analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

SURS help for Moraine Valley Community College personnel.msg

Full analysis: https://app.any.run/tasks/5d86b9ed-bd05-4aa1-b397-3bd8e8e961b8
Verdict: Malicious activity
Analysis date: October 14, 2019, 13:55:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

3821F7720E24D71BFB0ECB751F65CF12

SHA1:

1A9907011D75BF856FD1ABC9EA5571011958E772

SHA256:

EE03C3897CC6A09D55CDAB6FE711BDE9002C7EB7426D1D4368B772144B40794E

SSDEEP:

384:NRKLi/6aqysKysK73oUxdGdT0ZMWqzvIesPRtY7Ou+MmBZV:WVaqysKysK73oIrZMWqjIeyu+MmN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • OUTLOOK.EXE (PID: 2420)

  • SUSPICIOUS

    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 2420)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 2420)

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 2420)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 1600)

    • Changes internet zones settings

      • iexplore.exe (PID: 1600)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3048)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3048)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 2420)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2420"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\SURS help for Moraine Valley Community College personnel.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
1600"C:\Program Files\Internet Explorer\iexplore.exe" http://app.publicemployeeretirementassistance.com/index.html#appointment/284ac2c9-31bf-4c5b-abf8-817f70f83413/unsubscribeC:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3048"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1600 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
1 879
Read events
1 253
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
83
Unknown types
10

Dropped files

PID
Process
Filename
Type
2420OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRA4C6.tmp.cvr —
MD5:—
SHA256:—
1600iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
1600iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2420OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:6EF521B6D15BB2276018E3CF83FA691C
SHA256:2466017849B8AA376CD61882B2143D2EBF2B7C90377DF77FADC6998C13640756
2420OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:7F2970A6CE0328F79C79E35CBAC18565
SHA256:46C88BF6F81690E6E8A6B3DDB1A48FD3BDBB647CD8B38F670EE9EBDF36F00708
3048iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:385E7D61F607D62BCAC12DA3C624FD0D
SHA256:8932AFEFA90794C124BCBBE8FFB080B4E3325CC8209E4ABA8D4804631DAA9D65
3048iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:BB862B1C182943E955B7E3A55C5452B7
SHA256:B69E4E2AB7F8FB605460282B33AA2529AD243F322C2F6DA493C7A700F5AC7A88
3048iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\8JZUG7K0\index[1].htmhtml
MD5:D94480BC874E0B386966ECCC6FF5ABC4
SHA256:FF6D629ACDEC1ED44FAF31A52B0EA0FB2EA434F3410398319959364CB3EBE1B3
2420OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inftext
MD5:48DD6CAE43CE26B992C35799FCD76898
SHA256:7BFE1F3691E2B4FB4D61FBF5E9F7782FBE49DA1342DBD32201C2CC8E540DBD1A
2420OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_762194A6ED28374583AE337D84C3A40D.datxml
MD5:B21ED3BD946332FF6EBC41A87776C6BB
SHA256:B1AAC4E817CD10670B785EF8E5523C4A883F44138E50486987DC73054A46F6F4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
58
TCP/UDP connections
12
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2420
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
3048
iexplore.exe
GET
200
68.168.96.100:80
http://app.publicemployeeretirementassistance.com/assets/stylesheets/pages.min.css
US
text
6.10 Kb
unknown
3048
iexplore.exe
GET
200
68.168.96.100:80
http://app.publicemployeeretirementassistance.com/lib/font-awesome/css/font-awesome.min.css
US
text
5.26 Kb
unknown
3048
iexplore.exe
GET
200
68.168.96.100:80
http://app.publicemployeeretirementassistance.com/assets/stylesheets/themes.min.css
US
text
24.2 Kb
unknown
3048
iexplore.exe
GET
200
68.168.96.100:80
http://app.publicemployeeretirementassistance.com/index.html
US
html
1.02 Kb
unknown
3048
iexplore.exe
GET
200
68.168.96.100:80
http://app.publicemployeeretirementassistance.com/assets/stylesheets/pixel-admin.min.css
US
text
41.7 Kb
unknown
3048
iexplore.exe
GET
200
68.168.96.100:80
http://app.publicemployeeretirementassistance.com/assets/stylesheets/splash.css
US
text
663 b
unknown
3048
iexplore.exe
GET
200
172.217.23.138:80
http://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,400,600,700,300&subset=latin
US
text
167 b
whitelisted
3048
iexplore.exe
GET
200
68.168.96.100:80
http://app.publicemployeeretirementassistance.com/lib/require/require.js
US
text
19.7 Kb
unknown
3048
iexplore.exe
GET
200
68.168.96.100:80
http://app.publicemployeeretirementassistance.com/assets/stylesheets/rtl.min.css
US
text
7.55 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2420
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
3048
iexplore.exe
172.217.23.163:80
fonts.gstatic.com
Google Inc.
US
whitelisted
1600
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3048
iexplore.exe
172.217.23.138:80
fonts.googleapis.com
Google Inc.
US
whitelisted
3048
iexplore.exe
68.168.96.100:80
app.publicemployeeretirementassistance.com
Codero
US
unknown
1600
iexplore.exe
68.168.96.100:80
app.publicemployeeretirementassistance.com
Codero
US
unknown

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
app.publicemployeeretirementassistance.com
  • 68.168.96.100
unknown
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
fonts.googleapis.com
  • 172.217.23.138
whitelisted
fonts.gstatic.com
  • 172.217.23.163
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SURS help for Moraine Valley Community College personnel.msg