File name: | DO not Open Sending as directed to IT Security possible Phishing .msg |
Full analysis: | https://app.any.run/tasks/3f7edc74-ce67-47bf-bd9d-3f826fa4027a |
Verdict: | Malicious activity |
Analysis date: | September 30, 2020, 13:43:33 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | 77A509BEFE48FB6C2C6E87A4A68D83BA |
SHA1: | 5991FCDB5D94BCF38664BFF53E800B2C78F7FD6E |
SHA256: | 58DBD143609D08BDE4B507400363D57DAA897E97FEDE6562B4DAFAC6016581D3 |
SSDEEP: | 3072:YSUtTwBIqhCJijZd5xTe4Luy4MYYRAfALE:Aqh9zYaAfALE |
.msg | | | Outlook Message (50.8) |
---|---|---|
.oft | | | Outlook Form Template (29.7) |
.doc | | | Microsoft Word document (old ver.) (13.6) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2648 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\DO not Open Sending as directed to IT Security possible Phishing .msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Exit code: 0 Version: 14.0.6025.1000 | ||||
340 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\9EH3D3CV\31627065715.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | OUTLOOK.EXE |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
3768 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | WinRAR.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
2508 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /Embedding | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
3316 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
3160 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /Embedding | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2648 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRB145.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2648 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\msoB751.tmp | — | |
MD5:— | SHA256:— | |||
2648 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\9EH3D3CV\31627065715 (2).zip\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
3768 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVRFC67.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3768 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DFC8314AFD6789B2B4.TMP | — | |
MD5:— | SHA256:— | |||
3768 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\OICE_D7C7E2D3-CC73-4190-8F82-EA1313E70BF4.0\96287283.xls\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
2648 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:B227AB18D6343662F0150CE11598F658 | SHA256:BCC6084CC1B9621C271C9DA9D75FAEBE67E732AFFCEE287D8C9C54F67032EC35 | |||
2648 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.log | text | |
MD5:AAAFAAB09C0F020A67A8E76FAAA35EC4 | SHA256:76100CD88E576396ADCBF5FAE542A13E9F859B9E5623E192D3E34E941505A1CA | |||
2648 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\94CB9D5B.dat | image | |
MD5:234D420DC91AD03946FDBC82486AF271 | SHA256:A8C21CE286B6E3D2549050BE1520C14F575D9A8433E64A148006DC355891EA23 | |||
2508 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\OICE_D7C7E2D3-CC73-4190-8F82-EA1313E70BF4.0\~DFB73A7E34EFEF00F8.TMP | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3316 | EXCEL.EXE | GET | 200 | 209.99.16.57:80 | http://pulsetekh.in/vythhkrg/88888.png | US | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3316 | EXCEL.EXE | 209.99.16.57:80 | pulsetekh.in | PDR | US | malicious |
2648 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
pulsetekh.in |
| malicious |