File name: | BEB6 et BMA6 Encours interne.msg |
Full analysis: | https://app.any.run/tasks/9c5f3ee1-97df-4920-b6f3-9df9155dcc57 |
Verdict: | Malicious activity |
Analysis date: | March 30, 2020, 15:39:45 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | 96BDC6B141EC2AF86EEC261BF6A56213 |
SHA1: | 6C861945BE1A32C8FFF90B1CD4B8165D67FD8CBB |
SHA256: | C4EB818E67B643369BB80C658516DF3D08695F4FB7C33802B465364B4FA3CD72 |
SSDEEP: | 3072:wT6rTz8Kr02hml0U6/bOyoTIy8kWw5RIs838F/a+H6NS1zpU:06bDLygyIvu/Fq |
.msg | | | Outlook Message (58.9) |
---|---|---|
.oft | | | Outlook Form Template (34.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3604 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\BEB6 et BMA6 Encours interne.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
1916 | "C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" -c IPM.Note /m "mailto:huelslak.buzz/ging/3___3___3___3___3___3___3/+_3@+_3@+_3@+_3@+_3@+_3@+_3@" | C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE | — | OUTLOOK.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Exit code: 0 Version: 14.0.6025.1000 | ||||
2988 | "C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" -c IPM.Note /m "mailto:huelslak.buzz/ging/3___3___3___3___3___3___3/+_3@+_3@+_3@+_3@+_3@+_3@+_3@" | C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE | — | OUTLOOK.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Exit code: 0 Version: 14.0.6025.1000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3604 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR770D.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1916 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR99D7.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2988 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR2202.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3604 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.log | text | |
MD5:469EE0B623E18FF32D1FCB7E184007AB | SHA256:C8CB9AF2C45234BEEA8CE69203F952DCCD96EEB3CD4C5166ECFC6C8DFA985F78 | |||
3604 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:065F21DE8D9160C89A340812E06BF6E0 | SHA256:2B90F8623FD84DA24C66267700FE906C2C3228CA27EF2A5C04DB6293619DC28B | |||
3604 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\61D2DEF1.dat | image | |
MD5:BC0C9B03A50EB447E69EE3B793B0522F | SHA256:AEF097C46A476CF2ED2B3F622C7ED9CEA642E203FFC2811A54DA9F05EBB1BCAA | |||
3604 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_BD1080993D40F24A8591783221258AB2.dat | xml | |
MD5:B21ED3BD946332FF6EBC41A87776C6BB | SHA256:B1AAC4E817CD10670B785EF8E5523C4A883F44138E50486987DC73054A46F6F4 | |||
3604 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{152C8AAC-203F-4553-9441-F0B1592C8B6D}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.png | image | |
MD5:4C61C12EDBC453D7AE184976E95258E1 | SHA256:296526F9A716C1AA91BA5D6F69F0EB92FDF79C2CB2CFCF0CEB22B7CCBC27035F | |||
3604 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_RssRule_2_265B62A2A2950B46B9E3A9B5644E64F6.dat | xml | |
MD5:D8B37ED0410FB241C283F72B76987F18 | SHA256:31E68049F6B7F21511E70CD7F2D95B9CF1354CF54603E8F47C1FC40F40B7A114 | |||
3604 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ConversationPrefs_2_C5481453767498489DC3CF7921D05556.dat | xml | |
MD5:57F30B1BCA811C2FCB81F4C13F6A927B | SHA256:612BAD93621991CB09C347FF01EC600B46617247D5C041311FF459E247D8C2D3 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3604 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |