File name: | zsecure MMC Request for Participation 2020 Q1 2021 Exams .msg |
Full analysis: | https://app.any.run/tasks/06b7315b-af65-4a53-adda-59a2e460ace8 |
Verdict: | Malicious activity |
Analysis date: | September 10, 2019, 23:00:45 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | 4D3B8D03556CDFE79C477202D58C6ED7 |
SHA1: | 135FD0BE65F1765848B5B7461E47174B96282845 |
SHA256: | 246B6B00402C5ACCFB56C1495E247A11809F29D6562B12BE2F8BA498317AFDE4 |
SSDEEP: | 1536:YuWxWJrCx0c8hBgqo1UNunW7WJQkveGKf/GKVSIov6:Y4rCx0c8hBfYrQkvJKfuKVS1 |
.msg | | | Outlook Message (58.9) |
---|---|---|
.oft | | | Outlook Form Template (34.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2756 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\zsecure MMC Request for Participation 2020 Q1 2021 Exams .msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
704 | "C:\Program Files\Internet Explorer\iexplore.exe" https://secure-web.cisco.com/1HlKoV59vuInP2hdiK8XYH0bEny7oCxpfCKiY4b3PC2N9AWkiZh2haEV3zGfaAcBzvVcsJVdq7kkxdNJ8Q4eO-Jm3WdZMT3E3hArsj9ag10K7muIXreFxnUDo9wlnHGFQm5lV16obam4KMowi3YTG-1c5893rXWThYAJX3yWmTqpGjEMHx00yASUru9xR9OGI51IA_FiHZoNYaVk-Ot1QqtVL_JIgUqrtaBL-7wTJZgkEPAd8-KFIpTXD7rcOleNEgUQe7SjBRGobgIre8ebEB-Hsno8eBY_CQ6SBWDE_KrJ25EsT24_GAyFO7CWv2x7-UsL1ictSygWhP3oA31Eo5Q/https%3A%2F%2Fweb1.zixmail.net%2Fs%2Fe%3Fb%3Dcsbs%26m%3DABAixbqsPpk4X7oOTEedtzYp%26em%3Dtmurphy%2540dcca%252ehawaii%252egov | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
504 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:704 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2860 | "C:\Program Files\Internet Explorer\iexplore.exe" https://secure-web.cisco.com/1HlKoV59vuInP2hdiK8XYH0bEny7oCxpfCKiY4b3PC2N9AWkiZh2haEV3zGfaAcBzvVcsJVdq7kkxdNJ8Q4eO-Jm3WdZMT3E3hArsj9ag10K7muIXreFxnUDo9wlnHGFQm5lV16obam4KMowi3YTG-1c5893rXWThYAJX3yWmTqpGjEMHx00yASUru9xR9OGI51IA_FiHZoNYaVk-Ot1QqtVL_JIgUqrtaBL-7wTJZgkEPAd8-KFIpTXD7rcOleNEgUQe7SjBRGobgIre8ebEB-Hsno8eBY_CQ6SBWDE_KrJ25EsT24_GAyFO7CWv2x7-UsL1ictSygWhP3oA31Eo5Q/https%3A%2F%2Fweb1.zixmail.net%2Fs%2Fe%3Fb%3Dcsbs%26m%3DABAixbqsPpk4X7oOTEedtzYp%26em%3Dtmurphy%2540dcca%252ehawaii%252egov | C:\Program Files\Internet Explorer\iexplore.exe | — | OUTLOOK.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3532 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2860 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3548 | "C:\Program Files\Internet Explorer\iexplore.exe" http://secure-web.cisco.com/195aF2D0DxuP6G4ThGLBuuyH5MR7ZJ5r_-_FaEiAcAurXh5L_vLJ0PF9UXO6ENRSIBKFhMlGXbKIaFfgb99QQFbAeqwJRF6H1NdLr7JmI6Os6Czu18JsQ36KSihb7RBVmgbKI9DRuA_O2UfNn0sNigz1RgKkCn5FH_49e5-r-JW7S-Z9DBjWkPuDC3nW9WK4SQbXmpneYTzN--4gHWPnNGzNYXYAyPBK2z2zR2FlK5WsobyRzG7EBjUFU0GLUnH2BlQDbMpvuiKvl-0B7iPV9xaTHRUsY1vTBEi8Z-rKg6UyjWdvNH6D_6hzFnC9uQ4obSMeWpVy7rcPBfGgOv3GwDQ/http%3A%2F%2Fwww.zixcorp.com%2Finfo%2Fzixmail_ZMC | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2308 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3548 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3824 | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe | — | svchost.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Version: 26,0,0,131 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2756 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR9BE7.tmp.cvr | — | |
MD5:— | SHA256:— | |||
704 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
704 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
504 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\CabB8E5.tmp | — | |
MD5:— | SHA256:— | |||
504 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\TarB8E6.tmp | — | |
MD5:— | SHA256:— | |||
