File name:

Administrator Notification_ Redirecting email with malware.msg

Full analysis: https://app.any.run/tasks/b06b883a-1a35-4176-bf1f-e67c13689db5
Verdict: Malicious activity
Analysis date: November 29, 2021, 16:28:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

06660C234A8C54EF8217EEF6A140E7D9

SHA1:

3A7A01A40BF3966F05C2F393B6384EEE3FD2DD1A

SHA256:

735CAE2D85EE22625DF81A59D6204BFEF60F9BFAC9F2DF86E04936EFB15618DB

SSDEEP:

1536:CKiPdWzWiw7teWdo+UJWRW7H2B3fAr5gu5WDTk+UzV6p9i7id079SyLCj/w3/X13:CKiPr7OAI+yWDTk/qS7Yj2lyjWp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 2824)

  • SUSPICIOUS

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 2824)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2044)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 2208)
      • iexplore.exe (PID: 2044)
      • OUTLOOK.EXE (PID: 2824)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2044)

    • Checks supported languages

      • iexplore.exe (PID: 2044)
      • iexplore.exe (PID: 2208)
      • OUTLOOK.EXE (PID: 2824)

    • Application launched itself

      • iexplore.exe (PID: 2208)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2824)

    • Changes internet zones settings

      • iexplore.exe (PID: 2208)

    • Searches for installed software

      • OUTLOOK.EXE (PID: 2824)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2044)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2824)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe iexplore.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2824"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Administrator Notification_ Redirecting email with malware.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2208"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\CF0MLHD5\Office Email Notification.htmlC:\Program Files\Internet Explorer\iexplore.exe—OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2044"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2208 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
6 946
Read events
6 296
Write events
628
Delete events
22

Modification events

(PID) Process:(2824) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2824) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(2824) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(2824) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(2824) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(2824) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(2824) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(2824) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(2824) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
Off
(PID) Process:(2824) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1055
Value:
Off
Executable files
0
Suspicious files
0
Text files
14
Unknown types
3

Dropped files

PID
Process
Filename
Type
2824OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRE85F.tmp.cvr —
MD5:—
SHA256:—
2824OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst —
MD5:—
SHA256:—
2824OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\~DFCB525452D14732E5.TMPatn
MD5:C99F5B3ECBF1406F569CB2000A88F84D
SHA256:1B1761B76FC80899BA10DC91BB1919FF90DF6532615677B2F3C7520CEA7029BA
2824OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\CF0MLHD5\Email Notification.msgmsg
MD5:F0B5DA28FB6B8198D2C65E528AB15456
SHA256:CEDB67BCD01CB13D05E06A26F032363E3223724B850290B292D530B2A805697C
2824OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\CF0MLHD5\Office Email Notification.htmlhtml
MD5:D6830616C9D4F58B80D1422134038786
SHA256:DEE2E07B3946C6198F81A90BDC66396733D429C4A35232371D63367E1066643E
2824OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\CF0MLHD5\Office Email Notification (2).htmlhtml
MD5:D6830616C9D4F58B80D1422134038786
SHA256:DEE2E07B3946C6198F81A90BDC66396733D429C4A35232371D63367E1066643E
2824OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:4755BEFF1D1CF54ADD34A09E71621673
SHA256:998C57519306B9B46A9544D0CDB2FF89567F43EBFB74B89A4363ED06D9E4EA7E
2824OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:16397988B74B530EBC1C5430B7CF610A
SHA256:094954C8E55BB8C648D1062D23957E6DAA291D3A280A9351B6557EE837903102
2824OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\CF0MLHD5\Office Email Notification (2).html:Zone.Identifier:$DATAtext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
2824OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inftext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
40
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2824
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
—
—
GET
200
95.100.146.43:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b873937b2950c786
unknown
compressed
4.70 Kb
whitelisted
—
—
GET
200
95.100.146.43:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?30bbc276884e717b
unknown
compressed
4.70 Kb
whitelisted
—
—
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEASDadw4Hj8omz0LYxoxgB8%3D
US
der
279 b
whitelisted
—
—
GET
200
95.100.146.43:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b03b823663231589
unknown
compressed
4.70 Kb
whitelisted
—
—
GET
200
95.100.146.43:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4987adbf9f7143ae
unknown
compressed
4.70 Kb
whitelisted
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA9bw6F2y3ieICDHiTyBZ7Q%3D
US
der
1.47 Kb
whitelisted
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA9bw6F2y3ieICDHiTyBZ7Q%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2824
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
2044
iexplore.exe
172.217.16.138:443
ajax.googleapis.com
Google Inc.
US
whitelisted
2044
iexplore.exe
172.217.18.106:443
fonts.googleapis.com
Google Inc.
US
whitelisted
—
—
95.100.146.43:80
ctldl.windowsupdate.com
Akamai Technologies, Inc.
—
unknown
2044
iexplore.exe
104.18.11.207:443
maxcdn.bootstrapcdn.com
Cloudflare Inc
US
suspicious
2044
iexplore.exe
104.16.18.94:443
cdnjs.cloudflare.com
Cloudflare Inc
US
unknown
2044
iexplore.exe
13.107.246.44:443
aadcdn.msauth.net
Microsoft Corporation
US
suspicious
2044
iexplore.exe
69.16.175.42:443
code.jquery.com
Highwinds Network Group, Inc.
US
malicious
2044
iexplore.exe
104.21.78.7:443
use.fontawesome.com
Cloudflare Inc
US
suspicious
—
—
142.250.185.99:80
ocsp.pki.goog
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
maxcdn.bootstrapcdn.com
  • 104.18.11.207
  • 104.18.10.207
whitelisted
code.jquery.com
  • 69.16.175.42
  • 69.16.175.10
whitelisted
fonts.googleapis.com
  • 172.217.18.106
whitelisted
use.fontawesome.com
  • 104.21.78.7
  • 172.67.214.69
whitelisted
ajax.googleapis.com
  • 172.217.16.138
whitelisted
aadcdn.msauth.net
  • 13.107.246.44
  • 13.107.213.44
whitelisted
cdnjs.cloudflare.com
  • 104.16.18.94
  • 104.16.19.94
whitelisted
ctldl.windowsupdate.com
  • 95.100.146.43
  • 95.100.146.72
whitelisted
ocsp.pki.goog
  • 142.250.185.99
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Administrator Notification_ Redirecting email with malware.msg