File name: | Carley participate in this survey for an Amazon Gift Card (27.1 KB).msg |
Full analysis: | https://app.any.run/tasks/613c6224-b8af-4000-86cc-73d142ae37c6 |
Verdict: | Malicious activity |
Analysis date: | August 12, 2022, 16:10:50 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | 8169ABE15AA862AFC3239333BBE5F650 |
SHA1: | 62944CB952BAF38FA102248ECBDCC70A40F9516B |
SHA256: | 9F7D81F496C24C3C8D3FE64527EF917B724928B0FC83E700CBCAEFDD369A3F79 |
SSDEEP: | 768:XLhzLX/IkSq44O1dGB/VAQtGSBjHDNhUUrfYkZIb+0D8g9Kqi:XLhwPq4ZGByQbBIGp0gc |
.msg | | | Outlook Message (58.9) |
---|---|---|
.oft | | | Outlook Form Template (34.4) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2756 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\Desktop\Carley participate in this survey for an Amazon Gift Card (27.1 KB).msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.4760.1000 Modules
| |||||||||||||||
2572 | C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} | C:\Windows\system32\DllHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2680 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | Explorer.EXE | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 67.0.4 Modules
| |||||||||||||||
2628 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2680.0.1014583780\1496954628" -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2680 "\\.\pipe\gecko-crash-server-pipe.2680" 1184 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 67.0.4 Modules
| |||||||||||||||
2104 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2680.3.126665511\1490144462" -childID 1 -isForBrowser -prefsHandle 1708 -prefMapHandle 808 -prefsLen 1 -prefMapSize 189239 -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2680 "\\.\pipe\gecko-crash-server-pipe.2680" 1808 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 67.0.4 Modules
| |||||||||||||||
2748 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2680.13.614574323\1301444034" -childID 2 -isForBrowser -prefsHandle 2808 -prefMapHandle 2884 -prefsLen 5823 -prefMapSize 189239 -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2680 "\\.\pipe\gecko-crash-server-pipe.2680" 2896 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 67.0.4 Modules
| |||||||||||||||
2136 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2680.20.1747809695\351606786" -childID 3 -isForBrowser -prefsHandle 3412 -prefMapHandle 3416 -prefsLen 6545 -prefMapSize 189239 -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2680 "\\.\pipe\gecko-crash-server-pipe.2680" 3428 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 67.0.4 Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
2756 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR9EFB.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2756 | OUTLOOK.EXE | C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst | — | |
MD5:— | SHA256:— | |||
2572 | DllHost.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat | — | |
MD5:— | SHA256:— | |||
2756 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\TarDEE4.tmp | cat | |
MD5:7EE994C83F2744D702CBA18693ED1758 | SHA256:5DB917AB6DC8A42A43617850DFBE2C7F26A7F810B229B349E9DD2A2D615671D2 | |||
2756 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:D1B0595592B84BF3989E8691D414C121 | SHA256:CB3FABF7A8EBA7F4F5546EB828C4BA49818AF91D214B8E068A86493CB6ADF599 | |||
2572 | DllHost.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\WebCache\V01.chk | binary | |
MD5:3DA00FFBA5690F6AF13370F00CAE5A17 | SHA256:FD0449A09A4627216BFABE3DB5243B0DB1818F01ACD3E617AD075668D5D3D011 | |||
2756 | OUTLOOK.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 | binary | |
MD5:7F3D85AEB46B6509D5D9E0EE5C0363EA | SHA256:2A8C3787BE784C19E9E922B75123FF4800D413942EBBF7F37D6F916476A8EFEE | |||
2680 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\nltxvmn2.default\startupCache\scriptCache-current.bin | — | |
MD5:— | SHA256:— | |||
2756 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CabDEF5.tmp | compressed | |
MD5:589C442FC7A0C70DCA927115A700D41E | SHA256:2E5CB72E9EB43BAAFB6C6BFCC573AAC92F49A8064C483F9D378A9E8E781A526A | |||
2572 | DllHost.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\WebCache\V01.log | binary | |
MD5:5E3C6B74D1FD73C5D74C3871945A55DB | SHA256:B6CB57DE1A5EBF078CFCD4EBC2630DB260D2F2A377D0AEA280B603DC0E8A8CF9 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2756 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
2756 | OUTLOOK.EXE | GET | 200 | 23.216.77.80:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?4ec7c69bad642d4c | US | compressed | 60.2 Kb | whitelisted |
2756 | OUTLOOK.EXE | GET | 200 | 23.216.77.80:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?906075323e502e93 | US | compressed | 60.2 Kb | whitelisted |
2680 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
2680 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
2680 | firefox.exe | POST | 200 | 184.24.77.79:80 | http://r3.o.lencr.org/ | US | der | 503 b | shared |
2680 | firefox.exe | POST | 200 | 184.24.77.79:80 | http://r3.o.lencr.org/ | US | der | 503 b | shared |
2680 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
2680 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
2680 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2756 | OUTLOOK.EXE | 23.216.77.80:80 | ctldl.windowsupdate.com | NTT DOCOMO, INC. | US | suspicious |
2756 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
2680 | firefox.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2680 | firefox.exe | 13.224.189.45:443 | snippets.cdn.mozilla.net | — | US | suspicious |
2680 | firefox.exe | 52.35.93.250:443 | search.services.mozilla.com | Amazon.com, Inc. | US | unknown |
2756 | OUTLOOK.EXE | 207.189.124.9:443 | info.zoomintel.com | ViaWest | US | suspicious |
2680 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | — | US | whitelisted |
2680 | firefox.exe | 44.240.237.74:443 | shavar.services.mozilla.com | University of California, San Diego | US | unknown |
2680 | firefox.exe | 34.210.132.84:443 | push.services.mozilla.com | Amazon.com, Inc. | US | unknown |
2680 | firefox.exe | 13.224.189.60:443 | normandy.cdn.mozilla.net | — | US | unknown |
Domain | IP | Reputation |
---|---|---|
teredo.ipv6.microsoft.com |
| whitelisted |
config.messenger.msn.com |
| whitelisted |
info.zoomintel.com |
| suspicious |
ctldl.windowsupdate.com |
| whitelisted |
detectportal.firefox.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
search.services.mozilla.com |
| whitelisted |
search.r53-2.services.mozilla.com |
| whitelisted |
push.services.mozilla.com |
| whitelisted |
autopush.prod.mozaws.net |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
2680 | firefox.exe | Potentially Bad Traffic | ET INFO Terse Request for .txt - Likely Hostile |
2680 | firefox.exe | Potentially Bad Traffic | ET INFO Terse Request for .txt - Likely Hostile |