analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

FW FWpayment.msg

Full analysis: https://app.any.run/tasks/590688cd-1dd5-47f4-b708-f2c12ec197ec
Verdict: Malicious activity
Analysis date: September 30, 2020, 13:59:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

693714A5CA572426A5A333B64059B1DB

SHA1:

F00601F4BF8D106DC6885BCE78B29F13B363F898

SHA256:

A30A1C017A843B887A1605040BAE470513AEC15FE06F4873146EC12D1BFFF6D3

SSDEEP:

768:DV7hcDjObLAiyDi7eY6kIl5Nb4LMsKksK1sKiFyBPggeRtvIKTsK8sKUi7l3azjW:zcDjObLWxb4LMc967kFIzHi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 2572)

  • SUSPICIOUS

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 2572)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2572)

    • Executed via COM

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2384)

  • INFO

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 2572)
      • iexplore.exe (PID: 3960)
      • iexplore.exe (PID: 3616)

    • Application launched itself

      • iexplore.exe (PID: 3960)

    • Changes internet zones settings

      • iexplore.exe (PID: 3960)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2572)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3960)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3616)

    • Creates files in the user directory

      • iexplore.exe (PID: 3616)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2384)
      • iexplore.exe (PID: 3960)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3960)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3616)
      • iexplore.exe (PID: 3960)

    • Manual execution by user

      • explorer.exe (PID: 1652)
      • notepad++.exe (PID: 680)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
6
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs explorer.exe no specs notepad++.exe

Process information

PID
CMD
Path
Indicators
Parent process
2572"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\FW FWpayment.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
3960"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\VF532ONJ\beth straka@wecenergygroup com.hTMC:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3616"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3960 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2384C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Exit code:
0
Version:
26,0,0,131
1652"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
680"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Downloads\[email protected]"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO [email protected]
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Version:
7.51
Total events
3 135
Read events
2 324
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
78
Text files
103
Unknown types
58

Dropped files

PID
Process
Filename
Type
2572OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR77BB.tmp.cvr —
MD5:—
SHA256:—
2572OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\VF532ONJ\beth straka@wecenergygroup com (2).hTM\:Zone.Identifier:$DATA —
MD5:—
SHA256:—
3616iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabC02D.tmp —
MD5:—
SHA256:—
3616iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\TarC02E.tmp —
MD5:—
SHA256:—
2572OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:C0850615115917EA3CF19173419DC02B
SHA256:FA13FE5D87AD5732A5B750B66CA954B8C53C436E3D01337F6603C6DD73298B4B
2572OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:F6777B75D76EAC29DFD9AAA4ACFBA8F0
SHA256:4B780B5D39377A7ED830B40C469AFB7E485E0D601697141553EFE12C84CACF29
3616iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08binary
MD5:C3E54AE28091A71BBCD95AFECAD3C317
SHA256:E2FA795CD8F96FA94FF1262ADF17202AD765530BEC524DC53672645D0413F266
2572OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\VF532ONJ\beth straka@wecenergygroup com (2).hTMhtml
MD5:725259CB0415204E33056980C05E0904
SHA256:6BA0120A2884D87BD9F6F589CEF5A1BC5755D4A38FA1DEB52CCE26C546506ED9
2572OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\VF532ONJ\beth straka@wecenergygroup com.hTMhtml
MD5:725259CB0415204E33056980C05E0904
SHA256:6BA0120A2884D87BD9F6F589CEF5A1BC5755D4A38FA1DEB52CCE26C546506ED9
2572OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inftext
MD5:48DD6CAE43CE26B992C35799FCD76898
SHA256:7BFE1F3691E2B4FB4D61FBF5E9F7782FBE49DA1342DBD32201C2CC8E540DBD1A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
31
TCP/UDP connections
68
DNS requests
31
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2572
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
3616
iexplore.exe
GET
200
2.16.186.35:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
unknown
der
1.37 Kb
whitelisted
3616
iexplore.exe
GET
200
23.51.123.27:80
http://s.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEGMYDTj7gJd4qdA1oxYY%2BEA%3D
NL
der
1.71 Kb
shared
3616
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY
US
der
728 b
whitelisted
3616
iexplore.exe
GET
200
143.204.208.79:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
3960
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
3616
iexplore.exe
GET
200
23.51.123.27:80
http://s.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEGMYDTj7gJd4qdA1oxYY%2BEA%3D
NL
der
1.71 Kb
shared
3616
iexplore.exe
GET
200
143.204.208.108:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D
US
der
1.39 Kb
shared
3616
iexplore.exe
GET
200
143.204.208.79:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
3616
iexplore.exe
GET
200
143.204.208.23:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3960
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2572
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
3616
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3616
iexplore.exe
145.14.144.119:443
adob11.000webhostapp.com
Hostinger International Limited
US
shared
3616
iexplore.exe
151.139.128.14:80
ocsp.comodoca.com
Highwinds Network Group, Inc.
US
suspicious
3616
iexplore.exe
2.16.186.35:80
isrg.trustid.ocsp.identrust.com
Akamai International B.V.
—
whitelisted
3616
iexplore.exe
51.210.112.130:443
i.ibb.co
—
GB
unknown
3616
iexplore.exe
104.238.92.18:443
humaneabortion.com
GoDaddy.com, LLC
US
unknown
3616
iexplore.exe
3.220.170.82:443
jumpshare.com
—
US
unknown
3616
iexplore.exe
143.204.208.150:80
ocsp.sca1b.amazontrust.com
—
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
i.ibb.co
  • 51.210.112.130
  • 51.210.112.129
shared
adob11.000webhostapp.com
  • 145.14.144.119
shared
isrg.trustid.ocsp.identrust.com
  • 2.16.186.35
  • 2.16.186.11
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
api.bing.com
  • 13.107.13.80
whitelisted
humaneabortion.com
  • 104.238.92.18
unknown
ocsp.comodoca.com
  • 151.139.128.14
whitelisted
jumpshare.com
  • 3.220.170.82
  • 52.44.194.50
  • 52.3.24.116
  • 52.202.56.11
whitelisted

Threats

PID
Process
Class
Message
1052
svchost.exe
Not Suspicious Traffic
ET INFO Observed Free Hosting Domain (*.000webhostapp .com in DNS Lookup)
3616
iexplore.exe
Not Suspicious Traffic
ET INFO Observed SSL Cert for Free Hosting Domain (*.000webhostapp .com)
3616
iexplore.exe
Not Suspicious Traffic
ET INFO Observed SSL Cert for Free Hosting Domain (*.000webhostapp .com)
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
FW FWpayment.msg