URL: | http://www.zaohsin.gq |
Full analysis: | https://app.any.run/tasks/907f62f3-2e44-43cc-8984-f699440348fb |
Verdict: | Malicious activity |
Analysis date: | December 19, 2018, 00:00:03 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 9DDEBEB29F927DC3B849149D7F00F40F |
SHA1: | 3ED016CA72B671098FF0191776A9FE05DEC8F0F0 |
SHA256: | 0F5123E762ED7B08DA6DAF07DA8DD2BD2B950A85E7025E754959F879B2BDD38E |
SSDEEP: | 3:N1KJS4sRK2U:Cc4s2 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2960 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3240 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2960 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
|
(PID) Process: | (2960) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
(PID) Process: | (2960) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (2960) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (2960) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones |
Operation: | write | Name: | SecuritySafe |
Value: 1 | |||
(PID) Process: | (2960) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
(PID) Process: | (2960) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
Operation: | write | Name: | SavedLegacySettings |
Value: 4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000 | |||
(PID) Process: | (2960) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active |
Operation: | write | Name: | {1258F65B-0321-11E9-834A-5254004A04AF} |
Value: 0 | |||
(PID) Process: | (2960) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
Operation: | write | Name: | Type |
Value: 4 | |||
(PID) Process: | (2960) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
Operation: | write | Name: | Count |
Value: 3 | |||
(PID) Process: | (2960) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
Operation: | write | Name: | Time |
Value: E2070C00030013000000000014006801 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2960 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
2960 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
3240 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\zaohsin_gq[1].txt | — | |
MD5:— | SHA256:— | |||
3240 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\banner[1].jpg | image | |
MD5:B92038E960A3F467E4668BAD5EE25E72 | SHA256:8272C405B77FAE374A81B53945DDD60EF78D30415D8519470272EBFD90D32B41 | |||
3240 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\f[1].txt | html | |
MD5:A8AF520DEDDAFF39C76A3C5F3D8F39C0 | SHA256:093B53BC02092EB97302CF78745A2772AF6D152DB2718DCA4440A97F99A8E845 | |||
3240 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\js[1].js | text | |
MD5:21413C3FF0DD760E8FAB82D9E997C241 | SHA256:F145698E0B4C2E1008555BD5878E43CA362A83F6C28B15BBC997D21719692223 | |||
3240 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\search[1].jpg | image | |
MD5:0D804A8F53D5449C323819BA97605DB7 | SHA256:7C2A4121F7B732946AEB2763A66637A8BC71424F941BEB21E5D081D15989C9AA | |||
3240 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\logo[1].jpg | image | |
MD5:6CEE5DBBD12BE0B0D67FE60DA1D9D718 | SHA256:E07D7C41B1DE8863ECD1D589EB625491811599C6604772108BD00294C3638D2F | |||
3240 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\style[1].css | text | |
MD5:B5045689FE1A5FA11132D9148E3F27F6 | SHA256:0AEFEF13214A01AA135D1A5A7E5DF544C11EE9F5707375AD28CF3CA1D85FF023 | |||
3240 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@zaohsin[1].txt | text | |
MD5:69247FA644A0E061237725EFF88FD275 | SHA256:FF8D8BA05B853B885B9EEA91B207E294DAE34AB0CA27DE9DF65036BA567CC878 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3240 | iexplore.exe | GET | 503 | 67.229.135.6:80 | http://www.zaohsin.gq/tshopr10simg/jmei/cabinet/kihon6/imgrc0064402977.jpg?fitin=140:140 | US | — | — | suspicious |
3240 | iexplore.exe | GET | 503 | 67.229.135.6:80 | http://www.zaohsin.gq/tshopr10simg/edenki/cabinet/kaden2/ed1170030.jpg?fitin=140:140 | US | — | — | suspicious |
3240 | iexplore.exe | GET | 503 | 67.229.135.6:80 | http://www.zaohsin.gq/tshopr10simg/sanwadirect/cabinet/1/100-mr041.jpg?fitin=140:140 | US | — | — | suspicious |
3240 | iexplore.exe | GET | 503 | 67.229.135.6:80 | http://www.zaohsin.gq/tshopr10simg/eco-return/cabinet/54000_55999/55040.jpg?fitin=140:140 | US | — | — | suspicious |
3240 | iexplore.exe | GET | 503 | 67.229.135.6:80 | http://www.zaohsin.gq/tshopr10simg/81wind/cabinet/04272582/sss.jpg?fitin=140:140 | US | — | — | suspicious |
3240 | iexplore.exe | GET | — | 67.229.135.6:80 | http://www.zaohsin.gq/tshopr10simg/eps111/cabinet/syouhin/tochigi/tlbook-12gatu.jpg?fitin=140:140 | US | — | — | suspicious |
3240 | iexplore.exe | GET | 503 | 67.229.135.6:80 | http://www.zaohsin.gq/tshopr10simg/doorbay/cabinet/jisoncase/jison-vtg-ipad1.jpg?fitin=140:140 | US | — | — | suspicious |
3240 | iexplore.exe | GET | 503 | 67.229.135.6:80 | http://www.zaohsin.gq/tshopr10simg/goodgoodsy/cabinet/02292946/newtop/ldj-50h-1-sy.jpg?fitin=140:140 | US | — | — | suspicious |
3240 | iexplore.exe | GET | 200 | 67.229.135.6:80 | http://www.zaohsin.gq/template/default/image/logo.jpg | US | image | 5.44 Kb | suspicious |
3240 | iexplore.exe | GET | 200 | 67.229.135.6:80 | http://www.zaohsin.gq/template/default/css/style.css | US | text | 3.03 Kb | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2960 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3240 | iexplore.exe | 67.229.135.6:80 | www.zaohsin.gq | Krypt Technologies | US | suspicious |
3240 | iexplore.exe | 220.243.212.50:80 | js.users.51.la | QUANTIL, INC | CN | unknown |
2960 | iexplore.exe | 67.229.135.6:80 | www.zaohsin.gq | Krypt Technologies | US | suspicious |
3240 | iexplore.exe | 183.131.207.78:80 | ia.51.la | DaLi | CN | suspicious |
— | — | 67.229.135.6:80 | www.zaohsin.gq | Krypt Technologies | US | suspicious |
Domain | IP | Reputation |
---|---|---|
www.bing.com |
| whitelisted |
www.zaohsin.gq |
| suspicious |
js.users.51.la |
| whitelisted |
ia.51.la |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET INFO DNS Query for Suspicious .gq Domain |