Malware analysis Remittance Advice.msg Malicious activity

Add for printing

File name:	Remittance Advice.msg
Full analysis:	https://app.any.run/tasks/40373c32-2441-4a3c-b806-8e0cd808667d
Verdict:	Malicious activity
Analysis date:	July 17, 2019, 11:40:53
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME:	application/vnd.ms-outlook
File info:	CDFV2 Microsoft Outlook Message
MD5:	73A58778DBA470FF9E5342AC78B192C1
SHA1:	2509A63C09A5AA4DDE0CF36FD36A7B2425F18C0E
SHA256:	3FECD68565418E3E4A0379D46C1417F7B7CD65331E3A68E041C1EE6287670F9D
SSDEEP:	1536:EQ66UQxXCCLEZJhmNdLUwWwWQalT3CWaLrYsErK/+WQmBjiJmWQSRcOMSzJdh:B6rQBCCLKHvBOLrYsErK/+g8LcFSzJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (75.0.3770.100)
Google Update Helper (1.3.34.7)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.7.2 (4.7.03062)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702 (14.21.27702.2)
Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702 (14.21.27702)
Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702 (14.21.27702)
Mozilla Firefox 67.0.4 (x86 en-US) (67.0.4)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
Update for Microsoft .NET Framework 4.7.2 (KB4087364) (1)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB4019990
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
- Unusual execution from Microsoft Office
  - OUTLOOK.EXE (PID: 3692)
SUSPICIOUS
- Executed via COM
  - OUTLOOK.EXE (PID: 4052)
- Reads Internet Cache Settings
  - OUTLOOK.EXE (PID: 3692)
- Creates files in the user directory
  - OUTLOOK.EXE (PID: 3692)
- Starts Internet Explorer
  - OUTLOOK.EXE (PID: 3692)
INFO
- Reads Microsoft Office registry keys
  - OUTLOOK.EXE (PID: 3692)
  - OUTLOOK.EXE (PID: 4052)
- Application launched itself
  - iexplore.exe (PID: 3548)
- Changes internet zones settings
  - iexplore.exe (PID: 3548)
- Reads internet explorer settings
  - iexplore.exe (PID: 1916)
  - iexplore.exe (PID: 3304)
- Reads Internet Cache Settings
  - iexplore.exe (PID: 1916)
  - iexplore.exe (PID: 3304)
- Reads settings of System Certificates
  - iexplore.exe (PID: 3548)
- Changes settings of System certificates
  - iexplore.exe (PID: 3548)
- Adds / modifies Windows certificates
  - iexplore.exe (PID: 3548)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.msg	\|	Outlook Message (58.9)
.oft	\|	Outlook Form Template (34.4)

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
3692	"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Remittance Advice.msg"	C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE		explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000
4052	"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding	C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE	—	svchost.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Exit code: 0 Version: 14.0.6025.1000
3548	"C:\Program Files\Internet Explorer\iexplore.exe" https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.bcde-tango.com%2Fref.html%23gyozo.kiss%2Baffidea.hu&data=02%7C01%7Cgyozo.kiss%40affidea.hu%7Cc30eaa47ec5a4a92d8c708d70aaa7f4b%7C61cea4b18a5a402aa97b23d6b1de63fc%7C0%7C1%7C636989599722793873&sdata=Uz%2F4w0WFN7yFRKVBZ%2Fd%2BGqBZgSqY2D4Rl%2FaTAWN62tY%3D&reserved=0	C:\Program Files\Internet Explorer\iexplore.exe		OUTLOOK.EXE
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)
1916	"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3548 CREDAT:71937	C:\Program Files\Internet Explorer\iexplore.exe		iexplore.exe
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)
3304	"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3548 CREDAT:6403	C:\Program Files\Internet Explorer\iexplore.exe		iexplore.exe
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)

Add for printing

Total events

1 926

Read events

1 405

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
3692	OUTLOOK.EXE	C:\Users\admin\AppData\Local\Temp\CVRF760.tmp.cvr		—
		MD5:—	SHA256:—
3692	OUTLOOK.EXE	C:\Users\admin\AppData\Local\Temp\~DF514F7EE1C1C61617.TMP		—
		MD5:—	SHA256:—
4052	OUTLOOK.EXE	C:\Users\admin\AppData\Local\Temp\CVR1866.tmp.cvr		—
		MD5:—	SHA256:—
1916	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\8BW8CI0Y\eur03_safelinks_protection_outlook_com[1].txt		—
		MD5:—	SHA256:—
3692	OUTLOOK.EXE	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4EE56473.dat		image
		MD5:2427F8E3B7431297F0EFBE90E6CF2F6C	SHA256:F5D0116D7A9E05AB9FEF2F9DC9FD4DB448CF32DDEF9F1351CED9178C7B96AF0D
3692	OUTLOOK.EXE	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D3CA09F9.dat		image
		MD5:39A49DD5AA45E08737BAEE0E8D0F38AD	SHA256:AC806B3556F810825D39C8FC6D2AB10B32829D51A4878F073C50D881DF459E68
3692	OUTLOOK.EXE	C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm		pgc
		MD5:D222862C2D808057DE0EB23F10E7045D	SHA256:0C9C3B40250043C4586947D78DEA578AC8428739A22C6EA3C4B281B1A837F726
3692	OUTLOOK.EXE	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\36E6EBD8.dat		image
		MD5:C96BA98170DD2E63DDD55E2AE4074DFC	SHA256:5B527EF1DBDAF8D2F1C1FF40F7C87813BC1BF03EB51DE9FAD671052D45A874E0
3692	OUTLOOK.EXE	C:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inf		text
		MD5:48DD6CAE43CE26B992C35799FCD76898	SHA256:7BFE1F3691E2B4FB4D61FBF5E9F7782FBE49DA1342DBD32201C2CC8E540DBD1A
1916	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\8BW8CI0Y\safelinksv2[1].css		text
		MD5:955BD574AEA5C196750C5779F2F89600	SHA256:23861370472248E068061677B30A993C0DA84BA011D585C7F8D9B00077A90EE6

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
3692	OUTLOOK.EXE	GET	—	64.4.26.155:80	http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig	US	—	—	whitelisted
3548	iexplore.exe	GET	200	13.107.21.200:80	http://www.bing.com/favicon.ico	US	image	237 b	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
3548	iexplore.exe	204.79.197.200:80	www.bing.com	Microsoft Corporation	US	whitelisted
3692	OUTLOOK.EXE	64.4.26.155:80	config.messenger.msn.com	Microsoft Corporation	US	whitelisted
3304	iexplore.exe	78.142.19.148:80	www.bcde-tango.com	FOP Smirnov V'yacheslav Valentunovuch	BG	suspicious
3548	iexplore.exe	104.47.10.28:443	eur03.safelinks.protection.outlook.com	Microsoft Corporation	IE	whitelisted
1916	iexplore.exe	104.47.10.28:443	eur03.safelinks.protection.outlook.com	Microsoft Corporation	IE	whitelisted
3548	iexplore.exe	13.107.21.200:80	www.bing.com	Microsoft Corporation	US	whitelisted
3548	iexplore.exe	104.47.8.28:443	eur03.safelinks.protection.outlook.com	Microsoft Corporation	NL	whitelisted

DNS requests

Domain	IP	Reputation
config.messenger.msn.com	64.4.26.155	whitelisted
eur03.safelinks.protection.outlook.com	104.47.10.28 104.47.8.28	whitelisted
www.bing.com	204.79.197.200 13.107.21.200	whitelisted
www.bcde-tango.com	78.142.19.148	suspicious
dns.msftncsi.com	131.107.255.255	shared

Threats

No threats detected

Add for printing

No debug info

General Info

Remittance Advice.msg

73A58778DBA470FF9E5342AC78B192C1

2509A63C09A5AA4DDE0CF36FD36A7B2425F18C0E

3FECD68565418E3E4A0379D46C1417F7B7CD65331E3A68E041C1EE6287670F9D

1536:EQ66UQxXCCLEZJhmNdLUwWwWQalT3CWaLrYsErK/+WQmBjiJmWQSRcOMSzJdh:B6rQBCCLKHvBOLrYsErK/+g8LcFSzJ

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Unusual execution from Microsoft Office

SUSPICIOUS

Executed via COM

Reads Internet Cache Settings

Creates files in the user directory

Starts Internet Explorer

INFO

Reads Microsoft Office registry keys

Application launched itself

Changes internet zones settings

Reads internet explorer settings

Reads Internet Cache Settings

Reads settings of System Certificates

Changes settings of System certificates

Adds / modifies Windows certificates

Malware configuration

Static information

TRiD

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings