analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

AW Auftragskontrolle codecentric AG.msg

Full analysis: https://app.any.run/tasks/9ef3e708-ac09-4084-9954-d5e457e080e1
Verdict: Malicious activity
Analysis date: October 20, 2020, 10:35:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

DC260215ED47292C8BC7FECBCFA5843C

SHA1:

0F563C03022DB40F47863146CBEC3A292DE64DE6

SHA256:

373470A9B09EC0AED43F9883CBC43F54FC6EED9C23D415D9C8FB0A5D5C377D6E

SSDEEP:

3072:hjKMQ+Mn3nwrEbBIZFjysxV3ral05nIA:hjSwYbaZFjN3ral05nI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 2504)

  • SUSPICIOUS

    • Creates files in the program directory

      • AdobeARM.exe (PID: 3132)

  • INFO

    • Application launched itself

      • AcroRd32.exe (PID: 3332)
      • RdrCEF.exe (PID: 3492)
      • chrome.exe (PID: 3648)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2504)

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 2504)
      • AcroRd32.exe (PID: 3168)
      • AcroRd32.exe (PID: 3332)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2504)

    • Changes IE settings (feature browser emulation)

      • AcroRd32.exe (PID: 3332)

    • Reads the hosts file

      • RdrCEF.exe (PID: 3492)
      • chrome.exe (PID: 2124)
      • chrome.exe (PID: 3648)

    • Reads settings of System Certificates

      • AcroRd32.exe (PID: 3332)
      • chrome.exe (PID: 2124)

    • Manual execution by user

      • chrome.exe (PID: 3648)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
72
Monitored processes
32
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe acrord32.exe acrord32.exe no specs rdrcef.exe no specs rdrcef.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs adobearm.exe no specs reader_sl.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2504"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\AW Auftragskontrolle codecentric AG.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
3332"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\QKY6ODC1\AVV-Itelligence-2018(1).pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
OUTLOOK.EXE
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Version:
15.23.20070.215641
3168"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\QKY6ODC1\AVV-Itelligence-2018(1).pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Version:
15.23.20070.215641
3492"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16448250C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
2484"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="3492.0.1976442312\1873601845" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Version:
15.23.20053.211670
3648"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
1792"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6c84a9d0,0x6c84a9e0,0x6c84a9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3320"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3284 --on-initialized-event-handle=324 --parent-handle=328 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
1744"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=992,4754183131041443632,9303274925597121385,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=13741880142678231030 --mojo-platform-channel-handle=1008 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
2124"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=992,4754183131041443632,9303274925597121385,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=6250693398999341461 --mojo-platform-channel-handle=1500 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
Total events
2 781
Read events
2 091
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
86
Text files
185
Unknown types
31

