analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Administrator Notification_ Redirecting email with malware.msg

Full analysis: https://app.any.run/tasks/e93ee0df-caf2-48d5-a8ca-fdb7a466df4f
Verdict: Malicious activity
Analysis date: October 14, 2019, 12:43:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
phishing
phish-excel
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

B1F853232EB5912C5C79C1A47FB6E386

SHA1:

D18AFDF8C043F691B03DA5ADFC5E06F4938BAAA4

SHA256:

AEF1DA2D3F75C21809A09BB463B8DEB0D3127FE27B0268C5E2A625333C24CD30

SSDEEP:

768:qT4e9zFhOPWsKvWsKDBDNh/MRv4Zf7vsFbYnvf9Trz3teDNhG2ailBL9vwGb1WsV:MwWnWlNvsi1MLNwuWUWgcYn4K

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 1400)

  • SUSPICIOUS

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 1400)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 1400)

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 1400)

  • INFO

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 1400)

    • Reads internet explorer settings

      • iexplore.exe (PID: 4000)

    • Changes internet zones settings

      • iexplore.exe (PID: 2536)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 4000)
      • iexplore.exe (PID: 2536)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2536)

    • Application launched itself

      • iexplore.exe (PID: 2536)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2536)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2536)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1400"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Administrator Notification_ Redirecting email with malware.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
2536"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\Y3BTGP81\Invoice.htmlC:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
4000"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2536 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
2 293
Read events
1 648
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
42
Unknown types
8

Dropped files

PID
Process
Filename
Type
1400OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRA91B.tmp.cvr —
MD5:—
SHA256:—
1400OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\~DF712E1FBCA87270E1.TMP —
MD5:—
SHA256:—
1400OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\Y3BTGP81\Invoice (2).html\:Zone.Identifier:$DATA —
MD5:—
SHA256:—
1400OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:D90B766D3E9453218519BCC797521347
SHA256:30944972AFD37CF0E779F58A4E7992B84612151ABB737D279C272B1735EDBC93
1400OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:A32F76A50B69D9EE1A05A7A915C88B58
SHA256:B0CB37C2D1CC305FD855DCB00166E16161259AFD54301621AB126B8F1741969A
2536iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
1400OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\Y3BTGP81\Please Confirm Account Details.msgmsg
MD5:CF31A99522A5623C6F52BD5E53B8440C
SHA256:AB52986DBD9DAA03487C39C54186634128A4067DB514E939699080C0DCAB4800
4000iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:59AD11816947D31BEC3513F65C794224
SHA256:0C12707240A809BF9F8B72F52B84AADA66E7F5B03A5D41F56B861BE49749C8F9
2536iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
1400OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_WorkHours_1_FFE18E6B2B43CB4E88C022C5AA06761C.datxml
MD5:807EF0FC900FEB3DA82927990083D6E7
SHA256:4411E7DC978011222764943081500FFF0E43CBF7CCD44264BD1AB6306CA68913
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
15
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2536
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4000
iexplore.exe
172.217.22.106:443
fonts.googleapis.com
Google Inc.
US
whitelisted
4000
iexplore.exe
38.76.31.5:443
dubai.jdeed.info
Cogent Communications
US
suspicious
2536
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2536
iexplore.exe
38.76.31.5:443
dubai.jdeed.info
Cogent Communications
US
suspicious
1400
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
4000
iexplore.exe
172.217.22.35:443
fonts.gstatic.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
dubai.jdeed.info
  • 38.76.31.5
suspicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
fonts.googleapis.com
  • 172.217.22.106
whitelisted
fonts.gstatic.com
  • 172.217.22.35
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Administrator Notification_ Redirecting email with malware.msg