URL:

assets-oce.mkt.dynamics.com

Full analysis: https://app.any.run/tasks/00569520-3a1e-4271-8c43-9180b8789d34
Verdict: Malicious activity
Analysis date: January 15, 2024, 22:26:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
phishing
Indicators:
MD5:

0FAAF44DE81042FCF87D02EE7EBF4650

SHA1:

955859E2C7183C323CCDF3DA96BE71C27D9F4AA9

SHA256:

22027AD7DFBD0B088B17DE574CE85364C81D9EE1199FD2B4B4D4E8EE64F7A101

SSDEEP:

3:/Wzzz6d:avi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 120)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
120"C:\Program Files\Internet Explorer\iexplore.exe" "assets-oce.mkt.dynamics.com"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
392"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:120 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
18 605
Read events
18 537
Write events
66
Delete events
2

Modification events

(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
11
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
392iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:C5801672ADF052B41F786C4010992EF3
SHA256:A7EE4A4D53CB5B912A64EC00FC91AE566EA91E833F9B62EABD81086E22F19FC2
392iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\cloud_drop[1].svgimage
MD5:4EC53B63F37493ABF7FB9CE7EDC73C34
SHA256:B14CB354AF6DE250CC71C032A897A9F75EC2E5D3A6BFF64D7002CAE7A2BCB920
392iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64Abinary
MD5:AA2959A60897E06CE646D1B09F9212F5
SHA256:85F3BEB14DC56ECE6964C550F44295B07F6438D46E082256F20D89E24F9436B0
392iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\UxFxErrorCss_8097D4DBB3B4874308CB3816C1762BED98637360[1].csstext
MD5:88E1336D359F8FC204863E2230FDB266
SHA256:F702775B4C9ADC1E8FA61169A437B6F22556B44B9F2A975464E02432B547C13B
392iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\chevron[1].svgimage
MD5:62DF6BF3DDD28B11EFA8CB94623E9E0D
SHA256:EB5DD3BB4BBC52BC91FACFCC42E6C6F0F82E0FE9109693F3958CA6C16AA32F11
392iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7EF516642261549A23D49DB36FFE5F3F_A2BCF99942AAE4C6860856CA56EC76FDbinary
MD5:C5EE9EFA3FCC5AC474FCC8A1DF502D7B
SHA256:772B65980B4F8A116D00B9845417500903BDA6620A83687CEC8CD5BD0BB4A81A
392iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64Abinary
MD5:A800610A524803A5B40EA1B3C166052C
SHA256:8F463FC93D4857AC1AED7EBEE17E76BCC31E175ABCD916FB8AB09DB9E6E75B91
392iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
392iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\UxFxStableCssWesternEuropean_6724ABFCA058F28804A76FD40AD14C9D7A6031D9[1].csstext
MD5:B3FACF280AD7C12124415DFDC290BC96
SHA256:FB384CDEB37D9E15FF825977806172D13F5FC9D5289D07DC81C5407C08B82F2B
392iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\ErrorBackground[1].pngimage
MD5:0F115D2C19D9C485EB8FF39AAC44AFE5
SHA256:A6CBAA934A88444E751973109C0675982883A2768656FB17A292F2F557E5A96C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
21
DNS requests
11
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
392
iexplore.exe
GET
404
13.107.246.45:80
http://assets-oce.mkt.dynamics.com/
unknown
html
1.05 Kb
unknown
392
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1a2f195c97973615
unknown
compressed
4.66 Kb
unknown
392
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e8d10b3d3596790f
unknown
compressed
4.66 Kb
unknown
392
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1de7a95d5c7aac20
unknown
compressed
4.66 Kb
unknown
120
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d8f761b8c0f86c21
unknown
—
—
unknown
120
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?67308e0939100114
unknown
—
—
unknown
120
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
392
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b9cb2e4cef5cf09c
unknown
compressed
4.66 Kb
unknown
392
iexplore.exe
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBTkdQGdwyPiJnQdbEA5B5X5BZZGLgQUO3DRU%2Bl2JZ1gqMpmD8abrm9UFmoCEzMAHRPzLOIQHHRRAdgAAAAdE%2FM%3D
unknown
binary
1.74 Kb
unknown
392
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
392
iexplore.exe
13.107.246.45:80
assets-oce.mkt.dynamics.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
392
iexplore.exe
13.107.246.45:443
assets-oce.mkt.dynamics.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
392
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
392
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
392
iexplore.exe
204.79.197.203:80
oneocsp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
120
iexplore.exe
104.126.37.145:443
www.bing.com
Akamai International B.V.
DE
unknown
120
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
120
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
120
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
assets-oce.mkt.dynamics.com
  • 13.107.246.45
  • 13.107.213.45
unknown
azurefrontdoorpages.azureedge.net
  • 13.107.246.45
  • 13.107.213.45
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.145
  • 104.126.37.163
  • 104.126.37.155
  • 104.126.37.161
  • 104.126.37.162
  • 104.126.37.170
  • 104.126.37.123
  • 104.126.37.139
  • 104.126.37.147
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

PID
Process
Class
Message
392
iexplore.exe
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Suspicious message detected (saved from)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
assets-oce.mkt.dynamics.com