Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Modelo D4 ejercicio 2023.msg

Overview

General Information

Sample name:	Modelo D4 ejercicio 2023.msg
Analysis ID:	1592709
MD5:	62a215df68bcf8cd19b771533952aedc
SHA1:	d06b0d19097d4a3a0ad40ed06ccb55e1a558296c
SHA256:	0da74951bed8cd8bd9ecd1ae8ceb41347a42d58df2f239299a249482277e8b92
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Detected non-DNS traffic on DNS port

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores large binary data to the registry

Classification

×

Process Tree

System is w10x64

OUTLOOK.EXE (PID: 2820 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Modelo D4 ejercicio 2023.msg" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 5644 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "12157C9C-F2AB-4554-9279-52D2C9B95A50" "129406FC-B878-4C9B-A7A3-7BCE9A003929" "2820" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 2820, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global traffic	TCP traffic: 192.168.2.5:61641 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:61409 -> 162.159.36.2:53

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2

Source: Modelo D4 ejercicio 2023.msg

String found in binary or memory: https://aka.ms/LearnAboutSenderIdentification

Source: classification engine

Classification label: clean2.winMSG@3/4@0/0

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250116T0708110674-2820.etl

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Modelo D4 ejercicio 2023.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "12157C9C-F2AB-4554-9279-52D2C9B95A50" "129406FC-B878-4C9B-A7A3-7BCE9A003929" "2820" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "12157C9C-F2AB-4554-9279-52D2C9B95A50" "129406FC-B878-4C9B-A7A3-7BCE9A003929" "2820" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"			Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll			Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX			Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Modify Registry	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://aka.ms/LearnAboutSenderIdentification	Modelo D4 ejercicio 2023.msg	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1592709
Start date and time:	2025-01-16 13:07:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Modelo D4 ejercicio 2023.msg
Detection:	CLEAN
Classification:	clean2.winMSG@3/4@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .msg

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 52.109.89.18, 52.113.194.132, 20.42.73.28, 4.175.87.197, 13.107.246.45
Excluded domains from analysis (whitelisted): ecs.office.com, slscr.update.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, ctldl.windowsupdate.com, weu-azsc-config.officeapps.live.com, s-0005-office.config.skype.com, mobile.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, ecs-office.s-0005.s-msedge.net, s-0005.s-msedge.net, config.officeapps.live.com, 4.8.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0.2.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa, officeclient.microsoft.com, onedscolprdeus15.eastus.cloudapp.azure.com, ecs.office.trafficmanager.net, europe.configsvc1.live.com.akadns.net, mobile.events.data.trafficmanager.net
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

⊘No simulations

LLM Input / Output

Input	Output
URL: email Model: Joe Sandbox AI	{ "explanation": [ "The email appears to be a legitimate government communication regarding missing tax/regulatory forms (Modelo D4)", "The sender domain (@economia.gob.es) is a legitimate Spanish government domain", "The content and tone are professional and specific, referencing actual form numbers and legal requirements" ], "phishing": false, "confidence": 8, "generated_by_ai": false }
{ "date": "Thu, 16 Jan 2025 12:53:33 +0100", "subject": "Modelo D4 ejercicio 2023", "communications": [ "\t\nNo suele recibir correo electrnico de nalcainaa@economia.gob.es. <https://aka.ms/LearnAboutSenderIdentification> Por qu es esto importante \n\t\n\nBuenas tardes:\n\nLes escribimos porque en el ao 2023 enviaron el modelo B87948477_D1A_8073729, relativo a la sociedad GGTECH ENTERTAINMENT, S.L.. Durante el ao 2024 no han presentado el modelo D4 relativo al ejercicio 2023 de dicha compaa, y tampoco se ha presentado modelo D1B informando de una posible desinversin. \n\nNos gustara conocer el motivo por el que no se ha presentado este modelo, y que regularizaran su situacin, bien enviando el modelo D4 requerido, o bien mediante el modelo D1B correspondiente.\n\nLes recordamos que la falta de respuesta al presente requerimiento constituye infraccin administrativa grave a tenor de lo dispuesto en la Ley 19/2003, de 4 de julio.\n\nSaludos cordiales.\n\n" ], "from": "\"Alcaina Acosta, Neus\" <nalcainaa@economia.gob.es>", "to": "\"ANGONZALEZ@EVERSHEDS-SUTHERLAND.ES\" <ANGONZALEZ@EVERSHEDS-SUTHERLAND.ES>", "attachements": [] }
URL: email Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": [ "Email originates from a legitimate Spanish government domain (economia.gob.es)", "Low spam confidence level (SCL:1) and bulk complaint level (BCL:0)", "Consistent internal routing through government infrastructure (mityc.age)", "Headers show expected Microsoft Exchange server patterns", "Forefront antispam report shows legitimate Spanish IP and matching PTR record", "Safety score is good (SFTY:9.25)", "Internal IP addresses (10.55.x.x) are consistent with legitimate internal network routing" ] }
Date: Thu, 16 Jan 2025 12:53:33 +0100 Key: mime-version Value: 1.0 Key: return-path Value: nalcainaa@economia.gob.es Key: x-microsoft-antispam-message-info Value: =?us-ascii?Q?WMbzNy0yx5ueCKe7MG/t9/m5otk5QyGoF8yyLdNY9mThYhP93PjqV80J+fJ7?= Key: message-id Value: <8f6718854a7a4e5a90e7a4b25dcb1be1@economia.gob.es> Key: received Value: from VSRV544.mityc.age ([10.55.80.144]) by VSRV544.mityc.age Key: x-ms-exchange-crosstenant-authas Value: Anonymous Key: x-ms-exchange-crosstenant-originalarrivaltime Value: 16 Jan 2025 11:53:34.3609 Key: content-type Value: multipart/alternative; Key: x-forefront-antispam-report Value: CIP:192.187.16.27;CTRY:ES;LANG:es;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mailout1.serviciosmin.gob.es;PTR:mailout1.serviciosmin.gob.es;CAT:NONE;SFTY:9.25;SFS:(13230040)(8096899003);DIR:INB;SFTY:9.25; Key: x-originating-ip Value: [10.55.80.241] Key: x-ms-exchange-organization-scl Value: 1 Key: x-microsoft-antispam Value: BCL:0;ARA:13230040\|8096899003;
URL: Email Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Por que es eso importante", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "unknown" }

URL: Email Model: Joe Sandbox AI	{ "brands": [ "Gstech Entertainment" ] }
	{ "brands": [ "Gstech Entertainment" ] }

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20250116T0708110674-2820.etl

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	4.443886017174986
Encrypted:	false
SSDEEP:	1536:b0KE2/JEAsF7Y/G77IkjU6Vh/VSlJI2cPg+6sKmyXwAV9vm4oMWA9IfScQnfHN1l:C4uAifSc7XaH
MD5:	D86D8D0EAFFA78D8A9042EF7111F0AD2
SHA1:	F22F8C86B0D4F514B23F0CF6745C153C6EE868F3
SHA-256:	BA6FAE9E532DCBE26909C29F4235C357ACA5AB4B6616824DBDC3C81D8913F0CF
SHA-512:	7B2A6D50D0EB4EEB05C930C0AEA7E2FAE6C2D3759C87E3BA1D01506627F28D8990A520FEC27E2B4AD2F3F5B2B8B193AD9923F44CB25111378C8DB2C4B452B6E0
Malicious:	false
Reputation:	low
Preview:	............................................................................b.............0P.h..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................0..O..............0P.h..........v.2._.O.U.T.L.O.O.K.:.b.0.4.:.e.5.9.d.6.5.0.a.3.9.d.7.4.7.2.6.b.d.8.7.2.e.1.7.c.a.0.1.a.a.0.4...C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.5.0.1.1.6.T.0.7.0.8.1.1.0.6.7.4.-.2.8.2.0...e.t.l.............P.P.........K[3P.h..................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF7FB63B4A695C20F2.TMP

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	163840
Entropy (8bit):	0.47586572133933636
Encrypted:	false
SSDEEP:	384:mHsDjLYP6n0V5hb4zHlqeilMv2jZz0XHOo7:cwjF0V7b4IeilMvIz0XHO
MD5:	BBA7242C38987FAF1DD204207BE88648
SHA1:	6E90696BFAECD550C0581CBA82663A53E97BCE89
SHA-256:	DACBEF541EF858138584BEFD7DF5C1AF0EBB1D97E85F34F10125FD740A6DA6F1
SHA-512:	27551EF4D165160CF5EDAD6D0A7C79FCB96BA29A95708CEE851EB921DA451F3DE170BBD5F134CC3375D180282424515CE468AA29DE53AE2D8710195E8985EDDD
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	1.343065867605027
Encrypted:	false
SSDEEP:	768:J8QcHgZ5nXdvWTXqvOB2D5hGunyphBf38BUTIZHm:jfXyv29ivf3eNZG
MD5:	327799015DC60649EB77C32BFD6A313F
SHA1:	3170C330B0DF981B95404DAB6ABFD387F0B747A8
SHA-256:	5A1670DA26A0117C52E59507E1BB7AEA3D0CA4A7E67ADE906A12B758C08C66A5
SHA-512:	2CAEE8983B4A9B2493AD0AA4D45C29D967109635BF4FD9E73C29965D617C7D2E1995CF442D0E27DAE0C4434E644D42D3C47D03B720815AE3A31DA0C1BA4880C4
Malicious:	false
Reputation:	low
Preview:	!BDN...SM......\....Q...*......:.......U................@...........@...@...................................@...........................................................................$.......D......@"..............6...............9....................................................................................................................................................................................................................................................................................................'ew.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	1.2549587638797521
Encrypted:	false
SSDEEP:	384:rMTmVxqFpS4MY6kt5TqvmCfhGNFFiBpWyZG0yO4rSWiKqg47d1RHa:rMeAjhyGftBflRm
MD5:	3F5DBB119528573E95A50325645ADAE2
SHA1:	9BD9D0E60530EF50F65D236AE29AEF943826B5CC
SHA-256:	251E733CCCB98579A0F42A0FBD614B9E1EC7BF0FF5AB7B45E0C47578B47F045D
SHA-512:	B467222520A558600AC0763169D1DDA8B17117E39A93DDBB15F5E341C4FCA89FABEB58B3ADFAEAD36E6E1BAC6280C0680D658D994FBD55D3BDC92C5814CDECDC
Malicious:	false
Reputation:	low
Preview:	...:0...]............$.M.h.......B............#...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................:G....:..........C...^............$.M.h....................#.!BDN...SM......\....Q...*......:.......U................@...........@...@...................................@...........................................................................$.......D......@"..............6...............9...............................................................................................................................................................

Static File Info

General

File type:	CDFV2 Microsoft Outlook Message
Entropy (8bit):	3.9291808648780346
TrID:	Outlook Message (71009/1) 58.92% Outlook Form Template (41509/1) 34.44% Generic OLE2 / Multistream Compound File (8008/1) 6.64%
File name:	Modelo D4 ejercicio 2023.msg
File size:	102'400 bytes
MD5:	62a215df68bcf8cd19b771533952aedc
SHA1:	d06b0d19097d4a3a0ad40ed06ccb55e1a558296c
SHA256:	0da74951bed8cd8bd9ecd1ae8ceb41347a42d58df2f239299a249482277e8b92
SHA512:	c7b873c2d713dbcbc3ff60e8256acb23c3c37596d98939ea7fed13ddef3e80bdfc4a60b688e62bf66d55c8f98c9b35d0058b70df48b22cf23f6733a592e8d92a
SSDEEP:	768:seb4IeilMvpmqF+M3CWsKAkWsKNnDXxPESDNhswFZVoqCBp5jLQNjh+kWyKJWsK3:sViG1F+MSWTW9DBPf4BkvWPW/IotD00
TLSH:	8DA3112439FA4119F3B79F318BE290AF8536FD93AD15965F2191330E0672941AC62B3B
File Content Preview:	........................>......................................................................................................................................................................................................................................

