analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Notice of Resignation (27.2 KB).msg

Full analysis: https://app.any.run/tasks/a2834eb5-6dea-4a84-a227-6b45256665e2
Verdict: Malicious activity
Analysis date: December 18, 2018, 19:32:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

7061D51CD470DA15BF44F5080D1F3AB7

SHA1:

BBDC8E00C3CC9B10B564DDA0573737BCD8A89BFE

SHA256:

839513F61048A68576F13F233773615EA74CD5515466D6C91823DA792A285AB8

SSDEEP:

768:fuguwr+t35jADEhJp+jdK9SETIQF3U+O6QUS+M7TK/dy/9b:f7S9ZfTIQFNrQr/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 2968)

  • SUSPICIOUS

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2968)

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 2968)

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 2968)

    • Starts itself from another location

      • OUTLOOK.EXE (PID: 2968)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3000)

    • Changes internet zones settings

      • iexplore.exe (PID: 3000)
      • iexplore.exe (PID: 3980)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2968)
      • OUTLOOK.EXE (PID: 2404)
      • OUTLOOK.EXE (PID: 3696)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3732)
      • iexplore.exe (PID: 2160)

    • Creates files in the user directory

      • iexplore.exe (PID: 3000)
      • iexplore.exe (PID: 3732)
      • iexplore.exe (PID: 2160)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3000)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3732)
      • iexplore.exe (PID: 2160)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3000)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3000)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe outlook.exe no specs outlook.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2968"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Notice of Resignation (27.2 KB).msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
3000"C:\Program Files\Internet Explorer\iexplore.exe" http://email.veromailer.com/c/eJxdkEtPwzAQhH9NcqkU-ZVHDzmURhVcECeu0dbZtkZ2HNkmgX-PnQoISLa02hnNN7YEM4G6jln54FCqSeEY-sEaUHHVtfepkNbk8teJcal7_35-QxmS7RG1tvnQAm_IfuucwSkIyq5hRzsGZ3WuWkZoQ1m8TVlSUdCiPnLKu1MlDoLQjtFMkBldgmt0K_7WMlpXDakGyRu4CMJFxc97ZBJZLRgA33I33TLWvDicFS4Z2-_uTXV7C2HyGT9k7BTPsizFAAGsAwMgJXpfyEsS8Ox5VeaudR_GhbXYNbX6_yWTswnYj2AwUSNyjIF696p8fP7uaZRbe_icVtszLl5jCOj-qGgmDQF_0rbi99irIUkloYRXX6MElhkC:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3732"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3000 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3980"C:\Program Files\Internet Explorer\iexplore.exe" https://aka.ms/getspmobileC:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2160"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3980 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3696"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" -c IPM.Note /m "mailto:[email protected]"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE—OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
2404"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" -EmbeddingC:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Total events
2 311
Read events
1 710
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
8
Text files
80
Unknown types
14

Dropped files

PID
Process
Filename
Type
2968OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRA5E8.tmp.cvr —
MD5:—
SHA256:—
3000iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
3000iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\webs365[1].txt —
MD5:—
SHA256:—
2968OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:CEBC32D9D44FB66C09BFABEA8722CD52
SHA256:8365C193FABFCDFE66A927D2009D435FCA55079F5A2C83F93A7605F394F43D03
2968OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\55C9FF8.datimage
MD5:79606E2089B29FD002997A4D711ABFC0
SHA256:296B0174BAE12C79424760EF1DE9FCAC8BCD23D6CC01B8E7418791A999919124
2968OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1640113.datimage
MD5:E4496E22A7064E0CD5E71D7EB2C2C52F
SHA256:22626B3C77AD0ED35D4D6B2E7909704ACC09C8204F37049DB5B2DEC481DE2EE5
2968OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3E1302DA.datimage
MD5:1E9375350C324091EBDD9C2CAAADE1DE
SHA256:4C72DD657422F14E8FB7BD202A1952F92BC72D2D6425A307E7BBC9EAC5ACCA53
2968OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\19FC20C6.datimage
MD5:BAD27B1192A7E595C150F0AC186C2565
SHA256:F96EDB7595DD8AC2F8883FD652CC67A265E97D0B4813A6B746987E1683F0BB68
3732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\webs365[1].htmhtml
MD5:A2AD6844FBBACF892AA14E7166567378
SHA256:0BDCA62E12598B18F44EC64B3AD5F8306A9D25D94137E36CE5A95D6A74766E4D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
60
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2968
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
3732
iexplore.exe
GET
302
52.72.252.15:80
http://email.veromailer.com/c/eJxdkEtPwzAQhH9NcqkU-ZVHDzmURhVcECeu0dbZtkZ2HNkmgX-PnQoISLa02hnNN7YEM4G6jln54FCqSeEY-sEaUHHVtfepkNbk8teJcal7_35-QxmS7RG1tvnQAm_IfuucwSkIyq5hRzsGZ3WuWkZoQ1m8TVlSUdCiPnLKu1MlDoLQjtFMkBldgmt0K_7WMlpXDakGyRu4CMJFxc97ZBJZLRgA33I33TLWvDicFS4Z2-_uTXV7C2HyGT9k7BTPsizFAAGsAwMgJXpfyEsS8Ox5VeaudR_GhbXYNbX6_yWTswnYj2AwUSNyjIF696p8fP7uaZRbe_icVtszLl5jCOj-qGgmDQF_0rbi99irIUkloYRXX6MElhk
US
html
283 b
whitelisted
3000
iexplore.exe
GET
200
13.107.21.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
3980
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2968
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
3000
iexplore.exe
13.107.21.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3732
iexplore.exe
64.137.233.115:443
www.dataoramaaccess.cf
2267921 ONTARIO LTD
CA
suspicious
3732
iexplore.exe
52.72.252.15:80
email.veromailer.com
Amazon.com, Inc.
US
unknown
3000
iexplore.exe
64.137.233.115:443
www.dataoramaaccess.cf
2267921 ONTARIO LTD
CA
suspicious
2160
iexplore.exe
23.66.21.99:443
aka.ms
Akamai Technologies, Inc.
NL
whitelisted
2160
iexplore.exe
23.43.119.238:443
products.office.com
Akamai International B.V.
NL
whitelisted
3980
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2160
iexplore.exe
2.21.37.228:443
query.prod.cms.rt.microsoft.com
GTT Communications Inc.
FR
unknown
2160
iexplore.exe
152.199.19.160:443
ajax.aspnetcdn.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
email.veromailer.com
  • 52.72.252.15
  • 34.228.211.143
whitelisted
www.dataoramaaccess.cf
  • 64.137.233.115
suspicious
www.bing.com
  • 13.107.21.200
  • 204.79.197.200
whitelisted
aka.ms
  • 23.66.21.99
whitelisted
products.office.com
  • 23.43.119.238
whitelisted
ajax.aspnetcdn.com
  • 152.199.19.160
whitelisted
statics-uhf-eus.akamaized.net
  • 2.16.186.33
  • 2.16.186.8
whitelisted
mem.gfx.ms
  • 23.8.8.86
whitelisted
query.prod.cms.rt.microsoft.com
  • 2.21.37.228
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .cf Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Notice of Resignation (27.2 KB).msg