File name:

FW We're working on your order 55-834000005771937.msg

Full analysis: https://app.any.run/tasks/e2ce0618-7e40-48bc-9a99-bf0dbff3cf2c
Verdict: Malicious activity
Analysis date: March 23, 2022, 19:14:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

B53C3358D54A2AAFADBBABF6F953182B

SHA1:

057C9A0F3D1D512A6A0674BB17D927DE97B85F60

SHA256:

36BFC425431ADB19682FEB9BF9C67AD76E6EEEA43EA0B54BB1BAAAE7AFF56D6E

SSDEEP:

1536:BI0CHQhWVZ9WHOBBnZD9D/Iz6RrkfH6LDbZDb4cAzi:BI0CbVZ9vL9/IORrkfH6LD5bz6i

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 1988)

  • SUSPICIOUS

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 1988)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 1556)
      • iexplore.exe (PID: 4068)

  • INFO

    • Searches for installed software

      • OUTLOOK.EXE (PID: 1988)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 1988)
      • iexplore.exe (PID: 1556)

    • Checks Windows Trust Settings

      • OUTLOOK.EXE (PID: 1988)
      • iexplore.exe (PID: 4068)
      • iexplore.exe (PID: 3264)
      • iexplore.exe (PID: 1556)

    • Checks supported languages

      • iexplore.exe (PID: 3264)
      • OUTLOOK.EXE (PID: 1988)
      • iexplore.exe (PID: 1556)
      • iexplore.exe (PID: 4068)

    • Reads the computer name

      • iexplore.exe (PID: 3264)
      • OUTLOOK.EXE (PID: 1988)
      • iexplore.exe (PID: 1556)
      • iexplore.exe (PID: 4068)

    • Changes internet zones settings

      • iexplore.exe (PID: 3264)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1556)
      • OUTLOOK.EXE (PID: 1988)
      • iexplore.exe (PID: 4068)
      • iexplore.exe (PID: 3264)

    • Application launched itself

      • iexplore.exe (PID: 3264)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1556)
      • iexplore.exe (PID: 4068)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 1988)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 1556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe iexplore.exe iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1556"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3264 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1988"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\FW We're working on your order 55-834000005771937.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\version.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
3264"C:\Program Files\Internet Explorer\iexplore.exe" https://www.att.com/checkmyorder/orderDetails?onum=55-834000005771937&zip=64759&appid=OT&source=EZzkOLj450000000E&wtExtndSource=OrderTrack&context=bjrDD8anARuOxhN/rvdqVqWlLfDSiNhgh0j7N7+mcBk9w6lXmt4D0ZnR/Zdhxd1Ac3ne/5fcX4zK09S+VvhgjmhthNa0n3R80+7M+Fhfc8r6+ECld0lxsD7SncioVgh2O2I67PiuHYrHsG4vtO3A6TYOR9ZH5MIsvXiKjPHg9fqifHQxhUpbWZ7IT64sWBQO+egKDL8dbW1XN8jyrkBjN3khXm5rf04dLcPYZa6R9errw8BYruBDpIU0KCH4V/Y3ZjCEHs9sGopEBrsKBPsQtLqQurb+rmEspuxgNmorSe3d/83T3TD6EOuUbr2JK2jQKEGCAfH6QzDoSt+WWXSrkzWA55KIJDPHYIFlJKs+Zcgo7bAeAlyKFYzbyEIrIshSNYDnkogkM8dggWUkqz5lyNUSbs9algGrQu2RYkudXTJtnbu/w1knDrQkaM1AwyfobFRVGUOuBQx2gTazgml8D/UkJjsqmApOOCkTDgQnQEjxCEg3Q0W+hHGP0heVIgya%20C:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
4068"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3264 CREDAT:4068637 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
38 127
Read events
37 113
Write events
994
Delete events
20

Modification events

(PID) Process:(1988) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(1988) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(1988) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(1988) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(1988) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(1988) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(1988) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(1988) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(1988) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
Off
(PID) Process:(1988) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1055
Value:
Off
Executable files
0
Suspicious files
47
Text files
294
Unknown types
46

Dropped files

PID
Process
Filename
Type
1988OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRE477.tmp.cvr —
MD5:—
SHA256:—
1988OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst —
MD5:—
SHA256:—
1988OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:—
SHA256:—
1988OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:—
SHA256:—
1556iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:—
SHA256:—
1988OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ContactPrefs_2_80CC8EFDF11D5049B4340799CED6216B.datxml
MD5:BBCF400BD7AE536EB03054021D6A6398
SHA256:383020065C1F31F4FB09F448599A6D5E532C390AF4E5B8AF0771FE17A23222AD
1556iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\36W4FUXM.txttext
MD5:—
SHA256:—
1988OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_RssRule_2_900B09412C69204E810729D082D11276.datxml
MD5:D8B37ED0410FB241C283F72B76987F18
SHA256:31E68049F6B7F21511E70CD7F2D95B9CF1354CF54603E8F47C1FC40F40B7A114
1556iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\UF6KXGJ8.txttext
MD5:—
SHA256:—
1556iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\orderDetails[1].htmhtml
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
42
TCP/UDP connections
156
DNS requests
72
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1988
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
1556
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAwIlmU1uUKpc1Jl5Pl1QLw%3D
US
der
471 b
whitelisted
1556
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
1556
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
1556
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAPcXPipNqNLgWgvPi2Uwnc%3D
US
der
471 b
whitelisted
1556
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAiUAg1J7ie9IHbDN8v5koI%3D
US
der
471 b
whitelisted
1556
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
1556
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCruRSnMdEIAQoAAAABOwY0
US
der
472 b
whitelisted
1556
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDAT8PFQRvl2xIAAAAABaYX
US
der
472 b
whitelisted
1556
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1988
OUTLOOK.EXE
74.200.39.23:443
www.lbt.com
Jack Henry & Associates, Inc.
US
suspicious
1556
iexplore.exe
67.27.235.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
1556
iexplore.exe
54.77.200.211:443
dpm.demdex.net
Amazon.com, Inc.
IE
unknown
1556
iexplore.exe
104.89.44.55:443
www.att.com
Akamai Technologies, Inc.
NL
unknown
1988
OUTLOOK.EXE
184.25.158.41:443
www.att.com
Akamai International B.V.
US
whitelisted
—
—
67.27.235.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
1556
iexplore.exe
184.25.158.41:443
www.att.com
Akamai International B.V.
US
whitelisted
1556
iexplore.exe
142.250.184.200:443
www.googletagmanager.com
Google Inc.
US
suspicious
1556
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1556
iexplore.exe
13.107.21.200:443
www.bing.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
www.att.com
  • 184.25.158.41
  • 104.89.44.55
suspicious
www.lbt.com
  • 74.200.39.23
  • 74.200.39.24
  • 74.200.39.25
suspicious
ctldl.windowsupdate.com
  • 67.27.235.254
  • 8.241.78.254
  • 67.26.139.254
  • 8.248.139.254
  • 8.248.119.254
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
att.mpeasylink.com
  • 54.175.77.159
unknown
dpm.demdex.net
  • 54.77.200.211
  • 52.212.211.89
  • 18.203.152.154
  • 54.154.124.119
  • 54.155.94.243
  • 52.212.153.175
  • 63.35.20.93
  • 54.220.215.179
whitelisted
cdn.quantummetric.com
  • 104.22.53.252
  • 172.67.20.158
  • 104.22.52.252
whitelisted
smetrics.att.com
  • 104.89.44.55
suspicious
fls.doubleclick.net
  • 142.250.184.198
whitelisted

Threats

PID
Process
Class
Message
1988
OUTLOOK.EXE
Potentially Bad Traffic
ET INFO TLS Handshake Failure
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
FW We're working on your order 55-834000005771937.msg