analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

phish_alert_sp2_2.0.0.0.eml

Full analysis: https://app.any.run/tasks/df5c491a-7081-4f4d-8dfd-34babdab2868
Verdict: Malicious activity
Analysis date: August 12, 2022, 17:01:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: message/rfc822
File info: RFC 822 mail, ASCII text, with very long lines, with CRLF line terminators
MD5:

EAA28EBCB44AF7B0188B24F01159F32C

SHA1:

EC880A8EF60843A2E4E9455AD464F051392E197B

SHA256:

FFED036D5B74A23F0E433206BD9A2DCA64871D9FC68D2E143FE48E1887695F1E

SSDEEP:

192:H3KbZnmlIe4Ke0WlP5c1LObriJxx8+sOq1:Hum2tve1ayJxxtE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Checks supported languages

      • OUTLOOK.EXE (PID: 3576)
      • OUTLOOK.EXE (PID: 2792)

    • Reads the computer name

      • OUTLOOK.EXE (PID: 3576)

    • Application launched itself

      • OUTLOOK.EXE (PID: 3576)

    • Reads Microsoft Outlook installation path

      • OUTLOOK.EXE (PID: 3576)
      • iexplore.exe (PID: 3600)

    • Searches for installed software

      • OUTLOOK.EXE (PID: 3576)

  • INFO

    • Reads settings of System Certificates

      • OUTLOOK.EXE (PID: 3576)
      • iexplore.exe (PID: 3600)
      • iexplore.exe (PID: 1488)

    • Checks Windows Trust Settings

      • OUTLOOK.EXE (PID: 3576)
      • iexplore.exe (PID: 1488)
      • iexplore.exe (PID: 3600)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2792)
      • OUTLOOK.EXE (PID: 3576)

    • Checks supported languages

      • iexplore.exe (PID: 3600)
      • iexplore.exe (PID: 1488)

    • Reads the computer name

      • iexplore.exe (PID: 1488)
      • iexplore.exe (PID: 3600)

    • Application launched itself

      • iexplore.exe (PID: 1488)

    • Changes internet zones settings

      • iexplore.exe (PID: 1488)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1488)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1488)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3600)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 5) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe outlook.exe no specs iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3576"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\phish_alert_sp2_2.0.0.0.eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2792"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" -c IPM.Note /m "mailto:[email protected]"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE—OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\gdi32.dll
1488"C:\Program Files\Internet Explorer\iexplore.exe" http://link.email.dynect.net/link.php?DynEngagement=true&H=ZMyLy4zTjFxrCOdStp0zbd2NiCP4ytwFjHTp6a9KcMS5g16ubipo%2FrzuYxYF%2B97OSN6SXY20ZbdRMAzyWhepoaZSBiL7cAQCVqUQQ8GNxc9tszBGW62g2D7ar5%2FatIdM97dIdks0whQ%3D&G=0&R=https%3A%2F%2Fapp.hatchbuck.com%2FSignUp%2FUnsubscribe%3Fid%3DLujRZfdYCvA6WSQX6xhtc9TX9YvHpJA7fM_iUZRW5ym2PDhcexvgE5fIe6RhOrsO0&I=20220812164755.00000013385e%40smtp-ad1-49-phx&X=MHwxMjU5MjE4OjI3MjY0MjA1NTI7MXwxMjU5MjE5OjIzMTQ4NTg2Njs%3D&V=3&S=nWDPc0UrOVCgvLfuk_ObyrBF63nokjfyeeeLAjH3uu4C:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3600"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1488 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\iertutil.dll
Total events
24 822
Read events
24 052
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
32
Text files
58
Unknown types
26

Dropped files

PID
Process
Filename
Type
3576OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRD650.tmp.cvr —
MD5:—
SHA256:—
3576OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst —
MD5:—
SHA256:—
2792OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR3103.tmp.cvr —
MD5:—
SHA256:—
3576OUTLOOK.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:C7EC0A2E0B3ADAF524D0164BA1F230F3
SHA256:6297F9261BA617BA08473DA7804B71FF55CD61B03FE7BC6CC1254ED436DFEDF2
3576OUTLOOK.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894der
MD5:5BB5CA42084D14764DDE113367306D3D
SHA256:414CD473A33EBAD34C28C08587BDF269E35A2CD1AD3E7DB273AFC5CB47480F30
3576OUTLOOK.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894binary
MD5:7887FB4EFF4B30A086CA8C7F1B1C23BE
SHA256:5B789EF5718DDF9233AA740FB702ABA58B7F88C99D9CBE592CAE2A5220252BED
3576OUTLOOK.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D6243C18F0F8F9AEC6638DD210F1984_87B795CAAEAF416D2E26B0D1C67CF759der
MD5:5EE77FEBDFDC2FE24C3A1E77FED8E2E8
SHA256:0B2C94B11C5702980984047B65902B89DAE04E6F277025B039902C81A64F989B
3576OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_RssRule_2_1B964D4EB7C2A64C8721F7E4AADCA286.datxml
MD5:D8B37ED0410FB241C283F72B76987F18
SHA256:31E68049F6B7F21511E70CD7F2D95B9CF1354CF54603E8F47C1FC40F40B7A114
3576OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:096561B2DF3773723CCBBBE3C740CFB1
SHA256:83036B67BD0CC2AEC4F12D416FBD5EEE2123197F98BF2A460155E34A85789BBE
3576OUTLOOK.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\620BEF1064BD8E252C599957B3C91896der
MD5:27EF00046ED89574D41848FBC734B9EB
SHA256:50CD79D6C13FDCE35B21CC08DBBA90172B619B6EEF1AEC6DCFF2A6393F0FE007
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
94
DNS requests
46
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3576
OUTLOOK.EXE
GET
200
13.225.84.175:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D
US
der
1.39 Kb
shared
3576
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
3600
iexplore.exe
GET
302
147.154.102.193:80
http://link.email.dynect.net/link.php?DynEngagement=true&H=ZMyLy4zTjFxrCOdStp0zbd2NiCP4ytwFjHTp6a9KcMS5g16ubipo%2FrzuYxYF%2B97OSN6SXY20ZbdRMAzyWhepoaZSBiL7cAQCVqUQQ8GNxc9tszBGW62g2D7ar5%2FatIdM97dIdks0whQ%3D&G=0&R=https%3A%2F%2Fapp.hatchbuck.com%2FSignUp%2FUnsubscribe%3Fid%3DLujRZfdYCvA6WSQX6xhtc9TX9YvHpJA7fM_iUZRW5ym2PDhcexvgE5fIe6RhOrsO0&I=20220812164755.00000013385e%40smtp-ad1-49-phx&X=MHwxMjU5MjE4OjI3MjY0MjA1NTI7MXwxMjU5MjE5OjIzMTQ4NTg2Njs%3D&V=3&S=nWDPc0UrOVCgvLfuk_ObyrBF63nokjfyeeeLAjH3uu4
US
—
—
whitelisted
1488
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3600
iexplore.exe
GET
200
151.101.2.133:80
http://ocsp2.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEHr7M35ZTSPHb9t8TGKb2tY%3D
US
der
1.40 Kb
whitelisted
3576
OUTLOOK.EXE
GET
200
13.225.84.104:80
http://ocsp.sca1b.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEA7p6nb44vOS6k180MZvH9Y%3D
US
der
471 b
whitelisted
3576
OUTLOOK.EXE
GET
200
13.225.84.104:80
http://ocsp.sca1b.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEAzOpcYJCrGrjv9ZLTtXZUw%3D
US
der
471 b
whitelisted
3576
OUTLOOK.EXE
GET
200
13.225.84.58:80
http://crl.rootca1.amazontrust.com/rootca1.crl
US
der
493 b
whitelisted
1488
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3600
iexplore.exe
GET
200
13.225.84.66:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3600
iexplore.exe
147.154.102.193:80
link.email.dynect.net
—
US
unknown
3576
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
3576
OUTLOOK.EXE
209.197.3.8:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
3576
OUTLOOK.EXE
18.66.139.39:443
e6mubp.img.hatchbuckinbox.com
Massachusetts Institute of Technology
US
shared
3576
OUTLOOK.EXE
99.86.247.98:80
o.ss2.us
AT&T Services, Inc.
US
unknown
3576
OUTLOOK.EXE
13.225.84.172:80
s.ss2.us
—
US
unknown
3576
OUTLOOK.EXE
13.225.84.49:80
ocsp.rootg2.amazontrust.com
—
US
whitelisted
3576
OUTLOOK.EXE
54.88.204.136:443
app.hatchbuck.com
Amazon.com, Inc.
US
unknown
3600
iexplore.exe
13.225.84.66:80
o.ss2.us
—
US
suspicious
3600
iexplore.exe
54.88.204.136:443
app.hatchbuck.com
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
e6mubp.img.hatchbuckinbox.com
  • 18.66.139.39
  • 18.66.139.66
  • 18.66.139.74
  • 18.66.139.105
malicious
ctldl.windowsupdate.com
  • 209.197.3.8
  • 178.79.242.0
  • 95.140.236.0
whitelisted
o.ss2.us
  • 99.86.247.98
  • 99.86.247.16
  • 99.86.247.31
  • 99.86.247.118
  • 13.225.84.66
  • 13.225.84.42
  • 13.225.84.97
  • 13.225.84.68
whitelisted
s.ss2.us
  • 13.225.84.172
  • 13.225.84.92
  • 13.225.84.53
  • 13.225.84.50
whitelisted
ocsp.rootg2.amazontrust.com
  • 13.225.84.49
  • 13.225.84.175
  • 13.225.84.145
  • 13.225.84.13
whitelisted
link.email.dynect.net
  • 147.154.102.193
  • 130.35.144.103
whitelisted
ocsp.rootca1.amazontrust.com
  • 13.225.84.175
  • 13.225.84.13
  • 13.225.84.49
  • 13.225.84.145
shared
crl.rootca1.amazontrust.com
  • 13.225.84.58
  • 13.225.84.120
  • 13.225.84.149
  • 13.225.84.14
whitelisted
ocsp.sca1b.amazontrust.com
  • 13.225.84.104
  • 13.225.84.107
  • 13.225.84.142
  • 13.225.84.88
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
phish_alert_sp2_2.0.0.0.eml