analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

15-minute_support_meeting.vcs

Full analysis: https://app.any.run/tasks/8fa2f815-09c6-43a7-afda-03b4423d1373
Verdict: Malicious activity
Analysis date: October 04, 2022, 19:57:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/calendar
File info: vCalendar calendar file
MD5:

0BE7F4D5E53CB145DA3305C9D4DB7228

SHA1:

4FAD301D6E29BC90B6A6354C43B7F8421B6A804F

SHA256:

417D12BF08A64A78AF2890D297B44FC29EA50176B48EABA21125456D4F153972

SSDEEP:

48:E0fXuWU41VxBXr5EgM7KKTL/q+NAp6jDB/RBLUhLNwp7CkRyxuYxE:E0fXu94XlZKtTLiy46ZJBp7CeWuME

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the date of Windows installation

      • OUTLOOK.EXE (PID: 1388)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 2288)

  • INFO

    • Reads the computer name

      • OUTLOOK.EXE (PID: 1388)
      • chrome.exe (PID: 2288)
      • chrome.exe (PID: 2520)
      • chrome.exe (PID: 2852)
      • chrome.exe (PID: 3468)
      • chrome.exe (PID: 3980)
      • chrome.exe (PID: 4008)

    • Checks supported languages

      • OUTLOOK.EXE (PID: 1388)
      • chrome.exe (PID: 2288)
      • chrome.exe (PID: 408)
      • chrome.exe (PID: 2852)
      • chrome.exe (PID: 2520)
      • chrome.exe (PID: 1868)
      • chrome.exe (PID: 2896)
      • chrome.exe (PID: 3860)
      • chrome.exe (PID: 3036)
      • chrome.exe (PID: 3468)
      • chrome.exe (PID: 2644)
      • chrome.exe (PID: 2440)
      • chrome.exe (PID: 1360)
      • chrome.exe (PID: 856)
      • chrome.exe (PID: 276)
      • chrome.exe (PID: 2780)
      • chrome.exe (PID: 3980)
      • chrome.exe (PID: 3688)
      • chrome.exe (PID: 3852)
      • chrome.exe (PID: 3108)
      • chrome.exe (PID: 3288)
      • chrome.exe (PID: 3900)
      • chrome.exe (PID: 4008)

    • Reads Microsoft Outlook installation path

      • OUTLOOK.EXE (PID: 1388)

    • Reads internet explorer settings

      • OUTLOOK.EXE (PID: 1388)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 1388)

    • Searches for installed software

      • OUTLOOK.EXE (PID: 1388)

    • Manual execution by user

      • chrome.exe (PID: 2288)

    • Application launched itself

      • chrome.exe (PID: 2288)

    • Reads the hosts file

      • chrome.exe (PID: 2288)
      • chrome.exe (PID: 2852)

    • Reads settings of System Certificates

      • chrome.exe (PID: 2852)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 1388)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.ics/vcs | iCalendar - vCalendar (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
60
Monitored processes
23
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1388"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /ical "C:\Users\admin\AppData\Local\Temp\15-minute_support_meeting.vcs.ics"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
2288"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
Explorer.EXE
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
408"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x7324d988,0x7324d998,0x7324d9a4C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
2520"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,18087600464913874596,16396323327508673911,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1056 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
2852"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1040,18087600464913874596,16396323327508673911,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1276 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3860"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,18087600464913874596,16396323327508673911,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1904 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1868"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,18087600464913874596,16396323327508673911,131072 --enable-features=PasswordImport --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
2896"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,18087600464913874596,16396323327508673911,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2256 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3036"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,18087600464913874596,16396323327508673911,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2300 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
2644"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,18087600464913874596,16396323327508673911,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
Total events
18 610
Read events
17 832
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
132
Text files
106
Unknown types
13

Dropped files

PID
Process
Filename
Type
1388OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR95C8.tmp.cvr —
MD5:—
SHA256:—
1388OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst —
MD5:—
SHA256:—
1388OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\be71009ff8bb02a2.customDestinations-msbinary
MD5:7E0F6D9C4BE2FD31696140FD1A314637
SHA256:DA3B385915E8D30CB180B4F7DE4D7B3AE38C5261B738CA1FCCFF0A9947E614CB
1388OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:29F147A5AAFD8DEB14CD027B8C61652D
SHA256:CBB50F01CB6D6E565F7316815955DB37D5DD45A2401EF45FB57B1988D1CC8EC9
1388OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\~DF21C97D128AB5B64E.TMPgmc
MD5:86950204FDAAF2E0E6254AE968C55FBC
SHA256:7FC2DDE5C528132C0961276B08FDE8BFD4D8C1A4DC9C40BF9249D2F66FC4153E
1388OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Outlook.lnklnk
MD5:301F671CC17AF078AC9A373BB2430E6D
SHA256:8D2A3C21C2A78050CDF58078ED973025CA0E86B8895D0FCB0889B0D0AD7ACE0C
1388OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Outlook\NoMail.srssrs
MD5:35C66C4A9043D85E161FDE4E488EA111
SHA256:56498EF2944FA8E29EDE3E49FC77DF5952A81CDF2539A154DBF373991C1CA182
1388OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:75FDF5E78B90D1C96F204DA1D56BCD32
SHA256:49DE2F1465C4813DCBBC76BAA701D5077936EA54A97B179E094BED8B1794905C
1388OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KS754OH3FIBD70J6ESQ3.tempbinary
MD5:7E0F6D9C4BE2FD31696140FD1A314637
SHA256:DA3B385915E8D30CB180B4F7DE4D7B3AE38C5261B738CA1FCCFF0A9947E614CB
1388OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{7AEC0E7F-6915-45D1-BC23-190B676AC633}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.pngimage
MD5:4C61C12EDBC453D7AE184976E95258E1
SHA256:296526F9A716C1AA91BA5D6F69F0EB92FDF79C2CB2CFCF0CEB22B7CCBC27035F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
31
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1388
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
2852
chrome.exe
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
crx
242 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2852
chrome.exe
142.250.185.100:443
www.google.com
GOOGLE
US
whitelisted
2852
chrome.exe
142.250.181.225:443
clients2.googleusercontent.com
GOOGLE
US
whitelisted
2852
chrome.exe
142.250.185.106:443
fonts.googleapis.com
GOOGLE
US
whitelisted
1388
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2852
chrome.exe
142.250.184.238:443
clients2.google.com
GOOGLE
US
whitelisted
2852
chrome.exe
142.250.185.227:443
clientservices.googleapis.com
GOOGLE
US
whitelisted
2852
chrome.exe
172.217.18.13:443
accounts.google.com
GOOGLE
US
whitelisted
2852
chrome.exe
142.250.184.195:443
ssl.gstatic.com
GOOGLE
US
whitelisted
2852
chrome.exe
142.250.184.206:443
apis.google.com
GOOGLE
US
whitelisted
2852
chrome.exe
34.104.35.123:80
edgedl.me.gvt1.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
clientservices.googleapis.com
  • 142.250.185.227
whitelisted
accounts.google.com
  • 172.217.18.13
shared
clients2.google.com
  • 142.250.184.238
whitelisted
www.google.com
  • 142.250.185.100
whitelisted
clients2.googleusercontent.com
  • 142.250.181.225
whitelisted
fonts.googleapis.com
  • 142.250.185.106
whitelisted
www.gstatic.com
  • 142.250.181.227
whitelisted
fonts.gstatic.com
  • 172.217.23.99
whitelisted
apis.google.com
  • 142.250.184.206
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
15-minute_support_meeting.vcs