analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Daisy Delavega shared πŸŽ—πŸŽžπŸŽŠ I Am Crazy Girl πŸŽ—πŸŽžπŸŽŠ with you.msg

Full analysis: https://app.any.run/tasks/f4053df5-24f7-4c30-b02a-e29f0975110a
Verdict: Malicious activity
Analysis date: January 24, 2022, 19:58:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

F6764325A48E45917DA46368E29646C9

SHA1:

31ECEE939E6865AD0AD29431B18D8D51D94B3C7B

SHA256:

071051C00B2BFC209BBC136617CCAF012AC53CC1468C8E91CB01682D41E5E602

SSDEEP:

6144:aDTCrimNrS+3ANUASMMergDD4i0yStj/DbYrViJw6:a2ESMfly8bkViJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 2212)

  • SUSPICIOUS

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 2212)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3764)
      • iexplore.exe (PID: 3184)
      • iexplore.exe (PID: 2972)

  • INFO

    • Checks supported languages

      • OUTLOOK.EXE (PID: 2212)
      • iexplore.exe (PID: 2164)
      • iexplore.exe (PID: 3764)
      • iexplore.exe (PID: 3184)
      • iexplore.exe (PID: 2972)

    • Reads the computer name

      • OUTLOOK.EXE (PID: 2212)
      • iexplore.exe (PID: 2164)
      • iexplore.exe (PID: 3764)
      • iexplore.exe (PID: 3184)
      • iexplore.exe (PID: 2972)

    • Searches for installed software

      • OUTLOOK.EXE (PID: 2212)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2212)
      • iexplore.exe (PID: 3184)
      • iexplore.exe (PID: 3764)

    • Changes internet zones settings

      • iexplore.exe (PID: 2164)

    • Application launched itself

      • iexplore.exe (PID: 2164)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3764)
      • iexplore.exe (PID: 2164)
      • iexplore.exe (PID: 3184)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2164)
      • iexplore.exe (PID: 3764)
      • iexplore.exe (PID: 3184)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3184)
      • iexplore.exe (PID: 3764)
      • iexplore.exe (PID: 2972)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2212)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2164)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2164)
Find more information about signature artifacts and mapping to MITRE ATT&CKβ„’ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2212"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Daisy Delavega shared ?????? I Am Crazy Girl ?????? with you.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2164"C:\Program Files\Internet Explorer\iexplore.exe" https://sites.google.com/view/localsdate/homeC:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3764"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2164 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3184"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2164 CREDAT:3544330 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2972"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2164 CREDAT:2626830 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
21Β 873
Read events
21Β 123
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
12
Text files
43
Unknown types
34

Dropped files

PID
Process
Filename
Type
2212OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR344C.tmp.cvr β€”
MD5:β€”
SHA256:β€”
2212OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst β€”
MD5:β€”
SHA256:β€”
2212OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:8E81C0054968037B01202F616310AE2F
SHA256:4F132C04915D8D95A6A4DE2785C1FA5F9827AEAF16BBC983C7203BFB5FABBE08
2164iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:11C47BAC91563BC6EDD18E1980F9279D
SHA256:16349FD60E511EB8CA88741EE3758008A0FFBC2CA2CDBC79C252F87B68E06865
2212OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:416EE4AD4CDE75C90A251FBC1728887D
SHA256:D5F62648DA24AB71FFB31DCCCC41A81DA6A0792B89B5D9F9EDC005521DF0A734
2164iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:628390EEC2994A600BED55BC349F95CA
SHA256:98522852BEACFC8DA8730B3FB1D1A2D1D408A2610E37BFFD09EB29D8DE3743A3
2212OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{D7D13865-E5E4-472B-883C-D715FCC2D496}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.pngimage
MD5:4C61C12EDBC453D7AE184976E95258E1
SHA256:296526F9A716C1AA91BA5D6F69F0EB92FDF79C2CB2CFCF0CEB22B7CCBC27035F
2212OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ContactPrefs_2_DFB995BF98A7E340B2568F900BC0C0A9.datxml
MD5:BBCF400BD7AE536EB03054021D6A6398
SHA256:383020065C1F31F4FB09F448599A6D5E532C390AF4E5B8AF0771FE17A23222AD
2212OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_AvailabilityOptions_2_C09EEE1DECA49342AAF2A8722C8E8246.datxml
MD5:EEAA832C12F20DE6AAAA9C7B77626E72
SHA256:C4C9A90F2C961D9EE79CF08FBEE647ED7DE0202288E876C7BAAD00F4CA29CA16
2212OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\93086921.datimage
MD5:D05B937912FE25C2DF09F78A71B21950
SHA256:628A7AC0FCC56FFF15DAFD33AF37138D47433EFBBA12922103A4560C770877E9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
67
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2164
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
2212
OUTLOOK.EXE
GET
β€”
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
β€”
β€”
whitelisted
3184
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCrvyQ4GllugQoAAAABK4Az
US
der
472 b
whitelisted
2164
iexplore.exe
GET
200
67.26.73.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a5915c9442700360
US
compressed
4.70 Kb
whitelisted
3184
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC04WHG3wyS9QoAAAABK3x8
US
der
472 b
whitelisted
3184
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
3184
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
3184
iexplore.exe
GET
200
142.250.185.206:80
http://crls.pki.goog/gts1c3/fVJxbV-Ktmk.crl
US
der
6.05 Kb
whitelisted
3764
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEH4wYrandiOsCgAAAAErgCs%3D
US
der
471 b
whitelisted
3764
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEA9%2FdKivN6zeCgAAAAErf8I%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2164
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2212
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
3764
iexplore.exe
142.250.184.206:443
sites.google.com
Google Inc.
US
whitelisted
2164
iexplore.exe
131.253.33.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3184
iexplore.exe
142.250.184.206:443
sites.google.com
Google Inc.
US
whitelisted
3764
iexplore.exe
67.26.73.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
2164
iexplore.exe
67.26.73.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
3764
iexplore.exe
142.250.184.195:80
ocsp.pki.goog
Google Inc.
US
whitelisted
3184
iexplore.exe
142.250.184.195:80
ocsp.pki.goog
Google Inc.
US
whitelisted
3184
iexplore.exe
142.250.181.238:443
apis.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
sites.google.com
  • 142.250.184.206
whitelisted
ctldl.windowsupdate.com
  • 67.26.73.254
  • 67.27.157.126
  • 8.253.207.120
  • 8.248.145.254
  • 8.248.119.254
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
  • 131.253.33.200
  • 13.107.22.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ocsp.pki.goog
  • 142.250.184.195
whitelisted
fonts.googleapis.com
  • 142.250.186.42
whitelisted
www.gstatic.com
  • 142.250.184.227
whitelisted
apis.google.com
  • 142.250.181.238
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
Β© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Daisy Delavega shared πŸŽ—πŸŽžπŸŽŠ I Am Crazy Girl πŸŽ—πŸŽžπŸŽŠ with you.msg