analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Phish Alert FYI - PROJECT.msg

Full analysis: https://app.any.run/tasks/0c5c36ce-3cc2-4846-9c45-9aee98e3ee23
Verdict: Malicious activity
Analysis date: October 14, 2019, 14:04:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

9B196518DBDBA4CED222D239A043DC52

SHA1:

28D41070F491ED9847E58AEF5626BC58C15FD19E

SHA256:

DE05A94A72D2B5BA2D5BBF10A43899FACACC66D6E251AAC29DFA29C60D6456B1

SSDEEP:

3072:KyUKdWbvT1sH227IzUYecvGdqfnXGZZhep1ADep1AKT1sH227IzU3qfnXG0mxM8Q:VdWedLD+nj9wEdDxP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 1584)

  • SUSPICIOUS

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 1584)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 1584)

    • Starts itself from another location

      • OUTLOOK.EXE (PID: 1584)

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 1584)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 2884)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2700)

    • Application launched itself

      • iexplore.exe (PID: 2884)
      • chrome.exe (PID: 2588)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2916)
      • OUTLOOK.EXE (PID: 1584)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2700)
      • iexplore.exe (PID: 2884)

    • Creates files in the user directory

      • iexplore.exe (PID: 2700)

    • Manual execution by user

      • chrome.exe (PID: 2588)

    • Reads the hosts file

      • chrome.exe (PID: 2588)
      • chrome.exe (PID: 788)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (50.8)
.oft | Outlook Form Template (29.7)
.doc | Microsoft Word document (old ver.) (13.6)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
17
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe outlook.exe no specs iexplore.exe iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1584"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Phish Alert FYI - PROJECT.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
2916"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\MYI6SUKL\PROJECT.eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE—OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
2884"C:\Program Files\Internet Explorer\iexplore.exe" https://strategicleisure-my.sharepoint.com/:b:/g/personal/amandacsteele_strategicleisure_co_uk/EQEAS7TMi51PmRyDFWN64HcBBMPY7jHul736fHdJdobF9A?e=MxicawC:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2700"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2884 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2588"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
2264"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6fe1a9d0,0x6fe1a9e0,0x6fe1a9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3868"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=932 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3404"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1032,14002843400145535165,1921639629102073157,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=8676545409567391806 --mojo-platform-channel-handle=1044 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
788"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1032,14002843400145535165,1921639629102073157,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=4199519663876459961 --mojo-platform-channel-handle=1636 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3272"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,14002843400145535165,1921639629102073157,131072 --enable-features=PasswordImport --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=11006233967995462829 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2224 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
Total events
2 907
Read events
1 836
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
13
Text files
90
Unknown types
8

Dropped files

PID
Process
Filename
Type
1584OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRB07E.tmp.cvr —
MD5:—
SHA256:—
1584OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\MYI6SUKL\PROJECT (2).eml\:Zone.Identifier:$DATA —
MD5:—
SHA256:—
2916OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRDF2F.tmp.cvr —
MD5:—
SHA256:—
1584OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:A3C2E068E08DC2A8E9201CA5A2AF1DAB
SHA256:1CA2FFD409F9D7993A85C51F784E57567A697FD6E80B2F854867CB70EA82C7B3
1584OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:B19F38074B687CCAA71AE6B0B489FE15
SHA256:BC1FA8513825655ED7D06BA19BD728A89C05A808389996EED5575AEDD00B26B9
1584OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5B0F2D28.datimage
MD5:62BEB3ABD9176D8C22570FBEBC8B2D9C
SHA256:7142DE8D3AF8F9FE1B364465CBD5D09A8AADBCC6D7EFEF147523E9E6D591FADF
1584OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\44604C1C.datimage
MD5:2167106A080A924660D7FD506836EC97
SHA256:ED6A95C7E0E64146E3FF25CEDE67B40B0BA3764599BCDE8EEAB21188D4165382
1584OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\45F3056D.datimage
MD5:09D8B4A73134B1041880AEF61E68E166
SHA256:A439E0F0694092BB2CEBA91EEB1F405A974957C9B26F7188DDD183585779C03D
1584OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\MYI6SUKL\PROJECT.emlhtml
MD5:9AFB7F87FE94028058D84CA15772D42B
SHA256:C920F7D14FA56B8F910C326D95B34C0229318499827CEC729A81B4F6BB5C84DA
2884iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
37
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1584
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
2884
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1584
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
2884
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
—
—
104.96.95.205:443
static.sharepointonline.com
Akamai Technologies, Inc.
NL
unknown
2700
iexplore.exe
13.107.136.9:443
strategicleisure-my.sharepoint.com
Microsoft Corporation
US
whitelisted
—
—
13.107.136.9:443
strategicleisure-my.sharepoint.com
Microsoft Corporation
US
whitelisted
2700
iexplore.exe
104.96.95.205:443
static.sharepointonline.com
Akamai Technologies, Inc.
NL
unknown
788
chrome.exe
172.217.23.99:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2884
iexplore.exe
13.107.136.9:443
strategicleisure-my.sharepoint.com
Microsoft Corporation
US
whitelisted
788
chrome.exe
172.217.16.195:443
www.gstatic.com
Google Inc.
US
whitelisted
788
chrome.exe
216.58.207.77:443
accounts.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
strategicleisure-my.sharepoint.com
  • 13.107.136.9
suspicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
static.sharepointonline.com
  • 104.96.95.205
whitelisted
clientservices.googleapis.com
  • 172.217.23.99
whitelisted
accounts.google.com
  • 216.58.207.77
shared
www.google.com.ua
  • 172.217.16.131
whitelisted
fonts.googleapis.com
  • 172.217.22.10
whitelisted
www.gstatic.com
  • 172.217.16.195
whitelisted
www.google.com
  • 172.217.16.132
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Phish Alert FYI - PROJECT.msg