File name: | Instrukcje.msg |
Full analysis: | https://app.any.run/tasks/d7a7e38b-9330-47a2-bdbd-02cab1d6136d |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | October 09, 2019, 17:51:16 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | 2768878FA24399C73287AB4D73BA93C9 |
SHA1: | 3378666CE989A86628465A78C2903FFDB54C392E |
SHA256: | C43B98495E9BA8F834703761D63CBBAFD924006353D7CF71A321A4173B951AB7 |
SSDEEP: | 6144:RVGP85XuWpTEW1kKMJQqKahTUPLkI47NSU4jJntATfD9W:RVGP85XuWpTEW1kKMJQqKah6X47NSU44 |
.msg | | | Outlook Message (41.3) |
---|---|---|
.oft | | | Outlook Form Template (24.1) |
.doc | | | Microsoft Word document (18.6) |
.doc | | | Microsoft Word document (old ver.) (11) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3036 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\Desktop\Instrukcje.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
2824 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Embedding | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | OUTLOOK.EXE |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Word Version: 14.0.6024.1000 | ||||
3800 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\4O3BY5NV\umowa 103916299 20 09 2019.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | OUTLOOK.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
908 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\4O3BY5NV\umowa 103916299 20 09 2019.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | OUTLOOK.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3036 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR4D04.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3036 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\~DFD2D7188C3E60CC63.TMP | — | |
MD5:— | SHA256:— | |||
3036 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\4O3BY5NV\umowa 103916299 20 09 2019 (2).doc\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
3036 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\~DFE2D85B1B9C35F53C.TMP | — | |
MD5:— | SHA256:— | |||
3036 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\~DFC447FB402FDC66A8.TMP | — | |
MD5:— | SHA256:— | |||
3036 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\OICE_74CD5203-088A-4A5B-86C0-751D7612082B.0\7703BBFB.doc\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
3036 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:89FB7B5114FD7850BDE3B4C12FAF1427 | SHA256:BAB0F1ED3EE43D800CCF12210E0627FB00977ED01E3355FBAD1EDD13FEA1548B | |||
2824 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\OICE_74CD5203-088A-4A5B-86C0-751D7612082B.0\E95DC16.wmf | wmf | |
MD5:6822F687B3A727C5BD97A3DE8B6BB3A1 | SHA256:7550E2F49E6BA0598A80C853D2C2A0C9B37E28BF5ED74BB72C4620FF0933DA95 | |||
2824 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\OICE_74CD5203-088A-4A5B-86C0-751D7612082B.0\3B69B785.wmf | wmf | |
MD5:33EC0E6D654E006541C1FA63A27F1D00 | SHA256:CBF36E498481F989EC4FA051AA18F973605E86CE5B18494266749B22B22F5144 | |||
3036 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_09F1395998E00449960B0DBE7402A0E6.dat | xml | |
MD5:B21ED3BD946332FF6EBC41A87776C6BB | SHA256:B1AAC4E817CD10670B785EF8E5523C4A883F44138E50486987DC73054A46F6F4 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3036 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3036 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
dns.msftncsi.com |
| shared |