analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

invite.ics

Full analysis: https://app.any.run/tasks/f3c18ba0-8f38-4876-a083-b21971ed36fb
Verdict: Malicious activity
Analysis date: October 04, 2022, 21:21:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/calendar
File info: vCalendar calendar file
MD5:

2267A2D81F027CCE26405CE781070D19

SHA1:

80C2AA727E9C0E878D63510D978EE2E798D49FA3

SHA256:

22C85532B8798E080534070E8D128BCCAEC45D00E46EAD490FE968811017EA21

SSDEEP:

48:EgfozMQQX2YPppf0EDXkF1InxwHNR+Iq9p5OUOMycqGJs:EgfoxQtHfxLqwwtR+p9VtqGJs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 1160)

    • Drops executable file immediately after starts

      • iexplore.exe (PID: 944)
      • iexplore.exe (PID: 3984)
      • TeamsSetup_s_8DAA64EE8EAC579-3-0_c_w_.exe (PID: 588)
      • Update.exe (PID: 592)
      • chrome.exe (PID: 3160)
      • chrome.exe (PID: 3764)

    • Application was dropped or rewritten from another process

      • TeamsSetup_s_8DAA64EE8EAC579-3-0_c_w_.exe (PID: 588)
      • Update.exe (PID: 592)
      • Squirrel.exe (PID: 3760)
      • Update.exe (PID: 2096)

    • Loads dropped or rewritten executable

      • Teams.exe (PID: 3332)
      • Teams.exe (PID: 3036)
      • Teams.exe (PID: 1764)
      • Teams.exe (PID: 2568)
      • Teams.exe (PID: 2880)
      • Teams.exe (PID: 1340)
      • Teams.exe (PID: 2344)
      • Teams.exe (PID: 3060)
      • Teams.exe (PID: 1368)
      • regsvr32.exe (PID: 3816)
      • Teams.exe (PID: 628)
      • Teams.exe (PID: 2576)
      • Teams.exe (PID: 664)
      • Teams.exe (PID: 2628)

    • Registers / Runs the DLL via REGSVR32.EXE

      • Update.exe (PID: 592)

    • Changes the autorun value in the registry

      • Teams.exe (PID: 3036)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • OUTLOOK.EXE (PID: 1160)

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 1160)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 944)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 944)
      • iexplore.exe (PID: 3984)
      • TeamsSetup_s_8DAA64EE8EAC579-3-0_c_w_.exe (PID: 588)
      • Update.exe (PID: 592)
      • chrome.exe (PID: 3160)
      • chrome.exe (PID: 3764)

    • Drops a file with a compile date too recent

      • iexplore.exe (PID: 3984)
      • iexplore.exe (PID: 944)
      • TeamsSetup_s_8DAA64EE8EAC579-3-0_c_w_.exe (PID: 588)
      • Update.exe (PID: 592)
      • chrome.exe (PID: 3160)
      • chrome.exe (PID: 3764)

    • Checks supported languages

      • TeamsSetup_s_8DAA64EE8EAC579-3-0_c_w_.exe (PID: 588)
      • Update.exe (PID: 592)
      • Teams.exe (PID: 3332)
      • Squirrel.exe (PID: 3760)
      • Teams.exe (PID: 2880)
      • Update.exe (PID: 2096)
      • Teams.exe (PID: 3036)
      • Teams.exe (PID: 2568)
      • Teams.exe (PID: 1764)
      • Teams.exe (PID: 3060)
      • Teams.exe (PID: 1340)
      • Teams.exe (PID: 1368)
      • Teams.exe (PID: 2344)
      • Teams.exe (PID: 664)
      • Teams.exe (PID: 2576)
      • Teams.exe (PID: 628)
      • Teams.exe (PID: 2628)

    • Reads the computer name

      • Update.exe (PID: 592)
      • Update.exe (PID: 2096)
      • Teams.exe (PID: 3332)
      • Squirrel.exe (PID: 3760)
      • Teams.exe (PID: 2568)
      • Teams.exe (PID: 1764)
      • Teams.exe (PID: 3036)
      • Teams.exe (PID: 2880)
      • Teams.exe (PID: 2344)
      • Teams.exe (PID: 1340)
      • Teams.exe (PID: 664)
      • Teams.exe (PID: 628)
      • Teams.exe (PID: 2628)

    • Reads Environment values

      • Update.exe (PID: 592)
      • Update.exe (PID: 2096)
      • Teams.exe (PID: 3036)
      • Squirrel.exe (PID: 3760)

    • Creates files in the user directory

      • Update.exe (PID: 592)
      • Teams.exe (PID: 3332)
      • Update.exe (PID: 2096)
      • Teams.exe (PID: 3036)
      • Teams.exe (PID: 2344)
      • Teams.exe (PID: 2628)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 3160)

    • Reads CPU info

      • Teams.exe (PID: 3332)
      • Teams.exe (PID: 3036)

    • Application launched itself

      • Teams.exe (PID: 3332)
      • Teams.exe (PID: 3036)

    • Changes default file association

      • Teams.exe (PID: 3036)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 3816)

    • Creates a software uninstall entry

      • Update.exe (PID: 592)

  • INFO

    • Checks supported languages

      • OUTLOOK.EXE (PID: 1160)
      • iexplore.exe (PID: 3984)
      • iexplore.exe (PID: 944)
      • WISPTIS.EXE (PID: 3088)
      • chrome.exe (PID: 3160)
      • chrome.exe (PID: 3276)
      • chrome.exe (PID: 1752)
      • chrome.exe (PID: 3764)
      • chrome.exe (PID: 2464)
      • chrome.exe (PID: 732)
      • chrome.exe (PID: 3608)
      • chrome.exe (PID: 2232)
      • chrome.exe (PID: 1712)
      • chrome.exe (PID: 3748)
      • chrome.exe (PID: 1324)
      • chrome.exe (PID: 3832)
      • chrome.exe (PID: 2332)
      • chrome.exe (PID: 3324)
      • chrome.exe (PID: 3796)
      • chrome.exe (PID: 3180)
      • chrome.exe (PID: 3072)
      • chrome.exe (PID: 924)
      • chrome.exe (PID: 4008)
      • chrome.exe (PID: 2108)
      • chrome.exe (PID: 2944)
      • chrome.exe (PID: 2832)
      • chrome.exe (PID: 2260)
      • chrome.exe (PID: 1764)
      • chrome.exe (PID: 2984)
      • chrome.exe (PID: 440)
      • chrome.exe (PID: 3668)
      • chrome.exe (PID: 3016)
      • chrome.exe (PID: 1360)
      • chrome.exe (PID: 2128)
      • chrome.exe (PID: 924)
      • chrome.exe (PID: 4048)
      • chrome.exe (PID: 2668)
      • chrome.exe (PID: 1596)
      • chrome.exe (PID: 3132)
      • chrome.exe (PID: 3452)
      • chrome.exe (PID: 3200)
      • chrome.exe (PID: 1144)
      • chrome.exe (PID: 1004)
      • chrome.exe (PID: 1564)
      • chrome.exe (PID: 3072)
      • chrome.exe (PID: 4012)
      • chrome.exe (PID: 3192)
      • chrome.exe (PID: 1408)
      • chrome.exe (PID: 3824)
      • chrome.exe (PID: 3320)
      • chrome.exe (PID: 3048)
      • chrome.exe (PID: 2068)
      • chrome.exe (PID: 3540)
      • chrome.exe (PID: 2260)
      • chrome.exe (PID: 3600)
      • chrome.exe (PID: 1388)
      • chrome.exe (PID: 2744)
      • chrome.exe (PID: 2480)
      • chrome.exe (PID: 3248)
      • chrome.exe (PID: 752)
      • chrome.exe (PID: 4008)
      • chrome.exe (PID: 868)
      • regsvr32.exe (PID: 3816)
      • chrome.exe (PID: 3744)
      • chrome.exe (PID: 3312)
      • chrome.exe (PID: 2608)
      • chrome.exe (PID: 3732)
      • chrome.exe (PID: 2600)
      • chrome.exe (PID: 120)
      • chrome.exe (PID: 1488)
      • chrome.exe (PID: 904)
      • chrome.exe (PID: 2524)
      • chrome.exe (PID: 1484)
      • chrome.exe (PID: 752)
      • chrome.exe (PID: 3240)
      • chrome.exe (PID: 572)
      • explorer.exe (PID: 2832)
      • chrome.exe (PID: 2136)
      • chrome.exe (PID: 2388)

    • Reads the computer name

      • OUTLOOK.EXE (PID: 1160)
      • iexplore.exe (PID: 3984)
      • iexplore.exe (PID: 944)
      • WISPTIS.EXE (PID: 3088)
      • chrome.exe (PID: 3160)
      • chrome.exe (PID: 2464)
      • chrome.exe (PID: 3764)
      • chrome.exe (PID: 1752)
      • chrome.exe (PID: 924)
      • chrome.exe (PID: 1360)
      • chrome.exe (PID: 3132)
      • chrome.exe (PID: 1564)
      • chrome.exe (PID: 2068)
      • chrome.exe (PID: 2524)
      • chrome.exe (PID: 752)
      • explorer.exe (PID: 2832)

    • Reads Microsoft Outlook installation path

      • OUTLOOK.EXE (PID: 1160)

    • Reads internet explorer settings

      • OUTLOOK.EXE (PID: 1160)
      • iexplore.exe (PID: 944)

    • Searches for installed software

      • OUTLOOK.EXE (PID: 1160)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 1160)
      • iexplore.exe (PID: 944)
      • iexplore.exe (PID: 3984)

    • Changes internet zones settings

      • iexplore.exe (PID: 3984)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 944)
      • iexplore.exe (PID: 3984)
      • Update.exe (PID: 592)
      • chrome.exe (PID: 3764)
      • Teams.exe (PID: 2344)
      • Teams.exe (PID: 2628)

    • Application launched itself

      • iexplore.exe (PID: 3984)
      • chrome.exe (PID: 3160)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 944)
      • iexplore.exe (PID: 3984)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3984)

    • Reads Microsoft Office registry keys

      • Update.exe (PID: 592)
      • OUTLOOK.EXE (PID: 1160)
      • Update.exe (PID: 2096)
      • Teams.exe (PID: 3036)
      • Squirrel.exe (PID: 3760)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3984)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3984)

    • Manual execution by user

      • chrome.exe (PID: 3160)
      • explorer.exe (PID: 2832)

    • Reads the hosts file

      • chrome.exe (PID: 3160)
      • chrome.exe (PID: 3764)
      • Teams.exe (PID: 3332)
      • Teams.exe (PID: 2568)
      • Teams.exe (PID: 3036)
      • Teams.exe (PID: 2344)

    • Reads the date of Windows installation

      • chrome.exe (PID: 1360)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.ics/vcs | iCalendar - vCalendar (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
97
Malicious processes
15
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start drop and start outlook.exe iexplore.exe iexplore.exe teamssetup_s_8daa64ee8eac579-3-0_c_w_.exe update.exe wisptis.exe no specs wisptis.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs squirrel.exe teams.exe update.exe teams.exe no specs teams.exe no specs teams.exe no specs teams.exe teams.exe no specs teams.exe teams.exe no specs teams.exe no specs regsvr32.exe no specs teams.exe no specs teams.exe no specs teams.exe no specs chrome.exe no specs teams.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs explorer.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1160"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /ical "C:\Users\admin\AppData\Local\Temp\invite.ics"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3984"C:\Program Files\Internet Explorer\iexplore.exe" https://teams.microsoft.com/l/meetup-join/19%3ameeting_ZmMyYzNkYTMtODJjNC00OGIzLTg3YmQtOTYyMjNhZmZiZTM5%40thread.v2/0?context=%7b%22Tid%22%3a%227f786e85-2b61-4bbe-a796-71e91e5e7e38%22%2c%22Oid%22%3a%22e332548b-bf8e-4b01-8ad0-68494620df96%22%7dC:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\version.dll
944"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3984 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
588"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\TeamsSetup_s_8DAA64EE8EAC579-3-0_c_w_.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\TeamsSetup_s_8DAA64EE8EAC579-3-0_c_w_.exe
iexplore.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Installer for Squirrel-based applications
Exit code:
0
Version:
1.4.4.0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\teamssetup_s_8daa64ee8eac579-3-0_c_w_.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
592"C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe" --install . --exeName=TeamsSetup_s_8DAA64EE8EAC579-3-0_c_w_.exe --bootstrapperModeC:\Users\admin\AppData\Local\SquirrelTemp\Update.exe
TeamsSetup_s_8DAA64EE8EAC579-3-0_c_w_.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Teams
Exit code:
0
Version:
3.0.4.0
Modules
Images
c:\users\admin\appdata\local\squirreltemp\update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2276"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;C:\Windows\SYSTEM32\WISPTIS.EXE—Update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Pen and Touch Input Component
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wisptis.exe
c:\windows\system32\ntdll.dll
3088"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;C:\Windows\SYSTEM32\WISPTIS.EXE
Update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Pen and Touch Input Component
Exit code:
24
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wisptis.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
3160"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
Explorer.EXE
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
3276"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x66ced988,0x66ced998,0x66ced9a4C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
2464"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1036,14678372788603869326,3946627528915566078,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1048 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
Total events
64 214
Read events
62 081
Write events
0
Delete events
0

Modification events

No data
Executable files
351
Suspicious files
448
Text files
411
Unknown types
158

Dropped files

PID
Process
Filename
Type
1160OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR98C6.tmp.cvr —
MD5:—
SHA256:—
1160OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst —
MD5:—
SHA256:—
1160OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\be71009ff8bb02a2.customDestinations-msbinary
MD5:7E0F6D9C4BE2FD31696140FD1A314637
SHA256:DA3B385915E8D30CB180B4F7DE4D7B3AE38C5261B738CA1FCCFF0A9947E614CB
1160OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\~DFE7EDE971D29B4B63.TMPgmc
MD5:3DBF6EF3C5023EB50C5952A2D5041D65
SHA256:CB6BD0BBF4386FADDCFEE1F53D0F8EAE1E21282DDA90B2C5AC59E6F1666E696A
1160OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9SYD2G1TFBD5WEIIH0TI.tempbinary
MD5:7E0F6D9C4BE2FD31696140FD1A314637
SHA256:DA3B385915E8D30CB180B4F7DE4D7B3AE38C5261B738CA1FCCFF0A9947E614CB
1160OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\~DF3D4723E75DC97A2A.TMPoft
MD5:D5AD9A80E5AD18DE1546BABB08DC60B3
SHA256:0FAD7D5806B77375B0F875D2EAE83FFC0136B52FB750672B22B38FB3E37F77F3
1160OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:AA3A0175B4854A2FD3D6F4610D78E4D5
SHA256:9E325C03E0720CDBA73A19179AD00F559CBDC9EAE707A670D78626862EB74D14
1160OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\~DF00C35B0CE8FFDD8F.TMPbinary
MD5:CFF23A288AC92FA3FDC7323A4271184C
SHA256:840FDE6D59B666B6A6C913B6F475E87BE1668DE70ADD0C93BEE9A662040D2510
1160OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Outlook.lnklnk
MD5:301F671CC17AF078AC9A373BB2430E6D
SHA256:8D2A3C21C2A78050CDF58078ED973025CA0E86B8895D0FCB0889B0D0AD7ACE0C
1160OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:3EB0A7F1D1294DEE10A4DD6740662E9F
SHA256:772E7D7F2B3469610B61F0205DD9FC7C0816B5B8A52A1238C3F45AE166D788E6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
134
DNS requests
101
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1160
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
944
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
US
der
471 b
whitelisted
3984
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
3764
chrome.exe
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
crx
242 Kb
whitelisted
944
iexplore.exe
GET
200
23.216.77.69:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1c3e076ed021c716
US
compressed
4.70 Kb
whitelisted
944
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3984
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
der
471 b
whitelisted
944
iexplore.exe
GET
200
23.216.77.69:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7caa18904c3c839a
US
compressed
4.70 Kb
whitelisted
944
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D
US
der
471 b
whitelisted
880
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ac5q25btpqhkjhcekqoslcldvuya_1.3.36.141/ihnlcenocehgdaegdmhbidjhnhdchfmm_1.3.36.141_win_ehzjmd5kjmert7jdgsrj4xqxj4.crx3
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3984
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1160
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
944
iexplore.exe
52.113.194.132:443
teams.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
suspicious
944
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
3984
iexplore.exe
23.216.77.69:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
suspicious
3984
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
944
iexplore.exe
23.216.77.69:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
suspicious
592
Update.exe
52.113.194.132:443
teams.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
suspicious
3984
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
3984
iexplore.exe
96.16.143.41:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
teams.microsoft.com
  • 52.113.194.132
  • 2620:1ec:42::132
whitelisted
ctldl.windowsupdate.com
  • 23.216.77.69
  • 23.216.77.80
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
statics.teams.cdn.office.net
  • 52.113.194.132
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
browser.pipe.aria.microsoft.com
  • 20.42.72.131
whitelisted

Threats

No threats detected
Process
Message
Update.exe
Update.exe Information: 0 :
Update.exe
Starting TelemetryManager constructor
Update.exe
Update.exe Information: 0 :
Update.exe
TelemetryManagerImpl creation started
Update.exe
Update.exe Information: 0 :
Update.exe
Performance counters are disabled. Skipping creation of counters category.
Update.exe
Update.exe Information: 0 :
Update.exe
RecordBatcherTask with ID 4 started.
Update.exe
Update.exe Information: 0 :
Update.exe
DataPackageSender with UserAgent name: AST-exe-C#, version: 3.0.4.0, [Ast_Default_Source]
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
invite.ics