File name: | FARO IT Alert - Possible Fraudulent MessageCDDATETIME for 638704Closing Instruction Prelim CD HOI ATTACHEDSPAM.msg |
Full analysis: | https://app.any.run/tasks/602efce2-bf6c-48fd-b817-83d171fa7ef4 |
Verdict: | Malicious activity |
Analysis date: | December 05, 2022, 17:53:34 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | D5B61628C37570A04428D6027873B046 |
SHA1: | 5DC097376082505490661216BACFAFB94ACA4833 |
SHA256: | 1F8B9F3E518DA03624BAA97A7D5EE57E423A4B4B98F02D3CFC192886D54084E4 |
SSDEEP: | 1536:6qqs3VwXj5AIEMzLrDh/h+wXAcxz7++F7RMHj1:6qqs3VwXjq7MzPDh/UwX75MD1 |
.msg | | | Outlook Message (58.9) |
---|---|---|
.oft | | | Outlook Form Template (34.4) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2984 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\e5519029-d787-460d-aca0-766fffb13414.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 Modules
| |||||||||||||||
3160 | "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\XOYCPS2T\OrderConfirmation20221205_34498.html | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
452 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3160 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
2984 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRA9CD.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2984 | OUTLOOK.EXE | C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst | — | |
MD5:— | SHA256:— | |||
2984 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:54A9AFAB016D58B6F1B027690579F5AE | SHA256:59C57F93919786DB31D6C6AF4E80D9812AE8BB87351F7A49D6B299CA1F5F7A9D | |||
2984 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\XOYCPS2T\OrderConfirmation20221205_34498 (2).html | html | |
MD5:3F5D474593639718E28B16561B6914EA | SHA256:300B8BB61795AED5BD088CEE499402C693692D8B9D11D6B178C02A161507256D | |||
2984 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.log | text | |
MD5:E8F2C6F6E8B6846D524D1E6DF9114393 | SHA256:E6192040CB48131199C7F2AFADEEBFB89468C8CE2621BA4683BFF3DF0EDF6BA0 | |||
452 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:D95BE31122BDFF67E1F9157F59423FD8 | SHA256:BD3F4E0931FF494D402CC7E41F64C5BBFD7AA27A05643440CD18541F05BEA722 | |||
452 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 | binary | |
MD5:C7CA6D7DDFFB37A783254BC9C095FD6A | SHA256:DF30A0739B201846322CE58FD76E784B7EB0413F6034AC0B681997C158529955 | |||
452 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_A250FA44615D767A3F3B7AFA283419C9 | der | |
MD5:1245DB08BC06BDC452FDB41B8E959F26 | SHA256:D591926F6495B722A0B545D292F16A342CBA87889FD7D4F5CA448C3613760BE6 | |||
452 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 | der | |
MD5:D5D82C08E6FD869FBAAAAF1765526E41 | SHA256:FEB7A9E2A2E668C38CA21A509C6F235AFB74F9576B24F69942F6EFD3261DB142 | |||
2984 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\XOYCPS2T\OrderConfirmation20221205_34498.html | html | |
MD5:3F5D474593639718E28B16561B6914EA | SHA256:300B8BB61795AED5BD088CEE499402C693692D8B9D11D6B178C02A161507256D |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
452 | iexplore.exe | GET | 200 | 142.250.201.195:80 | http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D | US | der | 1.41 Kb | whitelisted |
452 | iexplore.exe | GET | 200 | 104.18.32.68:80 | http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D | US | der | 1.42 Kb | whitelisted |
452 | iexplore.exe | GET | 200 | 172.64.155.188:80 | http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D | US | der | 2.18 Kb | whitelisted |
3160 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
452 | iexplore.exe | GET | 200 | 142.250.201.195:80 | http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDreCS75DAIaRKqvCi%2FvL9c | US | der | 472 b | whitelisted |
452 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEAlrgulzmZS6%2FVWwIdvHyL8%3D | US | der | 278 b | whitelisted |
452 | iexplore.exe | GET | 200 | 104.18.32.68:80 | http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQC6VdPxXoCsunhGMTuwDp7D | US | der | 472 b | whitelisted |
3160 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D | US | der | 471 b | whitelisted |
452 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D | US | der | 1.47 Kb | whitelisted |
3160 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://crl3.digicert.com/Omniroot2025.crl | US | der | 7.78 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2984 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
3160 | iexplore.exe | 204.79.197.200:443 | www.bing.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
452 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | EDGECAST | GB | whitelisted |
452 | iexplore.exe | 209.197.3.8:80 | ctldl.windowsupdate.com | STACKPATH-CDN | US | whitelisted |
452 | iexplore.exe | 104.17.24.14:443 | cdnjs.cloudflare.com | CLOUDFLARENET | — | suspicious |
452 | iexplore.exe | 199.232.194.154:443 | www.zdnet.com | FASTLY | US | suspicious |
452 | iexplore.exe | 2.18.232.137:443 | img.freepik.com | AKAMAI-AS | DE | whitelisted |
452 | iexplore.exe | 54.91.59.199:443 | api.ipify.org | AMAZON-AES | US | malicious |
452 | iexplore.exe | 142.250.201.195:80 | ocsp.pki.goog | GOOGLE | US | whitelisted |
452 | iexplore.exe | 142.251.39.74:443 | ajax.googleapis.com | GOOGLE | US | suspicious |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
cdnjs.cloudflare.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
ajax.googleapis.com |
| whitelisted |
img.freepik.com |
| suspicious |
ocsp.pki.goog |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
www.zdnet.com |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
452 | iexplore.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
452 | iexplore.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |