analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Potential+Phishing+Email.msg

Full analysis: https://app.any.run/tasks/8e96db53-2c61-47bf-8022-567508b698c1
Verdict: Malicious activity
Analysis date: May 20, 2019, 13:28:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

0048A8FC66C6F26B97B6F8D1A056C00B

SHA1:

4E22265197C1748A9D050DCC2DABCF2378943C27

SHA256:

5527B29EC8B8E0DE609BC5AE41431379851EA813025FBC7B6C11D7F3AF5E3A22

SSDEEP:

1536:hQ2shnymJtUPWTeVHjPhA9t4VdWwuH2XY9G+cBUB+2PWrA2XU6BMxoAFiB9STMF+:kzhJ9IdyMT9+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 3372)

  • SUSPICIOUS

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 3372)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 3372)
      • notepad++.exe (PID: 3560)

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 3372)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 2484)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 3616)
      • iexplore.exe (PID: 2584)
      • iexplore.exe (PID: 2172)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 3372)

    • Application launched itself

      • iexplore.exe (PID: 3616)
      • iexplore.exe (PID: 2584)
      • iexplore.exe (PID: 2172)
      • chrome.exe (PID: 2484)

    • Creates files in the user directory

      • iexplore.exe (PID: 3232)
      • iexplore.exe (PID: 3616)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3616)
      • iexplore.exe (PID: 3232)
      • iexplore.exe (PID: 2076)
      • iexplore.exe (PID: 2876)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3232)
      • iexplore.exe (PID: 2076)
      • iexplore.exe (PID: 2876)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3232)
      • iexplore.exe (PID: 2076)
      • iexplore.exe (PID: 2876)

    • Manual execution by user

      • explorer.exe (PID: 868)
      • notepad++.exe (PID: 3560)
      • chrome.exe (PID: 2484)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (50.8)
.oft | Outlook Form Template (29.7)
.doc | Microsoft Word document (old ver.) (13.6)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
65
Monitored processes
29
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe explorer.exe no specs notepad++.exe gup.exe iexplore.exe iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3372"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Potential+Phishing+Email.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
3616"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\EJW37CQO\Contra989376.htmlC:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3232"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3616 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2584"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\EJW37CQO\Contra989376.htmlC:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2076"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2584 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
868"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3560"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Downloads\Contra989376.html"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO [email protected]
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Version:
7.51
2812"C:\Program Files\Notepad++\updater\gup.exe" -v7.51C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
User:
admin
Company:
Don HO [email protected]
Integrity Level:
MEDIUM
Description:
GUP : a free (LGPL) Generic Updater
Exit code:
0
Version:
4.1
2172"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\EJW37CQO\Contra989376.htmlC:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2876"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2172 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
4 244
Read events
3 453
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
29
Text files
209
Unknown types
19

Dropped files

PID
Process
Filename
Type
3372OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVREC70.tmp.cvr —
MD5:—
SHA256:—
3372OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\EJW37CQO\Contra989376 (2).html\:Zone.Identifier:$DATA —
MD5:—
SHA256:—
3372OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:155AABAD40F4AD3CB3E1D64A44328D83
SHA256:F8E3E3F6EC52A53FDA222112B9C9C45CF3685CF1945AEE6B5AE020787AAD5D10
3372OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_B77F526AE3866C4BBC52A625C9C10DD4.datxml
MD5:B21ED3BD946332FF6EBC41A87776C6BB
SHA256:B1AAC4E817CD10670B785EF8E5523C4A883F44138E50486987DC73054A46F6F4
3372OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_AvailabilityOptions_2_10FA8782BE83734E810745D177984E5E.datxml
MD5:EEAA832C12F20DE6AAAA9C7B77626E72
SHA256:C4C9A90F2C961D9EE79CF08FBEE647ED7DE0202288E876C7BAAD00F4CA29CA16
3372OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ContactPrefs_2_4CEE0AC16EECF9409CFBB7E4038E452F.datxml
MD5:BBCF400BD7AE536EB03054021D6A6398
SHA256:383020065C1F31F4FB09F448599A6D5E532C390AF4E5B8AF0771FE17A23222AD
3616iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Feeds Cache\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
3372OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_WorkHours_1_A6DF1AA51DD45246BC48D15938BA9108.datxml
MD5:807EF0FC900FEB3DA82927990083D6E7
SHA256:4411E7DC978011222764943081500FFF0E43CBF7CCD44264BD1AB6306CA68913
3372OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{2100EE27-350C-4088-B087-0459C7C99B11}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.pngimage
MD5:7D80C0A7E3849818695EAF4989186A3C
SHA256:72DC527D78A8E99331409803811CC2D287E812C008A1C869A6AEA69D7A44B597
3616iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
56
DNS requests
28
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2484
chrome.exe
GET
200
173.194.138.201:80
http://r4---sn-aigzrn7d.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvMjJlQUFXRC12Ny1ldUFnMXF3SDlXZDlFZw/7319.128.0.1_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mip=217.147.89.18&mm=28&mn=sn-aigzrn7d&ms=nvh&mt=1558358863&mv=u&pl=22&shardbypass=yes
US
crx
842 Kb
whitelisted
3372
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
2484
chrome.exe
GET
302
172.217.22.46:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvMjJlQUFXRC12Ny1ldUFnMXF3SDlXZDlFZw/7319.128.0.1_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx
US
html
504 b
whitelisted
—
—
GET
200
23.14.90.97:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
NL
der
1.37 Kb
whitelisted
2172
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
3616
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
2584
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3232
iexplore.exe
104.199.113.1:443
loading.io
Google Inc.
US
whitelisted
3372
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
3232
iexplore.exe
104.16.31.34:443
i.stack.imgur.com
Cloudflare Inc
US
shared
3232
iexplore.exe
184.31.91.84:443
secure.aadcdn.microsoftonline-p.com
Akamai International B.V.
NL
whitelisted
3616
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3232
iexplore.exe
104.16.126.175:443
unpkg.com
Cloudflare Inc
US
shared
2076
iexplore.exe
104.16.126.175:443
unpkg.com
Cloudflare Inc
US
shared
2584
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2076
iexplore.exe
104.16.31.34:443
i.stack.imgur.com
Cloudflare Inc
US
shared
2812
gup.exe
37.59.28.236:443
notepad-plus-plus.org
OVH SAS
FR
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
loading.io
  • 104.199.113.1
whitelisted
secure.aadcdn.microsoftonline-p.com
  • 184.31.91.84
whitelisted
unpkg.com
  • 104.16.126.175
  • 104.16.123.175
  • 104.16.124.175
  • 104.16.125.175
  • 104.16.122.175
whitelisted
i.stack.imgur.com
  • 104.16.31.34
  • 104.16.26.34
  • 104.16.1.35
  • 104.16.25.34
  • 104.16.30.34
  • 104.16.3.35
  • 104.16.2.35
  • 104.16.24.34
  • 104.16.29.34
  • 104.16.0.35
  • 104.16.28.34
  • 104.16.27.34
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
notepad-plus-plus.org
  • 37.59.28.236
whitelisted
isrg.trustid.ocsp.identrust.com
  • 23.14.90.97
  • 23.14.90.107
whitelisted
clientservices.googleapis.com
  • 172.217.22.67
whitelisted
accounts.google.com
  • 172.217.22.13
shared

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Potential+Phishing+Email.msg