URL: | https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fu10704350.ct.sendgrid.net%2Fls%2Fclick%3Fupn%3Dn0I16x2JTvUQ5lBFUSFflE5RXCzViUzPnq9b1wKq9Nc0uHXWH-2FSiU3boqrP0TzkwUkk-2BtIRAYgmkiirvxnT85Jmi7VEffIEaPKTZ7vBf-2FgO2A2BOQvnjEhNz-2BhiKm9KRzeUiAp1T-2FHezuZ-2BA1ssW7g-3D-3D_YOS_uAGIKxVHnzoGVmPcnUwHmaU-2FnkoJkDSw4aHFiI-2B0y4Fhy58-2BRG59axtnosJJcUGv8X7JXZioX2JD6uR3gQZeHqpELfestL6V8E-2BR-2FLxVjVCIvADFiCk-2Fb75CxRZCcrmkH9U-2F873t8hRTbMuiEkpqZI1X7-2B1uAjkBOEu6MJIMi64iS8dhfVITYlBTFWg5lDn6UoPVFy-2B4CfTGgZ4Su65F-2FFxiEHnQdniJKwhGIWoe598-3D&data=05%7C01%7Cdaniel.thibault%40saaq.gouv.qc.ca%7C62ec7c6d83764198c20208da7bf2757d%7C4df32e45efd840c193ead0041b95d83b%7C0%7C0%7C637958578649493597%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=xYZMHHYWq4jIGfSMOm142iT%2FoOGCwXfebm5gEiCtR9s%3D&reserved=0 |
Full analysis: | https://app.any.run/tasks/e257c856-35a3-476c-a51e-fe82b262121b |
Verdict: | Malicious activity |
Analysis date: | August 12, 2022, 17:54:04 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | AFFE3F7E6EFE97D4FF1E565E6CC3F400 |
SHA1: | DEFC65BB9D633CC8621CFBADC6E6C37DD59CABB7 |
SHA256: | 248144831EBCB359AD5678B01EAB6DE55EB749A3967FBF1FF1A00F7B74792036 |
SSDEEP: | 12:2G9qx9hjYvXYg8O39sJIqvQD8p0zkKp7zOmcgqjwud4L7HwDA5ZddCXtp0UKP7Rj:2aqxeoP2qvQ9k+iBjwuaV5ZddRHP7Qu |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2480 | "C:\Program Files\Internet Explorer\iexplore.exe" "https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fu10704350.ct.sendgrid.net%2Fls%2Fclick%3Fupn%3Dn0I16x2JTvUQ5lBFUSFflE5RXCzViUzPnq9b1wKq9Nc0uHXWH-2FSiU3boqrP0TzkwUkk-2BtIRAYgmkiirvxnT85Jmi7VEffIEaPKTZ7vBf-2FgO2A2BOQvnjEhNz-2BhiKm9KRzeUiAp1T-2FHezuZ-2BA1ssW7g-3D-3D_YOS_uAGIKxVHnzoGVmPcnUwHmaU-2FnkoJkDSw4aHFiI-2B0y4Fhy58-2BRG59axtnosJJcUGv8X7JXZioX2JD6uR3gQZeHqpELfestL6V8E-2BR-2FLxVjVCIvADFiCk-2Fb75CxRZCcrmkH9U-2F873t8hRTbMuiEkpqZI1X7-2B1uAjkBOEu6MJIMi64iS8dhfVITYlBTFWg5lDn6UoPVFy-2B4CfTGgZ4Su65F-2FFxiEHnQdniJKwhGIWoe598-3D&data=05%7C01%7Cdaniel.thibault%40saaq.gouv.qc.ca%7C62ec7c6d83764198c20208da7bf2757d%7C4df32e45efd840c193ead0041b95d83b%7C0%7C0%7C637958578649493597%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=xYZMHHYWq4jIGfSMOm142iT%2FoOGCwXfebm5gEiCtR9s%3D&reserved=0" | C:\Program Files\Internet Explorer\iexplore.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
4020 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2480 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
(PID) Process: | (2480) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPDaysSinceLastAutoMigration |
Value: 1 | |||
(PID) Process: | (2480) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPLastLaunchLowDateTime |
Value: | |||
(PID) Process: | (2480) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPLastLaunchHighDateTime |
Value: 30977652 | |||
(PID) Process: | (2480) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
Operation: | write | Name: | NextCheckForUpdateLowDateTime |
Value: | |||
(PID) Process: | (2480) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 30977652 | |||
(PID) Process: | (2480) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
Operation: | write | Name: | CachePrefix |
Value: | |||
(PID) Process: | (2480) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (2480) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (2480) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
(PID) Process: | (2480) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2480 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63 | binary | |
MD5:96A8706B641E773D69C9A109686C64DC | SHA256:253092919621853A54A6E4A7EC0759D725E0394402E415BDE111B75DEFB7B015 | |||
2480 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:26F2B52D6AAD18FE57FFBF9B0BD542BD | SHA256:E29CCB7E16567C95360929A2D4A99D61E0E8894FCC0E3FAD6B0F5A10585A7D1F | |||
4020 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EE663020D19099DF1F0301BC70AB2E57_FFD867000A0830D5CC0FA7946195DDD4 | der | |
MD5:B88DCF4B068C4721B297942D39187901 | SHA256:B2972B15359EF6CE3FCA5064EEB296F71754EC6B63AB85D9793212C83FACB357 | |||
2480 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63 | der | |
MD5:EE87BB11E233C12009CC11725035DBDC | SHA256:D82930A5B051B3C3F1639C24E83BDDF41D5AA66E467A0944D1AC3D59AE6330C5 | |||
4020 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D | der | |
MD5:731961DEA42A253E0D50F88E7C104352 | SHA256:BDEF2FB73CC39298479BC53D1B3EE1BE54B0E940A7F3150E85031F9B1FA61324 | |||
4020 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2F23D0F5E4D72862517E1CB26A329742_F6FACC49395CFA949BCE851E73323C49 | der | |
MD5:B5DB26BF7F8D02FAC377C8E343B930A1 | SHA256:CB814FABB0DAF12D7AFA5CD5853B94F879481D25766C0BB03C1FC904994DD1A1 | |||
4020 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2F23D0F5E4D72862517E1CB26A329742_F6FACC49395CFA949BCE851E73323C49 | binary | |
MD5:AAD5B4EDB349BF833A969BEF85A180B8 | SHA256:C65258204544614A802D41C08705EF97AFFA2796B096051F081ADE44AFB73911 | |||
4020 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\unsubscribe[1].htm | html | |
MD5:99CEEAF29443AD423247BCCC6BFCE17C | SHA256:3FA6E61218BA33CCC2D106CAACF3D143FC46465D03B7C8056F68D97D6CC58F2F | |||
4020 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771 | der | |
MD5:EAE315910DF7E04D7386FEB6E156E0C3 | SHA256:2AE573190FA210FFD635047D18EC4D54993772FCC00F8D24A191D9542B58DACD | |||
4020 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA | der | |
MD5:FC4A5A9D19C073BF2FCB2090CE0F8D1E | SHA256:33DEFDCBE87BC5E257D30F2FA45683F7898FF0FF1327D1E6753BD51A657A3DA2 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2480 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D | US | der | 1.47 Kb | whitelisted |
4020 | iexplore.exe | GET | 200 | 54.189.84.127:80 | http://ec2-54-189-84-127.us-west-2.compute.amazonaws.com/x/unsubscribe?u=95ae468f-bd27-45e1-8b32-83c0d99a3c07 | US | html | 3.25 Kb | shared |
4020 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAGewca9P1l7sgwzOOVR2Hc%3D | US | der | 471 b | whitelisted |
4020 | iexplore.exe | GET | 301 | 54.189.84.127:80 | http://ec2-54-189-84-127.us-west-2.compute.amazonaws.com/x/Unsubscribe?u=95ae468f-bd27-45e1-8b32-83c0d99a3c07 | US | html | 170 b | shared |
4020 | iexplore.exe | GET | 200 | 142.250.186.35:80 | http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D | US | der | 1.41 Kb | whitelisted |
4020 | iexplore.exe | GET | — | 54.189.84.127:80 | http://ec2-54-189-84-127.us-west-2.compute.amazonaws.com/x/Unsubscribe?u=95ae468f-bd27-45e1-8b32-83c0d99a3c07&unsubscribe=True | US | — | — | shared |
4020 | iexplore.exe | GET | 200 | 192.124.249.36:80 | http://ocsp.godaddy.com//MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQCbtonfHJ3EDA%3D%3D | US | der | 1.74 Kb | whitelisted |
4020 | iexplore.exe | GET | 200 | 142.250.186.35:80 | http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D | US | der | 724 b | whitelisted |
4020 | iexplore.exe | GET | 200 | 192.124.249.36:80 | http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D | US | der | 1.69 Kb | whitelisted |
2480 | iexplore.exe | GET | 200 | 54.189.84.127:80 | http://ec2-54-189-84-127.us-west-2.compute.amazonaws.com/android-icon-192x192.png | US | image | 12.0 Kb | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 13.107.21.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
2480 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2480 | iexplore.exe | 8.238.176.254:80 | ctldl.windowsupdate.com | Level 3 Communications, Inc. | US | suspicious |
4020 | iexplore.exe | 8.238.176.254:80 | ctldl.windowsupdate.com | Level 3 Communications, Inc. | US | suspicious |
4020 | iexplore.exe | 104.47.60.28:443 | can01.safelinks.protection.outlook.com | Microsoft Corporation | CA | suspicious |
2480 | iexplore.exe | 13.107.21.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
4020 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
4020 | iexplore.exe | 192.124.249.36:80 | ocsp.godaddy.com | Sucuri | US | suspicious |
4020 | iexplore.exe | 172.217.18.106:80 | ajax.googleapis.com | Google Inc. | US | whitelisted |
4020 | iexplore.exe | 54.189.84.127:80 | ec2-54-189-84-127.us-west-2.compute.amazonaws.com | Amazon.com, Inc. | US | shared |
Domain | IP | Reputation |
---|---|---|
can01.safelinks.protection.outlook.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
u10704350.ct.sendgrid.net |
| malicious |
ocsp.godaddy.com |
| whitelisted |
ec2-54-189-84-127.us-west-2.compute.amazonaws.com |
| shared |
ajax.googleapis.com |
| whitelisted |
fonts.googleapis.com |
| whitelisted |