analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

_EXTERNAL_ Invoices & Payment Receipt.msg

Full analysis: https://app.any.run/tasks/0665e99c-ff86-4d3c-94be-fcaa81cf7dfe
Verdict: Malicious activity
Analysis date: January 24, 2022, 17:58:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
phishing
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

C782E08777B78845A9A5A52AD057FE3A

SHA1:

BF1362E02890ECBCE19622FF8D8F5E6A070512C7

SHA256:

35EF4287354E7448BC37113DCC27CDD05CCEF49C2C07F410C91D287F63BCD230

SSDEEP:

3072:2s1vEUz24pO+avsEU0O4H8jgyG2TbuwsOzuof6Dxuh6Dxu06DxuP6DxuPv6DxujY:UUz24pOwiOk8llsZDNJNCNrNjNvNbN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 3148)

    • Phishing background detected

      • iexplore.exe (PID: 3420)

  • SUSPICIOUS

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 3148)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3420)

  • INFO

    • Reads the computer name

      • OUTLOOK.EXE (PID: 3148)
      • iexplore.exe (PID: 2320)
      • iexplore.exe (PID: 3420)

    • Checks supported languages

      • OUTLOOK.EXE (PID: 3148)
      • iexplore.exe (PID: 3420)
      • iexplore.exe (PID: 2320)

    • Searches for installed software

      • OUTLOOK.EXE (PID: 3148)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 3148)
      • iexplore.exe (PID: 2320)
      • iexplore.exe (PID: 3420)

    • Application launched itself

      • iexplore.exe (PID: 2320)

    • Changes internet zones settings

      • iexplore.exe (PID: 2320)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3420)
      • iexplore.exe (PID: 2320)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3420)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2320)
      • iexplore.exe (PID: 3420)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 3148)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2320)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2320)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3148"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\_EXTERNAL_ Invoices & Payment Receipt.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2320"C:\Program Files\Internet Explorer\iexplore.exe" https://protect-us.mimecast.com/s/pdYXC1wnlQHpXYgwcLvxXe?domain=form.jotform.comC:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3420"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2320 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
27 581
Read events
26 379
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
29
Text files
83
Unknown types
26

Dropped files

PID
Process
Filename
Type
3148OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRE6E8.tmp.cvr —
MD5:—
SHA256:—
3148OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst —
MD5:—
SHA256:—
3148OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:926042A488EC78374CA2DFDB5DBA4F83
SHA256:44312824F13E3CDE42D84FD816607A416A2A9A290746D6D4160A1B23F33F34CD
3148OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BFB9B67D.datimage
MD5:4A5A67513212A6CE70C9DC947BD7BDE7
SHA256:34554EE3BCC351C7CEDA412D9D4C4543585103FC7A63B8F97F1A06409481AB83
3148OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:FC3237EBCCF3D793AF1543E88A797927
SHA256:55C6259C1DC59EE49D240AC1EAE30CE44DE8398DF491B01028A691513DE3EA8A
3148OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\15240D6C.datimage
MD5:A8A0ED547A34D08CAFB0447FAFD18B6B
SHA256:320C1B18ED07423E3D39F8D36BF6D353497BC3933B6E8A37548421C7DC6557A8
2320iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:C3AF302F0FA95FC0FCEF65C86319225F
SHA256:061A0113C59148B2FF3992FB8A0050A7390677F5FD38548877D0CFEAC2E3F451
3148OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inftext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
3148OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_62EF35BE61DD934AA5B39079C482A83C.datxml
MD5:B21ED3BD946332FF6EBC41A87776C6BB
SHA256:B1AAC4E817CD10670B785EF8E5523C4A883F44138E50486987DC73054A46F6F4
2320iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:AF0CB4FEEC2181354030EFE6668FC730
SHA256:E7B3C73E6DFCE90DC7E197E122AFAD5F4520897445FFA3DCDC192C1D95BD65CD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
107
DNS requests
51
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2320
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3420
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAj8EtmP3tUuyPE3Fv2fV60%3D
US
der
471 b
whitelisted
2320
iexplore.exe
GET
200
67.27.233.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?470dae91bdd64f2d
US
compressed
4.70 Kb
whitelisted
3420
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
3420
iexplore.exe
GET
200
104.18.30.182:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
3420
iexplore.exe
GET
200
104.18.31.182:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
3420
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
2320
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3420
iexplore.exe
GET
200
52.84.186.217:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
2320
iexplore.exe
GET
200
67.27.233.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1edce958bd6c8db8
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2320
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3420
iexplore.exe
67.27.233.126:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
2320
iexplore.exe
67.27.233.126:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
3420
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3420
iexplore.exe
207.211.31.64:443
protect-us.mimecast.com
Navisite, Inc.
US
suspicious
2320
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3148
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
3420
iexplore.exe
67.27.235.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
2320
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3420
iexplore.exe
207.211.31.119:443
security-us.mimecast.com
Navisite, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
protect-us.mimecast.com
  • 205.139.111.113
  • 207.211.31.64
  • 205.139.111.12
  • 205.139.111.117
  • 207.211.31.106
  • 207.211.31.113
whitelisted
api.bing.com
  • 13.107.5.80
  • 13.107.13.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
  • 131.253.33.200
  • 13.107.22.200
whitelisted
ctldl.windowsupdate.com
  • 67.27.233.126
  • 67.27.235.254
  • 8.253.95.120
  • 8.248.143.254
  • 67.26.81.254
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
form.jotform.com
  • 35.201.118.58
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.comodoca.com
  • 104.18.30.182
  • 104.18.31.182
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query for .to TLD
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
_EXTERNAL_ Invoices & Payment Receipt.msg