File name: | Como Importar de China - Aprende Paso a Paso de Manera Fácil Segura y Rápida - Enfoque 100% Práctico.msg |
Full analysis: | https://app.any.run/tasks/9de248e1-eca5-4177-995c-395c74a6a1d0 |
Verdict: | Malicious activity |
Analysis date: | December 06, 2019, 15:09:56 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | 4E989C008CC3DCCB152D241ADCE5C42A |
SHA1: | 3E4B1C828F7C9301973AD863248AD5386686EC84 |
SHA256: | 4538DD60ED4CAA5031AA44BEE54E1051DD741AC89895597C108D17F036D9FC2A |
SSDEEP: | 768:54/4m9WsK6WsKkQhqnxDNhv8LcjVcfK5Ot0j7Yd3gYRWu6WsKJWsKehrK5IFu/5i:bOWCWmVkkOyjkdwYwWRWjmW5c |
.msg | | | Outlook Message (58.9) |
---|---|---|
.oft | | | Outlook Form Template (34.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2264 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\d11636c5-8065-4668-ba9a-ec8f3a1b4d08.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
2924 | "C:\Program Files\Internet Explorer\iexplore.exe" https://docs.google.com/forms/d/1m-XA2blJabTszRFXnixOHs2xp9DshmHQdvVLLJYdrxI/viewform | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3972 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2924 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3572 | "C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" -c IPM.Note /m "mailto:[email protected]" | C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE | — | OUTLOOK.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Exit code: 0 Version: 14.0.6025.1000 | ||||
3756 | "C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" -c IPM.Note /m "mailto:[email protected]" | C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE | — | OUTLOOK.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Exit code: 0 Version: 14.0.6025.1000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2264 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRDFB1.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3972 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@google[1].txt | — | |
MD5:— | SHA256:— | |||
2264 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.log | text | |
MD5:F4879E9CAC8837528C2CDD7B92FED114 | SHA256:104B2793967502E9BCEDB98012C460D5B7EFAD4C834933E4856078F6123A023B | |||
2264 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:7004C567A41B04669469F25B89303263 | SHA256:74614614463B12D07A5772EB2D64E92130383A622F245B1323C9EF102AF52A18 | |||
3972 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@google[2].txt | text | |
MD5:F760F18344145CCBFA329E11D225F5F3 | SHA256:5B9E9D2F3F4AF3CC7AA3DCB423B27157DD57EBF1C9427E19888546A5C1070542 | |||
3972 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:E3939FABD1A264D944BDD688E72FB2DE | SHA256:4F5E9577BD3CF84B1FEBDB5238AC578DC499DC5503D97C24886CA845B6724D6B | |||
3972 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt | text | |
MD5:23E6A10FECDF959EF6AAF1FFB59D121E | SHA256:FD4F3395BD4E167EA442A0213E810D6391F69A34558FC5015542A0CCC6C481EA | |||
3972 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TGWRGCZS\viewform[1].txt | — | |
MD5:— | SHA256:— | |||
3972 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat | dat | |
MD5:92E282AC79EAA9C450C81992D7FB6677 | SHA256:206EA6DB75E6F0A0455ACA2466F164FF85C31204773E90C2A4F876884A32599D | |||
3972 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.dat | dat | |
MD5:7F364148D299BD0B8B4AA5FEFE76CB4F | SHA256:FCA15F753E883809C52812BD58824374B4FD27528EFF34F7E1B38E281482032A |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2264 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3972 | iexplore.exe | 216.58.206.3:443 | www.gstatic.com | Google Inc. | US | whitelisted |
3972 | iexplore.exe | 172.217.18.174:443 | docs.google.com | Google Inc. | US | whitelisted |
2264 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
2924 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3972 | iexplore.exe | 216.58.205.234:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
3972 | iexplore.exe | 172.217.22.99:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
3972 | iexplore.exe | 172.217.23.100:443 | www.google.com | Google Inc. | US | whitelisted |
3972 | iexplore.exe | 172.217.18.1:443 | lh6.googleusercontent.com | Google Inc. | US | whitelisted |
2924 | iexplore.exe | 216.58.206.3:443 | www.gstatic.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
docs.google.com |
| shared |
www.bing.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
www.google.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
lh6.googleusercontent.com |
| whitelisted |
ssl.gstatic.com |
| whitelisted |