analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

outlook.msg

Full analysis: https://app.any.run/tasks/e56bac8c-b482-4935-9bb2-654c8cbdc027
Verdict: Malicious activity
Analysis date: December 02, 2019, 17:36:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

F5531A7822138F8A40098C58EC93D79B

SHA1:

2D3136F3256D83D3DE5DBB1FA719C95785F3B08B

SHA256:

2DDE2A88999A124A9FF3B7ADD3D601C2E8CEB4E7D45C9F831353F181E9B0A23A

SSDEEP:

768:xOnUHA4TKI0XbWKbt8/n5O5c7J2WsKjWsKN:qsTKnWUgYu12W7WV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 2524)

  • SUSPICIOUS

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 2524)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2524)

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 2524)

  • INFO

    • Creates files in the user directory

      • iexplore.exe (PID: 1524)

    • Application launched itself

      • chrome.exe (PID: 2748)

    • Changes internet zones settings

      • iexplore.exe (PID: 2700)

    • Reads the hosts file

      • chrome.exe (PID: 3940)
      • chrome.exe (PID: 2748)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 1524)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1524)

    • Manual execution by user

      • chrome.exe (PID: 2748)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2524)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (50.8)
.oft | Outlook Form Template (29.7)
.doc | Microsoft Word document (old ver.) (13.6)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
20
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe iexplore.exe iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2524"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\outlook.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
2700"C:\Program Files\Internet Explorer\iexplore.exe" https://tdrive.li/NuhKjuC:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
1524"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2700 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2748"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3332"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6feda9d0,0x6feda9e0,0x6feda9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3796"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2456 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3172"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1016,14002843400145535165,1921639629102073157,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=1450909198600560945 --mojo-platform-channel-handle=1024 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
3940"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1016,14002843400145535165,1921639629102073157,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=5911177842575728281 --mojo-platform-channel-handle=1616 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3300"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1016,14002843400145535165,1921639629102073157,131072 --enable-features=PasswordImport --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=16915988749310086962 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2248 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
1708"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1016,14002843400145535165,1921639629102073157,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=2976661985388189015 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2432 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
Total events
2 022
Read events
1 364
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
15
Text files
78
Unknown types
8

Dropped files

PID
Process
Filename
Type
2524OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRA737.tmp.cvr —
MD5:—
SHA256:—
2700iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
2700iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2524OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:1AEB12F8F52B3D1627402D67C01C78FF
SHA256:83E1EF6C349AED96DEB49B5F8B743417EBD673E0B44750D635EA0CC3F5E64B26
2524OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:369BEA812B705722FF1EFE5D9F50C515
SHA256:3203D47F249D10AF13746FEA8AD4C9778C6D3B4D6CCC024B354623FC5D55D576
1524iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:9576F1521CB272CE8D7A63D411CB5282
SHA256:22CD0E51BC6ED7FEE976DA700900F09FDEC1A3176AFA3887F2665B4F45F6BE94
2524OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inftext
MD5:48DD6CAE43CE26B992C35799FCD76898
SHA256:7BFE1F3691E2B4FB4D61FBF5E9F7782FBE49DA1342DBD32201C2CC8E540DBD1A
1524iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:C01FCB759F040CAA3949216451133736
SHA256:613FF05F0477BDF34BDEBD8CE768E4BDB42F50FD9BFA185550878409CF30271F
1524iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YX808Q76\ipcallback[1].jstext
MD5:ACEBE5EFE4C5AAC7B31E409421A2F31E
SHA256:523F32181F36EE4CE4FF2C230659CBE2BD64C3A1AA10C96B20FF7FE22BE6AFAA
2524OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_WorkHours_1_E2C90DD529B0EF4F91AFC7E7FF236D79.datxml
MD5:807EF0FC900FEB3DA82927990083D6E7
SHA256:4411E7DC978011222764943081500FFF0E43CBF7CCD44264BD1AB6306CA68913
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
92
DNS requests
26
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2524
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
3940
chrome.exe
GET
—
74.125.153.27:80
http://r5---sn-hpa7zned.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mip=185.128.27.151&mm=28&mn=sn-hpa7zned&ms=nvh&mt=1575308182&mv=m&mvi=4&pl=24&shardbypass=yes
US
—
—
whitelisted
3940
chrome.exe
GET
302
216.58.210.14:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
html
510 b
whitelisted
3940
chrome.exe
GET
200
74.125.153.27:80
http://r5---sn-hpa7zned.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx?cms_redirect=yes&mip=185.128.27.151&mm=28&mn=sn-hpa7zned&ms=nvh&mt=1575308182&mv=m&mvi=4&pl=24&shardbypass=yes
US
crx
293 Kb
whitelisted
3940
chrome.exe
GET
302
216.58.210.14:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx
US
html
515 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2524
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
2700
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
—
—
173.194.76.82:443
html5shiv.googlecode.com
Google Inc.
US
whitelisted
1524
iexplore.exe
216.52.72.155:443
www.zoho.com
ZOHO
US
unknown
—
—
172.217.18.104:443
www.googletagmanager.com
Google Inc.
US
suspicious
—
—
13.225.78.93:443
www.zohowebstatic.com
—
US
whitelisted
1524
iexplore.exe
13.225.78.93:443
www.zohowebstatic.com
—
US
whitelisted
1524
iexplore.exe
8.39.54.37:443
iplocation.zoho.com
ZOHO
US
unknown
1524
iexplore.exe
136.143.187.52:443
tdrive.li
Cogent Communications
US
suspicious
3940
chrome.exe
216.58.207.35:443
clientservices.googleapis.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
tdrive.li
  • 136.143.187.52
suspicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.zoho.com
  • 216.52.72.155
  • 8.39.54.155
suspicious
iplocation.zoho.com
  • 8.39.54.37
whitelisted
www.zohowebstatic.com
  • 13.225.78.93
  • 13.225.78.96
  • 13.225.78.69
  • 13.225.78.106
shared
html5shiv.googlecode.com
  • 173.194.76.82
whitelisted
www.googletagmanager.com
  • 172.217.18.104
whitelisted
clientservices.googleapis.com
  • 216.58.207.35
whitelisted
accounts.google.com
  • 172.217.22.109
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
outlook.msg