Static Mail

General

Subject:	Modelo D4 ejercicio 2023
From:	"Alcaina Acosta, Neus" <nalcainaa@economia.gob.es>
To:	"ANGONZALEZ@EVERSHEDS-SUTHERLAND.ES" <ANGONZALEZ@EVERSHEDS-SUTHERLAND.ES>
Cc:
BCC:
Date:	Thu, 16 Jan 2025 12:53:33 +0100
Communications:	No suele recibir correo electrnico de nalcainaa@economia.gob.es. <https://aka.ms/LearnAboutSenderIdentification> Por qu es esto importante Buenas tardes: Les escribimos porque en el ao 2023 enviaron el modelo B87948477_D1A_8073729, relativo a la sociedad GGTECH ENTERTAINMENT, S.L.. Durante el ao 2024 no han presentado el modelo D4 relativo al ejercicio 2023 de dicha compaa, y tampoco se ha presentado modelo D1B informando de una posible desinversin. Nos gustara conocer el motivo por el que no se ha presentado este modelo, y que regularizaran su situacin, bien enviando el modelo D4 requerido, o bien mediante el modelo D1B correspondiente. Les recordamos que la falta de respuesta al presente requerimiento constituye infraccin administrativa grave a tenor de lo dispuesto en la Ley 19/2003, de 4 de julio. Saludos cordiales.
Attachments:

Headers

Key	Value
Received	from VSRV544.mityc.age ([10.55.80.144]) by VSRV544.mityc.age
11	53:37 +0000
by DB9P194MB1307.EURP194.PROD.OUTLOOK.COM (2603	10a6:10:292::24) with
2025 11	53:34 +0000
(2603	10a6:10:be::20) with Microsoft SMTP Server (version=TLS1_3,
16 Jan 2025 11	53:34 +0000
Authentication-Results	spf=pass (sender IP is 192.187.16.27)
Received-SPF	Pass (protection.outlook.com: domain of economia.gob.es
15.20.8356.11 via Frontend Transport; Thu, 16 Jan 2025 11	53:34 +0000
X-AuditID	0a0a0538-b18877000000727c-eb-6788f33d5468
by mailout1.serviciosmin.gob.es (hello) with SMTP id 06.C0.29308.D33F8876; Thu, 16 Jan 2025 12	53:33 +0100 (CET)
2025 12	53:33 +0100
([10.55.80.144]) with mapi id 15.01.2507.039; Thu, 16 Jan 2025 12	53:33 +0100
From	"Alcaina Acosta, Neus" <nalcainaa@economia.gob.es>
To	"ANGONZALEZ@EVERSHEDS-SUTHERLAND.ES" <ANGONZALEZ@EVERSHEDS-SUTHERLAND.ES>
Subject	Modelo D4 ejercicio 2023
Thread-Topic	Modelo D4 ejercicio 2023
Thread-Index	AdtoDUL6w/AoaOAfTIG/07KVGovMDw==
Date	Thu, 16 Jan 2025 11:53:33 +0000
Message-ID	<8f6718854a7a4e5a90e7a4b25dcb1be1@economia.gob.es>
Accept-Language	es-ES, en-US
Content-Language	es-ES
X-MS-Has-Attach	X-MS-TNEF-Correlator:
x-originating-ip	[10.55.80.241]
Content-Type	multipart/alternative;
MIME-Version	1.0
Return-Path	nalcainaa@economia.gob.es
X-Brightmail-Tracker	H4sIAAAAAAAAA+NgFvrOLMWRmVeSWpSXmKPExsXCZR7Qp2v7uSPd4P4LQ4vtzR1sDoweez6f
X-MS-Exchange-Organization-ExpirationStartTime	16 Jan 2025 11:53:34.5171
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id	766b8c23-463c-4d2b-5d6d-08dd362467d4
X-EOPAttributedMessage	0
X-EOPTenantAttributedMessage	055b0795-7299-45a9-bc23-ad109157818e:0
X-MS-Exchange-Organization-MessageDirectionality	Incoming
X-MS-PublicTrafficType	Email
X-MS-TrafficTypeDiagnostic	DU2PEPF00028D0C:EE_\|DB9P194MB1307:EE_\|DU4P194MB2351:EE_
X-MS-Exchange-Organization-AuthSource	DU2PEPF00028D0C.eurprd03.prod.outlook.com
X-MS-Exchange-Organization-AuthAs	Anonymous
X-MS-Office365-Filtering-Correlation-Id	766b8c23-463c-4d2b-5d6d-08dd362467d4
X-MS-Exchange-AtpMessageProperties	SA\|SL
X-MS-Exchange-Organization-SCL	1
X-Microsoft-Antispam	BCL:0;ARA:13230040\|8096899003;
X-Forefront-Antispam-Report	CIP:192.187.16.27;CTRY:ES;LANG:es;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mailout1.serviciosmin.gob.es;PTR:mailout1.serviciosmin.gob.es;CAT:NONE;SFTY:9.25;SFS:(13230040)(8096899003);DIR:INB;SFTY:9.25;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	16 Jan 2025 11:53:34.3609
X-MS-Exchange-CrossTenant-Network-Message-Id	766b8c23-463c-4d2b-5d6d-08dd362467d4
X-MS-Exchange-CrossTenant-Id	055b0795-7299-45a9-bc23-ad109157818e
X-MS-Exchange-CrossTenant-AuthSource	DU2PEPF00028D0C.eurprd03.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader	Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped	DB9P194MB1307
X-MS-Exchange-Transport-EndToEndLatency	00:00:03.5602735
X-MS-Exchange-Processed-By-BccFoldering	15.20.8335.015
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003)(1420198);
X-Microsoft-Antispam-Message-Info	=?us-ascii?Q?WMbzNy0yx5ueCKe7MG/t9/m5otk5QyGoF8yyLdNY9mThYhP93PjqV80J+fJ7?=
date	Thu, 16 Jan 2025 12:53:33 +0100

