analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

FW_ New positions near University Park_ NM - 03-29-2020.msg

Full analysis: https://app.any.run/tasks/da4ca7bf-9023-46d5-a437-628c3bc7b733
Verdict: Malicious activity
Analysis date: March 30, 2020, 15:07:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

2329C7ACA2A993F9035185ADFFFA7098

SHA1:

C353A32A78EF7E05C2D773B55DD4A7A246615F25

SHA256:

75919E12F950985567B67544CE1A25678AD96E12F6D519C691E4A5D072F83586

SSDEEP:

3072:9HLBB7vw5t5uEyeArhUgCgs8uwSP4Mp3DbDfqebce9P4SO4SO4SAEwvR4pJoX6CD:J3QLkeAGP8R+qi/wDKce

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 1520)

  • SUSPICIOUS

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 1520)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 1520)

    • Executed via COM

      • OUTLOOK.EXE (PID: 3328)

  • INFO

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 3328)
      • OUTLOOK.EXE (PID: 1520)

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 1520)
      • iexplore.exe (PID: 3568)
      • iexplore.exe (PID: 780)

    • Application launched itself

      • iexplore.exe (PID: 3568)

    • Changes internet zones settings

      • iexplore.exe (PID: 3568)

    • Reads internet explorer settings

      • iexplore.exe (PID: 780)

    • Creates files in the user directory

      • iexplore.exe (PID: 3568)
      • iexplore.exe (PID: 780)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3568)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3568)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (45.3)
.oft | Outlook Form Template (26.5)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe outlook.exe no specs iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1520"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\FW_ New positions near University Park_ NM - 03-29-2020.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
Modules
Images
c:\program files\microsoft office\office14\outlook.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3328"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" -EmbeddingC:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\program files\microsoft office\office14\outlook.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3568"C:\Program Files\Internet Explorer\iexplore.exe" https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fl.koraljobs.com%2Fmps2%2Fc%2FCAE%2FgMpRAA%2Ft.30h%2FQ_NybzRgTjahebIBComZ2w%2Fh1%2FJxHK25qWkKvvP5zJa79GzfKlpQle5C-2FuDcQFDj5Tfid9xkKcd8xhMDZqcBS8R5-2BcvMKiAg6A8a754h54CpuguxuyV9jY2fQhWviX-2FpGPKQk-3D%2FwJHl&data=01%7C01%7Chasana%40nmsu.edu%7C54d68f8a983e42ca467e08d7d4b24e43%7Ca3ec87a89fb84158ba8ff11bace1ebaa%7C1&sdata=jHuiU%2F8FKPHZosyOEZVSum%2FwJLSDLcnzUezKRZaAkH0%3D&reserved=0C:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
780"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3568 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
10 810
Read events
2 013
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
114
Text files
110
Unknown types
56

Dropped files

PID
Process
Filename
Type
1520OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR6B45.tmp.cvr —
MD5:—
SHA256:—
3328OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR841C.tmp.cvr —
MD5:—
SHA256:—
780iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabA2FF.tmp —
MD5:—
SHA256:—
780iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\TarA300.tmp —
MD5:—
SHA256:—
1520OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:23D82C667AD1357E3A5E471FC972BEF1
SHA256:59EF0D46C7C0BC279AEB0E08B2BC48B54DF01A10B554F73D41F5E1E7943B6F69
1520OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:1A2FA43E37E4B317614B864F33034DD6
SHA256:24AE6EBC000DCF822D868743DB979D5CC3A6A7B49CE1C9B0F5799B7EC095642B
780iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2F23D0F5E4D72862517E1CB26A329742_F6FACC49395CFA949BCE851E73323C49der
MD5:C46FECE849A4FB720D4468E63C72F67B
SHA256:C56079EA1777990734700448194E09528413A80B118DAA63ECD47DD20EDAA2C4
1520OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4586D5E8.datimage
MD5:B2F312C70D97DE875CED8DE200E9A27C
SHA256:FE548822C3A475670FD9321FA26EBEAABF15844279915D3FCF51EE255E9DB935
780iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2F23D0F5E4D72862517E1CB26A329742_F6FACC49395CFA949BCE851E73323C49binary
MD5:F16FCD85213B3FFFD8E5991602FA7929
SHA256:158F4C8115EA0B3ED5421EA3A8465D8AA484F0E16044CA40FE6034066B4DDD91
1520OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inftext
MD5:48DD6CAE43CE26B992C35799FCD76898
SHA256:7BFE1F3691E2B4FB4D61FBF5E9F7782FBE49DA1342DBD32201C2CC8E540DBD1A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
56
TCP/UDP connections
118
DNS requests
43
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1520
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
780
iexplore.exe
GET
200
13.225.87.155:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
780
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
780
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEBPqKHBb9OztDDZjCYBhQzY%3D
US
der
471 b
whitelisted
780
iexplore.exe
GET
200
143.204.98.91:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D
US
der
1.39 Kb
shared
780
iexplore.exe
GET
200
13.225.87.121:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
780
iexplore.exe
GET
200
172.217.18.163:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
780
iexplore.exe
GET
200
13.225.87.142:80
http://crl.sca1b.amazontrust.com/sca1b.crl
US
binary
682 Kb
whitelisted
780
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2Fz5hY5qj0aEmX0H4s05bY%3D
US
der
1.47 Kb
whitelisted
780
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEBPqKHBb9OztDDZjCYBhQzY%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
780
iexplore.exe
104.47.32.28:443
nam01.safelinks.protection.outlook.com
Microsoft Corporation
US
whitelisted
1520
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
780
iexplore.exe
13.225.73.74:443
l.koraljobs.com
—
US
suspicious
780
iexplore.exe
143.204.98.91:80
ocsp.rootca1.amazontrust.com
—
US
whitelisted
780
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
780
iexplore.exe
13.225.87.61:80
o.ss2.us
—
US
suspicious
780
iexplore.exe
13.225.87.155:80
o.ss2.us
—
US
unknown
780
iexplore.exe
13.225.87.121:80
ocsp.rootg2.amazontrust.com
—
US
whitelisted
780
iexplore.exe
143.204.98.63:80
ocsp.sca1b.amazontrust.com
—
US
whitelisted
3568
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
nam01.safelinks.protection.outlook.com
  • 104.47.32.28
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
l.koraljobs.com
  • 13.225.73.74
  • 13.225.73.27
  • 13.225.73.119
  • 13.225.73.40
malicious
o.ss2.us
  • 13.225.87.155
  • 13.225.87.61
  • 13.225.87.148
  • 13.225.87.124
whitelisted
ocsp.rootg2.amazontrust.com
  • 13.225.87.121
  • 13.225.87.38
  • 13.225.87.218
  • 13.225.87.183
whitelisted
ocsp.rootca1.amazontrust.com
  • 143.204.98.91
  • 143.204.98.183
  • 143.204.98.215
  • 143.204.98.108
shared
ocsp.sca1b.amazontrust.com
  • 143.204.98.63
  • 143.204.98.188
  • 143.204.98.199
  • 143.204.98.3
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
FW_ New positions near University Park_ NM - 03-29-2020.msg