File name: | Administrator Notification_ Redirecting email with malware.msg |
Full analysis: | https://app.any.run/tasks/49415737-6772-44ee-8aca-b4e3e2f4c5b7 |
Verdict: | Malicious activity |
Analysis date: | July 17, 2019, 12:50:18 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | 86DA24358F9BF07BD6A9B4C1BB063A59 |
SHA1: | 472856E49ED26B4F2751CC71CB8B5E450939159C |
SHA256: | 6DB71D73D58BE3AD0D8CC08FE7EABAD8C99E6B02CD67E6F446070BB1C43E3EB9 |
SSDEEP: | 3072:LVFJ6O0SBzB0hFsakSUEvQ+ccISwOvSodDs0IG/yUPVhi1bfnYbOeYZhm/Gzjvi6:LTShFsuJYiyEqGeR66 |
.msg | | | Outlook Message (41.3) |
---|---|---|
.oft | | | Outlook Form Template (24.1) |
.doc | | | Microsoft Word document (18.6) |
.doc | | | Microsoft Word document (old ver.) (11) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2896 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Administrator Notification_ Redirecting email with malware.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
2440 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\BQ93JEPV\po#7898.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | OUTLOOK.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3256 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Embedding | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
3892 | "C:\Users\admin\AppData\Local\Temp\karo.exe" | C:\Users\admin\AppData\Local\Temp\karo.exe | — | WINWORD.EXE |
User: admin Company: daman4 Integrity Level: MEDIUM Description: CUREPIPE2 Exit code: 0 Version: 1.02.0004 | ||||
3808 | C:\Users\admin\AppData\Local\Temp\karo.exe" | C:\Users\admin\AppData\Local\Temp\karo.exe | — | karo.exe |
User: admin Company: daman4 Integrity Level: MEDIUM Description: CUREPIPE2 Version: 1.02.0004 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2896 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRB834.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2896 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\~DF07FC3473738F467D.TMP | — | |
MD5:— | SHA256:— | |||
2896 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\BQ93JEPV\po#7898 (2).doc\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
2440 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRE3E7.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2440 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\OICE_75B04D49-BF6A-4514-A524-AF665BC9FE72.0\CCD74E1A.doc\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
2896 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:4B924BE942E305541F9B94D2941A9E00 | SHA256:555CD18B8EB67F67465888E1A05E53D5473D031FEFB655534C5765F9FEAC145D | |||
2440 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:B57CFC8AFC12A7310E73671DB4955338 | SHA256:E4C31725736D162380D08CDF1742B70A2B51E1760598F58662229399E4F1DA97 | |||
2896 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\BQ93JEPV\NEW ORDER.msg | msg | |
MD5:8755E222BA8B48914803FE25A2304E0C | SHA256:33597A1137DC7052EAE3B1A6358C61CA320F260CD686D4838E3A834C072D4056 | |||
2896 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\BQ93JEPV\po#7898 (2).doc | document | |
MD5:3DA330FF7B9B2BEE81545D5D36EDD64E | SHA256:98B3D4EE0FBDFB136462BB2F1E200368A5BB05C524E353A42EA9700EAEC44928 | |||
2896 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7A1D9C8D.dat | image | |
MD5:A6AC4B6113C88741179E8D627EE765B2 | SHA256:1F17C4D905722411A2C1817735F0074251860E4C523DECFFD07CD26234E10E6E |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2440 | WINWORD.EXE | GET | 301 | 104.18.48.237:80 | http://elkagroupe.com/wp/karo.exe | US | — | — | malicious |
2896 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 104.18.48.237:80 | elkagroupe.com | Cloudflare Inc | US | shared |
2896 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
2440 | WINWORD.EXE | 104.18.48.237:443 | elkagroupe.com | Cloudflare Inc | US | shared |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
elkagroupe.com |
| malicious |