analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

15-minute_support_meeting.vcs

Full analysis: https://app.any.run/tasks/540640d8-4fb7-4911-b590-8863339a5f95
Verdict: Malicious activity
Analysis date: October 04, 2022, 20:00:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/calendar
File info: vCalendar calendar file
MD5:

0BE7F4D5E53CB145DA3305C9D4DB7228

SHA1:

4FAD301D6E29BC90B6A6354C43B7F8421B6A804F

SHA256:

417D12BF08A64A78AF2890D297B44FC29EA50176B48EABA21125456D4F153972

SSDEEP:

48:E0fXuWU41VxBXr5EgM7KKTL/q+NAp6jDB/RBLUhLNwp7CkRyxuYxE:E0fXu94XlZKtTLiy46ZJBp7CeWuME

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the date of Windows installation

      • OUTLOOK.EXE (PID: 3260)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 4088)

  • INFO

    • Checks supported languages

      • OUTLOOK.EXE (PID: 3260)
      • chrome.exe (PID: 4088)
      • chrome.exe (PID: 1828)
      • chrome.exe (PID: 1256)
      • chrome.exe (PID: 2700)
      • chrome.exe (PID: 3520)
      • chrome.exe (PID: 3680)
      • chrome.exe (PID: 3280)
      • chrome.exe (PID: 3432)
      • chrome.exe (PID: 3992)
      • chrome.exe (PID: 3812)
      • chrome.exe (PID: 3524)
      • chrome.exe (PID: 692)
      • chrome.exe (PID: 3656)
      • chrome.exe (PID: 3976)
      • chrome.exe (PID: 1292)
      • chrome.exe (PID: 2944)
      • chrome.exe (PID: 1360)
      • chrome.exe (PID: 3140)
      • chrome.exe (PID: 2896)
      • chrome.exe (PID: 420)

    • Reads the computer name

      • OUTLOOK.EXE (PID: 3260)
      • chrome.exe (PID: 4088)
      • chrome.exe (PID: 1828)
      • chrome.exe (PID: 2700)
      • chrome.exe (PID: 3680)
      • chrome.exe (PID: 3524)
      • chrome.exe (PID: 3140)
      • chrome.exe (PID: 2896)

    • Reads Microsoft Outlook installation path

      • OUTLOOK.EXE (PID: 3260)

    • Reads internet explorer settings

      • OUTLOOK.EXE (PID: 3260)

    • Manual execution by user

      • chrome.exe (PID: 4088)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 3260)

    • Searches for installed software

      • OUTLOOK.EXE (PID: 3260)

    • Application launched itself

      • chrome.exe (PID: 4088)

    • Reads the hosts file

      • chrome.exe (PID: 1828)
      • chrome.exe (PID: 4088)

    • Reads settings of System Certificates

      • chrome.exe (PID: 1828)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 3260)

    • Reads the date of Windows installation

      • chrome.exe (PID: 3140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.ics/vcs | iCalendar - vCalendar (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
21
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3260"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /ical "C:\Users\admin\AppData\Local\Temp\15-minute_support_meeting.vcs.ics"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4088"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
Explorer.EXE
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
1256"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6ee6d988,0x6ee6d998,0x6ee6d9a4C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
2700"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1044,12074859379703716632,13007669266318237366,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1028 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1828"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1044,12074859379703716632,13007669266318237366,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1412 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3280"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,12074859379703716632,13007669266318237366,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3432"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,12074859379703716632,13007669266318237366,131072 --enable-features=PasswordImport --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1944 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
3520"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,12074859379703716632,13007669266318237366,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2184 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
3680"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1044,12074859379703716632,13007669266318237366,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1032 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3992"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1044,12074859379703716632,13007669266318237366,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
Total events
16 911
Read events
16 124
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
140
Text files
113
Unknown types
17

