analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Claro Chile Informa.msg

Full analysis: https://app.any.run/tasks/8ded2e69-fb11-420c-835c-a3e6a5583048
Verdict: Malicious activity
Analysis date: July 17, 2019, 21:18:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

A3935E93C946E9A9003C21AFE55AF9FD

SHA1:

A0D264E064F561FF81C87833F29327477489D75D

SHA256:

D589255CF335A23AEF08C536CE4B564D127BAC66F10281116CF44C8677BBA453

SSDEEP:

768:Bzkzr9VP45s60NLxgKSIknZ/0hWmT4K6Cef/zFC4JO9sKAsEOWRRg224zMAisKA1:VOAWhWTKHe5YYOWwpTYmOX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 3708)

  • SUSPICIOUS

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 3708)

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 3708)

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 3708)

    • Executed via COM

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3172)

    • Uses RUNDLL32.EXE to load library

      • OUTLOOK.EXE (PID: 3708)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 3464)
      • iexplore.exe (PID: 1316)

    • Creates files in the user directory

      • iexplore.exe (PID: 2592)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3172)
      • iexplore.exe (PID: 2084)
      • iexplore.exe (PID: 128)
      • iexplore.exe (PID: 3464)

    • Application launched itself

      • iexplore.exe (PID: 3464)
      • AcroRd32.exe (PID: 3216)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2592)
      • iexplore.exe (PID: 2084)
      • iexplore.exe (PID: 996)
      • iexplore.exe (PID: 128)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2592)
      • iexplore.exe (PID: 2084)
      • iexplore.exe (PID: 128)
      • iexplore.exe (PID: 996)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3464)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 3708)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
13
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs iexplore.exe rundll32.exe no specs acrord32.exe no specs acrord32.exe no specs rdrcef.exe no specs rdrcef.exe no specs iexplore.exe iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3708"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Claro Chile Informa.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
3464"C:\Program Files\Internet Explorer\iexplore.exe" https://urldefense.proofpoint.com/v2/url?u=http-3A__www.serbanc.cl&d=DwMFAw&c=1NM8PwXszG7AQ9HfdmWbEEMkVRRTYdMYEy55pO9feSo&r=94iIEJXDvHwuAiJ60lGeTTH577QkmKPRyVkAciLqzao&m=_rHDe3mGn6cFfk2vEoGMcV7JcqPAdK5cp8MPgjC8QtE&s=lAfr8evfw7YQ_bTFCAko7O294B8a3HH-MCsoE_m_2dk&e=C:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2592"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3464 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3172C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Exit code:
0
Version:
26,0,0,131
2084"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3464 CREDAT:6403C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3508"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL tel:%20+56227517777C:\Windows\system32\rundll32.exe—OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3216"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "tel:%20+56227517777"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—rundll32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
15.23.20070.215641
1548"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer tel:%20+56227517777C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
15.23.20070.215641
2044"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16448250C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe RdrCEF
Exit code:
3221225547
Version:
15.23.20053.211670
3404"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="2044.0.1293320633\405795612" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
0
Version:
15.23.20053.211670
Total events
3 122
Read events
2 319
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
16
Text files
144
Unknown types
25

