URL: | https://urldefense.com/v3/__https://mandrillapp.com/track/click/30903943/www.loopandtie.com?p=eyJzIjoiQ3lMaHJwdDBmQ3dCRUUzbS05TVk1ZHJXbFBZIiwidiI6MSwicCI6IntcInVcIjozMDkwMzk0MyxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3d3dy5sb29wYW5kdGllLmNvbVxcXC91bnRpZVxcXC93THp4V0Z4Wl83UFBFREd5TWpORVwiLFwiaWRcIjpcImZmMzZmZDMyYWNlZDRlZTVhMjI2NjI0Njc3MWExYWY5XCIsXCJ1cmxfaWRzXCI6W1wiNDljMWJhZWViMGU4OTRlYWY4ZjIyMjk5NTI0NmEzOWFiZWM2MTY1MVwiXX0ifQ__;!!IfxEu6BwJhiJTV6w8aG_rQ!Y1uj6d09L9mlKH3UhRQW3xxmBlTFRrCz01-Oo2WVFfmSZRr6AopjJUisXXisud2-6NZTtE9Iq9CBjXc8XnZoQw$ |
Full analysis: | https://app.any.run/tasks/993900cd-4fcc-4457-8655-ee0873098920 |
Verdict: | Malicious activity |
Analysis date: | December 05, 2022, 16:55:17 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 26DDFF4A3E29A7E5375B7EF62DE4B1E7 |
SHA1: | 781C0E86594B5442AA18005C1DC5287D8D20BF24 |
SHA256: | 081F2FDF1E5585D5408011B6A93D5051EDEC990BBC5DC6AF1AB2B5A7CE07A7A2 |
SSDEEP: | 12:2U0nc3WKSAXfuYj1cM3HPbmxk9LEdHY63b/xEu4OBQJPH5FFwh:2hc3WK1cMXDyEEu0/xX48mRzQ |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2056 | "C:\Program Files\Internet Explorer\iexplore.exe" "https://urldefense.com/v3/__https://mandrillapp.com/track/click/30903943/www.loopandtie.com?p=eyJzIjoiQ3lMaHJwdDBmQ3dCRUUzbS05TVk1ZHJXbFBZIiwidiI6MSwicCI6IntcInVcIjozMDkwMzk0MyxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3d3dy5sb29wYW5kdGllLmNvbVxcXC91bnRpZVxcXC93THp4V0Z4Wl83UFBFREd5TWpORVwiLFwiaWRcIjpcImZmMzZmZDMyYWNlZDRlZTVhMjI2NjI0Njc3MWExYWY5XCIsXCJ1cmxfaWRzXCI6W1wiNDljMWJhZWViMGU4OTRlYWY4ZjIyMjk5NTI0NmEzOWFiZWM2MTY1MVwiXX0ifQ__;!!IfxEu6BwJhiJTV6w8aG_rQ!Y1uj6d09L9mlKH3UhRQW3xxmBlTFRrCz01-Oo2WVFfmSZRr6AopjJUisXXisud2-6NZTtE9Iq9CBjXc8XnZoQwf7f81a39-5f63-5b42-9efd-1f13b5431005quot; | C:\Program Files\Internet Explorer\iexplore.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
1960 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2056 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
2056 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F | binary | |
MD5:32881398456C66669A733EDAE31B1814 | SHA256:9F42C077CFBF8FBB62C7ACB8EDBB479A0C146DBAF3DDB13A6D771501E223395B | |||
2056 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F | der | |
MD5:406B3F4C3DCB12AC7EE515803CDBACCF | SHA256:824B08BB5371B3583F45B4C08037EDC08B30860079D8A6EA5DBEE813BC7625CA | |||
1960 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E | der | |
MD5:C51850A96D359A09A3A3A2249C52A92D | SHA256:D66175EC867BEE8F450F2F3AD05D9D161384241244E6D5CF791A608DD31EF175 | |||
1960 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_D93C575AD9E9AF9B95268A3CB953B5A1 | der | |
MD5:E8B87ADF7C1358AA15D80A49494D7DA5 | SHA256:CCC63E022E9D37FFBF3D4B71271BB7604CE6F62502A2C34F06BAEE03057B01CC | |||
1960 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B | der | |
MD5:98785C54BD472AD0ACD6C1F7029B877F | SHA256:D9ECC0CDED2A8B841F7FA7FF9FD8A3EC7B91E9C30F264F3E29DDB9459AE79C94 | |||
2056 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 | binary | |
MD5:C36CFB7A6999A409C2EB08C854C64AAE | SHA256:1A248C23B7C160AD562B736AE4D0188964E5030463C68739B9EA136E09848AA3 | |||
2056 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 | der | |
MD5:AC572CBBC82D6D652CDBE2596AEAC4EE | SHA256:50B6D8F62150A7BD25FB3E462130E8E054A0F1FB619487E8C426A4C8BF6BDCA8 | |||
1960 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEB3247079FFA7BF2B5622D101414A7E | binary | |
MD5:3CF4853AD4F8FA96246D496624AD623A | SHA256:0F7BEACE75F0074378D65241F7184C3E91B47CF4E86418B69F8E842E668AFD84 | |||
1960 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3538626A1FCCCA43C7E18F220BDD9B02 | der | |
MD5:7B8060B571D2A875D91B7D1CDA11BB30 | SHA256:21537AFE7D8FFCCA1788F5446A819DA45747EC5E0BC53C767EAE013DD67CC76A | |||
1960 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEB3247079FFA7BF2B5622D101414A7E | binary | |
MD5:26BD401718E38E5A72D3AF9261846229 | SHA256:21FB5C5809B90262E2C0AA1959C6419110E45C7DE7836172712E51CAE24CA455 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2056 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://crl3.digicert.com/Omniroot2025.crl | US | der | 7.78 Kb | whitelisted |
2056 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
1960 | iexplore.exe | GET | 200 | 104.18.32.68:80 | http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D | US | der | 1.42 Kb | whitelisted |
1960 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://status.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFvn094QJ%2BcWGTwWWEy%2BBXPZkW8AQUo8heZVTlMHjBBeoHCmpZzLn%2B3loCEAf2256eFSPwjx9v3bPqt%2BI%3D | US | der | 471 b | whitelisted |
1960 | iexplore.exe | GET | 200 | 104.18.32.68:80 | http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl | US | der | 978 b | whitelisted |
1960 | iexplore.exe | GET | 200 | 104.18.32.68:80 | http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEBN9U5yqfDGppDNwGWiEeo0%3D | US | der | 2.18 Kb | whitelisted |
1960 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJaiu8Zb34NbCEEshrmcCs%3D | US | der | 471 b | whitelisted |
1960 | iexplore.exe | GET | 200 | 172.64.155.188:80 | http://crl.sectigo.com/SectigoRSAOrganizationValidationSecureServerCA.crl | US | binary | 707 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2056 | iexplore.exe | 204.79.197.200:443 | www.bing.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
1960 | iexplore.exe | 52.71.28.102:443 | — | AMAZON-AES | US | suspicious |
2056 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | EDGECAST | GB | whitelisted |
1960 | iexplore.exe | 52.204.90.22:443 | — | AMAZON-AES | US | suspicious |
2056 | iexplore.exe | 93.184.221.240:80 | ctldl.windowsupdate.com | EDGECAST | GB | whitelisted |
1960 | iexplore.exe | 104.18.32.68:80 | ocsp.comodoca.com | CLOUDFLARENET | — | suspicious |
2056 | iexplore.exe | 13.107.21.200:443 | www.bing.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
1960 | iexplore.exe | 172.64.155.188:80 | ocsp.comodoca.com | CLOUDFLARENET | US | suspicious |
2056 | iexplore.exe | 152.199.19.161:443 | iecvlist.microsoft.com | EDGECAST | US | whitelisted |
1960 | iexplore.exe | 52.6.56.188:443 | — | AMAZON-AES | US | suspicious |
Domain | IP | Reputation |
---|---|---|
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
dns.msftncsi.com |
| shared |
ocsp.digicert.com |
| whitelisted |
iecvlist.microsoft.com |
| whitelisted |
r20swj13mr.microsoft.com |
| whitelisted |
crl3.digicert.com |
| whitelisted |
ocsp.comodoca.com |
| whitelisted |
ocsp.usertrust.com |
| whitelisted |