analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Administrator Notification_ Redirecting email with malware.msg

Full analysis: https://app.any.run/tasks/cf684972-3e1c-4884-aad7-398212899927
Verdict: Malicious activity
Analysis date: July 18, 2019, 14:50:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

1744A3145D35AE27A7B9761055B2137F

SHA1:

B5D4D0CB67B50B901EE7A437D4BE6F23A7D518C6

SHA256:

54D5A9A5CEB6AD4F5E7D33474409F98AA9A43E4A77D4AB70CFD1EC6E10561127

SSDEEP:

3072:h3DMiZhXKu4pBIFOqeB8OuqCmIE21Gc8xXTRkJupW:hTIcTOuqCmIE21Gc85TRkkpW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 3896)

  • SUSPICIOUS

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 3896)

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 3896)

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 3896)

  • INFO

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 3896)

    • Changes internet zones settings

      • iexplore.exe (PID: 3708)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2256)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2256)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3896"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Administrator Notification_ Redirecting email with malware.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
3708"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\6SI0YDWO\☎️📞VoiceNote Call-recoded333233 WAV.htmlC:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2256"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3708 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
2 207
Read events
1 449
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
37
Unknown types
6

Dropped files

PID
Process
Filename
Type
3896OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRF6A5.tmp.cvr —
MD5:—
SHA256:—
3896OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\~DF34EF97A6F0C2EF21.TMP —
MD5:—
SHA256:—
3896OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\6SI0YDWO\☎️📞VoiceNote Call-recoded333233 WAV (2).html\:Zone.Identifier:$DATA —
MD5:—
SHA256:—
3708iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\favicon[1].ico —
MD5:—
SHA256:—
3708iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3896OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:876E5F570779786AC4D0C412C5DC2DBB
SHA256:C57EE5E43B86068C5949170F8ACE2D2964B076B3ABCAEA0EA14264010AE81B5E
3896OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\6SI0YDWO\You've Got A new Message From Last Caller.msgmsg
MD5:4DC271AE9BD7314939367846F4419550
SHA256:6B78170486EB2651B8D0A20FE73B0DB163DBDF4F0CAF5E954B46C66124C71C3A
3896OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\31443078.datimage
MD5:F7505A57756E156D0E06E7A2A517C31C
SHA256:3E8A788BB8397D7940D1C6DBA724BCB9415C35A423AF4088BCA1863E7712011A
3896OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\6SI0YDWO\☎️📞VoiceNote Call-recoded333233 WAV (2).htmltext
MD5:8BF55D0516DCC08BCF9E9F52D20EAA6D
SHA256:500200FF51A2D066A492CFF7CD4B8CD08A1E8889568FE5439E595CB7725E7F5A
3708iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019071820190719\index.datdat
MD5:1A979A2F6355A1DD8F66473706D7261C
SHA256:A772043ACEAF86F49EDD8E686A08AD254E46D60E3AB81571F983EEEFBD1BD75F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
6
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3708
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3708
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3896
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
2256
iexplore.exe
194.34.247.30:443
rqioooids.net
—
—
unknown

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
rqioooids.net
  • 194.34.247.30
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Administrator Notification_ Redirecting email with malware.msg