Dropped files

PID
Process
Filename
Type
3708OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRCFE2.tmp.cvr —
MD5:—
SHA256:—
3464iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\favicon[1].ico —
MD5:—
SHA256:—
3464iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3708OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:DE520BD0B171189E34745F3F23784E2A
SHA256:45D04D9A40DB95BCADBBF29132BC4776CBD3B6724906D977D09444858A3BB42A
3708OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_RssRule_2_7537DA12CB804546961679D84D470670.datxml
MD5:D8B37ED0410FB241C283F72B76987F18
SHA256:31E68049F6B7F21511E70CD7F2D95B9CF1354CF54603E8F47C1FC40F40B7A114
3708OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_AvailabilityOptions_2_4294368B3FFB514EA9D770C01E851F0D.datxml
MD5:EEAA832C12F20DE6AAAA9C7B77626E72
SHA256:C4C9A90F2C961D9EE79CF08FBEE647ED7DE0202288E876C7BAAD00F4CA29CA16
2592iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:3AA8BDB6D434D135EDC1C234EB8C52CF
SHA256:E68D7AE0F82B0E1BEF3FC01AFB5779FDA9E5315F4CA5E5AD90503A8F452E1C6B
3708OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{497E6FD8-B0E4-46E4-91D4-7086D3A6153C}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.pngimage
MD5:7D80C0A7E3849818695EAF4989186A3C
SHA256:72DC527D78A8E99331409803811CC2D287E812C008A1C869A6AEA69D7A44B597
2592iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BMMJUTOA\serbanc_cl[1].txt —
MD5:—
SHA256:—
2592iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
35
TCP/UDP connections
63
DNS requests
24
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3708
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
2592
iexplore.exe
GET
404
200.119.246.196:80
http://www.serbanc.cl/wp-content/themes/serbanc/css/normalize.min.css
CL
html
245 b
unknown
2592
iexplore.exe
GET
404
200.119.246.196:80
http://www.serbanc.cl/wp-content/themes/serbanc/style.css?v=3
CL
html
233 b
unknown
2592
iexplore.exe
GET
404
200.119.246.196:80
http://www.serbanc.cl/wp-content/themes/serbanc/js/vendor/jquery-1.10.1.min.js
CL
html
254 b
unknown
2592
iexplore.exe
GET
404
200.119.246.196:80
http://www.serbanc.cl/wp-content/themes/serbanc/img/logo_linkedin.png
CL
html
245 b
unknown
2592
iexplore.exe
GET
404
200.119.246.196:80
http://www.serbanc.cl/wp-content/themes/serbanc/js/vendor/modernizr-2.6.2-respond-1.1.0.min.js
CL
html
270 b
unknown
2592
iexplore.exe
GET
200
200.119.246.196:80
http://www.serbanc.cl/
CL
html
20.1 Kb
unknown
2592
iexplore.exe
GET
404
200.119.246.196:80
http://www.serbanc.cl/wp-content/themes/serbanc/js/bootstrap.min.js
CL
html
243 b
unknown
2592
iexplore.exe
GET
404
200.119.246.196:80
http://www.serbanc.cl/wp-content/themes/serbanc/js/jquery.form.min.js
CL
html
245 b
unknown
2592
iexplore.exe
GET
404
200.119.246.196:80
http://www.serbanc.cl/wp-content/themes/serbanc/css/ie.css
CL
html
234 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3464
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2592
iexplore.exe
172.217.23.174:80
www.google-analytics.com
Google Inc.
US
whitelisted
2592
iexplore.exe
200.119.246.196:80
www.serbanc.cl
Gtd Internet S.A.
CL
unknown
3708
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
128
iexplore.exe
200.29.129.227:443
sucursalvirtual.clarochile.cl
Telmex Chile Internet S.A.
CL
unknown
2084
iexplore.exe
200.119.246.196:80
www.serbanc.cl
Gtd Internet S.A.
CL
unknown
2592
iexplore.exe
67.231.146.66:443
urldefense.proofpoint.com
Proofpoint, Inc.
US
suspicious
2084
iexplore.exe
67.231.146.66:443
urldefense.proofpoint.com
Proofpoint, Inc.
US
suspicious
128
iexplore.exe
67.231.146.66:443
urldefense.proofpoint.com
Proofpoint, Inc.
US
suspicious
2592
iexplore.exe
104.111.219.192:443
www.clarochile.cl
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
urldefense.proofpoint.com
  • 67.231.146.66
  • 67.231.154.66
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.serbanc.cl
  • 200.119.246.196
unknown
www.google-analytics.com
  • 172.217.23.174
whitelisted
sucursalvirtual.clarochile.cl
  • 200.29.129.227
unknown
ssl.google-analytics.com
  • 216.58.207.72
whitelisted
www.clarochile.cl
  • 104.111.219.192
unknown
www.googletagmanager.com
  • 172.217.16.136
whitelisted
static.hotjar.com
  • 147.75.83.125
  • 147.75.204.150
  • 147.75.204.174
  • 147.75.204.222
  • 147.75.83.163
  • 147.75.204.210
  • 147.75.102.227
  • 147.75.83.123
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Claro Chile Informa.msg