analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Win $100 Amazon Gift Card-Were Back Hybrid Identity Protection 2020.msg

Full analysis: https://app.any.run/tasks/f4573485-f661-4056-a718-8a00e71ea3dc
Verdict: Malicious activity
Analysis date: October 20, 2020, 00:21:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

CC578532D0B7C65FE840F38C065C2072

SHA1:

FBD2ED1FEFAEB1F3920F929ABBC2E272D52BE431

SHA256:

9D080575833A4468A2C1190BF7EC8F9597CB9177210AB685534918863F49DD91

SSDEEP:

3072:VF9XVu2Xf3xPDkJtxtLp+LyobpvdXsnYbJ1:VFe2Xf3xrkJf7iycpv9s

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 2064)

  • SUSPICIOUS

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 2064)

  • INFO

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2064)
      • iexplore.exe (PID: 4064)

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 2064)
      • iexplore.exe (PID: 2356)
      • iexplore.exe (PID: 4064)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2064)

    • Application launched itself

      • iexplore.exe (PID: 2356)
      • chrome.exe (PID: 4044)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 4064)
      • chrome.exe (PID: 3724)
      • iexplore.exe (PID: 2356)

    • Changes internet zones settings

      • iexplore.exe (PID: 2356)

    • Reads internet explorer settings

      • iexplore.exe (PID: 4064)

    • Manual execution by user

      • chrome.exe (PID: 4044)

    • Reads the hosts file

      • chrome.exe (PID: 3724)
      • chrome.exe (PID: 4044)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2356)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2356)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (45.3)
.oft | Outlook Form Template (26.5)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
19
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe iexplore.exe iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2064"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Win $100 Amazon Gift Card-Were Back Hybrid Identity Protection 2020.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
2356"C:\Program Files\Internet Explorer\iexplore.exe" https://cts.vresp.com/c/?VirtualIntelligenceB/22e9d6fe9b/1a9a9801be/95f2709f9f/utm_source=vibC:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
4064"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2356 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
4044"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3688"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6c84a9d0,0x6c84a9e0,0x6c84a9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
2704"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=1732 --on-initialized-event-handle=324 --parent-handle=328 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
4068"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1008,7546137116029934680,11513802558572645732,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=12005707452305134133 --mojo-platform-channel-handle=1028 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
3724"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1008,7546137116029934680,11513802558572645732,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=11482216804149416383 --mojo-platform-channel-handle=1640 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
4048"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,7546137116029934680,11513802558572645732,131072 --enable-features=PasswordImport --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=12966773845550804591 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2228 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
3240"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,7546137116029934680,11513802558572645732,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=9891632511989170640 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2496 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Total events
2 441
Read events
1 742
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
120
Text files
108
Unknown types
10

Dropped files

PID
Process
Filename
Type
2064OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR4134.tmp.cvr —
MD5:—
SHA256:—
2064OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\mso4636.tmp —
MD5:—
SHA256:—
4064iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab808F.tmp —
MD5:—
SHA256:—
4064iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar809F.tmp —
MD5:—
SHA256:—
2064OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:6173FDE3C203280319734DFD97C5F469
SHA256:B1F99C027A86922B1FB15837B358213901EA544464300DE8730C9C4BC2D494D4
2064OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:E2A8E53C5C8387B81AF9A93AECD279C4
SHA256:E26F9905A3CF904F14B52C1A1E0C7AA23F370F935E6C111EDB77E55CF3CDBFCF
4064iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4344B8AF97AF3A423D9EE52899963CDE_04BA5175756E3BA9FC5BDAE2E0F4AA53der
MD5:54FFD30D9B818B8860E8120BC2378A3C
SHA256:DD4754A871C5B556D6EA0C586004C1A5D3EED905E196865CE81CF5F15B1546D6
4064iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_9487BC0D4381A7CDEB9A8CC43F66D27Cder
MD5:F8BE6DC579360BF3007373D6277F59E1
SHA256:EC1BA6C123241A7C2AD472CDFBA611125255E8DA51D9840AADAA355517773005
4064iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_9487BC0D4381A7CDEB9A8CC43F66D27Cbinary
MD5:CAFC73DCDAC895AB46072ED8F7760349
SHA256:A983224039400A9356AB9C5D326B3186CD2C0A90B624F253D579D490C1316AF6
4064iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4344B8AF97AF3A423D9EE52899963CDE_04BA5175756E3BA9FC5BDAE2E0F4AA53binary
MD5:57FDB87124F434E158C8F1BC0979ECDD
SHA256:6B303B7D24F25EDC3D9BF97C13FE89F6A763F4360300C3F618E5C0F9A7C05C41
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
50
DNS requests
37
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2064
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
4064
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D
US
der
471 b
whitelisted
4064
iexplore.exe
GET
200
93.184.220.29:80
http://status.geotrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR3enuod9bxDxzpICGW%2B2sabjf17QQUkFj%2FsJx1qFFUd7Ht8qNDFjiebMUCEApYuMXoydkUzhHJOZjpTAY%3D
US
der
471 b
whitelisted
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
2356
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
—
—
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
4064
iexplore.exe
104.111.229.43:443
www.brighttalk.com
Akamai International B.V.
NL
unknown
2064
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
4064
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
4064
iexplore.exe
74.116.90.99:443
cts.vresp.com
VerticalResponse, Inc.
US
unknown
3724
chrome.exe
172.217.16.170:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3724
chrome.exe
172.217.23.163:443
www.gstatic.com
Google Inc.
US
whitelisted
3724
chrome.exe
172.217.18.173:443
accounts.google.com
Google Inc.
US
whitelisted
3724
chrome.exe
172.217.16.163:443
clientservices.googleapis.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
cts.vresp.com
  • 74.116.90.99
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
status.geotrust.com
  • 93.184.220.29
whitelisted
www.brighttalk.com
  • 104.111.229.43
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
clientservices.googleapis.com
  • 172.217.16.163
whitelisted
accounts.google.com
  • 172.217.18.173
shared
www.google.com
  • 172.217.22.68
whitelisted

Threats

PID
Process
Class
Message
4064
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
4064
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Win $100 Amazon Gift Card-Were Back Hybrid Identity Protection 2020.msg