File name:

Spam.msg

Full analysis: https://app.any.run/tasks/7c09fe53-0843-4041-9d25-7871a3722910
Verdict: Malicious activity
Analysis date: August 13, 2019, 13:00:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

2E5AF5396CF3F8863A16143A879CC994

SHA1:

CDC1683BB180D2E63232E9ABFD51C879E0BBD4ED

SHA256:

C421F8FB55941A8DF225F3F96A4B9238AB250181F4114082809F6BD64ED68850

SSDEEP:

1536:/nqoWA9WTIWT/WYOkWxWTboq/5/aeVLlu0GWT9WuWQZnh69WTvOpnVqASWGWTslv:/nqbO4Ou1apVrm/TF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 2216)
  • SUSPICIOUS

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 2216)
    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 2216)
    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2216)
    • Executed via COM

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 4068)
  • INFO

    • Application launched itself

      • iexplore.exe (PID: 1680)
    • Changes internet zones settings

      • iexplore.exe (PID: 1680)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2096)
      • iexplore.exe (PID: 1680)
    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2216)
    • Reads internet explorer settings

      • iexplore.exe (PID: 2096)
    • Creates files in the user directory

      • iexplore.exe (PID: 2096)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 4068)
    • Reads settings of System Certificates

      • iexplore.exe (PID: 1680)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2216"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Spam.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
1680"C:\Program Files\Internet Explorer\iexplore.exe" https://gbr01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.avast.com%2Fantivirus&data=02%7C01%7Cchanel.townsend%40accaglobal.com%7C3e91db87fa354cd940e708d71fcb1872%7Cf2e7de2c59ba49fe8c684cd333f96b01%7C0%7C0%7C637012829449390946&sdata=3h1vKD62tldu3Jz%2FsskyJAIy2A%2B%2Fi4hUPZUPZUIjGOA%3D&reserved=0C:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2096"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1680 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
3221225547
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
4068C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exesvchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Exit code:
0
Version:
26,0,0,131
Total events
1 771
Read events
1 245
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
4
Text files
93
Unknown types
15

Dropped files

PID
Process
Filename
Type
2216OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRE671.tmp.cvr
MD5:
SHA256:
1680iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico
MD5:
SHA256:
1680iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
MD5:
SHA256:
2216OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:B5055A393788001E69EA0E2BC46D29A4
SHA256:39703256FA7B985D7ECE99ABC79D790BE6D260FF32DB0FBAD2C55E5840E86A65
2096iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\R3GQHTKS\index[1].txt
MD5:
SHA256:
2096iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.datdat
MD5:8AB68754954C3912ACABE946ED14508F
SHA256:8228F25E25C7033E1F9F330DED12705672B0457CEFE80ABE790B31320EFE1255
2216OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{E450FBE3-05EB-4DB6-BE0D-FF0F478E31E3}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.pngimage
MD5:7D80C0A7E3849818695EAF4989186A3C
SHA256:72DC527D78A8E99331409803811CC2D287E812C008A1C869A6AEA69D7A44B597
2096iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\R3GQHTKS\index[1].htmhtml
MD5:D2B05193A81C8076443D046EF6232113
SHA256:B2D463D4681222CFF9244D337FC03E38B1536C5649E3B7344DAF924C742736CB
2216OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_TCPrefs_2_174E103394869C458365B8106BDBB346.datxml
MD5:F194B1FA12F9B6F46A47391FAE8BEEC2
SHA256:FCD8D7E030BE6EA7588E5C6CB568E3F1BDFC263942074B693942A27DF9521A74
2216OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ConversationPrefs_2_9EBAC973D3C6C94CB96A8471A586CC92.datxml
MD5:57F30B1BCA811C2FCB81F4C13F6A927B
SHA256:612BAD93621991CB09C347FF01EC600B46617247D5C041311FF459E247D8C2D3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
32
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2216
OUTLOOK.EXE
GET
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
whitelisted
1680
iexplore.exe
GET
200
13.107.21.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1680
iexplore.exe
13.107.21.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2096
iexplore.exe
104.109.81.170:443
www.avast.com
Akamai International B.V.
NL
whitelisted
2096
iexplore.exe
23.210.250.131:443
static3.avast.com
Akamai International B.V.
NL
whitelisted
2216
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
2096
iexplore.exe
172.217.22.72:443
www.googletagmanager.com
Google Inc.
US
whitelisted
2096
iexplore.exe
104.47.21.28:443
gbr01.safelinks.protection.outlook.com
Microsoft Corporation
GB
unknown
2096
iexplore.exe
172.217.22.98:443
googleads.g.doubleclick.net
Google Inc.
US
whitelisted
2096
iexplore.exe
216.58.208.46:443
www.google-analytics.com
Google Inc.
US
whitelisted
2096
iexplore.exe
172.217.23.164:443
www.google.com
Google Inc.
US
whitelisted
2096
iexplore.exe
172.217.18.98:443
www.googleadservices.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared
gbr01.safelinks.protection.outlook.com
  • 104.47.21.28
  • 104.47.20.28
whitelisted
www.bing.com
  • 13.107.21.200
  • 204.79.197.200
whitelisted
www.avast.com
  • 104.109.81.170
whitelisted
static3.avast.com
  • 23.210.250.131
whitelisted
www.googletagmanager.com
  • 172.217.22.72
whitelisted
www.google-analytics.com
  • 216.58.208.46
whitelisted
www.googleadservices.com
  • 172.217.18.98
whitelisted
static.hotjar.com
  • 147.75.84.99
  • 147.75.32.75
  • 147.75.83.123
  • 147.75.83.163
  • 147.75.204.210
  • 147.75.102.227
  • 147.75.83.125
  • 147.75.204.222
whitelisted

Threats

No threats detected
No debug info