Windows Analysis Report
__ EXTERNAL __ .eml

ID:	882702
Product:	CloudBasic
Start time:	17:15:18
Start date:	06.06.2023
Sample:	__ EXTERNAL __ .eml
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 64 bit version 1909 (MS Office 2019, IE 11, Chrome 104, Firefox 88, Adobe Reader DC 21, Java 8 u291, 7-Zip)
Architecture:	WINDOWS
MD5:	0e7c2724d4a7fd642a09152fb8bdf975
SHA1:	fd2013b09273fa3a55c0a956840e135cbb2448b2
SHA256:	0ed963d906095c42fabc5b2ced49f3354fa273ef564b9be8b6aeb23edcfcb032
Filetype:	E-Mail message (Var. 5) (54515/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\FORMS\FRMDATA64.DAT	data	3256628B66522C46B5100CFEC3ADC250	58FD59611D2785D2433A953EC2B1A51C5B822037	FB0A1BF80675713998A148869D59B52EABD59DF4EB49CD0AD86B570A22F3289A
C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\FAB46BF9-2267-4C1D-9AD7-3A45B7558D0C	XML 1.0 document, ASCII text, with CRLF line terminators	5A14214763BE836B4092821CD3C52737	DA9C95C8066157026C37C2C9CF7A70DD856828D4	BEEE54A31CFDA1B2299DD1FE67BCFB9E7234A94C2018C9CA36122FC679B7B428
C:\Users\user\AppData\Local\Microsoft\Office\16.0\outlook.exe_Rules.xml	XML 1.0 document, ASCII text, with very long lines (65536), with no line terminators	A1B3E56B290A743CE977C6209FA39C85	839711A2FB9079890925E4E1A4F55A13853BD065	3E12BC7577C65A23B2ACFB2B309C3C271709C63C3F12D5A7D0D0B1557A805B58
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm	data	8FCF381F01131A1137D57E7B0589459B	05378FD171165BA66D791B21D7EF82885655BC9D	C79AC558C6C5123D90B74E7A3CDE6FDE3966A39EBCA089AA72D5EBDE94FB1271
C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal	SQLite Write-Ahead Log, version 3007000	F84C88A27AA1EB11ECA61397DE267F4B	7E490CB2878082B36B05AF54E7710862243BD90F	55A452E9721DDB6BDF3BFD102DE0CBD3D8539E9DE046004C9769AF0991914416
C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres	data	9828D7FC7F3A08F45830E748CA1152E9	7B812D2FDBCD6C3642BBBDF0760150A368F36011	466E156C255544074444C1C31500066E6FBB385DAA0F835C890B81FC031756B7
C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres	data	725266AA0C084D4FA82800B3DF6D3DA3	9F20918BD136FF852F0813F4CB87139ACAB885EE	5D1423232A8BDC5771EABABF03F6073C2686B3A6CACB66E645C748868DA879BB
C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\9aad439831564ef9f88438a70a63c87e26ef3852.tbres	data	C60EF5AD056E507E2AC0135BCAA97F72	C4B3EC254D5B9BF6E241A91AF9449575C7713A58	2A1F4DB4486741AD8568750838DE690950FA446D62751F098C88B519806E3432
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\PSFUO2BE\IMG_0515 (002).jpg:Zone.Identifier	ASCII text, with CRLF line terminators	FBCCF14D504B7B2DBCB5A5BDA75BD93B	D59FC84CDD5217C6CF74785703655F78DA6B582B	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\PSFUO2BE\IMG_0515.jpg	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 20, Exif Standard: [TIFF image data, big-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2], baseline, precision 8, 1536x2048, components 3	C99BA0F556028AF24A4D4C20C7B408F2	D77AC06E1A0955D940D1643DF36A9FC1EDFA37F7	742869086D3ADCB7578EBE7FCCC58AF392FA0A5858784752E5DC4C35C53DDFD5
C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_13929_20386-20230606T1715490538-3604.etl	DIY-Thermocam raw data (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 134217728.000000	7682DFD6A7956FAEDAA8EEEAB591659B	1BA13BAAB2A660BAF8F89D5F2FC75774266AE6DB	CA29C3FF93D3FF7044EBCB11FE8F2672C542AC187B66E0AE21D10931E8D69013
C:\Users\user\AppData\Local\Temp\olk7A73.tmp	data	544FD9D2F1A77DDB016E57265BB511F1	3994CDD70F87E932A59C91355CD4C0C199B4074B	790D3AD63EDC00B7B4F38E5A489EE6460BBF2DB93200FD43433C2EC3920280CB
C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC	Unicode text, UTF-16, little-endian text, with CRLF line terminators	09B7FD4F63059FB967C6CF0D36AF99A4	BDFABECF4B7BB2A0A08C69150C770C45C5A81303	AF2F74E5947D19590946BA404ED7FBEBF59A85BBF83354E24015FA9729A2808C
C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst	Microsoft Outlook email folder (>=2003)	4A206EE14819FAC2EE32E7E41B7CDE81	7FEBB31113B43309CC232D7AEC203ADCEBE95628	737114B4A913151D19FB7D65DBDF0F7FD5DAE468F446DD58CD40A83FB90EB36E
C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp	data	CFBB388E98E1D7B3423EA9BC25A3F49F	BBA6CE23DB1C705CCF03233C097B8117D9649C07	7ABCC49CF24AE7D0B4EAFFF3BCCB31BEF9D33A6803C865ACCCC499189BAA8ECF

System Summary

Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_13929_20386-20230606T1715490538-3604.etl

Source: classification engine

Classification label: clean0.winEML@1/15@0/60

Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE

File read: C:\Users\desktop.ini

Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Window detected: Number of UI elements: 11
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Window detected: Number of UI elements: 11
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Window detected: Number of UI elements: 11

Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Hooking and other Techniques for Hiding and Protection

Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1

Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	File Volume queried: C:\Windows\System32 FullSizeInformation
Source: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	File Volume queried: C:\Windows\System32 FullSizeInformation