File name: | Mark your Calendars for a Year of MAI Animal Health! 🎉 (46.1 KB).msg |
Full analysis: | https://app.any.run/tasks/0a323c58-1f1f-4989-978e-3f7377be6893 |
Verdict: | Malicious activity |
Analysis date: | January 14, 2022, 19:51:47 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
Indicators: | |
MIME: | application/vnd.ms-outlook |
File info: | CDFV2 Microsoft Outlook Message |
MD5: | 5D5BD439EFDA910674FD88F4C0CA9F3E |
SHA1: | 429841A4313B0CDC66E462274737A69E135849EF |
SHA256: | F0473553CED7DE4A72981C9BA7A5D0B4623F6274A033E1A341DB9623A0ED1153 |
SSDEEP: | 768:178BXaSh5BqcVwpGBEZgWLBYopbvx+dO8i0pc7i4IfJLtkDNhoAWjiih4qOgW4b:178Zjw6wAgvbW+iJL+KhxAq |
.msg | | | Outlook Message (58.9) |
---|---|---|
.oft | | | Outlook Form Template (34.4) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2560 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\Desktop\Mark your Calendars for a Year of MAI Animal Health! ?? (46.1 KB).msg" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Exit code: 0 Version: 14.0.4760.1000 Modules
| |||||||||||||||
2712 | C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} | C:\Windows\system32\DllHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1040 | "C:\Program Files\Internet Explorer\iexplore.exe" https://maianimalhealth.us8.list-manage.com/track/click?u=081d558ffe31dd41b722e783d&id=d88a612be8&e=fdf8863911 | C:\Program Files\Internet Explorer\iexplore.exe | OUTLOOK.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
988 | "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1040 CREDAT:267521 /prefetch:2 | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
1220 | "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1040 CREDAT:3806483 /prefetch:2 | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
(PID) Process: | (2560) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: Off | |||
(PID) Process: | (2560) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1041 |
Value: Off | |||
(PID) Process: | (2560) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1042 |
Value: Off | |||
(PID) Process: | (2560) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1046 |
Value: Off | |||
(PID) Process: | (2560) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1036 |
Value: Off | |||
(PID) Process: | (2560) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1031 |
Value: Off | |||
(PID) Process: | (2560) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1040 |
Value: Off | |||
(PID) Process: | (2560) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1049 |
Value: Off | |||
(PID) Process: | (2560) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 3082 |
Value: Off | |||
(PID) Process: | (2560) OUTLOOK.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1055 |
Value: Off |
PID | Process | Filename | Type | |
---|---|---|---|---|
2560 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR639C.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2560 | OUTLOOK.EXE | C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst | — | |
MD5:— | SHA256:— | |||
2712 | DllHost.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat | — | |
MD5:— | SHA256:— | |||
2560 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.log | text | |
MD5:E8AA066F630E64A8EA61D0AD548F1A6F | SHA256:4B82AA26A2E4797061F79D05DEB26D0BB913600F932D52569D9D7F23D2B9533A | |||
2712 | DllHost.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\WebCache\V01.log | binary | |
MD5:5E3C6B74D1FD73C5D74C3871945A55DB | SHA256:B6CB57DE1A5EBF078CFCD4EBC2630DB260D2F2A377D0AEA280B603DC0E8A8CF9 | |||
2712 | DllHost.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\WebCache\V01.chk | binary | |
MD5:3DA00FFBA5690F6AF13370F00CAE5A17 | SHA256:FD0449A09A4627216BFABE3DB5243B0DB1818F01ACD3E617AD075668D5D3D011 | |||
988 | IEXPLORE.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\1GO47TJS.txt | text | |
MD5:4924AE8F65ED73C173875CAC992FFA52 | SHA256:C9587CE1DB3F4FB35B7BFF0F5537086F76212B3DA46CB0C26278F3749E67A705 | |||
988 | IEXPLORE.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UJFUX3OG\cf.errors[1].css | text | |
MD5:B404C45EA3C3996B2EEADA6C5EA6B2C7 | SHA256:16FD28061D42CF29268600418D5AA26B585435027CA599A42141CBC820F2547C | |||
988 | IEXPLORE.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\P9J05Y8K.txt | text | |
MD5:4CE9EBDC89DEAC4BFD44E5914A042DFF | SHA256:4F3656D205244A9FEED72D45B05F5B0FAEE2FBA0AE373272C827F43AD5BDF124 | |||
2560 | OUTLOOK.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotm | pgc | |
MD5:2A8CB0892B394FD29B10CE1A8D764962 | SHA256:37CD4DB776137FA5112F86E5C9DABE5126D0934217F5F35CFC20443DD2CE8617 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2560 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
1220 | IEXPLORE.EXE | GET | 200 | 67.26.139.254:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?380299f05722a235 | US | compressed | 59.9 Kb | whitelisted |
1220 | IEXPLORE.EXE | GET | 200 | 67.26.137.254:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e2739048fe4ed2f5 | US | compressed | 59.9 Kb | whitelisted |
1220 | IEXPLORE.EXE | GET | 200 | 67.26.139.254:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?232eaff161f2dc96 | US | compressed | 59.9 Kb | whitelisted |
1220 | IEXPLORE.EXE | GET | 200 | 67.26.137.254:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?39f1c445f55f6003 | US | compressed | 59.9 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1040 | iexplore.exe | 13.107.21.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
2560 | OUTLOOK.EXE | 64.4.26.155:80 | config.messenger.msn.com | Microsoft Corporation | US | whitelisted |
988 | IEXPLORE.EXE | 104.26.2.147:443 | navc.com | Cloudflare Inc | US | unknown |
988 | IEXPLORE.EXE | 23.45.110.243:443 | maianimalhealth.us8.list-manage.com | Akamai International B.V. | NL | suspicious |
1220 | IEXPLORE.EXE | 23.45.110.243:443 | maianimalhealth.us8.list-manage.com | Akamai International B.V. | NL | suspicious |
988 | IEXPLORE.EXE | 104.16.169.131:443 | hcaptcha.com | Cloudflare Inc | US | unknown |
988 | IEXPLORE.EXE | 104.16.168.131:443 | hcaptcha.com | Cloudflare Inc | US | unknown |
1220 | IEXPLORE.EXE | 142.250.185.170:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
1220 | IEXPLORE.EXE | 142.250.185.99:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
1220 | IEXPLORE.EXE | 74.208.236.65:443 | www.laketahoeequineconference.com | 1&1 Internet SE | US | malicious |
Domain | IP | Reputation |
---|---|---|
config.messenger.msn.com |
| whitelisted |
maianimalhealth.us8.list-manage.com |
| suspicious |
navc.com |
| suspicious |
hcaptcha.com |
| whitelisted |
newassets.hcaptcha.com |
| whitelisted |
www.bing.com |
| whitelisted |
api.bing.com |
| whitelisted |
www.laketahoeequineconference.com |
| malicious |
fonts.googleapis.com |
| whitelisted |
www.statcounter.com |
| whitelisted |