URL: | https://dl.getsidekick.com/trayapp/setup.exe |
Full analysis: | https://app.any.run/tasks/7c545654-7bf1-46eb-8413-728906fb8b23 |
Verdict: | Malicious activity |
Analysis date: | June 18, 2019, 19:18:35 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | F5FF629024BC7984B100325F47E4C3C6 |
SHA1: | 7AC236C6D9CF2511CA66C2FE7969CAE24A38ABFD |
SHA256: | 43F9C9256E68DF98298D9B0D0A307CC5A22B035DC8DA8FB60F764BF6015418C8 |
SSDEEP: | 3:N8RnRL2OMGIEcEVT4A:21RL2OMGcE94A |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2932 | "C:\Program Files\Internet Explorer\iexplore.exe" https://dl.getsidekick.com/trayapp/setup.exe | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3404 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2932 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3116 | "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\setup[1].exe" | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\setup[1].exe | iexplore.exe | |
User: admin Integrity Level: MEDIUM Description: Setup Exit code: 0 Version: 15.0.27005.2 built by: D15REL | ||||
3956 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe | setup[1].exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: ClickOnce Version: 4.6.1055.0 built by: NETFXREL2 | ||||
3488 | "C:\Users\admin\AppData\Local\Apps\2.0\WCGP2AN2.WQ8\VN3BJXBM.EZM\side..tion_55d9f4e27097afb7_0001.0000_0508a31f4403d499\SidekickTrayWPF.exe" | C:\Users\admin\AppData\Local\Apps\2.0\WCGP2AN2.WQ8\VN3BJXBM.EZM\side..tion_55d9f4e27097afb7_0001.0000_0508a31f4403d499\SidekickTrayWPF.exe | dfsvc.exe | |
User: admin Integrity Level: MEDIUM Description: HubSpot for Windows Version: 1.0.0.111 | ||||
2288 | "C:\Program Files\Internet Explorer\iexplore.exe" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2848 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2288 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | — | iexplore.exe |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2932 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
2932 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
2932 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF0082541F2D6649AE.TMP | — | |
MD5:— | SHA256:— | |||
3404 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@getsidekick[1].txt | text | |
MD5:DC951561191B54786098FF639CEF585E | SHA256:F294318E7046E8238EFFAA524210C83F1219B7B09F844779A1BC520ED967305A | |||
3404 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\B1BB14DI\setup[1].exe | executable | |
MD5:B0FB47B73A0C278B799E51E3C4E488B3 | SHA256:095D1FF67A3C3A5F046DCADB81552AA9350370EF2B5ACD805F0F9FB3CD2E8D5D | |||
3404 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:DB388ACE1EA42C3A64867F66E7E1C735 | SHA256:7FAA7A9E406B1FB7222566D71A9BDB0D67E9DAF3B9E9453119F3F69B92F55D5D | |||
3404 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.dat | dat | |
MD5:A642E7155E1C61C41978A9C04E0CDAFB | SHA256:D8B3AEE4A0D8C0F6825AE3B54DC614DCB2DB9586A3C13218EB022D5DE501BF9A | |||
3404 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat | dat | |
MD5:4DDB0BA3957FA0D85F5FD96F66DABAFB | SHA256:C9CF7A062BD1E9ACC53FB24DCDAFF03235B87156C416560834B48902A67DD45E | |||
2932 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini | ini | |
MD5:4A3DEB274BB5F0212C2419D3D8D08612 | SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38 | |||
2932 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019061820190619\index.dat | dat | |
MD5:13BA88A7F2B1BE35ABB539342FFAC044 | SHA256:128AFE3D5B8A4B793F012E3EE4DA033922D91B7054BD7B7587DE587F378D7668 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2288 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
2932 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
3956 | dfsvc.exe | GET | 200 | 104.18.10.39:80 | http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt | US | der | 1.30 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2932 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3404 | iexplore.exe | 104.16.51.78:443 | dl.getsidekick.com | Cloudflare Inc | US | shared |
3488 | SidekickTrayWPF.exe | 104.16.250.5:443 | app.hubspot.com | Cloudflare Inc | US | shared |
3488 | SidekickTrayWPF.exe | 104.17.200.204:443 | api.hubapi.com | Cloudflare Inc | US | shared |
3116 | setup[1].exe | 104.16.51.78:443 | dl.getsidekick.com | Cloudflare Inc | US | shared |
3956 | dfsvc.exe | 104.16.51.78:443 | dl.getsidekick.com | Cloudflare Inc | US | shared |
3956 | dfsvc.exe | 104.18.10.39:80 | cacerts.digicert.com | Cloudflare Inc | US | shared |
2288 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3488 | SidekickTrayWPF.exe | 104.17.9.210:443 | static.hsappstatic.net | Cloudflare Inc | US | shared |
3488 | SidekickTrayWPF.exe | 172.217.23.163:443 | www.gstatic.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
dl.getsidekick.com |
| unknown |
www.bing.com |
| whitelisted |
cacerts.digicert.com |
| whitelisted |
api.hubapi.com |
| whitelisted |
app.hubspot.com |
| whitelisted |
static.hsappstatic.net |
| whitelisted |
www.google.com |
| whitelisted |
www.googletagmanager.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
www.google-analytics.com |
| whitelisted |
Process | Message |
---|---|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|
dfsvc.exe |
*** Status originated: -1073741811
*** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
|