URL:

https://HelpdeskSupport512274916.servicedesk.atera.com/GetAgent/Msi/?customerId=1&integratorLogin=hsinha%40fulcrumdigital.net&accountId=001Q3000001cyfLIAQ

Full analysis: https://app.any.run/tasks/e73c0a88-6158-4ca4-9dac-f9e630da654b
Verdict: Malicious activity
Analysis date: October 19, 2023, 16:24:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
SHA1:

CAE3FCACE32C69D4AF17E155C0008B89EEFF5E16

SHA256:

011734BC9144F861035D7BFE41C205C04E84AFFB5B01D56DD30841C92BF3446C

SSDEEP:

3:N8D46VVKmOXirAmJJUyG6lK1s9HACUl0RNp0GHM9e/a42VV3cD0n:2D3VgDij6yblKu9HALSH/HMA/QLn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 3568)
      • AteraAgent.exe (PID: 2812)
      • AgentPackageTicketing.exe (PID: 1620)

    • Loads dropped or rewritten executable

      • msiexec.exe (PID: 1764)
      • rundll32.exe (PID: 3076)
      • msiexec.exe (PID: 3084)
      • AteraAgent.exe (PID: 2812)
      • AteraAgent.exe (PID: 3672)
      • AgentPackageSTRemote.exe (PID: 3380)
      • AgentPackageADRemote.exe (PID: 3712)

    • Starts NET.EXE for service management

      • msiexec.exe (PID: 3084)
      • net.exe (PID: 3836)

    • Application was dropped or rewritten from another process

      • AteraAgent.exe (PID: 3672)
      • AteraAgent.exe (PID: 2812)
      • AgentPackageADRemote.exe (PID: 3712)
      • AgentPackageSTRemote.exe (PID: 3380)
      • AgentPackageTicketing.exe (PID: 1620)

    • Creates a writable file the system directory

      • AteraAgent.exe (PID: 3672)
      • AteraAgent.exe (PID: 2812)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 3276)
      • AteraAgent.exe (PID: 2812)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 3568)
      • AteraAgent.exe (PID: 3672)

    • Uses RUNDLL32.EXE to load library

      • msiexec.exe (PID: 1764)

    • Process drops legitimate windows executable

      • rundll32.exe (PID: 3076)
      • msiexec.exe (PID: 3568)
      • AteraAgent.exe (PID: 2812)

    • Uses TASKKILL.EXE to kill process

      • msiexec.exe (PID: 3084)

    • Starts SC.EXE for service management

      • AteraAgent.exe (PID: 2812)

    • The process creates files with name similar to system file names

      • AteraAgent.exe (PID: 2812)

    • Searches for installed software

      • AgentPackageAgentInformation.exe (PID: 3856)
      • AgentPackageProgramManagement.exe (PID: 856)

    • Starts CMD.EXE for commands execution

      • AgentPackageAgentInformation.exe (PID: 3856)

    • The process executes VB scripts

      • cmd.exe (PID: 2824)

  • INFO

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 3540)

    • Checks supported languages

      • msiexec.exe (PID: 3568)
      • msiexec.exe (PID: 1764)
      • msiexec.exe (PID: 3084)
      • AteraAgent.exe (PID: 3672)
      • AteraAgent.exe (PID: 2812)
      • AgentPackageSTRemote.exe (PID: 3380)
      • AgentPackageADRemote.exe (PID: 3712)
      • AgentPackageTicketing.exe (PID: 1620)
      • AgentPackageInternalPoller.exe (PID: 2604)
      • AgentPackageAgentInformation.exe (PID: 3856)
      • AgentPackageProgramManagement.exe (PID: 856)

    • Reads the computer name

      • msiexec.exe (PID: 3568)
      • msiexec.exe (PID: 1764)
      • AteraAgent.exe (PID: 3672)
      • AteraAgent.exe (PID: 2812)
      • msiexec.exe (PID: 3084)
      • AgentPackageADRemote.exe (PID: 3712)
      • AgentPackageSTRemote.exe (PID: 3380)
      • AgentPackageTicketing.exe (PID: 1620)
      • AgentPackageInternalPoller.exe (PID: 2604)
      • AgentPackageAgentInformation.exe (PID: 3856)
      • AgentPackageProgramManagement.exe (PID: 856)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 3568)
      • msiexec.exe (PID: 1764)
      • msiexec.exe (PID: 3084)
      • AteraAgent.exe (PID: 3672)
      • AteraAgent.exe (PID: 2812)
      • AgentPackageADRemote.exe (PID: 3712)
      • AgentPackageSTRemote.exe (PID: 3380)
      • AgentPackageTicketing.exe (PID: 1620)
      • AgentPackageInternalPoller.exe (PID: 2604)
      • AgentPackageAgentInformation.exe (PID: 3856)
      • AgentPackageProgramManagement.exe (PID: 856)

    • Application launched itself

      • iexplore.exe (PID: 556)
      • msiexec.exe (PID: 3568)

    • The process uses the downloaded file

      • iexplore.exe (PID: 556)

    • Drops the executable file immediately after the start

      • rundll32.exe (PID: 3076)

    • Create files in a temporary directory

      • rundll32.exe (PID: 3076)
      • msiexec.exe (PID: 3568)

    • Creates files in the program directory

      • AteraAgent.exe (PID: 3672)
      • AteraAgent.exe (PID: 2812)
      • AgentPackageInternalPoller.exe (PID: 2604)
      • AgentPackageTicketing.exe (PID: 1620)

    • Reads Environment values

      • AteraAgent.exe (PID: 3672)
      • AgentPackageADRemote.exe (PID: 3712)
      • AgentPackageSTRemote.exe (PID: 3380)
      • AteraAgent.exe (PID: 2812)
      • AgentPackageTicketing.exe (PID: 1620)
      • AgentPackageAgentInformation.exe (PID: 3856)
      • AgentPackageProgramManagement.exe (PID: 856)
      • AgentPackageInternalPoller.exe (PID: 2604)

    • Reads Microsoft Office registry keys

      • AgentPackageAgentInformation.exe (PID: 3856)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
73
Monitored processes
22
Malicious processes
10
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe msiexec.exe no specs msiexec.exe no specs vssvc.exe no specs msiexec.exe no specs rundll32.exe no specs msiexec.exe no specs net.exe no specs net1.exe no specs taskkill.exe no specs ateraagent.exe ateraagent.exe sc.exe no specs agentpackageadremote.exe agentpackagestremote.exe agentpackageticketing.exe agentpackageinternalpoller.exe agentpackageagentinformation.exe no specs cmd.exe no specs cscript.exe no specs agentpackageprogrammanagement.exe

Process information

PID
CMD
Path
Indicators
Parent process
556"C:\Program Files\Internet Explorer\iexplore.exe" "https://HelpdeskSupport512274916.servicedesk.atera.com/GetAgent/Msi/?customerId=1&integratorLogin=hsinha%40fulcrumdigital.net&accountId=001Q3000001cyfLIAQ"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
856"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 757ba443-b799-438e-b826-1c7f832ecf60 "a447cabf-29d5-471c-9e41-f9bb97d66d17" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
AteraAgent.exe
User:
SYSTEM
Company:
Atera Networks
Integrity Level:
SYSTEM
Description:
AgentPackageProgramManagement
Exit code:
0
Version:
22.0.0.0
1620"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 757ba443-b799-438e-b826-1c7f832ecf60 "b22bc30e-b206-419b-9a33-9ffb80ee00ba" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
AteraAgent.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
AgentPackageTicketing
Exit code:
0
Version:
24.10.0.0
Modules
Images
c:\program files\atera networks\ateraagent\packages\agentpackageticketing\agentpackageticketing.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
1764C:\Windows\system32\MsiExec.exe -Embedding 5E71815415E92E76030E5C747E4699B6C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
2604"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 757ba443-b799-438e-b826-1c7f832ecf60 "6e5c833c-862b-4fcb-b96b-00d705c06306" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll"C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
AteraAgent.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
AgentPackageInternalPoller
Exit code:
0
Version:
23.1.0.0
Modules
Images
c:\program files\atera networks\ateraagent\packages\agentpackageinternalpoller\agentpackageinternalpoller.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2812"C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
services.exe
User:
SYSTEM
Company:
ATERA Networks Ltd.
Integrity Level:
SYSTEM
Description:
AteraAgent
Exit code:
0
Version:
1.8.6.7
Modules
Images
c:\program files\atera networks\ateraagent\ateraagent.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
2824"C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office14\ospp.vbs" /dstatusC:\Windows\System32\cmd.exe—AgentPackageAgentInformation.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3076rundll32.exe "C:\Windows\Installer\MSI1268.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_2036468 1 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallationC:\Windows\System32\rundll32.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\user32.dll
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
3084C:\Windows\system32\MsiExec.exe -Embedding E186B28CD04D5771A396DE5164D7EB9F E Global\MSI0000C:\Windows\System32\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3124"TaskKill.exe" /f /im AteraAgent.exeC:\Windows\System32\taskkill.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\gdi32.dll
Total events
35 393
Read events
35 241
Write events
140
Delete events
12

Modification events

(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
160
Suspicious files
36
Text files
34
Unknown types
0

Dropped files

PID
Process
Filename
Type
3568msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3248iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\setup[1].msibinary
MD5:496667547D53B14E952D5E1CA26747A8
SHA256:225D6C87AE09FD96A92ABF2F1EB64E6340E1C0C4F84B05B90E80F362CB2F2332
3248iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419binary
MD5:E1272A240286D5A93E24C5B0BD13B13C
SHA256:FD228CFB37B6EFA28BB72BC7563533984298B0140EC26E57E2E58A1C7FFCB22D
556iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\setup.msi.wescq7z.partial:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
3248iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
3568msiexec.exeC:\Windows\Installer\1f0fe8.ipibinary
MD5:52E3148AE21C3D7395BF61F85587F428
SHA256:EE996423CE1BE71C299B2A0DB37F3281C0B2698270C97C6710E7D7BA32A0E511
3568msiexec.exeC:\Windows\Installer\MSI1268.tmpexecutable
MD5:672E03B9D7A2D50F3E935909A198928B
SHA256:C4772F8A8761F052BD0336923539699BA2F358AC203BEB197CDA576146E05A0D
3076rundll32.exeC:\Users\admin\AppData\Local\Temp\MSI1268.tmp-\Microsoft.Deployment.WindowsInstaller.dllexecutable
MD5:1A5CAEA6734FDD07CAA514C3F3FB75DA
SHA256:CF06D4ED4A8BAF88C82D6C9AE0EFC81C469DE6DA8788AB35F373B350A4B4CDCA
3076rundll32.exeC:\Users\admin\AppData\Local\Temp\MSI1268.tmp-\AlphaControlAgentInstallation.dllexecutable
MD5:4DB38E9E80632AF71E1842422D4B1873
SHA256:4924AAD650FA0F88C6FC6CA77068D73F70F0D0866A98212B615290FFB0B04EFA
3568msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF959F7D09EC6913D8.TMPbinary
MD5:D41BAE431B6DBCAB3ED591FB39F0474C
SHA256:DE216E27B716215EAE3CCDDC9D6D1D3E29DB5CF58F8327D78D7854A82D9FBDE9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
26
DNS requests
17
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3248
iexplore.exe
GET
200
67.27.235.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?060020e49c501eb3
unknown
compressed
4.66 Kb
unknown
3672
AteraAgent.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
binary
471 b
unknown
3248
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
binary
471 b
unknown
3248
iexplore.exe
GET
200
67.27.235.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b40315f06fd1d4d8
unknown
compressed
4.66 Kb
unknown
2812
AteraAgent.exe
GET
200
192.229.221.95:80
http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt
unknown
binary
1.68 Kb
unknown
556
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
3672
AteraAgent.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
binary
727 b
unknown
3672
AteraAgent.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAZ%2FYEeVZiSnFZlhdD2BlJM%3D
unknown
binary
727 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3248
iexplore.exe
20.101.44.219:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
3248
iexplore.exe
67.27.235.254:80
ctldl.windowsupdate.com
LEVEL3
US
unknown
3248
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3672
AteraAgent.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2812
AteraAgent.exe
40.119.152.241:443
agent-api.atera.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
2812
AteraAgent.exe
35.157.63.229:443
ps.pndsn.com
AMAZON-02
DE
unknown
556
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 67.27.235.254
  • 67.27.159.126
  • 8.241.123.254
  • 8.241.122.126
  • 8.241.121.254
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
agent-api.atera.com
  • 40.119.152.241
unknown
ps.pndsn.com
  • 35.157.63.229
  • 35.157.63.227
unknown
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ps.atera.com
  • 104.18.12.11
  • 104.18.13.11
unknown
cacerts.digicert.com
  • 192.229.221.95
whitelisted
api.nuget.org
  • 152.199.23.209
whitelisted

Threats

Found threats are available for the paid subscriptions
7 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://HelpdeskSupport512274916.servicedesk.atera.com/GetAgent/Msi/?customerId=1&integratorLogin=hsinha%40fulcrumdigital.net&accountId=001Q3000001cyfLIAQ