504 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\CabB8F6.tmp | — | |
MD5:— | SHA256:— | |||
504 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\TarB907.tmp | — | |
MD5:— | SHA256:— | |||
504 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\CabB9B4.tmp | — | |
MD5:— | SHA256:— | |||
2756 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:BC614AFB1B9C618371BB56E0529D6E6B | SHA256:4ED310210444229BF4A780D2F7AE73FA2B4ABE52CEE1AE9D3692222F482D1FDA | |||
504 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\TarB9B5.tmp | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2308 | iexplore.exe | GET | 302 | 184.94.240.100:80 | http://secure-web.cisco.com/195aF2D0DxuP6G4ThGLBuuyH5MR7ZJ5r_-_FaEiAcAurXh5L_vLJ0PF9UXO6ENRSIBKFhMlGXbKIaFfgb99QQFbAeqwJRF6H1NdLr7JmI6Os6Czu18JsQ36KSihb7RBVmgbKI9DRuA_O2UfNn0sNigz1RgKkCn5FH_49e5-r-JW7S-Z9DBjWkPuDC3nW9WK4SQbXmpneYTzN--4gHWPnNGzNYXYAyPBK2z2zR2FlK5WsobyRzG7EBjUFU0GLUnH2BlQDbMpvuiKvl-0B7iPV9xaTHRUsY1vTBEi8Z-rKg6UyjWdvNH6D_6hzFnC9uQ4obSMeWpVy7rcPBfGgOv3GwDQ/http%3A%2F%2Fwww.zixcorp.com%2Finfo%2Fzixmail_ZMC | US | — | — | whitelisted |
2756 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
2308 | iexplore.exe | GET | 302 | 199.30.234.249:80 | http://www.zixcorp.com/info/zixmail_ZMC | US | — | — | suspicious |
504 | iexplore.exe | GET | 200 | 13.107.4.50:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | US | compressed | 57.0 Kb | whitelisted |
2308 | iexplore.exe | GET | 200 | 205.185.216.10:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/F9B5B632455F9CBEEC575F80DCE96E2CC7B278B7.crt | US | der | 848 b | whitelisted |
2308 | iexplore.exe | GET | 200 | 199.15.213.30:80 | http://go.zixcorp.com/learn-more.html | US | html | 6.39 Kb | malicious |
2308 | iexplore.exe | GET | 200 | 216.58.207.42:80 | http://fonts.googleapis.com/css?family=Raleway | US | text | 162 b | whitelisted |
2308 | iexplore.exe | GET | 200 | 199.15.213.30:80 | http://go.zixcorp.com/rs/406-QBF-138/images/Learn%20More%20-%20Register%20Email.png | US | image | 45.6 Kb | malicious |
2308 | iexplore.exe | GET | 200 | 13.224.196.31:80 | http://d12ulf131zb0yj.cloudfront.net/SmartForms3-0/SmartForms.js | US | text | 20.5 Kb | shared |
2308 | iexplore.exe | GET | 200 | 199.15.213.30:80 | http://go.zixcorp.com/rs/406-QBF-138/images/Learn%20More%20-%20Open%20Email.png | US | image | 42.0 Kb | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
704 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2308 | iexplore.exe | 199.15.213.30:80 | go.zixcorp.com | MARKETO | US | unknown |
2756 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
2308 | iexplore.exe | 205.185.216.10:80 | www.download.windowsupdate.com | Highwinds Network Group, Inc. | US | whitelisted |
2308 | iexplore.exe | 209.197.3.15:443 | maxcdn.bootstrapcdn.com | Highwinds Network Group, Inc. | US | whitelisted |
504 | iexplore.exe | 63.71.15.50:443 | web1.zixmail.net | Zix Corporation | US | suspicious |
2308 | iexplore.exe | 199.30.234.249:80 | www.zixcorp.com | Zix Corporation | US | suspicious |
3532 | iexplore.exe | 63.71.15.50:443 | web1.zixmail.net | Zix Corporation | US | suspicious |
— | — | 199.15.213.30:80 | go.zixcorp.com | MARKETO | US | unknown |
2308 | iexplore.exe | 216.58.207.42:80 | fonts.googleapis.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
secure-web.cisco.com |
| whitelisted |
www.bing.com |
| whitelisted |
www.download.windowsupdate.com |
| whitelisted |
web1.zixmail.net |
| whitelisted |
www.zixcorp.com |
| suspicious |
go.zixcorp.com |
| malicious |
ajax.googleapis.com |
| whitelisted |
d12ulf131zb0yj.cloudfront.net |
| shared |
fonts.googleapis.com |
| whitelisted |