File name: | Capture.PNG |
Full analysis: | https://app.any.run/tasks/61877b59-e315-4637-abe7-143e8f229790 |
Verdict: | Malicious activity |
Analysis date: | January 10, 2025, 20:34:48 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Tags: | |
MIME: | image/png |
File info: | PNG image data, 948 x 479, 8-bit/color RGBA, non-interlaced |
MD5: | 94047FBBC1FA5AB15837FBA585B64812 |
SHA1: | FD607E827B9FAF22421E3B0C168CC72A16E9CF25 |
SHA256: | 0C107102E33E1E55874B34A3B19DEFCFF14AA4CDBA92E599DFFA7A367F067DC2 |
SSDEEP: | 3072:ug4+6L0GI4TLUVQ2LSiaEvaWx3FwEbJcbLEiMJr2RwvEk+k:ug4tCKoVVLS0vtx3FwgJcbLOJSR4N |
.png | | | Portable Network Graphics (100) |
---|
Megapixels: | 0.454 |
---|---|
ImageSize: | 948x479 |
PixelUnits: | meters |
---|---|
PixelsPerUnitY: | 3779 |
PixelsPerUnitX: | 3779 |
Gamma: | 2.2 |
SRGBRendering: | Perceptual |
Interlace: | Noninterlaced |
Filter: | Adaptive |
Compression: | Deflate/Inflate |
ColorType: | RGB with Alpha |
BitDepth: | 8 |
ImageHeight: | 479 |
ImageWidth: | 948 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
6148 | "C:\Windows\explorer.exe" "https://htbilisim.com/m/?c3Y9bzM2NV8xX3NwJnJhbmQ9V2tVNWFuWT0mdWlkPVVTRVIwNjAxMjAyNVUwMzAxMDYzOQ==N0123N#[email protected]" | C:\Windows\explorer.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 10.0.19041.3758 (WinBuild.160101.0800) Modules
| |||||||||||||||
6344 | C:\WINDOWS\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding | C:\Windows\explorer.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 10.0.19041.3758 (WinBuild.160101.0800) | |||||||||||||||
6632 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2584 --field-trial-handle=2432,i,5294958257231485215,1453246571413011409,262144 --variations-seed-version /prefetch:3 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | msedge.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 122.0.2365.59 |
PID | Process | Filename | Type | |
---|---|---|---|---|
6632 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports | ini | |
MD5:D751713988987E9331980363E24189CE | SHA256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945 | |||
6632 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6e8f354d-9c9f-4e37-9972-ee372eac6cf2.tmp | ini | |
MD5:D751713988987E9331980363E24189CE | SHA256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945 | |||
6632 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF1365d2.TMP | ini | |
MD5:D751713988987E9331980363E24189CE | SHA256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945 | |||
6632 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00025d | image | |
MD5:54BAE8FD03E88339FD15443DF63FE098 | SHA256:EA931B34A8611C2FA7194F3329F46759DD18D60FCB59E157D203FF1C845445F3 | |||
6632 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00025f | text | |
MD5:259A0AF98559C142A56D398E7922C5D8 | SHA256:CE1F580E31FA18412D11C859F2172AFC13EF07BB2BBDB654E626AD94EBB4E207 | |||
6632 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00025b | image | |
MD5:46E5A58F1866AE3C7D8A35AA3C7EE45F | SHA256:E906B20BD1028C6AEA3F81C736AF90F0C253E7DD581BC35C650DE8562A75A973 | |||
6632 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\65e8cebe-d48a-4be0-80e4-913da27c3d41.tmp | ini | |
MD5:D751713988987E9331980363E24189CE | SHA256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945 | |||
6632 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF135e7f.TMP | ini | |
MD5:D751713988987E9331980363E24189CE | SHA256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945 | |||
6632 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries | binary | |
MD5:20D4B8FA017A12A108C87F540836E250 | SHA256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D | |||
6632 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a7fe6b26-fe8b-436d-9155-46555c1d6c2d.tmp | binary | |
MD5:20D4B8FA017A12A108C87F540836E250 | SHA256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3488 | RUXIMICS.exe | GET | 200 | 104.107.161.181:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 104.107.161.181:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 104.107.161.181:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.21.245.134:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.21.245.134:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
3488 | RUXIMICS.exe | GET | 200 | 2.21.245.134:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3488 | RUXIMICS.exe | 4.231.128.59:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 2.21.133.179:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
— | — | 2.21.245.134:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
3488 | RUXIMICS.exe | 2.21.245.134:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
— | — | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
— | — | 104.107.161.181:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
3488 | RUXIMICS.exe | 104.107.161.181:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 4.231.128.59:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 192.168.100.255:138 | — | — | — | whitelisted |
Domain | IP | Reputation |
---|---|---|
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
config.edge.skype.com |
| whitelisted |
htbilisim.com |
| unknown |
edge.microsoft.com |
| whitelisted |
edge-mobile-static.azureedge.net |
| whitelisted |
business.bing.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Possible Social Engineering Attempted | PHISHING [ANY.RUN] Suspected Mamba2FA`s Phishing-Kit domain by CrossDomain (htbilisim .com) |
— | — | Possible Social Engineering Attempted | PHISHING [ANY.RUN] Suspected Mamba2FA`s Phishing-Kit domain by CrossDomain (htbilisim .com) |
— | — | Possible Social Engineering Attempted | PHISHING [ANY.RUN] Suspected Mamba2FA`s Phishing-Kit domain by CrossDomain (htbilisim .com) |