analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

invite.ics

Full analysis: https://app.any.run/tasks/ceebaf21-cc08-4763-8420-9d7cfacdb863
Verdict: Malicious activity
Analysis date: September 30, 2020, 00:47:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/calendar
File info: vCalendar calendar file
MD5:

5CEE767927F6BC797F7C2AD793D14C56

SHA1:

7AB816B3C7BBD4A7F46BA4AF67419ADEF2D811C1

SHA256:

805EF85E66D9CE218F443CF90A2B4BE4BAE944D39EF8B7A109C77AE43B7EA96B

SSDEEP:

24:EsrfEniN0gAzsS4h10JkDd431Q0JkDtxpj2A7+XpA170B1fn5ICkJhp:EgfozpsSe1Iz31QIQxpqpK74f6dJhp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 668)

  • SUSPICIOUS

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 668)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 668)

  • INFO

    • Reads settings of System Certificates

      • iexplore.exe (PID: 324)
      • iexplore.exe (PID: 1492)

    • Changes internet zones settings

      • iexplore.exe (PID: 1492)

    • Application launched itself

      • iexplore.exe (PID: 1492)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 324)
      • iexplore.exe (PID: 1492)
      • OUTLOOK.EXE (PID: 668)

    • Reads internet explorer settings

      • OUTLOOK.EXE (PID: 668)
      • iexplore.exe (PID: 324)

    • Creates files in the user directory

      • iexplore.exe (PID: 1492)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1492)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1492)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 668)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.ics/vcs | iCalendar - vCalendar (100)

EXIF

VCard

TimeTransparency: OPAQUE
Summary: Nicole <> Jeff
Status: CONFIRMED
SequenceNumber: -
Location: -
ModifyDate: 2020:09:29 22:12:51Z
Description: Quick call to close out Ambassador Program; Nicole to call Jeff at 212-479-6705 -::~:~::~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~::~:~::- Please do not edit this section of the description. View your event at https://www.google.com/calendar/event?action=VIEW&eid=MW1wYmdldGxmY2pnbmJ0MjBxdW9vMW9nN3EgamVmZkBsYXJldHRvLm5ldA&tok=MTcjbmljb2xlQGJvbHN0ZXIudXM0MjY4YjE5ZWM5ZGRlZDcxMWU4OWU3Y2VhMzc1OTk2YzQzN2NhN2Vl&ctz=America%2FNew_York&hl=en&es=1. -::~:~::~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~::~:~::-
DateCreated: 2020:09:29 22:12:50Z
Microsoft-cdo-ownerapptid: -759146609
Attendee: mailto:[email protected]
UID: [email protected]
Organizer: mailto:[email protected]
DateTimeStamp: 2020:09:29 22:12:53Z
DateTimeEnd: 2020:09:30 16:15:00Z
DateTimeStart: 2020:09:30 16:00:00Z
Method: REQUEST
CalendarScale: GREGORIAN
VCalendarVersion: 2
Software: -//Google Inc//Google Calendar 70.9054//EN
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
668"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /ical "C:\Users\admin\AppData\Local\Temp\invite.ics"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
1492"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/calendar/event?action=VIEW&eid=MW1wYmdldGxmY2pnbmJ0MjBxdW9vMW9nN3EgamVmZkBsYXJldHRvLm5ldA&tok=MTcjbmljb2xlQGJvbHN0ZXIudXM0MjY4YjE5ZWM5ZGRlZDcxMWU4OWU3Y2VhMzc1OTk2YzQzN2NhN2Vl&ctz=America%2FNew_York&hl=en&es=1C:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
324"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1492 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Total events
2 891
Read events
2 128
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
28
Text files
41
Unknown types
10

Dropped files

PID
Process
Filename
Type
668OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRC082.tmp.cvr —
MD5:—
SHA256:—
668OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\05J8PVOFWTP2Y0T66W7R.temp —
MD5:—
SHA256:—
668OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\~DF1078E2236CC346FD.TMP —
MD5:—
SHA256:—
668OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\~DF29729BD72F6BA676.TMP —
MD5:—
SHA256:—
668OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:A110827FD44F7AE69F469B21491FE44E
SHA256:AE6F7EE13D4EFBCB70AE82AE1352BDF34A3C0ADA6772DE3B36C8EA62D1790992
668OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\be71009ff8bb02a2.customDestinations-msbinary
MD5:ED9E667AC764168B4402FCDF889DFAC0
SHA256:CC83AFF11A0CFACD721E9FB56C353C88C6F14647DD19A4B62380865B850995AF
668OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\be71009ff8bb02a2.customDestinations-ms~RF3bc5c2.TMPbinary
MD5:ED9E667AC764168B4402FCDF889DFAC0
SHA256:CC83AFF11A0CFACD721E9FB56C353C88C6F14647DD19A4B62380865B850995AF
668OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Outlook.lnklnk
MD5:0E9EE817C961E557519D8C05340A1CB5
SHA256:7F52AF0D171A7F952A2197048D42956D3546C639D03385868B72C5DB53BED0D8
668OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:B9421549FFEA87868B90E1411563D514
SHA256:3EF3FE1EC11C2B94DD4347EFC590400161A1E7C37CD3828E4264C9785D25650C
668OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inftext
MD5:48DD6CAE43CE26B992C35799FCD76898
SHA256:7BFE1F3691E2B4FB4D61FBF5E9F7782FBE49DA1342DBD32201C2CC8E540DBD1A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
21
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
668
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
1056
svchost.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D
US
der
471 b
whitelisted
324
iexplore.exe
GET
200
172.217.22.99:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDOs%2FDKHsIMiAIAAAAAeksR
US
der
472 b
whitelisted
324
iexplore.exe
GET
200
172.217.22.99:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
324
iexplore.exe
GET
200
172.217.22.99:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCoziyTHasflwIAAAAAekur
US
der
472 b
whitelisted
324
iexplore.exe
GET
200
172.217.22.99:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDOs%2FDKHsIMiAIAAAAAeksR
US
der
472 b
whitelisted
1056
svchost.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAKXB1YM1Knrv%2BJy8eCW2II%3D
US
der
471 b
whitelisted
1056
svchost.exe
GET
200
2.16.186.120:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
der
781 b
whitelisted
1056
svchost.exe
GET
200
13.107.4.50:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
57.5 Kb
whitelisted
1056
svchost.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1492
iexplore.exe
172.217.22.110:443
calendar.google.com
Google Inc.
US
whitelisted
668
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
1056
svchost.exe
2.18.233.62:80
www.microsoft.com
Akamai International B.V.
—
whitelisted
324
iexplore.exe
172.217.22.99:80
ocsp.pki.goog
Google Inc.
US
whitelisted
1492
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
1056
svchost.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
324
iexplore.exe
172.217.22.110:443
calendar.google.com
Google Inc.
US
whitelisted
1056
svchost.exe
172.217.22.99:80
ocsp.pki.goog
Google Inc.
US
whitelisted
324
iexplore.exe
216.58.210.4:443
www.google.com
Google Inc.
US
whitelisted
1056
svchost.exe
104.18.25.243:80
ocsp.msocsp.com
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
www.google.com
  • 216.58.210.4
whitelisted
ocsp.pki.goog
  • 172.217.22.99
whitelisted
calendar.google.com
  • 172.217.22.110
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
crl.microsoft.com
  • 2.16.186.120
  • 2.16.186.74
whitelisted
ocsp.msocsp.com
  • 104.18.25.243
  • 104.18.24.243
whitelisted
www.microsoft.com
  • 2.18.233.62
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
invite.ics