File name: | документ.shtml |
Full analysis: | https://app.any.run/tasks/92e7dc0b-6919-4155-b4bc-a1ef0b2b7baf |
Verdict: | Malicious activity |
Analysis date: | December 06, 2022, 03:29:03 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | text/html |
File info: | HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators |
MD5: | D847B305F476A66E617C18D144EFD610 |
SHA1: | F62069460EAE3476140D9BC733426359776EEE5A |
SHA256: | 467A1D225FC3ED67101081CD03AFA2851A6E3C4408C0759BFABB58728302846B |
SSDEEP: | 1536:BciBHN//3hK8FhoVoa3Tgc6MR7yIwNa+2iOF8w7+DgxFzAjc:XoVocR7T |
.html | | | HyperText Markup Language (100) |
---|
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1756 | "C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\admin\AppData\Local\Temp\документ.shtml.html" | C:\Program Files\Internet Explorer\iexplore.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3128 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1756 CREDAT:144385 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | — | iexplore.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
2472 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1756 CREDAT:333057 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3164 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1756 CREDAT:1709317 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
1756 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442 | binary | |
MD5:081B24F0621C5FFF42382883DED3A3E1 | SHA256:3150612414BFB9F9D168616F189C25C6466C1E2FD80E1AD15B2B7AAD82F68975 | |||
1756 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:D9004FD2C504C152C8F987E6DE129EFB | SHA256:C9B8540D04E07914DC34B13C5D36A1F1233620F08979B7034C89EF632245D18B | |||
1756 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{2E2A8625-7516-11ED-80DA-12A9866C77DE}.dat | binary | |
MD5:4557EB780A4B4D0A8AD3DA2B77820BCE | SHA256:F8F703F3D9269926A7A7B0847B490398BC678EC4135019C79A03A98A74097D93 | |||
1756 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442 | der | |
MD5:503AD061073A29CEE4CB12D552F6A5B3 | SHA256:D2A97423F8B71CA1DAAC39F8A037DCA022303C1ADFBD49995EFF3B36AFFF33F9 | |||
1756 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{2E2A8628-7516-11ED-80DA-12A9866C77DE}.dat | binary | |
MD5:C76C575E9F40FF25CC02C062CD069D70 | SHA256:707EA5847F96DFF68AC7F66ACAB87A5D16C90A6E932FCD6D81133A5A011638FA | |||
1756 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | image | |
MD5:DA597791BE3B6E732F0BC8B20E38EE62 | SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07 | |||
1756 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{2E2A8624-7516-11ED-80DA-12A9866C77DE}.dat | binary | |
MD5:157ADD960BDF1F58A41D1F3952EE6DF8 | SHA256:983576FBC44138BDCF4E2367EE1B02B715131529DD0386CB610027189B225108 | |||
1756 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{2E2A862A-7516-11ED-80DA-12A9866C77DE}.dat | binary | |
MD5:5953A3B713D4C4444AF912CCF27C4E60 | SHA256:C6DD5A373C668E5DC7B1933C59EAB1EF468374BC0E75BA1AA72313061369834F | |||
1756 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{2E2A8627-7516-11ED-80DA-12A9866C77DE}.dat | binary | |
MD5:90104611DD355FB45B6CF121AE9790DE | SHA256:9CEEB0AA80E68F33C61E69E156FFFF02DAF2BF75BB22E31505F20875AD470D6F | |||
1756 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{2E2A8626-7516-11ED-80DA-12A9866C77DE}.dat | binary | |
MD5:3088C30E33646DC41ED52C44918A49E3 | SHA256:86034B5B04FFBD913A5FDFD5207A46DCFCFD6665DC6A8E8EDEFE9193BC0D494F |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1756 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
1756 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D | US | der | 1.47 Kb | whitelisted |
1756 | iexplore.exe | GET | 200 | 178.79.242.128:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?67cc66f09702b6b4 | DE | compressed | 4.70 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1756 | iexplore.exe | 204.79.197.200:443 | www.bing.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
1756 | iexplore.exe | 178.79.242.128:80 | ctldl.windowsupdate.com | LLNW | DE | malicious |
2472 | iexplore.exe | 103.27.35.250:443 | thevetlounge.com.au | SYNERGY WHOLESALE PTY LTD | AU | suspicious |
1756 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | EDGECAST | GB | whitelisted |
3164 | iexplore.exe | 103.27.35.250:443 | thevetlounge.com.au | SYNERGY WHOLESALE PTY LTD | AU | suspicious |
1756 | iexplore.exe | 152.199.19.161:443 | r20swj13mr.microsoft.com | EDGECAST | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
thevetlounge.com.au |
| suspicious |
r20swj13mr.microsoft.com |
| whitelisted |
iecvlist.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
2472 | iexplore.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
3164 | iexplore.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
2472 | iexplore.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
2472 | iexplore.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
2472 | iexplore.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
2472 | iexplore.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
3164 | iexplore.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |