analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Customer Experience Engagement in Energy Sector.msg

Full analysis: https://app.any.run/tasks/3a188352-c7f4-431b-8ada-4f605714468e
Verdict: Malicious activity
Analysis date: May 20, 2019, 10:56:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

130D345C219924780FC8802CB827EC69

SHA1:

77AD12E709CFDFEEBEA610D23EAD307632CBA66B

SHA256:

78302C329F6FB8CBFAFFEDA3D6452B28B01041E51FBAD161E2410904589DC916

SSDEEP:

6144:oglt8V1mDpKK5SLuL+bFPd4Tf1igYBs0+0r:okyVstKHHbF6TRYBs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 3016)

  • SUSPICIOUS

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 3016)

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 3016)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 3016)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3088)
      • RdrCEF.exe (PID: 2840)
      • AcroRd32.exe (PID: 2904)

    • Creates files in the user directory

      • AcroRd32.exe (PID: 2904)
      • iexplore.exe (PID: 1472)

    • Changes internet zones settings

      • iexplore.exe (PID: 3088)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 3016)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 1472)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1472)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
8
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe acrord32.exe acrord32.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3016"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Customer Experience Engagement in Energy Sector.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
2904"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\RK7M3E50\Agenda - Customer Experience in Energy.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
OUTLOOK.EXE
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
15.23.20070.215641
3208"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\RK7M3E50\Agenda - Customer Experience in Energy.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
15.23.20070.215641
2840"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16448250C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe RdrCEF
Exit code:
3221225547
Version:
15.23.20053.211670
2084"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="2840.0.2118135322\683232854" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
0
Version:
15.23.20053.211670
2796"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="2840.1.420495036\48542413" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
0
Version:
15.23.20053.211670
3088"C:\Program Files\Internet Explorer\iexplore.exe" https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.prosperoevents.com&data=02%7C01%7Chenna.begum%40havenpower.com%7C7c2d2eac3c2a4058865b08d6c98390bb%7C007c146d3d97467d849f6f4fe5a6a0f3%7C0%7C0%7C636917964450266510&sdata=PE7%2BM9mYmaqaV97vJpFP9cFWDQxz9mRsYPvlbhjxueU%3D&reserved=0C:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
1472"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3088 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
2 068
Read events
1 529
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
9
Text files
57
Unknown types
19

Dropped files

PID
Process
Filename
Type
3016OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRE60.tmp.cvr —
MD5:—
SHA256:—
3016OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\RK7M3E50\Agenda - Customer Experience in Energy (2).pdf\:Zone.Identifier:$DATA —
MD5:—
SHA256:—
3208AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal —
MD5:—
SHA256:—
3208AcroRd32.exeC:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal —
MD5:—
SHA256:—
3016OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:4B2ED9F42484FB9C37FC1AA33219FAFB
SHA256:117744F6B1BD4625DA53723F35E236F651BC6EA35D1E8051EF9352445A3A7482
3208AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt16.lst.3208 —
MD5:—
SHA256:—
3016OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A239C97D.datimage
MD5:1DE635ACF0F3CA8E9A6B9E2C9D95D219
SHA256:2F0AB89C83BB9AB8B2B44CD2B107E98BA2D25EDBFC53E6D37D9353F3D882E1E2
3208AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEventssqlite
MD5:7E6F46F710D0E224185747A31903E3CB
SHA256:CB2DB61F2173B4095A9FD5A358B4D9F900217C8A8CA5ECF3FA58F56E4C902D9B
3208AcroRd32.exeC:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagessqlite
MD5:71289F8F8D3000638A846F994C51E52B
SHA256:A67239B25EF289BB16B95FEB12A1D0A77FEF6772CD26901970BCE3116D81FCB9
3016OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\RK7M3E50\Agenda - Customer Experience in Energy (2).pdfpdf
MD5:22690730D661C8657495A943BFE80C26
SHA256:34F8775C427CE5E0F20FF1A2F0A276EC6D0E9CB512CB68E3788263E8EA977FCB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
13
DNS requests
10
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3016
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
1472
iexplore.exe
GET
200
82.208.48.93:80
http://www.prosperoevents.com/modules/mod_news_pro_gk4/interface/css/style.portal.mode.1.css
CZ
text
684 b
suspicious
1472
iexplore.exe
GET
200
82.208.48.93:80
http://www.prosperoevents.com/templates/gk_appsite/css/menu.gkmenu.css
CZ
text
196 b
suspicious
3088
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
2904
AcroRd32.exe
GET
304
2.16.186.33:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/278_15_23_20070.zip
unknown
—
—
whitelisted
1472
iexplore.exe
GET
200
82.208.48.93:80
http://www.prosperoevents.com/templates/gk_appsite/js/gk.video.js
CZ
text
7.12 Kb
suspicious
1472
iexplore.exe
GET
200
82.208.48.93:80
http://www.prosperoevents.com/modules/mod_image_show_gk4/styles/gk_financial_business/style.css
CZ
text
637 b
suspicious
1472
iexplore.exe
GET
200
82.208.48.93:80
http://www.prosperoevents.com/components/com_k2store/js/k2store.js
CZ
text
2.28 Kb
suspicious
1472
iexplore.exe
GET
200
82.208.48.93:80
http://www.prosperoevents.com/
CZ
html
9.65 Kb
suspicious
1472
iexplore.exe
GET
200
82.208.48.93:80
http://www.prosperoevents.com/templates/gk_appsite/css/k2.css
CZ
compressed
9.65 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3088
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
1472
iexplore.exe
216.58.207.42:80
ajax.googleapis.com
Google Inc.
US
whitelisted
2904
AcroRd32.exe
2.18.233.74:443
armmf.adobe.com
Akamai International B.V.
—
whitelisted
3016
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
1472
iexplore.exe
104.47.10.28:443
eur03.safelinks.protection.outlook.com
Microsoft Corporation
IE
whitelisted
1472
iexplore.exe
13.90.95.14:80
www.ape78cn2.com
Microsoft Corporation
US
whitelisted
2904
AcroRd32.exe
2.16.186.33:80
acroipm2.adobe.com
Akamai International B.V.
—
whitelisted
1472
iexplore.exe
82.208.48.93:80
www.prosperoevents.com
Casablanca INT
CZ
suspicious

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
acroipm2.adobe.com
  • 2.16.186.33
  • 2.16.186.32
whitelisted
armmf.adobe.com
  • 2.18.233.74
whitelisted
eur03.safelinks.protection.outlook.com
  • 104.47.10.28
  • 104.47.8.28
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.prosperoevents.com
  • 82.208.48.93
suspicious
ajax.googleapis.com
  • 216.58.207.42
  • 172.217.16.170
  • 216.58.208.42
  • 172.217.16.138
  • 172.217.22.42
  • 172.217.22.74
  • 172.217.22.106
  • 216.58.210.10
  • 172.217.18.106
  • 172.217.23.170
  • 216.58.205.234
  • 172.217.21.234
  • 172.217.22.10
  • 172.217.18.10
  • 172.217.23.138
  • 216.58.206.10
whitelisted
www.ape78cn2.com
  • 13.90.95.14
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Customer Experience Engagement in Energy Sector.msg