analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | RechnungOnline für Buchungskonto 9791877086 Abr. 02.2019.msg |
| Full analysis: | https://app.any.run/tasks/1b04c326-1992-461d-8660-667344870bb4 |
| Verdict: | Malicious activity |
| Analysis date: | February 19, 2019, 09:14:16 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.ms-outlook |
| File info: | CDFV2 Microsoft Outlook Message |
| MD5: | CB15A011E75621D6246DEC3A0E71AD6D |
| SHA1: | 2AE5D81202EED81EB25C5692246A793E7FFA2784 |
| SHA256: | 8243D3D9C420F107C905E673C81A50221BC9289992663665DBB79B37013F57AB |
| SSDEEP: | 1536:u1ddGQ95FB7DxRD0Gr6plx6hO0ndMQ6e21mthmvqv2yy81Y:u1ddGu5FBvQE8L6hfMQS1mt8uy+Y |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts Internet Explorer
- AcroRd32.exe (PID: 2508)
Reads Internet Cache Settings
- OUTLOOK.EXE (PID: 2928)
Creates files in the user directory
- OUTLOOK.EXE (PID: 2928)
Creates files in the program directory
- AdobeARM.exe (PID: 708)
INFO
Creates files in the user directory
- AcroRd32.exe (PID: 2508)
- iexplore.exe (PID: 2588)
Reads Internet Cache Settings
- iexplore.exe (PID: 2588)
- iexplore.exe (PID: 1932)
- iexplore.exe (PID: 2576)
Changes internet zones settings
- iexplore.exe (PID: 3508)
- iexplore.exe (PID: 3388)
- iexplore.exe (PID: 1536)
Application launched itself
- iexplore.exe (PID: 3508)
- AcroRd32.exe (PID: 2508)
- RdrCEF.exe (PID: 4032)
- iexplore.exe (PID: 3388)
- iexplore.exe (PID: 1536)
Reads Microsoft Office registry keys
- OUTLOOK.EXE (PID: 2928)
Reads internet explorer settings
- iexplore.exe (PID: 2576)
- iexplore.exe (PID: 2588)
- iexplore.exe (PID: 1932)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .msg | | | Outlook Message (58.9) |
|---|---|---|
| .oft | | | Outlook Form Template (34.4) |
Total processes
46
Monitored processes
14
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2928 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\RechnungOnline für Buchungskonto 9791877086 Abr. 02.2019.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
| 2508 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\Desktop\Rechnung_2019_02_9791877086.pdf" | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | explorer.exe | |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe Acrobat Reader DC Version: 15.23.20070.215641 | ||||
| 4016 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\Desktop\Rechnung_2019_02_9791877086.pdf" | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | — | AcroRd32.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe Acrobat Reader DC Version: 15.23.20070.215641 | ||||
| 4032 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16448250 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | — | AcroRd32.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe RdrCEF Version: 15.23.20053.211670 | ||||
| 3876 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="4032.0.807887772\1985370456" --allow-no-sandbox-job /prefetch:673131151 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | — | RdrCEF.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe RdrCEF Version: 15.23.20053.211670 | ||||
| 2340 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="4032.1.1952725469\1440199978" --allow-no-sandbox-job /prefetch:673131151 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | — | RdrCEF.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe RdrCEF Version: 15.23.20053.211670 | ||||
| 3508 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | AcroRd32.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 2588 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3508 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 3388 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | AcroRd32.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 2576 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3388 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
Total events
2 949
Read events
2 319
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
6
Text files
51
Unknown types
14
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2928 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR97C2.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 2928 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\S1927L8X\Rechnung_2019_02_9791877086 (2).pdf\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
| 2928 | OUTLOOK.EXE | C:\Users\admin\Desktop\Rechnung_2019_02_9791877086.pdf\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
| 4016 | AcroRd32.exe | C:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal | — | |
MD5:— | SHA256:— | |||
| 2928 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:DB79D2A540BC0302E4057635368ABD7D | SHA256:F82286BC1A050CDA4CADC5B2C35FD6DEF742CA86743E33F7066B8A81E744EF74 | |||
| 2928 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\S1927L8X\Rechnung_2019_02_9791877086.pdf | ||
MD5:3F3E85BB946D39E868D9864A8FD27A40 | SHA256:FE548AE1DC4434BDDF7517366B92743A56D8DA8FA3E629A07CD5403CB69EF7A0 | |||
| 2928 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\S1927L8X\Rechnung_2019_02_9791877086 (2).pdf | ||
MD5:3F3E85BB946D39E868D9864A8FD27A40 | SHA256:FE548AE1DC4434BDDF7517366B92743A56D8DA8FA3E629A07CD5403CB69EF7A0 | |||
| 2928 | OUTLOOK.EXE | C:\Users\admin\Desktop\Rechnung_2019_02_9791877086.pdf | ||
MD5:3F3E85BB946D39E868D9864A8FD27A40 | SHA256:FE548AE1DC4434BDDF7517366B92743A56D8DA8FA3E629A07CD5403CB69EF7A0 | |||
| 4016 | AcroRd32.exe | C:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9Rs9cnef_1801chs_33k.tmp | — | |
MD5:— | SHA256:— | |||
| 4016 | AcroRd32.exe | C:\Users\admin\AppData\Local\Temp\acrord32_sbx\A9R1t8kbej_1801chr_33k.tmp | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
12
DNS requests
9
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2928 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
2508 | AcroRd32.exe | GET | 304 | 2.16.186.32:80 | http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/281_15_23_20070.zip | unknown | — | — | whitelisted |
2508 | AcroRd32.exe | GET | 304 | 2.16.186.32:80 | http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/277_15_23_20070.zip | unknown | — | — | whitelisted |
2508 | AcroRd32.exe | GET | 304 | 2.16.186.32:80 | http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/280_15_23_20070.zip | unknown | — | — | whitelisted |
2508 | AcroRd32.exe | GET | 304 | 2.16.186.32:80 | http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/278_15_23_20070.zip | unknown | — | — | whitelisted |
2576 | iexplore.exe | GET | 200 | 192.163.232.189:80 | http://atreticandlawns.com.au/CDVQRWK8354111/Rechnungs/Fakturierung/ | US | document | 316 Kb | unknown |
3508 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
2588 | iexplore.exe | GET | 200 | 192.163.232.189:80 | http://atreticandlawns.com.au/CDVQRWK8354111/Rechnungs/Fakturierung/ | US | document | 316 Kb | unknown |
2576 | iexplore.exe | GET | 301 | 192.163.232.189:80 | http://atreticandlawns.com.au/CDVQRWK8354111/Rechnungs/Fakturierung | US | html | 348 b | unknown |
2508 | AcroRd32.exe | GET | 304 | 2.16.186.32:80 | http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/message.zip | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2588 | iexplore.exe | 192.163.232.189:80 | atreticandlawns.com.au | Unified Layer | US | unknown |
2508 | AcroRd32.exe | 2.18.233.74:443 | armmf.adobe.com | Akamai International B.V. | — | whitelisted |
3388 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2508 | AcroRd32.exe | 2.16.186.32:80 | acroipm2.adobe.com | Akamai International B.V. | — | whitelisted |
2928 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
3508 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
— | — | 23.210.248.251:443 | ardownload2.adobe.com | Akamai International B.V. | NL | whitelisted |
1932 | iexplore.exe | 192.163.232.189:80 | atreticandlawns.com.au | Unified Layer | US | unknown |
2576 | iexplore.exe | 192.163.232.189:80 | atreticandlawns.com.au | Unified Layer | US | unknown |
1536 | iexplore.exe | 13.107.21.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
config.messenger.msn.com |
| whitelisted |
acroipm2.adobe.com |
| whitelisted |
armmf.adobe.com |
| whitelisted |
www.bing.com |
| whitelisted |
atreticandlawns.com.au |
| unknown |
ardownload2.adobe.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2588 | iexplore.exe | Misc activity | SUSPICIOUS [PTsecurity] Download DOC file with VBAScript |
2576 | iexplore.exe | Misc activity | SUSPICIOUS [PTsecurity] Download DOC file with VBAScript |
1932 | iexplore.exe | Misc activity | SUSPICIOUS [PTsecurity] Download DOC file with VBAScript |