File name: | SUSPECTED SPAM Edgar Mayorga shared IMFAB Inc with you..msg |
Full analysis: | https://app.any.run/tasks/7297e72c-0d3d-402b-ad5f-011f62672601 |
Verdict: | Malicious activity |
Analysis date: | December 05, 2022, 17:45:27 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | B14AF9942FFCE67E90FD0F8733D7C89A |
SHA1: | 67AF14FA135965FFED6A20512512D5F40FE84E08 |
SHA256: | B7FAFEF47A4BD7B7A4E9E157F4F5C37D539AB0999A121664A500B6F34CB79CF5 |
SSDEEP: | 3072:xavRfdyYJXZD+Hf1oHct+5UReYW9dVCapNj1fTNYn:xaTyYJpsf1oHct+JQa |
.msg | | | Outlook Message (58.9) |
---|---|---|
.oft | | | Outlook Form Template (34.4) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1756 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\SUSPECTED SPAM Edgar Mayorga shared IMFAB Inc with you..msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 Modules
| |||||||||||||||
3876 | "C:\Program Files\Internet Explorer\iexplore.exe" https://imfabinc-my.sharepoint.com/:o:/p/edward_mayorga/EpGQsWbEQlZEtTrUDHITkr0B-08iorj_Q7kBGSpVTju4SQ?e=5%3ajI33xn&at=9 | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
124 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3876 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
760 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3876 CREDAT:1185034 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
240 | "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\MicrosoftEdgeSetup.exe" | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\MicrosoftEdgeSetup.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Update Setup Version: 1.3.171.37 Modules
| |||||||||||||||
1968 | C:\Users\admin\AppData\Local\Temp\EUC5E1.tmp\MicrosoftEdgeUpdate.exe /installsource taggedmi /install "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&usagestats=0" | C:\Users\admin\AppData\Local\Temp\EUC5E1.tmp\MicrosoftEdgeUpdate.exe | — | MicrosoftEdgeSetup.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Update Version: 1.3.171.37 Modules
| |||||||||||||||
1400 | "C:\Users\admin\AppData\Local\Temp\EUC5E1.tmp\MicrosoftEdgeUpdateSetup.exe" /installsource taggedmi /install "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&usagestats=0" /installelevated /nomitag | C:\Users\admin\AppData\Local\Temp\EUC5E1.tmp\MicrosoftEdgeUpdateSetup.exe | MicrosoftEdgeUpdate.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Update Setup Version: 1.3.171.37 Modules
| |||||||||||||||
3496 | "C:\Program Files\Microsoft\Temp\EUC91D.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&usagestats=0" /installelevated | C:\Program Files\Microsoft\Temp\EUC91D.tmp\MicrosoftEdgeUpdate.exe | MicrosoftEdgeUpdateSetup.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Update Version: 1.3.171.37 Modules
| |||||||||||||||
3280 | "C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc | C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | — | MicrosoftEdgeUpdate.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Update Exit code: 0 Version: 1.3.171.37 Modules
| |||||||||||||||
4028 | "C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver | C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe | — | MicrosoftEdgeUpdate.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Update Exit code: 0 Version: 1.3.171.37 Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
1756 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVREA07.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1756 | OUTLOOK.EXE | C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst | — | |
MD5:— | SHA256:— | |||
1756 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.log | text | |
MD5:38882CBABF69D9891E500DC7A9AE8EA4 | SHA256:5D3D9D59477D17069F4390AABF335AC74B959DC9651D2471A14667E27903C239 | |||
124 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_1941775A515122A167E3FBACF08992E1 | der | |
MD5:273DD17BFAB10759B4DBAB3D7496CFC2 | SHA256:F9EA136CB708561E65050E12F78A3975DCE38E0A52D4313A8B036797750C4931 | |||
1756 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B98D1A7F.dat | image | |
MD5:39692F08FFFC3AC5E4B89E3C0F9B2071 | SHA256:6A96AFD9DEE60C7976743BA29609321017CA87DA156B7E89D688BF2E2442C09B | |||
1756 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\~DF1931CB3490AEC882.TMP | gmc | |
MD5:2D334915242E053E0426D1E6CCDB0296 | SHA256:E22126CCB2FB2ED4F9F6C6440649F9A477E6BFB5EDFCA0D93F425EE70208CFA8 | |||
1756 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:E5A63F997A6E29BE082A5D5D627DD1D2 | SHA256:1007F75560186916610A68736C44F0A470191A149B28EF4EE63ACFB736925DF6 | |||
1756 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{632BBEDC-8F61-4CA0-ADF9-6D5FA4DC5ECC}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.png | image | |
MD5:4C61C12EDBC453D7AE184976E95258E1 | SHA256:296526F9A716C1AA91BA5D6F69F0EB92FDF79C2CB2CFCF0CEB22B7CCBC27035F | |||
124 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\BrowserSupport[1].htm | html | |
MD5:1AFA5B3398CE958D5CEBF05C8A016E69 | SHA256:EC39D20EAB3998A09F05C2833456089C96B57CB7E72BA140016A64C89F35D507 | |||
1756 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_AvailabilityOptions_2_5CA75981F10A5B43A99F0A1F0EE0091E.dat | xml | |
MD5:EEAA832C12F20DE6AAAA9C7B77626E72 | SHA256:C4C9A90F2C961D9EE79CF08FBEE647ED7DE0202288E876C7BAAD00F4CA29CA16 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
760 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
1756 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
760 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D | US | der | 471 b | whitelisted |
760 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D | US | der | 471 b | whitelisted |
868 | svchost.exe | GET | — | 8.253.207.120:80 | http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8e10486f-658f-459b-a7a4-0833fa70774e?P1=1670867196&P2=404&P3=2&P4=PT%2bU%2bGjm3oNFzQu9iADNoIPhEckKz9xD3wfyc7uYXBs2%2bCerKc1KKFanlzKzeaJZOp9IZNiCxOHFscpErVp%2f5A%3d%3d | US | — | — | whitelisted |
124 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D | US | der | 1.47 Kb | whitelisted |
124 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEA8XGkjG8iOAkhjNLtbdwOg%3D | US | der | 471 b | whitelisted |
868 | svchost.exe | HEAD | 200 | 8.253.207.120:80 | http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8e10486f-658f-459b-a7a4-0833fa70774e?P1=1670867196&P2=404&P3=2&P4=PT%2bU%2bGjm3oNFzQu9iADNoIPhEckKz9xD3wfyc7uYXBs2%2bCerKc1KKFanlzKzeaJZOp9IZNiCxOHFscpErVp%2f5A%3d%3d | US | — | — | whitelisted |
3876 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D | US | der | 1.47 Kb | whitelisted |
124 | iexplore.exe | GET | 200 | 8.238.29.254:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?45c6e818adbacbc3 | US | compressed | 4.70 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1756 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
124 | iexplore.exe | 8.238.29.254:80 | ctldl.windowsupdate.com | LEVEL3 | US | suspicious |
3876 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | EDGECAST | GB | whitelisted |
3876 | iexplore.exe | 131.253.33.200:443 | www.bing.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
124 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | EDGECAST | GB | whitelisted |
124 | iexplore.exe | 13.107.138.8:443 | imfabinc-my.sharepoint.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | suspicious |
760 | iexplore.exe | 88.221.169.152:443 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
3876 | iexplore.exe | 13.107.138.8:443 | imfabinc-my.sharepoint.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | suspicious |
760 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | EDGECAST | GB | whitelisted |
760 | iexplore.exe | 152.199.19.160:443 | ajax.aspnetcdn.com | EDGECAST | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
imfabinc-my.sharepoint.com |
| suspicious |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
ajax.aspnetcdn.com |
| whitelisted |
js.monitor.azure.com |
| whitelisted |
edgefrecdn.azureedge.net |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
124 | iexplore.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
124 | iexplore.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
868 | svchost.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |