analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | Aaron Shaw.msg |
| Full analysis: | https://app.any.run/tasks/cc5f441b-bbe6-41aa-83bf-ac7816b345b6 |
| Verdict: | Malicious activity |
| Analysis date: | June 16, 2019, 08:05:09 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/vnd.ms-outlook |
| File info: | CDFV2 Microsoft Outlook Message |
| MD5: | A5CCA6D3ABEBF85C032D3FB5ED4D38A3 |
| SHA1: | 87C20F8C083BBA071C68424AADF577EC9998AFAD |
| SHA256: | B416616D1393CD269E0C99979AA2B3E727E22276EB78AB00A3E3A69361AD2997 |
| SSDEEP: | 768:Hi4eMw7uWhK6WsKGtWsKx5RRdaghzDNVqFtWsK5JWsKEWsKKWInxWBTwGfUDWBHD:KuWdW4WCtWTWsWUn8TzfUiH2ezxF |
MALICIOUS
Unusual execution from Microsoft Office
- OUTLOOK.EXE (PID: 2556)
SUSPICIOUS
Creates files in the user directory
- OUTLOOK.EXE (PID: 2556)
Starts Internet Explorer
- OUTLOOK.EXE (PID: 2556)
Reads Internet Cache Settings
- OUTLOOK.EXE (PID: 2556)
INFO
Changes internet zones settings
- iexplore.exe (PID: 588)
Creates files in the user directory
- iexplore.exe (PID: 1504)
Reads Microsoft Office registry keys
- OUTLOOK.EXE (PID: 2556)
Application launched itself
- iexplore.exe (PID: 588)
Reads Internet Cache Settings
- iexplore.exe (PID: 1504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .msg | | | Outlook Message (58.9) |
|---|---|---|
| .oft | | | Outlook Form Template (34.4) |
Total processes
35
Monitored processes
3
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2556 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Aaron Shaw.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
| 588 | "C:\Program Files\Internet Explorer\iexplore.exe" http://web01.messagemailuifg.host/electroencephalographically/southwesterly.asp?confederate=argentojarosite&23546587=74fb31ec-e119-4c98-b628-aca6ad8bff1a | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 1504 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:588 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
Total events
1 513
Read events
1 053
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
31
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2556 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR3F3F.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 588 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 588 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 2556 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:2BC9F36E96301B0183F5E702ED170098 | SHA256:24548CF4344CF36503FAEC212A29B7EE23E3B5F788E034F6B2DBF54C9602C3C5 | |||
| 1504 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:1953841FDF0A6C222FBDEC75F9C80564 | SHA256:B5113622B50DD89E25692733AEC4135566612FC7BCED1A0F344C5C5BBB71B572 | |||
| 2556 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_17D47A3E9DFABF4EB300138C6F6C3D4B.dat | xml | |
MD5:B21ED3BD946332FF6EBC41A87776C6BB | SHA256:B1AAC4E817CD10670B785EF8E5523C4A883F44138E50486987DC73054A46F6F4 | |||
| 2556 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inf | text | |
MD5:48DD6CAE43CE26B992C35799FCD76898 | SHA256:7BFE1F3691E2B4FB4D61FBF5E9F7782FBE49DA1342DBD32201C2CC8E540DBD1A | |||
| 2556 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ConversationPrefs_2_BD5CD41836A798499B1477E58921C77E.dat | xml | |
MD5:57F30B1BCA811C2FCB81F4C13F6A927B | SHA256:612BAD93621991CB09C347FF01EC600B46617247D5C041311FF459E247D8C2D3 | |||
| 1504 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\D9P4RAL0\desktop.ini | ini | |
MD5:4A3DEB274BB5F0212C2419D3D8D08612 | SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38 | |||
| 2556 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ContactPrefs_2_011F08F338F2C944B2B281B6EE56BAB2.dat | xml | |
MD5:BBCF400BD7AE536EB03054021D6A6398 | SHA256:383020065C1F31F4FB09F448599A6D5E532C390AF4E5B8AF0771FE17A23222AD | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
3
DNS requests
3
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2556 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
1504 | iexplore.exe | GET | — | 168.63.46.17:80 | http://web01.messagemailuifg.host/electroencephalographically/southwesterly.asp?confederate=argentojarosite&23546587=74fb31ec-e119-4c98-b628-aca6ad8bff1a | IE | — | — | unknown |
588 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2556 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
588 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
1504 | iexplore.exe | 168.63.46.17:80 | web01.messagemailuifg.host | Microsoft Corporation | IE | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
config.messenger.msn.com |
| whitelisted |
web01.messagemailuifg.host |
| unknown |
www.bing.com |
| whitelisted |