analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

a8d81ff8-f95b-410d-da58-08da553d41f6_49c31ca4-8b70-ae24-0929-eee9aeeb941c.eml

Full analysis: https://app.any.run/tasks/207f1fbe-b06e-425b-8787-1f1e8ec182e6
Verdict: Malicious activity
Analysis date: June 27, 2022, 12:35:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
MIME: message/rfc822
File info: RFC 822 mail, ASCII text, with very long lines, with CRLF line terminators
MD5:

4BBB98182BE7F083CCCC10652936C6BE

SHA1:

E05FF8508D4881FB6C2DCA440BFE632BF623C700

SHA256:

FFF157EE73D95C020C61CA206A1A296F3B41B2EBE597D28C3BCDB67B214E91F4

SSDEEP:

1536:xJlQFCAMdrM3PXFCkio3EWZwvAy4WI6QCS9PaU2WD0XiC5NXYyg2S6eGC5NXYygi:xJqQDM/FXHZsWD0Xic/eGcc6pEjwTjgA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the computer name

      • OUTLOOK.EXE (PID: 1416)

    • Checks supported languages

      • OUTLOOK.EXE (PID: 1416)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 1416)

    • Searches for installed software

      • OUTLOOK.EXE (PID: 1416)

  • INFO

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 1416)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 5) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe

Process information

PID
CMD
Path
Indicators
Parent process
1416"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\a8d81ff8-f95b-410d-da58-08da553d41f6_49c31ca4-8b70-ae24-0929-eee9aeeb941c.eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
Total events
4 005
Read events
3 434
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
14
Unknown types
1

Dropped files

PID
Process
Filename
Type
1416OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR9801.tmp.cvr —
MD5:—
SHA256:—
1416OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst —
MD5:—
SHA256:—
1416OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:A782B20F316F0C45A82A5CA64A20946F
SHA256:57AD989A2D3393A040A7150393E4870BCCFB902DE09CEFFFE06CA4E94B6689E0
1416OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E66952BD.datimage
MD5:B7BF006CADF5CA96573090C2DCA1CD96
SHA256:2D350CCA16F2A164194E12F250C3739F26AC6C7243933700E2553F5026B37AF7
1416OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:F14B8EDF5AF2DFD52B5F89ADA45D74B7
SHA256:AFF9F141BBA1E7950472A7FAF302C9598126FC86FCB0414A088B3C6827C07086
1416OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6FFD4AAC.datimage
MD5:7353F04262F009A834ABE3EC6D751BAC
SHA256:829908AA36E680A584BB250F12911B43CCD6F5C48DDF43110DFE8671AA1A8459
1416OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_7C0E32BD98333344B72465337C884139.datxml
MD5:B21ED3BD946332FF6EBC41A87776C6BB
SHA256:B1AAC4E817CD10670B785EF8E5523C4A883F44138E50486987DC73054A46F6F4
1416OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_WorkHours_1_0F242EEAA0585B468D62D25D2E18C8E8.datxml
MD5:807EF0FC900FEB3DA82927990083D6E7
SHA256:4411E7DC978011222764943081500FFF0E43CBF7CCD44264BD1AB6306CA68913
1416OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ContactPrefs_2_F16466F9DA1F5344A5EC56418365C4C2.datxml
MD5:BBCF400BD7AE536EB03054021D6A6398
SHA256:383020065C1F31F4FB09F448599A6D5E532C390AF4E5B8AF0771FE17A23222AD
1416OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_TCPrefs_2_45CC746C4C0BA242AF96B38EA8321B3D.datxml
MD5:F194B1FA12F9B6F46A47391FAE8BEEC2
SHA256:FCD8D7E030BE6EA7588E5C6CB568E3F1BDFC263942074B693942A27DF9521A74
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1416
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
a8d81ff8-f95b-410d-da58-08da553d41f6_49c31ca4-8b70-ae24-0929-eee9aeeb941c.eml