File name: | Mal%20Emails.zip |
Full analysis: | https://app.any.run/tasks/9fd0de68-951b-4f00-87c5-d3f4b6ff8d9b |
Verdict: | Malicious activity |
Analysis date: | June 18, 2019, 17:19:22 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v1.0 to extract |
MD5: | A8EED002561A1CDB748FED15D8D89EC8 |
SHA1: | ED8EB0A43D8DA4C05F1CF8C52115D7E8FB7C81AF |
SHA256: | 20FB9059FFA16666C66EF448DE5162113EC1CE4D2848A4E726598E0A641089D4 |
SSDEEP: | 12288:F4JOxn7ATwqgJlcr2uOmSrBLk9oVBPl3QeMIhic668MZjlKpIhCroceHurzv:F44NAMqgYrDS5N3QeMBc661jCDeob |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 10 |
---|---|
ZipBitFlag: | 0x0800 |
ZipCompression: | None |
ZipModifyDate: | 2019:06:18 17:18:29 |
ZipCRC: | 0x28f852e6 |
ZipCompressedSize: | 290816 |
ZipUncompressedSize: | 290816 |
ZipFileName: | Administrator Notification_ Redirecting email with malware.msg |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2948 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\fc5b7db0-4652-47d9-9910-883f1964370b.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3392 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Rar$DIa2948.38995\Administrator Notification_ Redirecting email with malware.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | WinRAR.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Exit code: 0 Version: 14.0.6025.1000 | ||||
3188 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Exit code: 0 Version: 14.0.6025.1000 | ||||
3972 | "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\WNBW1KQQ\🔊VM_18-06-2019.html | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2800 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3972 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2972 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Rar$DIa2948.44606\Administrator Notification_ Redirecting email with malware.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | WinRAR.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Exit code: 0 Version: 14.0.6025.1000 | ||||
2432 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Rar$DIa2948.46578\Administrator Notification_ Redirecting email with malware.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | WinRAR.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Exit code: 0 Version: 14.0.6025.1000 | ||||
676 | "C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\fc5b7db0-4652-47d9-9910-883f1964370b.zip" C:\Users\admin\Desktop\ | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
2764 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\Desktop\Administrator Notification_ Redirecting email with malware.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Exit code: 0 Version: 14.0.6025.1000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2948 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\~DFE7394969C41CC5E7.TMP | — | |
MD5:— | SHA256:— | |||
3392 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR18E1.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3188 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR4995.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3392 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\~DFA6E1C412523A9B71.TMP | — | |
MD5:— | SHA256:— | |||
3392 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\WNBW1KQQ\🔊VM_18-06-2019 (2).html\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
2948 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa2948.38995\Administrator Notification_ Redirecting email with malware.msg | msg | |
MD5:FD8ADED2703D1DE33BB9D1A8F23E1B28 | SHA256:B8EECCB53A8B2AFCB448D1D09BC40024370B07586551F603CDC772210311A1DE | |||
3392 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ConversationPrefs_2_20C867CE443D9646938EC3C3092218FA.dat | xml | |
MD5:57F30B1BCA811C2FCB81F4C13F6A927B | SHA256:612BAD93621991CB09C347FF01EC600B46617247D5C041311FF459E247D8C2D3 | |||
3392 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:F3309FFE67C08A3E6DCA96ABBDC4B592 | SHA256:5A0C234D8FE96DEC7C02FBB553EC18E49E04635223041E6862FA9743A87C1377 | |||
3392 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\WNBW1KQQ\🔊VM_18-06-2019 (2).html | html | |
MD5:9F776642E9E9A95EC9452DDCE3B2D308 | SHA256:EE8CBA1941709C141075207A9498B18642BAD4D199756A37F728053515283767 | |||
3392 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\WNBW1KQQ\🔊VM_18-06-2019.html | html | |
MD5:9F776642E9E9A95EC9452DDCE3B2D308 | SHA256:EE8CBA1941709C141075207A9498B18642BAD4D199756A37F728053515283767 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2972 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
2432 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
3392 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
2764 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
2800 | iexplore.exe | GET | 200 | 93.185.104.64:80 | http://realmanbarber.cz/images/load.gif | CZ | image | 1.52 Kb | malicious |
3972 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3972 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2972 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
2800 | iexplore.exe | 93.185.104.64:80 | realmanbarber.cz | VSHosting s.r.o. | CZ | unknown |
2800 | iexplore.exe | 69.90.66.40:443 | jjconsultingandtranslation.com | Peer 1 Network (USA) Inc. | CA | suspicious |
2800 | iexplore.exe | 77.104.142.95:443 | www.erwantianshi.com | SoftLayer Technologies Inc. | US | unknown |
3392 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
2764 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
2432 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
realmanbarber.cz |
| malicious |
www.bing.com |
| whitelisted |
jjconsultingandtranslation.com |
| unknown |
www.erwantianshi.com |
| unknown |