File name: | директору Леонову Олегу Владимировичу.msg |
Full analysis: | https://app.any.run/tasks/be4a608b-162c-406d-b941-95ab842276ac |
Verdict: | Malicious activity |
Analysis date: | June 27, 2022, 13:04:47 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | 5E7C7C791D1AF006A9073DB3F25FE694 |
SHA1: | B93F19534F1C4EF490B7AC019EBD872726B31181 |
SHA256: | 9CBA537651B4BEB78A1AF39A31B1558E477DBCC149814D295618CA0A995D0531 |
SSDEEP: | 98304:4wXKukQq/Lea9DmZMKYcIygt2Wj2RPj9OgFB:4GkjBYXYylRPjQgF |
.msg | | | Outlook Message (58.9) |
---|---|---|
.oft | | | Outlook Form Template (34.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2864 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\директору Леонову Олегу Владимировичу.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | Explorer.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
2640 | "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\VP24KRI5\POSTMATE3(SF4090s).wmv" | C:\Program Files\VideoLAN\VLC\vlc.exe | OUTLOOK.EXE | |
User: admin Company: VideoLAN Integrity Level: MEDIUM Description: VLC media player Exit code: 0 Version: 3.0.11 | ||||
1660 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\VP24KRI5\Жигулевская ГЭС.pdf" | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | — | OUTLOOK.EXE |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe Acrobat Reader DC Version: 20.13.20064.405839 | ||||
2288 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\VP24KRI5\Жигулевская ГЭС.pdf" | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | — | AcroRd32.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe Acrobat Reader DC Version: 20.13.20064.405839 | ||||
2916 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | — | AcroRd32.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe RdrCEF Version: 20.13.20064.405839 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2864 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR51DB.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2864 | OUTLOOK.EXE | C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst | — | |
MD5:— | SHA256:— | |||
2864 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\VP24KRI5\POSTMATE3(SF4090s).wmv | — | |
MD5:— | SHA256:— | |||
2864 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\VP24KRI5\POSTMATE3(SF4090s) (2).wmv | — | |
MD5:— | SHA256:— | |||
2864 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.log | text | |
MD5:8DDF598994E77A3935BF83ECF32DC5C9 | SHA256:CDAFF1989D77DD8E425A1E676733A15605FEA1A1EAEBCB55917BE382428B827C | |||
2640 | vlc.exe | C:\Users\admin\AppData\Roaming\vlc\vlc-qt-interface.ini.fn2640 | ini | |
MD5:3C11773836E1F72916A41F05602B39E6 | SHA256:36E6041DA391E85B53234088993B9A2C8BB587B956240891C12A7B104318E4E5 | |||
2640 | vlc.exe | C:\Users\admin\AppData\Roaming\vlc\vlc-qt-interface.ini | ini | |
MD5:444B9C524E60E0A6C08A252CF4310465 | SHA256:CDE189AD9AA1B527636CAFB73A850C12D21AFCCE736B6070249097C81BC55E68 | |||
2640 | vlc.exe | C:\Users\admin\AppData\Roaming\vlc\vlc-qt-interface.ini.gq2640 | ini | |
MD5:3C11773836E1F72916A41F05602B39E6 | SHA256:36E6041DA391E85B53234088993B9A2C8BB587B956240891C12A7B104318E4E5 | |||
2864 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:C4B9B3B073D4E221A03FD16C1138AB79 | SHA256:5D283DF15E9F87F4C6D99A4449CCCD3F60DC72AA6239CBFB9E538D52F0C7B9FD | |||
2640 | vlc.exe | C:\Users\admin\AppData\Roaming\vlc\vlc-qt-interface.ini.Hp2640 | ini | |
MD5:444B9C524E60E0A6C08A252CF4310465 | SHA256:CDE189AD9AA1B527636CAFB73A850C12D21AFCCE736B6070249097C81BC55E68 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2864 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2864 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
Process | Message |
---|---|
vlc.exe | main libvlc debug: VLC media player - 3.0.11 Vetinari
|
vlc.exe | main libvlc debug: Copyright © 1996-2020 the VideoLAN team
|
vlc.exe | main libvlc debug: revision 3.0.11-0-gdc0c5ced72
|
vlc.exe | main libvlc debug: configured with ../extras/package/win32/../../../configure '--enable-update-check' '--enable-lua' '--enable-faad' '--enable-flac' '--enable-theora' '--enable-avcodec' '--enable-merge-ffmpeg' '--enable-dca' '--enable-mpc' '--enable-libass' '--enable-schroedinger' '--enable-realrtsp' '--enable-live555' '--enable-dvdread' '--enable-shout' '--enable-goom' '--enable-caca' '--enable-qt' '--enable-skins2' '--enable-sse' '--enable-mmx' '--enable-libcddb' '--enable-zvbi' '--disable-telx' '--enable-nls' '--host=i686-w64-mingw32' '--with-breakpad=https://win.crashes.videolan.org' 'host_alias=i686-w64-mingw32' 'PKG_CONFIG_LIBDIR=/home/jenkins/workspace/vlc-release/windows/vlc-release-win32-x86/contrib/i686-w64-mingw32/lib/pkgconfig'
|
vlc.exe | main libvlc debug: using multimedia timers as clock source
|
vlc.exe | main libvlc debug: min period: 1 ms, max period: 1000000 ms
|
vlc.exe | main libvlc debug: searching plug-in modules
|
vlc.exe | main libvlc debug: loading plugins cache file C:\Program Files\VideoLAN\VLC\plugins\plugins.dat
|
vlc.exe | main libvlc debug: recursively browsing `C:\Program Files\VideoLAN\VLC\plugins'
|
vlc.exe | main libvlc error: stale plugins cache: modified C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll
|