analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Upskill with Robert Shultz and Jessica Butler.msg

Full analysis: https://app.any.run/tasks/79e716b0-365a-48f1-a12b-e7f550032591
Verdict: Malicious activity
Analysis date: May 29, 2020, 20:46:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

C512EA36596DFB996AD7B487CF9534B0

SHA1:

433B734F5FA147B4A16389481BFF326E771A6401

SHA256:

8BB11E4B2E70B956445C4E84FA686879DCE9B7CC79FF13D1089A6752B679860D

SSDEEP:

1536:rbu89tz4FTcKAuUClnRNKwpS2ZLndkk3N3v905HSp3c:rbu89t8BALCfYOZak3N3F4S

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 2792)

  • SUSPICIOUS

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 2792)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2792)

  • INFO

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 2792)
      • iexplore.exe (PID: 3840)
      • iexplore.exe (PID: 3180)
      • iexplore.exe (PID: 2464)
      • iexplore.exe (PID: 4008)
      • iexplore.exe (PID: 2160)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2792)

    • Changes internet zones settings

      • iexplore.exe (PID: 3180)

    • Application launched itself

      • iexplore.exe (PID: 3180)

    • Creates files in the user directory

      • iexplore.exe (PID: 3840)
      • iexplore.exe (PID: 2464)
      • iexplore.exe (PID: 4008)
      • iexplore.exe (PID: 3180)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3840)
      • iexplore.exe (PID: 2464)
      • iexplore.exe (PID: 2160)
      • iexplore.exe (PID: 4008)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3840)
      • iexplore.exe (PID: 4008)
      • iexplore.exe (PID: 3180)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3180)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3180)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
6
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2792"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Upskill with Robert Shultz and Jessica Butler.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
3180"C:\Program Files\Internet Explorer\iexplore.exe" https://info.highradius.com/e2t/tc/VVyVLD1kl89DW2tFH3C71KYlPW5yX2x949FBvXMfRfk35nxGrV3Zsc37CgJFFN731VSY3WmPXW17sW3j85vwhwW3KsfBz4d2rplW2LQDhT3Ff6kSW1DRJZF7FB4PGW2tKHW06YJHQRN5Js2KdblvMVW7nq5S75CwxCQW5rww_s2wgFNKW2fj9St8JY5k1W2n_F0Q6z2pfKW1P-klC86TkgpW2KnvfS33DzvSW4Hgq543rJZ12Mc1PWRgX0htVMtVhw2pWl8yW33j9kB8T27xBW6LNYMK2_TR9fW5LdtMR7KBfngW8LCrmL1YXJCWN1n98Kd17XlnW1X4Cql4pwPcCN9fPWcJXzLtCW1zf_Cl49VPDYW3qhk2x25tmRZW27QxPX65cH0DW96msM02zx1nTVSwhPv84dcpQW7QMjXs3F5lyvN3q_yFc4H11PMkZbqx39KtRW71SW5n84BnWgW7MNMq-73tX-wN3sNzVzTS2hs39Wl1C:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3840"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3180 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2464"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3180 CREDAT:3478817 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
4008"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3180 CREDAT:4134184 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2160"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3180 CREDAT:4003103 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Total events
9 903
Read events
2 312
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
78
Text files
732
Unknown types
79

Dropped files

PID
Process
Filename
Type
2792OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRCB3D.tmp.cvr —
MD5:—
SHA256:—
3840iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab2573.tmp —
MD5:—
SHA256:—
3840iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar2574.tmp —
MD5:—
SHA256:—
2792OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:D36726E569873144C04282FF76F4EC67
SHA256:E62ADBF22219DFF0B0752E4F0F375EAD59FC41DE9A9D5F6CEFCDD1ED2CE7F409
2792OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:84AD47F05A2C88B563947D61D7C9E5BA
SHA256:2620E696D2CA4F8FAE3E52487CF158D0754E3D72B56C53EEAC00B0850CF05DE0
3840iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_74167E25E5476CCA2A5946AAA61BF9E1binary
MD5:44D134DBA1778344ADA586076353576A
SHA256:99D6857EE416385F9D289D00D7D01E44F59C2FF4ACE2F916CC99030BFFFFA708
3840iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771binary
MD5:012DDA1275E89736793F29A0C3E815BD
SHA256:622B00D180BF7A2D90A693180D73487719FE9C64A7BE57A5345C7AE5589ACABD
3840iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\WI50579B.txttext
MD5:CAA568D53FEAAD67B6CF0FC330811AB5
SHA256:29B2BB29EF62825F8F4E2C3FFD33CFA600A3B898BF71FCC80CA8BBFB3772840A
3840iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2Dbinary
MD5:5EC398A6F9334E40BAB583EEE01602D6
SHA256:8167594517E8A96F4536D98E2364FEE107FECCD6B70957544DBA439A648E0D20
2792OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\StructuredQuery.logtext
MD5:224D0D4EAC767AFDE665613C51869415
SHA256:11F2B0909AC7F71C0431381F79F6DC33279A35FF428A8F310D524D4C70DF462A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
30
TCP/UDP connections
133
DNS requests
40
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2792
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
3840
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
3840
iexplore.exe
GET
200
172.217.16.195:80
http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCJIRnrbzaAWwIAAAAAZzJX
US
der
472 b
whitelisted
3840
iexplore.exe
GET
200
172.217.16.195:80
http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCJIRnrbzaAWwIAAAAAZzJX
US
der
472 b
whitelisted
3840
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
3840
iexplore.exe
GET
200
192.124.249.41:80
http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D
US
der
1.66 Kb
whitelisted
3840
iexplore.exe
GET
200
192.124.249.41:80
http://ocsp.godaddy.com//MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCDtn6lDKBECW
US
der
1.73 Kb
whitelisted
3840
iexplore.exe
GET
200
172.217.16.195:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
3840
iexplore.exe
GET
200
52.222.157.120:80
http://ocsp.sca1b.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEA2xYMO6MLM11YrMKZPP488%3D
US
der
471 b
whitelisted
3840
iexplore.exe
GET
200
192.124.249.41:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
US
der
1.69 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2792
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
3840
iexplore.exe
52.222.149.180:443
www.highako.com
Amazon.com, Inc.
US
whitelisted
3840
iexplore.exe
192.124.249.23:80
ocsp.godaddy.com
Sucuri
US
suspicious
3840
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3840
iexplore.exe
192.124.249.41:80
ocsp.godaddy.com
Sucuri
US
suspicious
3840
iexplore.exe
104.17.132.180:443
info.highradius.com
Cloudflare Inc
US
shared
3840
iexplore.exe
2.16.186.59:443
use.typekit.net
Akamai International B.V.
—
whitelisted
3840
iexplore.exe
52.222.149.238:443
player.dacast.com
Amazon.com, Inc.
US
whitelisted
3840
iexplore.exe
52.222.157.211:80
o.ss2.us
Amazon.com, Inc.
US
suspicious
3840
iexplore.exe
104.111.215.74:443
p.typekit.net
Akamai International B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
info.highradius.com
  • 104.17.132.180
  • 104.17.136.180
  • 104.17.135.180
  • 104.17.134.180
  • 104.17.133.180
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
www.highako.com
  • 52.222.149.180
  • 52.222.149.216
  • 52.222.149.209
  • 52.222.149.196
shared
ocsp.godaddy.com
  • 192.124.249.23
  • 192.124.249.24
  • 192.124.249.36
  • 192.124.249.22
  • 192.124.249.41
whitelisted
use.typekit.net
  • 2.16.186.59
  • 2.16.186.49
whitelisted
player.dacast.com
  • 52.222.149.238
  • 52.222.149.98
  • 52.222.149.99
  • 52.222.149.15
whitelisted
js.hsforms.net
  • 104.17.183.73
  • 104.17.182.73
  • 104.17.186.73
  • 104.17.185.73
  • 104.17.184.73
whitelisted
o.ss2.us
  • 52.222.157.211
  • 52.222.157.21
  • 52.222.157.33
  • 52.222.157.93
whitelisted
ocsp.rootg2.amazontrust.com
  • 52.222.157.6
  • 52.222.157.171
  • 52.222.157.198
  • 52.222.157.62
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Upskill with Robert Shultz and Jessica Butler.msg