File name: | Administrator Notification_ Redirecting email with malware.msg |
Full analysis: | https://app.any.run/tasks/8e473c84-d453-43d5-97ec-3c718032053d |
Verdict: | Malicious activity |
Analysis date: | July 17, 2019, 14:02:30 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | 948361E587E6369C8EAEF54836C503A3 |
SHA1: | 4044ED23AE8FB2E5CA7493E115028EE81EBBD64D |
SHA256: | 5E2CEDE458BDE1F82B5F41BB90C9F452873D05DD162BDB799E4C7938DBA8D6B9 |
SSDEEP: | 3072:za1CVjA6fjFXtRnHVuGA6gjc9aLXYpJYM0FB8YI5rG6CBQ7P7:zVjRHVzA6gj6aLXYpx0lQGLe7 |
.msg | | | Outlook Message (58.9) |
---|---|---|
.oft | | | Outlook Form Template (34.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3492 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Administrator Notification_ Redirecting email with malware.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
1460 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | OUTLOOK.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
2500 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /Embedding | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
3344 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
2656 | "C:\Users\Public\vbc.exe" | C:\Users\Public\vbc.exe | — | EQNEDT32.EXE |
User: admin Company: Collapsehurricane5 Integrity Level: MEDIUM Description: CollapseBiarmia Exit code: 0 Version: 6.09.0005 | ||||
3644 | C:\Users\Public\vbc.exe" | C:\Users\Public\vbc.exe | — | vbc.exe |
User: admin Company: Collapsehurricane5 Integrity Level: MEDIUM Description: CollapseBiarmia Version: 6.09.0005 |
(PID) Process: | (3492) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: Off | |||
(PID) Process: | (3492) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: On | |||
(PID) Process: | (3492) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Resiliency\StartupItems |
Operation: | write | Name: | /0> |
Value: 2F303E00A40D0000010000000000000000000000 | |||
(PID) Process: | (3492) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook |
Operation: | write | Name: | MTTT |
Value: A40D00001206824FA83CD50100000000 | |||
(PID) Process: | (3492) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\SQM |
Operation: | write | Name: | SQMSessionNumber |
Value: 0 | |||
(PID) Process: | (3492) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\SQM |
Operation: | write | Name: | SQMSessionDate |
Value: 220129920 | |||
(PID) Process: | (3492) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\0a0d020000000000c000000000000046 |
Operation: | write | Name: | 00030429 |
Value: 03000000 | |||
(PID) Process: | (3492) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\9375CFF0413111d3B88A00104B2A6676 |
Operation: | write | Name: | {ED475418-B0D6-11D2-8C3B-00104B2A6676} |
Value: | |||
(PID) Process: | (3492) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\NoMail\9375CFF0413111d3B88A00104B2A6676 |
Operation: | write | Name: | LastChangeVer |
Value: 1200000000000000 | |||
(PID) Process: | (3492) OUTLOOK.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109A10090400000000000F01FEC\Usage |
Operation: | write | Name: | OutlookMAPI2Intl_1033 |
Value: 1324417045 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3492 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRE820.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3492 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\~DF2CE6CE37B88B0A4B.TMP | — | |
MD5:— | SHA256:— | |||
3492 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\J4I7QA38\Swift copy (2).xlsx\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
1460 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR10F5.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1460 | EXCEL.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\J4I7QA38\~$Swift copy.xlsx | — | |
MD5:— | SHA256:— | |||
1460 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DF80F8024F92FA2913.TMP | — | |
MD5:— | SHA256:— | |||
1460 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DFCF9241A058A3C0C3.TMP | — | |
MD5:— | SHA256:— | |||
1460 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\OICE_7E2EE5E4-F6FB-49FB-B19C-7DE3EB506E5C.0\4977E7BB.xlsx\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
1460 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\3D26.tmp\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
1460 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DFF132B94CF8B4C42C.TMP | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3492 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
3344 | EQNEDT32.EXE | GET | 200 | 47.74.38.64:80 | http://kimotokisen.com/k/put.exe | JP | executable | 764 Kb | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3344 | EQNEDT32.EXE | 47.74.38.64:80 | kimotokisen.com | Alibaba (China) Technology Co., Ltd. | JP | malicious |
3492 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
kimotokisen.com |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
3344 | EQNEDT32.EXE | Potentially Bad Traffic | ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile |
3344 | EQNEDT32.EXE | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |