URL: | https://www.opentable.com/reservation-reconfirmation?lang=en&rd=LzRjWFNveDU5U042VnZWZmg3RlVEQnNFUlRnWXVTQS8rV1R4RExSdWhhZ0RJMVVUV3JobmF4L2hsQi9qM0VRczNCSndOVGFUNW5tZ3V3ZUxhTE93M1JjN0p5ZXNya0pHbGVaeUpLOHVKWCtGOERLYkRpVjRWdWpkY1hqbHVvTFdJMEJCU3pCT2F3TTF6ZXZHVnMvejM4UjJmOGUzd3p6ZE9BVjhrTkwrU1Z5OEhmSW1PblhveWpaRzNRSEZQaGNxSVY4V1Zhbnh5RVVmWnJmb3N0SDAycnpFdWN5aXNiVk1GUjBHQ0lERk5kTWFpVDhLdlVuOUdLbTJucUVtaE1aNGJTTTlTSjEwOVEyS3RGbU5EQTBKeGpkR21MUE9wRlJXZFQ0QjJXa0NCSE93N2dtYkQ4RHRxQT09&utm_source=opentable&utm_medium=tms_email&utm_campaign=reso_reminder |
Full analysis: | https://app.any.run/tasks/8f83e1cc-35f9-450a-9d65-3604692f75a4 |
Verdict: | Malicious activity |
Analysis date: | February 21, 2020, 16:02:04 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 2E2139C4C8B50B5D6E2ABE9F1804D0B9 |
SHA1: | DA3D524DEC11DF583B24752764FDABE0A6070463 |
SHA256: | 2463EC5D3AEB1EFFC9C840EE4CE3AD9A829A77FFF075B17CC382DB0364DD5CA6 |
SSDEEP: | 12:2kRwLV4OzsQyzN39G4egELM7Xuz2ORuaPsBlpntbmO:2kRwLLzsz7TNEQ7eNGP |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2856 | "C:\Program Files\Internet Explorer\iexplore.exe" https://www.opentable.com/reservation-reconfirmation?lang=en&rd=LzRjWFNveDU5U042VnZWZmg3RlVEQnNFUlRnWXVTQS8rV1R4RExSdWhhZ0RJMVVUV3JobmF4L2hsQi9qM0VRczNCSndOVGFUNW5tZ3V3ZUxhTE93M1JjN0p5ZXNya0pHbGVaeUpLOHVKWCtGOERLYkRpVjRWdWpkY1hqbHVvTFdJMEJCU3pCT2F3TTF6ZXZHVnMvejM4UjJmOGUzd3p6ZE9BVjhrTkwrU1Z5OEhmSW1PblhveWpaRzNRSEZQaGNxSVY4V1Zhbnh5RVVmWnJmb3N0SDAycnpFdWN5aXNiVk1GUjBHQ0lERk5kTWFpVDhLdlVuOUdLbTJucUVtaE1aNGJTTTlTSjEwOVEyS3RGbU5EQTBKeGpkR21MUE9wRlJXZFQ0QjJXa0NCSE93N2dtYkQ4RHRxQT09&utm_source=opentable&utm_medium=tms_email&utm_campaign=reso_reminder | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
3888 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2856 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3888 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Cab7CAA.tmp | — | |
MD5:— | SHA256:— | |||
3888 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Tar7CAB.tmp | — | |
MD5:— | SHA256:— | |||
3888 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\I62BBKP0.txt | — | |
MD5:— | SHA256:— | |||
3888 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\4IT734EV.txt | — | |
MD5:— | SHA256:— | |||
2856 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
3888 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\WQ37RWQU.txt | — | |
MD5:— | SHA256:— | |||
3888 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\TKP7DMNH.txt | — | |
MD5:— | SHA256:— | |||
3888 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\4V3RLV70.txt | — | |
MD5:— | SHA256:— | |||
3888 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\8RNFF1Z0.txt | — | |
MD5:— | SHA256:— | |||
3888 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\PXKWO8KA.txt | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3888 | iexplore.exe | GET | 200 | 172.217.23.131:80 | http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCv2pgtDmXnZAgAAAAALnDT | US | der | 472 b | whitelisted |
3888 | iexplore.exe | GET | 200 | 172.217.23.131:80 | http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCv2pgtDmXnZAgAAAAALnDT | US | der | 472 b | whitelisted |
3888 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D | US | der | 471 b | whitelisted |
3888 | iexplore.exe | GET | 200 | 172.217.23.131:80 | http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDYfXN0lw5MLggAAAAALC6Z | US | der | 472 b | whitelisted |
3888 | iexplore.exe | GET | 200 | 172.217.23.131:80 | http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDu3mVgzTXArwIAAAAAWXG3 | US | der | 472 b | whitelisted |
3888 | iexplore.exe | GET | 200 | 172.217.23.131:80 | http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D | US | der | 468 b | whitelisted |
2856 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
3888 | iexplore.exe | GET | 200 | 172.217.23.131:80 | http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDu3mVgzTXArwIAAAAAWXG3 | US | der | 472 b | whitelisted |
3888 | iexplore.exe | GET | 200 | 172.217.23.131:80 | http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDx9it%2Fyk0DxwgAAAAALC4g | US | der | 472 b | whitelisted |
3888 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAGC%2BAmOouYmuRo7J4Qfua8%3D | US | der | 1.47 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3888 | iexplore.exe | 23.45.106.218:443 | — | Akamai International B.V. | NL | unknown |
3888 | iexplore.exe | 216.58.208.34:443 | www.googletagservices.com | Google Inc. | US | whitelisted |
3888 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2856 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3888 | iexplore.exe | 104.111.239.234:443 | components.otstatic.com | Akamai International B.V. | NL | whitelisted |
3888 | iexplore.exe | 143.204.202.47:443 | consent.truste.com | — | US | suspicious |
3888 | iexplore.exe | 13.35.253.49:443 | a.singleplatform.com | — | US | malicious |
3888 | iexplore.exe | 216.58.208.40:443 | www.googletagmanager.com | Google Inc. | US | whitelisted |
3888 | iexplore.exe | 172.217.23.131:80 | ocsp.pki.goog | Google Inc. | US | whitelisted |
3888 | iexplore.exe | 151.139.128.14:80 | www.opentable.com | Highwinds Network Group, Inc. | US | suspicious |
Domain | IP | Reputation |
---|---|---|
www.opentable.com |
| suspicious |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
components.otstatic.com |
| suspicious |
www.googletagservices.com |
| whitelisted |
a.singleplatform.com |
| whitelisted |
consent.truste.com |
| whitelisted |
ocsp.pki.goog |
| whitelisted |
www.googletagmanager.com |
| whitelisted |