File name: | Ваша заявка RE Диф.счета Киевстар за апрель 2022 (##RE-168110##) була виконана.msg |
Full analysis: | https://app.any.run/tasks/b3900942-e805-4e96-b970-9e2ca204e81b |
Verdict: | Malicious activity |
Analysis date: | May 20, 2022, 18:23:40 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | A7FE3E5EFD64D7C674F2222052088A90 |
SHA1: | 77B1212991597119F5928A2F9CE48FC796AD2FA0 |
SHA256: | 0C2D825962556E1334352522B0F99E6C7398FC2F577DD238C7882CB3734E11C2 |
SSDEEP: | 1536:GiNeKW3WtyjyLW5W3s5/Tsu4Tjq2wr88ndq3mS:GiNeGyWaBTsu4T3wr88nk3mS |
.msg | | | Outlook Message (58.9) |
---|---|---|
.oft | | | Outlook Form Template (34.4) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
120 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Ваша заявка RE Диф.счета Киевстар за апрель 2022 (##RE-168110##) була виконана.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Exit code: 0 Version: 14.0.6025.1000 Modules
| |||||||||||||||
3880 | "C:\Program Files\Internet Explorer\iexplore.exe" https://support.msl.ua/ | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3688 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3880 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3200 | "C:\Program Files\Internet Explorer\iexplore.exe" http://support.msl.ua/WorkOrder.do?woMode=viewWO&woID=168110 | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
1648 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3200 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
120 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR939C.tmp.cvr | — | |
MD5:— | SHA256:— | |||
120 | OUTLOOK.EXE | C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst | — | |
MD5:— | SHA256:— | |||
120 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:36BAE576771169049F041F0BE6AE0DB7 | SHA256:BE0C193077031E1CF135EA1EA62215462555D279451739E2F0D6FC2C42528167 | |||
3688 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4CA16E3F0BB4EC193193A361CA55488B | binary | |
MD5:4617F8469E2C290CD63746E90BD940ED | SHA256:8BBF1235B845FBFBA3DD9B8BFD84251D6B0DA76B6A2B06D61BBF98A551C58157 | |||
120 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.log | text | |
MD5:4113690DF3F684C0636348D986F980B0 | SHA256:A128CE56FD47D9C18E082FF2CEF1D333E685B86FC064DBA49D9818718B8C7259 | |||
3880 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63 | binary | |
MD5:EB0D0D3AE353923AFC308CA2A122DFC3 | SHA256:73872D41B1FE381C446BB4B445648C6025707E300701C67AE5656501E6C80742 | |||
3688 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 | binary | |
MD5:501F0C436193429A45FA2E8BE3FC4F91 | SHA256:124743B9B9CD9481B865F9E14A146C8789A0D3022E470D94B9B71E76B68DBD5D | |||
3688 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:327BB39C4E407C9850310AE702B5DC1D | SHA256:736B7790487C9242112C56AA12103BEF0517BAFE797BC358BC00F5B4B2C563A4 | |||
3688 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 | der | |
MD5:54E9306F95F32E50CCD58AF19753D929 | SHA256:45F94DCEB18A8F738A26DA09CE4558995A4FE02B971882E8116FC9B59813BB72 | |||
3880 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63 | der | |
MD5:AC8FE9D561E9E7288AECF13F03AEA3D1 | SHA256:CECD911136F3CCBE6F4869CBCBD9FD15B3FA91CD2FD49B9655FA3BCF8E932C05 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
120 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
3688 | iexplore.exe | GET | 200 | 96.16.145.230:80 | http://x1.c.lencr.org/ | US | der | 717 b | whitelisted |
3688 | iexplore.exe | GET | 200 | 184.24.77.72:80 | http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgOScLMgt2vmrkWN5rRUV55XQQ%3D%3D | US | der | 503 b | shared |
3688 | iexplore.exe | GET | 200 | 67.26.81.254:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?46136ce3e9204793 | US | compressed | 4.70 Kb | whitelisted |
3688 | iexplore.exe | GET | 200 | 67.26.81.254:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0098c482deecb752 | US | compressed | 4.70 Kb | whitelisted |
3880 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D | US | der | 1.47 Kb | whitelisted |
3200 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
1648 | iexplore.exe | GET | 301 | 185.128.235.3:80 | http://support.msl.ua/WorkOrder.do?woMode=viewWO&woID=168110 | UA | html | 162 b | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3688 | iexplore.exe | 185.128.235.3:443 | support.msl.ua | Gigatrans LTD | UA | unknown |
3880 | iexplore.exe | 204.79.197.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
3880 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
120 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
3688 | iexplore.exe | 67.26.81.254:80 | ctldl.windowsupdate.com | Level 3 Communications, Inc. | US | suspicious |
3688 | iexplore.exe | 184.24.77.72:80 | r3.o.lencr.org | Time Warner Cable Internet LLC | US | unknown |
3688 | iexplore.exe | 96.16.145.230:80 | x1.c.lencr.org | Akamai Technologies, Inc. | US | suspicious |
1648 | iexplore.exe | 185.128.235.3:80 | support.msl.ua | Gigatrans LTD | UA | unknown |
3200 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
3200 | iexplore.exe | 152.199.19.161:443 | r20swj13mr.microsoft.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
support.msl.ua |
| unknown |
ctldl.windowsupdate.com |
| whitelisted |
x1.c.lencr.org |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
r3.o.lencr.org |
| shared |
ocsp.digicert.com |
| whitelisted |
r20swj13mr.microsoft.com |
| whitelisted |
iecvlist.microsoft.com |
| whitelisted |