URL: | https://www.microsoft.com/microsoft-teams/join-a-meeting |
Full analysis: | https://app.any.run/tasks/395147dc-88bc-407f-b8ee-c0abcd4009da |
Verdict: | Malicious activity |
Analysis date: | August 12, 2022, 20:23:08 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 486E4DCEA886249D4FE9759E3032F0ED |
SHA1: | 327440EF2E1ED66228A6004FA442236BC3A06D57 |
SHA256: | 28C19192B61F5B4D7443033C77BDFE5140B931599DEF6E711C5A9D90BCF825A2 |
SSDEEP: | 3:N8DSLZRtRZWYuzE3:2OLTDZRuzg |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
676 | "C:\Program Files\Internet Explorer\iexplore.exe" "https://www.microsoft.com/microsoft-teams/join-a-meeting" | C:\Program Files\Internet Explorer\iexplore.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3704 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:676 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
3704 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:8789083F90FFAB18135F378E63B96736 | SHA256:35095F6D549C2017E42DD834EB1BEFB934196E4CE669458BA1102A36D7A60948 | |||
3704 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63 | der | |
MD5:EE87BB11E233C12009CC11725035DBDC | SHA256:D82930A5B051B3C3F1639C24E83BDDF41D5AA66E467A0944D1AC3D59AE6330C5 | |||
676 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\imagestore\f7ruq93\imagestore.dat | binary | |
MD5:10BB0918803E181E9748929536260A72 | SHA256:AC79BBB65E8EDA34B01445B5D28D771DD4D421F02ED4FD9B580EC48A1E28719E | |||
3704 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\social[1].css | text | |
MD5:76FB30C9043330F7F0B8AEA25010D80D | SHA256:D11DF5F51B96A11B4E5DA4C67A9C832C517FC2A9162AE34CA32B2DED2E0898E3 | |||
3704 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\ef-a24652[1].css | text | |
MD5:82CEF5D4F7CA1DAB1165CB8C67A65BA5 | SHA256:83EFA37DC655A1980A5B9393C5836E289B9B2166DB452B2AB6B120F620EB8B80 | |||
3704 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04 | binary | |
MD5:78C29BB328229D6374DE8BEDFA9295CA | SHA256:643496B4965F6754D2315893134F0D43631A93D3024EB3B4227FADDC166E6BC4 | |||
3704 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63 | binary | |
MD5:E8593FCCF3335454E87F6CBFF64635A3 | SHA256:3A5F91D5C1F71C375A46B49A1FC066636792900BA12C750A36F9DC880050C0C0 | |||
3704 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\join-a-meeting[1].htm | html | |
MD5:BC07C3E20CB5561B165A39DD326C9EA6 | SHA256:F88848E10B47CA90F0FDCFB38D630D619559A9F994709C58F49CFF16E6AD8F96 | |||
3704 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | compressed | |
MD5:F7DCB24540769805E5BB30D193944DCE | SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA | |||
676 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].ico | image | |
MD5:DA597791BE3B6E732F0BC8B20E38EE62 | SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3704 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D | US | der | 1.47 Kb | whitelisted |
3704 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://crl3.digicert.com/DigiCertGlobalRootG2.crl | US | der | 926 b | whitelisted |
3704 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D | US | der | 471 b | whitelisted |
3704 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA9bw6F2y3ieICDHiTyBZ7Q%3D | US | der | 1.47 Kb | whitelisted |
3704 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
3704 | iexplore.exe | GET | 200 | 67.27.159.126:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?9eae438d1ab9dc75 | US | compressed | 4.70 Kb | whitelisted |
3704 | iexplore.exe | GET | 200 | 67.27.159.126:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2ad426d40445cd63 | US | compressed | 4.70 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
676 | iexplore.exe | 204.79.197.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
3704 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
3704 | iexplore.exe | 2.18.233.62:443 | www.microsoft.com | Akamai International B.V. | — | whitelisted |
3704 | iexplore.exe | 13.107.246.45:443 | wcpstatic.microsoft.com | Microsoft Corporation | US | suspicious |
3704 | iexplore.exe | 2.21.20.148:443 | img-prod-cms-rt-microsoft-com.akamaized.net | NTT America, Inc. | DE | suspicious |
3704 | iexplore.exe | 67.27.159.126:80 | ctldl.windowsupdate.com | Level 3 Communications, Inc. | US | suspicious |
3704 | iexplore.exe | 2.21.20.144:443 | img-prod-cms-rt-microsoft-com.akamaized.net | NTT America, Inc. | DE | suspicious |
3704 | iexplore.exe | 20.190.159.71:443 | login.live.com | Microsoft Corporation | US | whitelisted |
676 | iexplore.exe | 13.107.21.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
3704 | iexplore.exe | 23.96.225.71:443 | web.vortex.data.microsoft.com | Microsoft Corporation | US | unknown |
Domain | IP | Reputation |
---|---|---|
www.microsoft.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
wcpstatic.microsoft.com |
| whitelisted |
mem.gfx.ms |
| whitelisted |
img-prod-cms-rt-microsoft-com.akamaized.net |
| whitelisted |
query.prod.cms.rt.microsoft.com |
| whitelisted |
wus-streaming-video-rt-microsoft-com.akamaized.net |
| whitelisted |