analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

0aa4_12e4_241de41b_52ff_45bb_96d5_83c60ff98b85.eml (73.1 KB).msg

Full analysis: https://app.any.run/tasks/78baeea5-d735-479f-bc5d-6cce208d9de7
Verdict: Malicious activity
Analysis date: November 08, 2018, 08:03:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

F7E94BD7C8580D8EBD3F1009C11F4D02

SHA1:

7889B0922827E1528A2B74680684B3B1F147F288

SHA256:

E203A4D568036AFB2171A26C719A5B6827587FBF9359201B1D41E519AF08FD0B

SSDEEP:

1536:c97YBd0pwlTa9oDhD2wr9rkIepWgo28S5GxvSt3y83D2hjNxqb8Ni:c978nWDw5r8pWgKKt3R4jXS8N

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 3032)

  • SUSPICIOUS

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 3032)

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 3032)

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 3032)

  • INFO

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 3032)

    • Application launched itself

      • iexplore.exe (PID: 1904)

    • Creates files in the user directory

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 1672)
      • iexplore.exe (PID: 2072)
      • iexplore.exe (PID: 1904)
      • iexplore.exe (PID: 3496)
      • iexplore.exe (PID: 2296)

    • Changes internet zones settings

      • iexplore.exe (PID: 1904)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2072)
      • iexplore.exe (PID: 3496)
      • iexplore.exe (PID: 2296)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2072)
      • iexplore.exe (PID: 3496)
      • iexplore.exe (PID: 2296)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1904)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1904)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1904)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (38.9)
.oft | Outlook Form Template (22.7)
.doc | Microsoft Word document (17.5)
.xls | Microsoft Excel sheet (16.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
6
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3032"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\0aa4_12e4_241de41b_52ff_45bb_96d5_83c60ff98b85.eml (73.1 KB).msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
1904"C:\Program Files\Internet Explorer\iexplore.exe" https://u6863864.ct.sendgrid.net/wf/click?upn=T8mg5Wan3CfUv57dm94kasU0NHyu9-2F65mSNJ3Bg1B5lcrjxPfT1SLrZg5imBDn0w_Hdb4rnHInm3Ozuypdsu9QmVcGyEM9YG7TYxcaIfW7JqTfNcDRs7X1q3nujGj3h5Tc7uQ5ayYvgY2Zj9ZtcD1MKhsjoh2SniGEV4iGqjLmR94pd-2F4LchL8Rg2eqPF97nKQIQUKcjkmEACANILu261cvAp8Rv-2FkoX5t6SdY8LlDI6elN1xJ-2F5zBVBKWgeeu98CZWdjAYeRetkr6XduyQtWoWU1uTk0-2F-2Fhh9nqRBltvVqU-3DC:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2072"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1904 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
1672C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Version:
26,0,0,131
3496"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1904 CREDAT:6403C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2296"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1904 CREDAT:6406C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
2 253
Read events
1 670
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
7
Text files
186
Unknown types
23

Dropped files

PID
Process
Filename
Type
3032OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRA6CA.tmp.cvr —
MD5:—
SHA256:—
1904iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
1904iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2072iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\reader[1].txt —
MD5:—
SHA256:—
3032OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:FBAEDD44E105814E5A0F22A9422E5A69
SHA256:04CA457D53D66FDC93F14722E2F7B6DB05F1E1472D92D8B5326E76C99DF32F4A
3032OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{EC3157AE-2AC7-4633-AF53-AF61D6363E87}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.pngimage
MD5:7D80C0A7E3849818695EAF4989186A3C
SHA256:72DC527D78A8E99331409803811CC2D287E812C008A1C869A6AEA69D7A44B597
2072iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\ie_fix[1].csstext
MD5:334EDD445DF7098324EDA10B783ACC24
SHA256:A02F730CD1029218360800F62A930618E2A53F802B77D6D3C808EBBCB2DD39FB
2072iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\reader[1].htmhtml
MD5:A5CE611E4DE7B753D7A3EEF81095BA91
SHA256:459AD4FF5DFF569632D06A3CF56A26AAF59889FF7FDE185C6F308606EE058FBE
2072iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\jquery-ui[1].csstext
MD5:4C8BE965D3CCBAE0B90FE96BD4FD896A
SHA256:7CA849A75C4C802358BEA3D04E7CA9BCAB4ECF3EB1E64094A152291D127E2752
3032OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inftext
MD5:48DD6CAE43CE26B992C35799FCD76898
SHA256:7BFE1F3691E2B4FB4D61FBF5E9F7782FBE49DA1342DBD32201C2CC8E540DBD1A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
91
DNS requests
40
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2296
iexplore.exe
GET
304
23.0.35.131:80
http://cdn.ek.aero/qubit/opentag-93989-1321710.js
NL
—
—
whitelisted
3032
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
2072
iexplore.exe
GET
301
193.104.215.66:80
http://get.adobe.com/uk/reader/
unknown
html
244 b
whitelisted
3496
iexplore.exe
GET
200
23.0.35.131:80
http://cdn.ek.aero/qubit/opentag-93989-1321710.js
NL
text
36.3 Kb
whitelisted
2072
iexplore.exe
GET
200
205.185.216.10:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
54.4 Kb
whitelisted
3496
iexplore.exe
GET
200
52.222.161.196:80
http://cdn.appdynamics.com/adrum/adrum-4.5.0.773.js?r=cib-767a
US
text
23.3 Kb
whitelisted
2072
iexplore.exe
GET
200
52.222.163.162:80
http://x.ss2.us/x.cer
US
der
1.27 Kb
whitelisted
1904
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1904
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3032
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
2072
iexplore.exe
193.104.215.66:443
get.adobe.com
Level 3 Communications, Inc.
—
malicious
2072
iexplore.exe
167.89.115.54:443
u6863864.ct.sendgrid.net
SendGrid, Inc.
US
suspicious
2072
iexplore.exe
104.111.237.111:443
wwwimages2.adobe.com
Akamai International B.V.
NL
whitelisted
2072
iexplore.exe
193.104.215.66:80
get.adobe.com
Level 3 Communications, Inc.
—
malicious
2072
iexplore.exe
54.164.20.167:443
fonts.adobe.com
Amazon.com, Inc.
US
unknown
1904
iexplore.exe
193.104.215.66:443
get.adobe.com
Level 3 Communications, Inc.
—
malicious
2072
iexplore.exe
2.18.232.23:443
assets.adobedtm.com
Akamai International B.V.
—
whitelisted
2072
iexplore.exe
172.82.236.67:443
sstats.adobe.com
Adobe Systems Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
u6863864.ct.sendgrid.net
  • 167.89.115.54
  • 167.89.118.35
suspicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
get.adobe.com
  • 193.104.215.66
whitelisted
wwwimages2.adobe.com
  • 104.111.237.111
whitelisted
fonts.adobe.com
  • 54.164.20.167
  • 52.22.166.234
whitelisted
assets.adobedtm.com
  • 2.18.232.23
whitelisted
static-fonts.adobe.com
  • 172.227.13.196
whitelisted
dpm.demdex.net
  • 52.51.131.19
  • 52.212.113.202
  • 52.16.89.247
  • 34.249.86.253
  • 52.17.182.129
  • 34.251.231.74
  • 34.247.143.160
  • 54.246.133.167
whitelisted
p.typekit.net
  • 172.227.13.196
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
0aa4_12e4_241de41b_52ff_45bb_96d5_83c60ff98b85.eml (73.1 KB).msg