Dropped files

PID
Process
Filename
Type
3260OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR5A04.tmp.cvr —
MD5:—
SHA256:—
3260OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst —
MD5:—
SHA256:—
3260OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:3188F31BC3C63F70036C870A1F0FF8BE
SHA256:B352ABD61869149AD3B84AA11AE2616046B005D5B19DBE3CCC5003B902F3D79D
3260OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\be71009ff8bb02a2.customDestinations-msbinary
MD5:7E0F6D9C4BE2FD31696140FD1A314637
SHA256:DA3B385915E8D30CB180B4F7DE4D7B3AE38C5261B738CA1FCCFF0A9947E614CB
3260OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:E4D032DEC58CDC9B165BFAD68D149791
SHA256:B7071E51F1AD28C7EFD0A8ED01D7B2203D53E0EA88EC354987A389D493ED51CA
3260OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Outlook.lnklnk
MD5:301F671CC17AF078AC9A373BB2430E6D
SHA256:8D2A3C21C2A78050CDF58078ED973025CA0E86B8895D0FCB0889B0D0AD7ACE0C
3260OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\~DFBAD67CD2865FFDB3.TMPgmc
MD5:86950204FDAAF2E0E6254AE968C55FBC
SHA256:7FC2DDE5C528132C0961276B08FDE8BFD4D8C1A4DC9C40BF9249D2F66FC4153E
3260OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{8407234F-AFC8-4A1C-B8BC-1FAF4CFC0EA6}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.pngimage
MD5:4C61C12EDBC453D7AE184976E95258E1
SHA256:296526F9A716C1AA91BA5D6F69F0EB92FDF79C2CB2CFCF0CEB22B7CCBC27035F
3260OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Z8TQFLCGCBPPQR7KNLV0.tempbinary
MD5:7E0F6D9C4BE2FD31696140FD1A314637
SHA256:DA3B385915E8D30CB180B4F7DE4D7B3AE38C5261B738CA1FCCFF0A9947E614CB
3260OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Outlook\NoMail.srssrs
MD5:9DE38CABFAE4B02233B9738B90B4AC25
SHA256:90D4E1DD69517A5EF85045B87F63EB48EE19EC8DA7AD19E0764CE7B181B3C9A4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
37
DNS requests
26
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3260
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
1828
chrome.exe
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
crx
242 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1828
chrome.exe
216.58.212.174:443
encrypted-tbn0.gstatic.com
GOOGLE
US
whitelisted
1828
chrome.exe
172.217.23.110:443
clients2.google.com
GOOGLE
US
whitelisted
3260
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1828
chrome.exe
216.58.212.164:443
www.google.com
GOOGLE
US
whitelisted
1828
chrome.exe
142.250.186.131:443
clientservices.googleapis.com
GOOGLE
US
whitelisted
1828
chrome.exe
172.217.18.1:443
clients2.googleusercontent.com
GOOGLE
US
whitelisted
1828
chrome.exe
142.250.187.109:443
accounts.google.com
GOOGLE
US
unknown
1828
chrome.exe
142.250.185.99:443
update.googleapis.com
GOOGLE
US
whitelisted
1828
chrome.exe
34.104.35.123:80
edgedl.me.gvt1.com
GOOGLE
US
whitelisted
1828
chrome.exe
142.251.39.78:443
apis.google.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
clientservices.googleapis.com
  • 142.250.186.131
whitelisted
clients2.google.com
  • 172.217.23.110
whitelisted
www.google.com
  • 216.58.212.164
whitelisted
accounts.google.com
  • 142.250.187.109
shared
clients2.googleusercontent.com
  • 172.217.18.1
whitelisted
encrypted-tbn0.gstatic.com
  • 216.58.212.174
whitelisted
update.googleapis.com
  • 142.250.185.99
whitelisted
ssl.gstatic.com
  • 142.250.180.195
whitelisted
edgedl.me.gvt1.com
  • 34.104.35.123
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
15-minute_support_meeting.vcs