File Icon


Icon Hash:	c4e1928eacb280a2

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 16, 2025 13:08:20.394213915 CET	61641	53	192.168.2.5	1.1.1.1
Jan 16, 2025 13:08:20.399085999 CET	53	61641	1.1.1.1	192.168.2.5
Jan 16, 2025 13:08:20.399194002 CET	61641	53	192.168.2.5	1.1.1.1
Jan 16, 2025 13:08:20.404042959 CET	53	61641	1.1.1.1	192.168.2.5
Jan 16, 2025 13:08:20.843808889 CET	61641	53	192.168.2.5	1.1.1.1
Jan 16, 2025 13:08:20.852801085 CET	53	61641	1.1.1.1	192.168.2.5
Jan 16, 2025 13:08:20.852863073 CET	61641	53	192.168.2.5	1.1.1.1
Jan 16, 2025 13:08:46.159694910 CET	61409	53	192.168.2.5	162.159.36.2
Jan 16, 2025 13:08:46.164619923 CET	53	61409	162.159.36.2	192.168.2.5
Jan 16, 2025 13:08:46.164694071 CET	61409	53	192.168.2.5	162.159.36.2
Jan 16, 2025 13:08:46.169507980 CET	53	61409	162.159.36.2	192.168.2.5
Jan 16, 2025 13:08:46.673345089 CET	61409	53	192.168.2.5	162.159.36.2
Jan 16, 2025 13:08:46.678431988 CET	53	61409	162.159.36.2	192.168.2.5
Jan 16, 2025 13:08:46.678503036 CET	61409	53	192.168.2.5	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 16, 2025 13:08:20.393739939 CET	53	58331	1.1.1.1	192.168.2.5
Jan 16, 2025 13:08:46.159254074 CET	53	58956	162.159.36.2	192.168.2.5
Jan 16, 2025 13:08:46.682229996 CET	53	51525	1.1.1.1	192.168.2.5

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: OUTLOOK.EXEPID: 2820, Parent PID: 1028

General

Target ID:	0
Start time:	07:08:08
Start date:	16/01/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\Modelo D4 ejercicio 2023.msg"
Imagebase:	0xb00000
File size:	34'446'744 bytes
MD5 hash:	91A5292942864110ED734005B7E005C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: ai.exePID: 5644, Parent PID: 2820

General

Target ID:	2
Start time:	07:08:13
Start date:	16/01/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "12157C9C-F2AB-4554-9279-52D2C9B95A50" "129406FC-B878-4C9B-A7A3-7BCE9A003929" "2820" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Imagebase:	0x7ff649370000
File size:	710'048 bytes
MD5 hash:	EC652BEDD90E089D9406AFED89A8A8BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly