File name: | EKSTERNAL RE Your invoice (1).msg |
Full analysis: | https://app.any.run/tasks/f5824fd1-a50c-4ed6-ab1b-fa0492f6d964 |
Verdict: | Malicious activity |
Analysis date: | December 28, 2023, 02:57:06 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | CBDCACF9667B7B036B908464B4354262 |
SHA1: | A574832732DCBD19B2D94692F785B0053AABCA73 |
SHA256: | 65F0D1F84DAA3554C8C42BC8D56044D655AA6837FAC56EE0B766EF2B36C2610C |
SSDEEP: | 6144:Gsu6Gu6EEmQzSHCWMr/kPoJA1+Mhs1Wsv8+A74pdib0jepj6tZPTCYA:nQzSHCWMr/0gA1kLU4pzjepjMCj |
.msg | | | Outlook Message (58.9) |
---|---|---|
.oft | | | Outlook Form Template (34.4) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
120 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\EKSTERNAL RE Your invoice (1).msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 Modules
| |||||||||||||||
1624 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /Embedding | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | OUTLOOK.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Excel Version: 14.0.6024.1000 Modules
| |||||||||||||||
1740 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | OUTLOOK.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 Modules
| |||||||||||||||
2296 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /Embedding | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | EXCEL.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
2428 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://password-changes.phishwall.net/XVTA1dFRHOHdNWGRKVTNSek56bHpjbmxpYm5oU1dIZG9PVWRpSzI5alFVMXNjRUl2TkN0NWRXUkhkalpoU1ZKbWFVSmpTVVZ5VXpJcmMwRlNUbkpvT1ZJeFpYZzBkWGR3WW5kSU1WUndNR1JIU1RkcWMxWXJjRnBUU1hFek56aEpaamtyYTFGSFIxcDNRWGxyTVV4VGRXaFpTVU13TlVwVU9GcG5OREpHVDFaMlJHNUhiMU5HZUdGcVJHVjFVRGRUZWsxcU1UVkVNa2M0SzNSSGIyTmlSaTlZVkVseGFuWTFLMmM0YVU1U2VsZG5aVzVUY21Ka1VHY3hhamxPU25WTFVYVkRhVmhCV0VaU1dqRkhiMkpVZW5aWFJYQnRVVDA5TFMxaU5rWklWVEJGVVVneGVHcHFWemxJVURkMmJtWkJQVDA9LS1iZjI0OTE2MTY3OTQ0ZWE0ODI0N2RiMDg2NDg2Yzg3M2E3YTQ1M2Y0?cid=1848244685 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | EXCEL.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 109.0.1518.115 Modules
| |||||||||||||||
1768 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x60c1f598,0x60c1f5a8,0x60c1f5b4 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 109.0.1518.115 Modules
| |||||||||||||||
2688 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1132 --field-trial-handle=1268,i,2407357972792688772,12316348891885140560,131072 /prefetch:2 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
2100 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1380 --field-trial-handle=1268,i,2407357972792688772,12316348891885140560,131072 /prefetch:3 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | msedge.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 109.0.1518.115 Modules
| |||||||||||||||
2804 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1632 --field-trial-handle=1268,i,2407357972792688772,12316348891885140560,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 109.0.1518.115 Modules
| |||||||||||||||
2112 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://password-changes.phishwall.net/XVTA1dFRHOHdNWGRKVTNSek56bHpjbmxpYm5oU1dIZG9PVWRpSzI5alFVMXNjRUl2TkN0NWRXUkhkalpoU1ZKbWFVSmpTVVZ5VXpJcmMwRlNUbkpvT1ZJeFpYZzBkWGR3WW5kSU1WUndNR1JIU1RkcWMxWXJjRnBUU1hFek56aEpaamtyYTFGSFIxcDNRWGxyTVV4VGRXaFpTVU13TlVwVU9GcG5OREpHVDFaMlJHNUhiMU5HZUdGcVJHVjFVRGRUZWsxcU1UVkVNa2M0SzNSSGIyTmlSaTlZVkVseGFuWTFLMmM0YVU1U2VsZG5aVzVUY21Ka1VHY3hhamxPU25WTFVYVkRhVmhCV0VaU1dqRkhiMkpVZW5aWFJYQnRVVDA5TFMxaU5rWklWVEJGVVVneGVHcHFWemxJVURkMmJtWkJQVDA9LS1iZjI0OTE2MTY3OTQ0ZWE0ODI0N2RiMDg2NDg2Yzg3M2E3YTQ1M2Y0?cid=1848244685 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | EXCEL.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
|
(PID) Process: | (120) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: On | |||
(PID) Process: | (120) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1041 |
Value: On | |||
(PID) Process: | (120) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1046 |
Value: On | |||
(PID) Process: | (120) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1036 |
Value: On | |||
(PID) Process: | (120) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1031 |
Value: On | |||
(PID) Process: | (120) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1040 |
Value: On | |||
(PID) Process: | (120) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1049 |
Value: On | |||
(PID) Process: | (120) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 3082 |
Value: On | |||
(PID) Process: | (120) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1042 |
Value: On | |||
(PID) Process: | (120) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1055 |
Value: On |
PID | Process | Filename | Type | |
---|---|---|---|---|
120 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRF6A5.tmp.cvr | — | |
MD5:— | SHA256:— | |||
120 | OUTLOOK.EXE | C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst | — | |
MD5:— | SHA256:— | |||
1740 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR14CC.tmp.cvr | — | |
MD5:— | SHA256:— | |||
120 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\OICE_BD9DB088-4D3B-46E5-B7F7-94A23FB83085.0\CF4335B6.xlsm:Zone.Identifier:$DATA | text | |
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B | SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913 | |||
1740 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\OICE_8C77074B-D941-4DD2-9CE8-A54240DB85FE.0\4421791F.xlsm:Zone.Identifier:$DATA | text | |
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B | SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913 | |||
120 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\FAB2MTQQ\AccountInvoice8472 (2).xlsm:Zone.Identifier:$DATA | text | |
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B | SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913 | |||
120 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\FAB2MTQQ\AccountInvoice8472.xlsm:Zone.Identifier | text | |
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B | SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913 | |||
1740 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\220B.tmp:Zone.Identifier:$DATA | text | |
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B | SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913 | |||
1740 | EXCEL.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\FAB2MTQQ\~$AccountInvoice8472.xlsm | binary | |
MD5:21E5D64E6DD2C94C577A61B0A25DE7A4 | SHA256:657F0604A7C1F6CFDC4E8A224F59BD6E1900A4A4DD8B3F61A20F67DEBE41F209 | |||
120 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inf | text | |
MD5:F3B25701FE362EC84616A93A45CE9998 | SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1740 | EXCEL.EXE | GET | 200 | 23.32.238.201:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d51724450f27ab9f | unknown | compressed | 4.66 Kb | unknown |
— | — | GET | 200 | 18.66.142.79:80 | http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D | unknown | binary | 1.37 Kb | unknown |
1080 | svchost.exe | GET | 304 | 23.32.238.201:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?34275567a5b520f7 | unknown | — | — | unknown |
1740 | EXCEL.EXE | GET | 200 | 18.66.142.79:80 | http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D | unknown | binary | 1.49 Kb | unknown |
1740 | EXCEL.EXE | GET | 200 | 108.138.2.107:80 | http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D | unknown | binary | 2.02 Kb | unknown |
1740 | EXCEL.EXE | GET | 200 | 13.32.117.210:80 | http://ocsp.r2m01.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBShdVEFnSEQ0gG5CBtzM48cPMe9XwQUgbgOY4qJEhjl%2Bjs7UJWf5uWQE4UCEA5Xb7E2luMJ844AA5%2FUSvc%3D | unknown | binary | 471 b | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
120 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
1624 | EXCEL.EXE | 34.206.102.91:443 | password-changes.phishwall.net | AMAZON-AES | US | unknown |
2296 | EXCEL.EXE | 34.206.102.91:443 | password-changes.phishwall.net | AMAZON-AES | US | unknown |
1740 | EXCEL.EXE | 34.206.102.91:443 | password-changes.phishwall.net | AMAZON-AES | US | unknown |
1740 | EXCEL.EXE | 23.32.238.201:80 | ctldl.windowsupdate.com | Akamai International B.V. | DE | unknown |
1740 | EXCEL.EXE | 108.138.2.107:80 | o.ss2.us | AMAZON-02 | US | whitelisted |
1740 | EXCEL.EXE | 18.66.142.79:80 | ocsp.rootg2.amazontrust.com | AMAZON-02 | US | unknown |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
password-changes.phishwall.net |
| unknown |
ctldl.windowsupdate.com |
| whitelisted |
o.ss2.us |
| whitelisted |
ocsp.rootg2.amazontrust.com |
| whitelisted |
ocsp.rootca1.amazontrust.com |
| shared |
ocsp.r2m01.amazontrust.com |
| whitelisted |
config.edge.skype.com |
| whitelisted |
nav-edge.smartscreen.microsoft.com |
| whitelisted |
edge.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
1080 | svchost.exe | Misc activity | ET POLICY Observed DNS Query to KnowBe4 Simulated Phish Domain (phishwall .net) |