File name: | Encontramos a proposta perfeita pra você.msg |
Full analysis: | https://app.any.run/tasks/5b38b8f2-b4d6-46e7-9ffb-da1fd510677c |
Verdict: | Malicious activity |
Analysis date: | January 24, 2022, 16:04:16 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | E1F8064BCA998D5277EE85F9AFAEB173 |
SHA1: | FB7F59834AAD31F7331B715BC1E5C763C2B88526 |
SHA256: | CFE9C24594A8A247D58092938118FA9B44FD6DAD9D8E57A3295F954745F51A7F |
SSDEEP: | 3072:OvenJv/t+Pq/ZW7wV5nkcTBDIgYLgJPVE1:OGnJv/t+Pq/ZW7wVlYg3 |
.msg | | | Outlook Message (58.9) |
---|---|---|
.oft | | | Outlook Form Template (34.4) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
4052 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Encontramos a proposta perfeita pra voc�.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 Modules
| |||||||||||||||
1748 | "C:\Program Files\Internet Explorer\iexplore.exe" https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flinks.comunicacao-blu365.com.br%2Fc%2Fc1p%2Fchm%2FEx3gVSrj2DGyV_o6jAFDfa%2FcM%2Fn-1f%2FF%2F54bb0217&data=04%7C01%7Cnatalia.posada%40epm.com.co%7Cc0f1284cb2904ce2d85808d9dda0d87a%7Cbf1ce8b55d394bc5ad6e07b3e4d7d67a%7C1%7C0%7C637784506058703953%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=TRPvkW2wNAiw8zZG%2BvPZLU8wpc5SrFxSA0rNwJwogQs%3D&reserved=0 | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
2816 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1748 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
4052 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR308C.tmp.cvr | — | |
MD5:— | SHA256:— | |||
4052 | OUTLOOK.EXE | C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst | — | |
MD5:— | SHA256:— | |||
4052 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.log | text | |
MD5:C6CDEE3472AFFA06041FABF53D65BBFB | SHA256:B2FC4B6919B796288FD118E34DEF30FFBDCBC4E73C392BC8D2827CFF5496122A | |||
4052 | OUTLOOK.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894 | binary | |
MD5:7F903BE9DD777640B0D8DE43F82B1C80 | SHA256:38EAEDF8D7A7C0E8EB2E81FB5D35C63E01C5ED88ACCAB0925570AAB00BA7BAC7 | |||
4052 | OUTLOOK.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:5287CC7900084020F048F694B7A7B72C | SHA256:0BF73D7788EBF4E7AEF8A45DB97CEC21F4BEC84463F3F99EDA4D2331F0362F6E | |||
4052 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:A1918EC3220ED0876F9C843D36E5FFA1 | SHA256:BF5442457C4A25D43559984614231AC5F56E0B33AA9E2FABCF6ABCF1C2E9A3F4 | |||
4052 | OUTLOOK.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F | binary | |
MD5:DA113F27C0795A69CA1AA969127D1ADB | SHA256:688003349882B4EB58A8E568B3F1C15EF4F0E62AA3C872FC7FDB0E883746D4C1 | |||
4052 | OUTLOOK.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62 | binary | |
MD5:F83EB882C77E14C9614509904238A3BD | SHA256:E90C8EA7F850A4F77636A379883249BC5D00D2B02E1D9B93C81132B394C8E8B2 | |||
4052 | OUTLOOK.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F | der | |
MD5:CC0C289EA7D427477ACE1B0A0DB02D54 | SHA256:A7A7E062E466C1F51B146C74B9C252AF0BCAC6D9DE256E85384A972BA13BE432 | |||
4052 | OUTLOOK.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FC5A820A001B41D68902E051F36A5282_4CCD6A9EEC71485F9A7F143C983227B8 | der | |
MD5:3DB94C449B14C32BA2667247DA2A6B03 | SHA256:91C766BCB6749FB2722E9E916D96467C206DF548FAAA1781D15C7A62C3EA8A64 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
4052 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
4052 | OUTLOOK.EXE | GET | 200 | 18.66.137.148:80 | http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D | US | der | 1.39 Kb | shared |
2816 | iexplore.exe | GET | 200 | 104.18.20.226:80 | http://ocsp2.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEHgDGCDPAjbzpoUYuu%2B39wE%3D | US | der | 1.40 Kb | whitelisted |
2816 | iexplore.exe | GET | 200 | 2.16.186.9:80 | http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgQbE31RuAA4lng53x%2BkMxHsyw%3D%3D | unknown | der | 503 b | shared |
2816 | iexplore.exe | GET | 200 | 142.250.186.67:80 | http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEEFKxQHtEPcBCgAAAAErfHU%3D | US | der | 471 b | whitelisted |
2816 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAGewca9P1l7sgwzOOVR2Hc%3D | US | der | 471 b | whitelisted |
4052 | OUTLOOK.EXE | GET | 200 | 2.16.186.9:80 | http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgQbE31RuAA4lng53x%2BkMxHsyw%3D%3D | unknown | der | 503 b | shared |
2816 | iexplore.exe | GET | 200 | 142.250.186.67:80 | http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCrvyQ4GllugQoAAAABK4Az | US | der | 472 b | whitelisted |
1748 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D | US | der | 1.47 Kb | whitelisted |
4052 | OUTLOOK.EXE | GET | 200 | 18.66.92.70:80 | http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D | US | der | 1.70 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4052 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
4052 | OUTLOOK.EXE | 46.248.181.125:443 | links.comunicacao-blu365.com.br | IQ PL Sp. z o.o. | PL | unknown |
4052 | OUTLOOK.EXE | 18.66.107.157:80 | ocsp.sca1b.amazontrust.com | Massachusetts Institute of Technology | US | whitelisted |
4052 | OUTLOOK.EXE | 23.32.238.201:80 | ctldl.windowsupdate.com | XO Communications | US | suspicious |
4052 | OUTLOOK.EXE | 18.66.137.97:80 | ocsp.rootg2.amazontrust.com | Massachusetts Institute of Technology | US | whitelisted |
2816 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
4052 | OUTLOOK.EXE | 18.66.137.148:80 | ocsp.rootg2.amazontrust.com | Massachusetts Institute of Technology | US | whitelisted |
4052 | OUTLOOK.EXE | 18.66.139.86:443 | assets.blu365.com.br | Massachusetts Institute of Technology | US | suspicious |
4052 | OUTLOOK.EXE | 18.66.92.70:80 | o.ss2.us | Massachusetts Institute of Technology | US | unknown |
2816 | iexplore.exe | 104.47.38.28:443 | nam02.safelinks.protection.outlook.com | Microsoft Corporation | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
assets.blu365.com.br |
| malicious |
links.comunicacao-blu365.com.br |
| unknown |
ctldl.windowsupdate.com |
| whitelisted |
o.ss2.us |
| whitelisted |
ocsp.rootg2.amazontrust.com |
| whitelisted |
ocsp.rootca1.amazontrust.com |
| shared |
ocsp.sca1b.amazontrust.com |
| whitelisted |
nam02.safelinks.protection.outlook.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |