File name: | Re_ Intento de fraude CARMEN NAVAS PEDRAZA CC 63481485.msg |
Full analysis: | https://app.any.run/tasks/12d4b8dd-a909-447d-a216-2343ec423936 |
Verdict: | Malicious activity |
Analysis date: | May 20, 2022, 18:18:20 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | 41990F6D5D3D3C8B1118E694675A50FE |
SHA1: | 5BEB79BC944F2420E38BD8E857DA2E245CFA1C3B |
SHA256: | D5FFCDF9F0554BBCA3674BD0B54C9DFE7D2EE1007FE08AB4174E0F406B4872A3 |
SSDEEP: | 6144:3V4kxLkxNPEebgSZFRv824LwY+iA7H8FUSregZ57c7mBaXW1ihk7fixyodVzQte4:scpSNXNYQcUSrFDcsZodo8Uc2B09Gd |
.msg | | | Outlook Message (58.9) |
---|---|---|
.oft | | | Outlook Form Template (34.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2088 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Re_ Intento de fraude CARMEN NAVAS PEDRAZA CC 63481485.msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | Explorer.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 | ||||
1248 | "C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" -c IPM.Note /m "mailto:[email protected]" | C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE | — | OUTLOOK.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Exit code: 0 Version: 14.0.6025.1000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2088 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR984F.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2088 | OUTLOOK.EXE | C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst | — | |
MD5:— | SHA256:— | |||
1248 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR736D.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2088 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:7FCF9B7954AC7E684A3FBC013DD9A727 | SHA256:21753C9C84A04961C187C1077013070F70858DE722F9DF4AD8B4BCB4611D32D5 | |||
2088 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\83D093EA.dat | image | |
MD5:E3EB63E73113D5FE306483942FB29D2B | SHA256:DC22F740CFD68E8C393C504E88788F9AEABB1CFB2322E106DC20C77949965C2C | |||
2088 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BC39EA4D.dat | image | |
MD5:0131F43D7C9B1FAA3762186E0509EE52 | SHA256:2B556D165766718E81F464B6FEEB8A5F34561ADEF2F8F3B9C5DD5BA0CC7B549F | |||
2088 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.log | text | |
MD5:9D305F804F62CBAF56C197663E4FFDA6 | SHA256:E0962BD97ACDFB68C453B87D52AF8F0505553319A8A1C20C6F3825EC660CB906 | |||
2088 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_TCPrefs_2_3C121BA2915AC844AC91E9990C43FF65.dat | xml | |
MD5:F194B1FA12F9B6F46A47391FAE8BEEC2 | SHA256:FCD8D7E030BE6EA7588E5C6CB568E3F1BDFC263942074B693942A27DF9521A74 | |||
2088 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_AvailabilityOptions_2_B469E53F24C84042AD1160231AD9AD7D.dat | xml | |
MD5:EEAA832C12F20DE6AAAA9C7B77626E72 | SHA256:C4C9A90F2C961D9EE79CF08FBEE647ED7DE0202288E876C7BAAD00F4CA29CA16 | |||
2088 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_RssRule_2_ECA18BB2CE63254CAA701D5F44BED998.dat | xml | |
MD5:D8B37ED0410FB241C283F72B76987F18 | SHA256:31E68049F6B7F21511E70CD7F2D95B9CF1354CF54603E8F47C1FC40F40B7A114 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2088 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
dns.msftncsi.com |
| shared |