001-ADEG001#pdf.exe (PID: 4092)
      • RegSvcs.exe (PID: 2072)
      • qtghch.pif (PID: 3116)

    • Changes the autorun value in the registry

      • qtghch.pif (PID: 3116)
      • qtghch.pif (PID: 2924)

    • Actions looks like stealing of personal data

      • RegSvcs.exe (PID: 2072)

    • Changes settings of System certificates

      • RegSvcs.exe (PID: 2072)

  • SUSPICIOUS

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 1336)
      • Remittance Advice001-ADEG001#pdf.exe (PID: 3624)
      • Remittance Advice001-ADEG001#pdf.exe (PID: 4092)
      • RegSvcs.exe (PID: 2072)

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 1336)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2664)
      • Remittance Advice001-ADEG001#pdf.exe (PID: 3624)
      • qtghch.pif (PID: 2924)

    • Starts application with an unusual extension

      • Remittance Advice001-ADEG001#pdf.exe (PID: 3624)
      • Remittance Advice001-ADEG001#pdf.exe (PID: 4092)

    • Drop AutoIt3 executable file

      • Remittance Advice001-ADEG001#pdf.exe (PID: 3624)

    • Reads the cookies of Google Chrome

      • RegSvcs.exe (PID: 2072)

    • Reads the cookies of Mozilla Firefox

      • RegSvcs.exe (PID: 2072)

    • Reads Environment values

      • RegSvcs.exe (PID: 2072)

    • Adds / modifies Windows certificates

      • RegSvcs.exe (PID: 2072)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • Remittance Advice001-ADEG001#pdf.exe (PID: 3624)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 1336)

    • Manual execution by user

      • Remittance Advice001-ADEG001#pdf.exe (PID: 4092)

    • Reads settings of System Certificates

      • RegSvcs.exe (PID: 2072)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 3) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
8
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start outlook.exe winrar.exe remittance advice001-adeg001#pdf.exe qtghch.pif regsvcs.exe no specs remittance advice001-adeg001#pdf.exe qtghch.pif regsvcs.exe

Process information

PID
CMD
Path
Indicators
Parent process
1336"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\Fw_ Remittance Advice 001-ADEG001.eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\progra~1\micros~1\office14\outlook.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1748"C:\Users\admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\admin\AppData\Local\Temp\RegSvcs.exe—qtghch.pif
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
4294967295
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\users\admin\appdata\local\temp\regsvcs.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2072"C:\Users\admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\admin\AppData\Local\Temp\RegSvcs.exe
qtghch.pif
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Services Installation Utility
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\users\admin\appdata\local\temp\regsvcs.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2664"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\8KOTGNOD\Remittance Advice001-ADEG001#pdf.rar"C:\Program Files\WinRAR\WinRAR.exe
OUTLOOK.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2924"C:\Users\admin\AppData\Roaming\04013055\qtghch.pif" kbixi.rvgC:\Users\admin\AppData\Roaming\04013055\qtghch.pif
Remittance Advice001-ADEG001#pdf.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 8, 1
Modules
Images
c:\users\admin\appdata\roaming\04013055\qtghch.pif
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
3116"C:\Users\admin\AppData\Roaming\04013055\qtghch.pif" kbixi.rvgC:\Users\admin\AppData\Roaming\04013055\qtghch.pif
Remittance Advice001-ADEG001#pdf.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
HIGH
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 8, 1
Modules
Images
c:\users\admin\appdata\roaming\04013055\qtghch.pif
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
3624"C:\Users\admin\AppData\Local\Temp\Rar$EXa2664.8272\Remittance Advice001-ADEG001#pdf.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2664.8272\Remittance Advice001-ADEG001#pdf.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2664.8272\remittance advice001-adeg001#pdf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
4092"C:\Users\admin\Desktop\Remittance Advice001-ADEG001#pdf.exe" C:\Users\admin\Desktop\Remittance Advice001-ADEG001#pdf.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
10
Modules
Images
c:\users\admin\desktop\remittance advice001-adeg001#pdf.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
4 263
Read events
2 494
Write events
1 750
Delete events
19

Modification events

(PID) Process:(1336) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(1336) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(1336) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(1336) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(1336) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(1336) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(1336) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(1336) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(1336) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
Off
(PID) Process:(1336) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1055
Value:
Off
Executable files
4
Suspicious files
2
Text files
51
Unknown types
1

Dropped files

PID
Process
Filename
Type
1336OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR6B92.tmp.cvr —
MD5:—
SHA256:—
1336OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\tmp6E13.tmp —
MD5:—
SHA256:—
1336OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\8KOTGNOD\Remittance Advice001-ADEG001#pdf (2).rar\:Zone.Identifier:$DATA —
MD5:—
SHA256:—
3624Remittance Advice001-ADEG001#pdf.exeC:\Users\admin\AppData\Roaming\04013055\kbixi.rvg —
MD5:—
SHA256:—
1336OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:—
SHA256:—
1336OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_C4E17F74A44AEC44BC58F94EF8E50762.datxml
MD5:B21ED3BD946332FF6EBC41A87776C6BB
SHA256:B1AAC4E817CD10670B785EF8E5523C4A883F44138E50486987DC73054A46F6F4
3624Remittance Advice001-ADEG001#pdf.exeC:\Users\admin\AppData\Roaming\04013055\gual.pdftext
MD5:—
SHA256:—
1336OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\8KOTGNOD\Remittance Advice001-ADEG001#pdf.rarcompressed
MD5:—
SHA256:—
1336OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:—
SHA256:—
1336OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\8KOTGNOD\Remittance Advice001-ADEG001#pdf (2).rarcompressed
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
2
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1336
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1336
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
2072
RegSvcs.exe
77.88.21.158:587
smtp.yandex.com
YANDEX LLC
RU
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
smtp.yandex.com
  • 77.88.21.158
malicious

Threats

PID
Process
Class
Message
2072
RegSvcs.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2072
RegSvcs.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Fw_ Remittance Advice 001-ADEG001.eml