download: | 2e8722d37b0b8c5301cb2468778547aa300968ff8914ef1a9ecd78ac52629224 |
Full analysis: | https://app.any.run/tasks/a11a3cb5-9391-4d73-b66e-d0e9dea73b7b |
Verdict: | Malicious activity |
Analysis date: | March 14, 2019, 12:58:12 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | 934CD77E11C4B1F1A6096F206CDDD4E1 |
SHA1: | 85ED0CD3DF125D4BD8542D429D15745335B3162A |
SHA256: | 2E8722D37B0B8C5301CB2468778547AA300968FF8914EF1A9ECD78AC52629224 |
SSDEEP: | 12288:wGEy6wGt9bJl9G7o2q8JRCUCvFJ1N+wcGclJ4DPU8G0aZ:Vaw0bJ0ooK3vj+7GwGDcj02 |
.msg | | | Outlook Message (58.9) |
---|---|---|
.oft | | | Outlook Form Template (34.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3588 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\Desktop\2e8722d37b0b8c5301cb2468778547aa300968ff8914ef1a9ecd78ac52629224.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
2440 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Exit code: 0 Version: 14.0.6025.1000 | ||||
3052 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\MML1SXGT\Missan dashboard.rar" | C:\Program Files\WinRAR\WinRAR.exe | — | OUTLOOK.EXE |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
2212 | "C:\Program Files\Internet Explorer\iexplore.exe" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2904 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2212 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3744 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | WinRAR.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
3292 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /Embedding | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Excel Version: 14.0.6024.1000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3588 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRDCB5.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2440 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR2075.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3588 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\MML1SXGT\Missan dashboard (2).rar\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
3588 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FFBD182D.dat | image | |
MD5:F90458A410B1BA570314765F67E32AAA | SHA256:DDC5BD4744C2A166E9C5C27A2654DE8F89FCC03C357B299C9A55890F03305F74 | |||
3588 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B0A1284A.dat | image | |
MD5:D34B37792A58AF5DE4E3608F41EC60D5 | SHA256:E6DFBFFFC2286A1031E020BEFAEE32ED7FCFFB39C6D1B30666636563509E94B9 | |||
3588 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:71B5A45B478FDCA202415FCE821E5377 | SHA256:48AC96A85EEBA57C83AA1B37A5F2BEA42DD5359BC2E566FCB35C2785B630B6F8 | |||
3588 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\43CB19C9.dat | image | |
MD5:28061D2DFB61D0E91B6D685D87152E9B | SHA256:1ED6E142C39290D5270F28596C3BB7894DD756303026774BD4D546D03BCE63E8 | |||
3588 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1D7687C3.dat | image | |
MD5:0F330554AF0EFF37FB446305A6428E79 | SHA256:4E696570FDE54734D43084E8E64EF38AC2D6D9F7304EC9864161820452BF06EE | |||
3588 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E2376536.dat | image | |
MD5:FBE0679300ECB512EB3F350C2F3B925D | SHA256:95AECD4D79FD4945F88245D69DEFC23794BF74DE1E705BC879E3000F9EF740AD | |||
2212 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\favicon[1].ico | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2904 | iexplore.exe | GET | — | 216.239.34.21:80 | http://virustotal.com/ | US | — | — | whitelisted |
3588 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
2212 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2212 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3588 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
2904 | iexplore.exe | 216.239.34.21:80 | virustotal.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
dns.msftncsi.com |
| shared |
www.bing.com |
| whitelisted |
virustotal.com |
| whitelisted |