analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Download Essential Xerox Security Guide and Checklist πŸ”“ .msg

Full analysis: https://app.any.run/tasks/7823107b-33c1-4195-8047-6974233ddbb5
Verdict: Malicious activity
Analysis date: October 09, 2019, 13:30:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

D894E1F4E487931235615646487E589A

SHA1:

1E6597823BD6D62913A798248E317B417FB5D632

SHA256:

0A59EE68E7D4494011DF9E8E5594D1AF59F3D5634BCD1DE64A9CF8452D900903

SSDEEP:

3072:72GL08aTlDKTqJxKbyS6IFVlDKTqJxKbySXCX9dO837xptTRoTqYZH3:D4ChptT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 3188)

  • SUSPICIOUS

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 3188)

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 3188)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 3188)

  • INFO

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 3188)

    • Changes internet zones settings

      • iexplore.exe (PID: 2520)
      • iexplore.exe (PID: 2536)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3352)
      • iexplore.exe (PID: 2520)
      • iexplore.exe (PID: 2856)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3352)
      • iexplore.exe (PID: 2856)

    • Creates files in the user directory

      • iexplore.exe (PID: 3352)
      • iexplore.exe (PID: 2520)
Find more information about signature artifacts and mapping to MITRE ATT&CKβ„’ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3188"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Download Essential Xerox Security Guide and Checklist πŸ”“ .msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
2520"C:\Program Files\Internet Explorer\iexplore.exe" http://www.info.external.xerox.com/m6004y0083KYd3HFMjs0EI0C:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3352"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2520 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2536"C:\Program Files\Internet Explorer\iexplore.exe" http://www.info.external.xerox.com/m6004y0083KYd3HFMjs0EI0C:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2856"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2536 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
2Β 031
Read events
1Β 510
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
4
Text files
49
Unknown types
8

Dropped files

PID
Process
Filename
Type
3188OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRD8E.tmp.cvr β€”
MD5:β€”
SHA256:β€”
3188OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\mso1243.tmp β€”
MD5:β€”
SHA256:β€”
2520iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico β€”
MD5:β€”
SHA256:β€”
2520iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico β€”
MD5:β€”
SHA256:β€”
2520iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019092020190921\index.dat β€”
MD5:β€”
SHA256:β€”
3188OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:13C6FC5A2F87A203E0D6647A06E29392
SHA256:DF9AD1FC1B5A7D2F9A3A7B1E79BABC7A7B16E1C5245464226412DD082AD420F5
3188OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_F3759E114C0C92478594A4DF4FD16F2A.datxml
MD5:B21ED3BD946332FF6EBC41A87776C6BB
SHA256:B1AAC4E817CD10670B785EF8E5523C4A883F44138E50486987DC73054A46F6F4
3352iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:3BFB2A15FB92B88E4F73F5CB6C413C2A
SHA256:711A58748E5A620C4E48D918E86BBA799D72FFEC324964D2DA79D2136A4DA3A7
3188OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{74F276E7-BF25-4BAE-B0CC-ED8F0B863AFE}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.pngimage
MD5:7D80C0A7E3849818695EAF4989186A3C
SHA256:72DC527D78A8E99331409803811CC2D287E812C008A1C869A6AEA69D7A44B597
3352iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4YP5CUS1\m6004y0083KYd3HFMjs0EI0[1].htmhtml
MD5:33913A24BEF0F1587A41B62A89665CA3
SHA256:DF62D70D28C52F1EE367CD1618D735C7238405D7261835EC29AB6E6D69D4FCAF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
12
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2856
iexplore.exe
GET
200
95.138.158.240:80
http://www.info.external.xerox.com/m6004y0083KYd3HFMjs0EI0
GB
html
504 b
suspicious
2536
iexplore.exe
GET
404
95.138.158.240:80
http://www.info.external.xerox.com/favicon.ico
GB
html
101 b
suspicious
2520
iexplore.exe
GET
200
13.107.21.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2520
iexplore.exe
95.138.158.240:80
www.info.external.xerox.com
Rackspace Ltd.
GB
unknown
3188
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
3352
iexplore.exe
95.138.158.240:80
www.info.external.xerox.com
Rackspace Ltd.
GB
unknown
2520
iexplore.exe
13.107.21.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
β€”
β€”
2.20.190.173:443
www.xerox.co.uk
Akamai International B.V.
β€”
whitelisted
3352
iexplore.exe
2.20.190.173:443
www.xerox.co.uk
Akamai International B.V.
β€”
whitelisted
2856
iexplore.exe
95.138.158.240:80
www.info.external.xerox.com
Rackspace Ltd.
GB
unknown
2536
iexplore.exe
95.138.158.240:80
www.info.external.xerox.com
Rackspace Ltd.
GB
unknown
2856
iexplore.exe
2.20.190.173:443
www.xerox.co.uk
Akamai International B.V.
β€”
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
www.info.external.xerox.com
  • 95.138.158.240
suspicious
www.bing.com
  • 13.107.21.200
  • 204.79.197.200
whitelisted
www.xerox.co.uk
  • 2.20.190.173
  • 2.20.190.140
suspicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
Β© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Download Essential Xerox Security Guide and Checklist πŸ”“ .msg