File name: | RV Actualiza tus detalles de pago ahora Cuenta suspendida.msg |
Full analysis: | https://app.any.run/tasks/e8b62544-16d2-4abc-9473-83537d10f175 |
Verdict: | Malicious activity |
Analysis date: | August 13, 2019, 19:40:57 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | 31B889D85C49BF4B8DF85713014C8B00 |
SHA1: | 8830F3752CED07543B56CDB2DD8ED8045301F737 |
SHA256: | D0A9A82291186BC23E53218CC624B93B51F3F83CE1F616C7B61C797C4C5E570B |
SSDEEP: | 1536:Zo1ZtZ+ZjaKNBcy/bWwrhgMcIrS10jkus+c+Za:Z1cyDWLIrSCK |
.msg | | | Outlook Message (58.9) |
---|---|---|
.oft | | | Outlook Form Template (34.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1700 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\Desktop\RV Actualiza tus detalles de pago ahora Cuenta suspendida.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
2852 | "C:\Program Files\Internet Explorer\iexplore.exe" https://www.netflix.com/simplemember/accountpayment?isPaymentAutoRetry=true&nftoken=BQAbAAEBEOgUQpYKpTuiakRtM4XFsdeAkLm9TwSGiCpdHfDLcysWIFdBZR4Mr1phs8%2B%2BXJZXUj7vg2boFj9s7Y1QM%2FOxkO71SG%2FwBBa3%2FtfuFT1xc%2BjsTw3pIlMjIu5Xj2%2FvZ5lMwPXJsbNoe65DpDlly4%2FHTTZBw5fvLKXkH%2BKlgC3F0E1QDR2VMWv46bag%2FzHJftNnfvpc%2B0muqokvHGZpnD5%2BxwoO5A%3D%3D&lnktrk=EMP&g=53D2EE439CE7FF278171C1AB37C8D11B6451ACA2&lkid=URL_RETRY_PAYMENT | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3060 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2852 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
1700 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVRE3E1.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2852 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
2852 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
3060 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@netflix[2].txt | — | |
MD5:— | SHA256:— | |||
1700 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:7D10F6CEB6FB827CCD8313479B682E8C | SHA256:F8EA3BA23C71A31DCC185C614FECE9EB78D06DAE75812A867E362B5F5C807A54 | |||
3060 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:0805913F00D4F5C6F71680DDFF6CADB2 | SHA256:DD7DB98179F76737D81DF9014F3C330806A182FED7BE4DC9CCAD36A43D7C3382 | |||
3060 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.dat | dat | |
MD5:AE9E4C45A767331B3233FF6E316CDCE5 | SHA256:78E2275C5B9838C697CBE28E7B8E1FB4D6A21531BDF4D7651D8B5F25021DD399 | |||
3060 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\230RYYJJ\youraccountpayment[1].txt | — | |
MD5:— | SHA256:— | |||
3060 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@netflix[1].txt | text | |
MD5:4A4C42271C2E2C15DAA91AEBB2EBC1DC | SHA256:425C908D3688272E82D0D05DE63CA097DED2DA7853228CECC235FE4E356B8844 | |||
1700 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{2F671A97-941F-4375-BC67-13D0AD06CE2E}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.png | image | |
MD5:7D80C0A7E3849818695EAF4989186A3C | SHA256:72DC527D78A8E99331409803811CC2D287E812C008A1C869A6AEA69D7A44B597 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1700 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
2852 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2852 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3060 | iexplore.exe | 52.208.15.72:443 | www.netflix.com | Amazon.com, Inc. | IE | unknown |
3060 | iexplore.exe | 54.77.199.154:443 | www.netflix.com | Amazon.com, Inc. | IE | unknown |
1700 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
3060 | iexplore.exe | 91.235.133.103:443 | secured.netflix.com | ThreatMetrix Inc. | NL | unknown |
3060 | iexplore.exe | 45.57.91.1:443 | codex.nflxext.com | Netflix Streaming Services Inc. | US | suspicious |
— | — | 45.57.91.1:443 | codex.nflxext.com | Netflix Streaming Services Inc. | US | suspicious |
3060 | iexplore.exe | 45.57.90.1:443 | codex.nflxext.com | Netflix Streaming Services Inc. | US | suspicious |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
www.netflix.com |
| whitelisted |
www.bing.com |
| whitelisted |
codex.nflxext.com |
| whitelisted |
assets.nflxext.com |
| whitelisted |
secured.netflix.com |
| whitelisted |