Dropped files

PID
Process
Filename
Type
2504OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR3DD9.tmp.cvr —
MD5:—
SHA256:—
2504OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:CF7FC7805B58F952BA7EDEE29096A482
SHA256:E1E97D1EDFF6665A8DF07055FE84ED2311C7EBFEC51D89237C3E87495CA40C47
2504OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\62BA5E52.datimage
MD5:168531BD1AB63B64B62CB26D04D92652
SHA256:D08B1469C299DE469F0223B45A7AF574C9D6A926D839E991F42124E04C3022E3
2504OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\26F72230.datimage
MD5:84E42DB69CA6ED054ED6EB7B7CBDAC46
SHA256:5C440A74F221FC0953F5B8F2754389BF58B63C33A0E2BF5D7C0B66B0748BA263
2504OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\77259A6.datimage
MD5:5E951F420C5028B689E3E24F796EBD41
SHA256:D3EF9415FD1B2895478CD19211752895F6BF675501AF613C2F65F9D07F3BAEE4
2504OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\302FB3F9.datimage
MD5:356FE9299222AF21635F961DA763484C
SHA256:A29F5EDE5C224B6DBDD5FD67C81FB17073F30CCCF30D06E6C37E5B9CBC862F69
2504OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9F4DFE73.datimage
MD5:DFC2EDAA204453AC734E358DD6FCA94C
SHA256:B0E7CF6807734393EC89663604BFD98BBADF6D677B598E822324C3CB5EB4A580
2504OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:31F87CB6FC8034BE9D701316B12E6FA5
SHA256:754C500CD7CFA14C6F6F51F9CB53088B0B488154B8D9C9254523B759451E6E0E
2504OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\QKY6ODC1\AVV-Itelligence-2018(1) (2).pdf\:Zone.Identifier:$DATA —
MD5:—
SHA256:—
3168AcroRd32.exeC:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
61
DNS requests
33
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3332
AcroRd32.exe
GET
304
2.16.177.91:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/279_15_23_20070.zip
unknown
—
—
whitelisted
3332
AcroRd32.exe
GET
304
2.16.177.91:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/280_15_23_20070.zip
unknown
—
—
whitelisted
3332
AcroRd32.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
3332
AcroRd32.exe
GET
304
2.16.177.91:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/281_15_23_20070.zip
unknown
—
—
whitelisted
2124
chrome.exe
GET
301
213.136.80.18:80
http://www.sicdata.de/
DE
—
—
unknown
3332
AcroRd32.exe
GET
200
2.16.177.91:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/message.zip
unknown
compressed
9.54 Kb
whitelisted
2124
chrome.exe
GET
200
216.58.212.163:80
http://www.google.de/maps/vt/data=YG9i_fsJWj1PisVn1nJYWWkfanDt9INmKWoQwn2W0MjytQDLQXI030J4T9LhQm2NbKZOEpR5CeFmN61C0QSrgNO9c-RimE7SEpisPnwPXBGqxczTIa2-Nn-MPZVePbvXfJ89ooTlD0SZlu0AsvQ
US
image
4.82 Kb
whitelisted
2124
chrome.exe
GET
302
216.58.212.163:80
http://www.google.de/maps?q=Systemhaus+Erdmann+GmbH+%26+Co.+KG,+Schlachthofstra%C3%9Fe,+Solingen&hl=de&ie=UTF8&ll=51.181522,7.085624&spn=0.010653,0.027874&sll=51.427085,7.663989&sspn=5.426479,14.27124&oq=Systemhaus+Erdmann&hq=Systemhaus+Erdmann+GmbH+%26+Co.+KG,&hnear=Schlachthofstra%C3%9Fe,+42651+Solingen,+Nordrhein-Westfalen&t=m&z=16&iwloc=A
US
html
594 b
whitelisted
2504
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2504
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
2124
chrome.exe
172.217.23.99:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
3332
AcroRd32.exe
2.18.233.74:443
armmf.adobe.com
Akamai International B.V.
—
whitelisted
2124
chrome.exe
216.58.212.173:443
accounts.google.com
Google Inc.
US
whitelisted
3332
AcroRd32.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3332
AcroRd32.exe
2.16.177.91:80
acroipm2.adobe.com
Akamai International B.V.
—
whitelisted
—
—
216.58.212.174:443
apis.google.com
Google Inc.
US
whitelisted
2124
chrome.exe
142.250.74.195:443
fonts.gstatic.com
Google Inc.
US
whitelisted
2124
chrome.exe
172.217.22.67:443
www.gstatic.com
Google Inc.
US
whitelisted
2124
chrome.exe
172.217.16.132:443
www.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
acroipm2.adobe.com
  • 2.16.177.91
  • 2.16.177.123
whitelisted
armmf.adobe.com
  • 2.18.233.74
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
clientservices.googleapis.com
  • 172.217.23.99
whitelisted
accounts.google.com
  • 216.58.212.173
shared
www.google.com
  • 172.217.16.132
whitelisted
fonts.googleapis.com
  • 216.58.210.10
whitelisted
www.gstatic.com
  • 172.217.22.67
whitelisted
fonts.gstatic.com
  • 142.250.74.195
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
AW Auftragskontrolle codecentric AG.msg