analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Document LCPAYOUT-633422216764.msg

Full analysis: https://app.any.run/tasks/34c15207-c6c7-44b6-928a-20a2a54c0443
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: January 24, 2022, 18:32:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
snakekeylogger
keylogger
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

322B223A197C71B62E3336F5C6EAA4AA

SHA1:

09A148713E3A014D2F84A42A4E3EDC04B8820669

SHA256:

F52A1128A4F8B7126C5FDC6D34244EC51B1BD7012FDDAE9D3F281DBA07B1A15F

SSDEEP:

1536:cjHmek+MW2W3fJ7B0Wj5RGgve1tv1Ndb9q0p5xiwLN8h5xDmTzo3fyHzPDzeYeBb:cjBdBH+gve1tvbdb9qwjiwLIT/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 7z2107-x64.exe (PID: 3568)
      • 7z2107-x64.exe (PID: 4068)
      • 7z2107.exe (PID: 2120)
      • 7z2107.exe (PID: 2176)
      • 7zG.exe (PID: 2060)
      • 633422216764.bat (PID: 2680)

    • Loads dropped or rewritten executable

      • svchost.exe (PID: 860)
      • Explorer.EXE (PID: 740)
      • 7zG.exe (PID: 2060)

    • Drops executable file immediately after starts

      • 7zG.exe (PID: 2060)

    • Changes the autorun value in the registry

      • 633422216764.bat (PID: 2680)

    • SNAKEKEYLOGGER was detected

      • MSBuild.exe (PID: 1572)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • Explorer.EXE (PID: 740)

    • Reads default file associations for system extensions

      • Explorer.EXE (PID: 740)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 2164)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2164)
      • chrome.exe (PID: 308)
      • 7z2107.exe (PID: 2120)
      • 7zG.exe (PID: 2060)
      • 633422216764.bat (PID: 2680)

    • Checks supported languages

      • 7z2107-x64.exe (PID: 4068)
      • 7z2107.exe (PID: 2120)
      • 7zG.exe (PID: 2060)
      • cmd.exe (PID: 2740)
      • 633422216764.bat (PID: 2680)
      • MSBuild.exe (PID: 1572)

    • Drops a file with a compile date too recent

      • chrome.exe (PID: 2164)
      • chrome.exe (PID: 308)
      • 7z2107.exe (PID: 2120)
      • 7zG.exe (PID: 2060)
      • 633422216764.bat (PID: 2680)

    • Creates a directory in Program Files

      • 7z2107.exe (PID: 2120)

    • Creates/Modifies COM task schedule object

      • 7z2107.exe (PID: 2120)

    • Reads the computer name

      • 7z2107.exe (PID: 2120)
      • 7zG.exe (PID: 2060)
      • 633422216764.bat (PID: 2680)
      • MSBuild.exe (PID: 1572)

    • Creates a software uninstall entry

      • 7z2107.exe (PID: 2120)

    • Creates files in the program directory

      • 7z2107.exe (PID: 2120)

    • Suspicious files were dropped or overwritten

      • 7zG.exe (PID: 2060)

    • Reads Environment values

      • 633422216764.bat (PID: 2680)
      • MSBuild.exe (PID: 1572)

    • Starts application with an unusual extension

      • Explorer.EXE (PID: 740)

    • Starts CMD.EXE for commands execution

      • 633422216764.bat (PID: 2680)

    • Creates files in the user directory

      • 633422216764.bat (PID: 2680)

    • Checks for external IP

      • MSBuild.exe (PID: 1572)

  • INFO

    • Checks supported languages

      • svchost.exe (PID: 860)
      • chrome.exe (PID: 388)
      • chrome.exe (PID: 3344)
      • chrome.exe (PID: 308)
      • OUTLOOK.EXE (PID: 1496)
      • chrome.exe (PID: 2164)
      • chrome.exe (PID: 1944)
      • chrome.exe (PID: 2816)
      • chrome.exe (PID: 1712)
      • chrome.exe (PID: 576)
      • chrome.exe (PID: 2600)
      • chrome.exe (PID: 116)
      • chrome.exe (PID: 1124)
      • chrome.exe (PID: 668)
      • chrome.exe (PID: 2528)
      • chrome.exe (PID: 304)
      • chrome.exe (PID: 2576)
      • chrome.exe (PID: 3948)
      • chrome.exe (PID: 3508)
      • chrome.exe (PID: 3948)
      • chrome.exe (PID: 3240)
      • chrome.exe (PID: 3308)
      • chrome.exe (PID: 2188)
      • chrome.exe (PID: 3476)
      • chrome.exe (PID: 2748)
      • chrome.exe (PID: 1840)
      • chrome.exe (PID: 576)
      • chrome.exe (PID: 2568)
      • chrome.exe (PID: 824)
      • chrome.exe (PID: 2420)
      • chrome.exe (PID: 1888)
      • chrome.exe (PID: 2264)
      • timeout.exe (PID: 1292)

    • Reads the computer name

      • chrome.exe (PID: 2164)
      • OUTLOOK.EXE (PID: 1496)
      • chrome.exe (PID: 1944)
      • chrome.exe (PID: 2816)
      • chrome.exe (PID: 308)
      • chrome.exe (PID: 3948)
      • chrome.exe (PID: 2188)
      • chrome.exe (PID: 3948)
      • chrome.exe (PID: 2420)
      • chrome.exe (PID: 2568)

    • Starts Microsoft Office Application

      • Explorer.EXE (PID: 740)

    • Reads the hosts file

      • chrome.exe (PID: 2164)
      • chrome.exe (PID: 308)

    • Searches for installed software

      • OUTLOOK.EXE (PID: 1496)

    • Manual execution by user

      • chrome.exe (PID: 2164)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 1496)

    • Application launched itself

      • chrome.exe (PID: 2164)

    • Reads settings of System Certificates

      • chrome.exe (PID: 308)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 1496)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
89
Monitored processes
42
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start outlook.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs 7z2107-x64.exe no specs 7z2107-x64.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs 7z2107.exe no specs 7z2107.exe chrome.exe no specs svchost.exe no specs explorer.exe no specs 7zg.exe 633422216764.bat cmd.exe no specs timeout.exe no specs #SNAKEKEYLOGGER msbuild.exe

Process information

PID
CMD
Path
Indicators
Parent process
1496"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\Document LCPAYOUT-633422216764.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
2164"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
Explorer.EXE
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
3221225547
Version:
86.0.4240.198
3344"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x678ed988,0x678ed998,0x678ed9a4C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
1944"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1072,3206682154273716263,8474552935370601859,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1060 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
308"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1072,3206682154273716263,8474552935370601859,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1336 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
388"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1072,3206682154273716263,8474552935370601859,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
1712"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1072,3206682154273716263,8474552935370601859,131072 --enable-features=PasswordImport --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1900 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
2576"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1072,3206682154273716263,8474552935370601859,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2268 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
304"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1072,3206682154273716263,8474552935370601859,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
2600"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1072,3206682154273716263,8474552935370601859,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Total events
24 856
Read events
23 951
Write events
0
Delete events
0

Modification events

No data
Executable files
18
Suspicious files
160
Text files
239
Unknown types
29

Dropped files

PID
Process
Filename
Type
1496OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR312F.tmp.cvr —
MD5:—
SHA256:—
1496OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst —
MD5:—
SHA256:—
2164chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61EEF0E7-874.pma —
MD5:—
SHA256:—
1496OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:EBE8B000F9865A9EB0847E6A299B810D
SHA256:20545C7CEB0DC33F8D1D220B042B9BCD86160971D036C6E2368A762209929507
1496OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:DE74F3AD23D1C162A45CCC64418468F4
SHA256:EA1632E9612E8130008D36DCAF69DDB849D1EF99195AF484451A0E3360134DBD
1496OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ConversationPrefs_2_6D0A8D68DE2D1647867CF3F28E635B3D.datxml
MD5:57F30B1BCA811C2FCB81F4C13F6A927B
SHA256:612BAD93621991CB09C347FF01EC600B46617247D5C041311FF459E247D8C2D3
2164chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datbinary
MD5:9C016064A1F864C8140915D77CF3389A
SHA256:0E7265D4A8C16223538EDD8CD620B8820611C74538E420A88E333BE7F62AC787
1496OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_WorkHours_1_A843DEE01A51AF489CFA18B4BC78DE3F.datxml
MD5:807EF0FC900FEB3DA82927990083D6E7
SHA256:4411E7DC978011222764943081500FFF0E43CBF7CCD44264BD1AB6306CA68913
2164chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:8FF312A95D60ED89857FEB720D80D4E1
SHA256:946A57FAFDD28C3164D5AB8AB4971B21BD5EC5BFFF7554DBF832CB58CC37700B
2164chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF1150ad.TMPtext
MD5:936EB7280DA791E6DD28EF3A9B46D39C
SHA256:CBAF2AFD831B32F6D1C12337EE5D2F090D6AE1F4DCB40B08BEF49BF52AD9721F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
42
DNS requests
24
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1572
MSBuild.exe
GET
—
158.101.44.242:80
http://checkip.dyndns.org/
US
—
—
shared
1572
MSBuild.exe
GET
200
158.101.44.242:80
http://checkip.dyndns.org/
US
html
107 b
shared
2680
633422216764.bat
GET
200
185.252.31.60:80
http://gbtak.ir/wp-content/Ygjklu.log
unknown
gmc
282 Kb
malicious
308
chrome.exe
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
crx
242 Kb
whitelisted
308
chrome.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?6218f49f95c943b0
US
compressed
59.9 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1496
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
Microsoft Corporation
US
whitelisted
308
chrome.exe
142.250.184.227:443
www.gstatic.com
Google Inc.
US
whitelisted
308
chrome.exe
172.217.16.142:443
apis.google.com
Google Inc.
US
whitelisted
308
chrome.exe
142.250.186.174:443
clients2.google.com
Google Inc.
US
whitelisted
308
chrome.exe
216.58.212.164:443
www.google.com
Google Inc.
US
whitelisted
308
chrome.exe
142.250.186.77:443
accounts.google.com
Google Inc.
US
suspicious
308
chrome.exe
142.250.185.195:443
update.googleapis.com
Google Inc.
US
whitelisted
308
chrome.exe
142.250.185.163:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
308
chrome.exe
142.250.186.35:443
ssl.gstatic.com
Google Inc.
US
whitelisted
308
chrome.exe
142.250.186.99:443
fonts.gstatic.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
clientservices.googleapis.com
  • 142.250.185.163
whitelisted
accounts.google.com
  • 142.250.186.77
shared
clients2.google.com
  • 142.250.186.174
whitelisted
www.google.com
  • 216.58.212.164
whitelisted
fonts.googleapis.com
  • 142.250.186.138
whitelisted
www.gstatic.com
  • 142.250.184.227
whitelisted
fonts.gstatic.com
  • 142.250.186.99
whitelisted
apis.google.com
  • 172.217.16.142
whitelisted
encrypted-tbn0.gstatic.com
  • 142.250.186.174
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.dyndns. Domain
—
—
Misc activity
AV INFO Query to checkip.dyndns. Domain
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.dyndns. Domain
—
—
Misc activity
AV INFO Query to checkip.dyndns. Domain
1572
MSBuild.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup - checkip.dyndns.org
1572
MSBuild.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup - checkip.dyndns.org
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Document LCPAYOUT-633422216764.msg