File name: | Administrator Notification_ Redirecting email with malware.msg |
Full analysis: | https://app.any.run/tasks/1f8a9c15-86c2-41fd-a108-0f36fbf8a795 |
Verdict: | Malicious activity |
Analysis date: | June 19, 2019, 15:34:34 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | 52956C66C71C8F79BFA9998D0A70E4AA |
SHA1: | EB23D6F5DFC4D5B8DFC7CF2549DA44547FEEC653 |
SHA256: | 8FEFD3A28BCCA58F0A579B7F65D6E99699F5B81F20F827336A792FBC568C6AB5 |
SSDEEP: | 1536:xsWTWJX0/b57mTbWxHKxGEVWWP8WcWa5H/TfQAEXRGfDomEkiFhLqyto4:xEX0/l7mTVGmPbRfH |
.msg | | | Outlook Message (58.9) |
---|---|---|
.oft | | | Outlook Form Template (34.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3376 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Administrator Notification_ Redirecting email with malware.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
1088 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\W6BUHODY\LIT Won Quotes Current Qtr Report.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | OUTLOOK.EXE |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
1240 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | WinRAR.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
3544 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /Embedding | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3376 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRED99.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3376 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\~DFE52A551A40E26175.TMP | — | |
MD5:— | SHA256:— | |||
3376 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\W6BUHODY\LIT Won Quotes Current Qtr Report (2).zip\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
1240 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR4B69.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1240 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\~DF0C60C432D175E9C4.TMP | — | |
MD5:— | SHA256:— | |||
1240 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\OICE_5ED56B17-FA3D-4C45-B954-A0C790AFBCC0.0\369D8A5C.xls\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
3376 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:CA25E629FD65C1CCAA231E2CA255393A | SHA256:AF142654EBEC72FE4D3D4FD5607DDFA2089A72AB5BC7D28820A4D8B9CB60149B | |||
3544 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\OICE_5ED56B17-FA3D-4C45-B954-A0C790AFBCC0.0\~DFE467780FF73D285E.TMP | — | |
MD5:— | SHA256:— | |||
3544 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\OICE_5ED56B17-FA3D-4C45-B954-A0C790AFBCC0.0\~DFAEAF96B70FD6E485.TMP | — | |
MD5:— | SHA256:— | |||
3376 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\W6BUHODY\CAUTION CONTAINS ZIP FILES LIT Quarterly Won Quotes.msg | msg | |
MD5:05A6D3F409D4210533606A56914E712B | SHA256:F9319CA59882D04E9116DA324277A82A114C98B968F9C2E63F865D21E2ABC200 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3376 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3376 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |