Windows Analysis Report
nested-FW%3A payment.eml

Overview

General Information

Sample name:	nested-FW%3A payment.eml
Analysis ID:	1524544
MD5:	5f8f0b0e9907ebba6720c25b2382904c
SHA1:	84d0ffd0e4274ef1dd297c62e51b7f76bfcfeaa2
SHA256:	b7f88f3aa4c7254cb9137193967ca07d2ba4cc99c7e44c91ec21ed5eea70ed31
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Creates a window with clipboard capturing capabilities

Sigma detected: Suspicious Office Outbound Connections

Sigma detected: Use Short Name Path in Command Line

Classification

Signatures

Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{0C98E726-7671-4943-B9C9-067EE3A43554}.tmp

Jump to behavior

Source: global traffic

DNS traffic detected: DNS query: config.messenger.msn.com

Source: nested-FW%3A payment.eml	String found in binary or memory: https://srfed-my.sharepoint.com/:f:/p/paul_scace/EtC5e2XquN9Fp0K3Sw7IAUsB1=
Source: ~WRS{0C98E726-7671-4943-B9C9-067EE3A43554}.tmp.0.dr	String found in binary or memory: https://srfed-my.sharepoint.com/:f:/p/paul_scace/EtC5e2XquN9Fp0K3Sw7IAUsB1jH11BqdCOET9BKLSlV1Tw?e=jP

Creates a window with clipboard capturing capabilities

Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: classification engine

Classification label: clean1.winEML@1/11@1/0

Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook.pst.tmp

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR8610.tmp

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE

Window detected: Number of UI elements: 15

Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
config.messenger.msn.com	unknown	unknown

ID:	1524544
Product:	CloudBasic
Start time:	00:01:19
Start date:	03.10.2024
Sample:	nested-FW%3A payment.eml
Cookbook:	default.jbs
System description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Architecture:	WINDOWS
MD5:	5f8f0b0e9907ebba6720c25b2382904c
SHA1:	84d0ffd0e4274ef1dd297c62e51b7f76bfcfeaa2
SHA256:	b7f88f3aa4c7254cb9137193967ca07d2ba4cc99c7e44c91ec21ed5eea70ed31

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\FORMS\FRMDATA64.DAT	data	CE1E2BF84590B058CB239E5FC28EE42E	E66677F634CA524E3CE8963A7D84EDFEA890C34E	355843696F3CB150CB830492B1BB6953878D6AC4AE70BA06603D5D64DA1102C0
C:\Users\user\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_C164271868E29D47BDEA29AB4D73CA8B.dat	XML 1.0 document, ASCII text, with CRLF line terminators	E059A0413C05A7539F3C7946435AE633	215A7015B625729123FB9DFF3A91BF72BCCB88F7	84F1A732EFEFB64300D3D715FC6CB8C5D9C357CFDD15CB6C27FB772128202537
C:\Users\user\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ContactPrefs_2_250D2E3C8794BC4E95FB6A4333D8D9DC.dat	XML 1.0 document, ASCII text, with CRLF line terminators	9582984B137701598BAC91FFB5B86FED	16373CF4B0BDEE47D85BA39981B9A9499E59D34E	9F5BE8ABA6283365BA05FAF08B54A7196E64B2146986D00BAED2FBDA8CF6482B
C:\Users\user\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ConversationPrefs_2_614BC982876BD14E82F4092077D7C625.dat	XML 1.0 document, ASCII text, with CRLF line terminators	57F30B1BCA811C2FCB81F4C13F6A927B	FE5ADC0968CF5727AE2D77FD57F39E552319C8E8	612BAD93621991CB09C347FF01EC600B46617247D5C041311FF459E247D8C2D3
C:\Users\user\AppData\Local\Microsoft\Outlook\RoamCache\Stream_TCPrefs_2_DE059256C55A1A4A853D9F1B8B61224D.dat	XML 1.0 document, ASCII text, with CRLF line terminators	F194B1FA12F9B6F46A47391FAE8BEEC2	A98AA68D6755CEF50B9AAF0B8ACFF6266BC49493	FCD8D7E030BE6EA7588E5C6CB568E3F1BDFC263942074B693942A27DF9521A74
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\901EE597.dat	PNG image data, 519 x 223, 8-bit/color RGBA, non-interlaced	B7A10E3C1A0B57A0F176148B01C85C2E	1C0DC3E517845089B7017CC2CBF2AB3F5C666071	C87B50239968BD8BCBA1DC27F042496A9A585C04E3EA01315871E88EF0A4E152
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{0C98E726-7671-4943-B9C9-067EE3A43554}.tmp	data	3E9402A4E29ADF43011C5F3FF8DB7868	FE875EFB109C5CDDD2BE31FBB71DEB3502FEAE97	6C28376E621A068809FB9C978D2084633D74098C3B94D555B8BA3A61C354244C
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\{4754ED9B-5C17-43EF-BD57-96744A09B729}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.png	PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced	4C61C12EDBC453D7AE184976E95258E1	87C1B3E9B6A11579F89CF92C0DB811E22840A3C2	296526F9A716C1AA91BA5D6F69F0EB92FDF79C2CB2CFCF0CEB22B7CCBC27035F
C:\Users\user\AppData\Roaming\Microsoft\Outlook\Outlook.srs	Composite Document File V2 Document, Cannot read section info	7CCEAB209E6B24B8965F7AA5DD8D54FD	DFE92CD93ED9E105D6341DD6B4D199B6760BEEBA	3508389D54C37E2D65F09E7D8BC20D04B696DADED43DDC3E97B12623721DA3E8
C:\Users\user\Documents\Outlook Files\Outlook.pst	Microsoft Outlook email folder (>=2003)	9184F736B257CE0B0BFF808054CF3C12	AA0A2F0C5A00B5C29FAC5EC28CF1AABC9A271D76	98A38299425E5CC6A25ADD3B814841A14540B508409FC1999A668C405A6C0025
C:\Users\user\Documents\Outlook Files\~Outlook.pst.tmp	data	FCD6BCB56C1689FCEF28B57C22475BAD	1ADC95BEBE9EEA8C112D40CD04AB7A8D75C4F961	DE2F256064A0AF797747C2B97505DC0B9F3DF0DE4F489EAC731C23AE9CA9CC31

Windows Analysis Report
nested-FW%3A payment.eml

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report nested-FW%3A payment.eml

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
nested-FW%3A payment.eml