URL: | http://hospitalsanjosedemariquita.mailrelay-iv.es/newslink/3605/4.html |
Full analysis: | https://app.any.run/tasks/e4b594f6-43b0-466c-90a1-b09a95c03b26 |
Verdict: | Malicious activity |
Analysis date: | April 25, 2019, 18:25:34 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 19FC235DE0B095735FB58FF8962A6170 |
SHA1: | 6214A415F50ACD01BD3A30194615D8920BCA0EBF |
SHA256: | 4D890EDA2E1F5D8A7B769E45FDDC90B6ACCC5F68C5393D24600DCF196020CBD8 |
SSDEEP: | 3:N1KWK/ipOWAFMi8bkc3WC6KWTVftQn:CWssAFRoOFVftQn |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2432 | "C:\Program Files\Internet Explorer\iexplore.exe" http://hospitalsanjosedemariquita.mailrelay-iv.es/newslink/3605/4.html | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3084 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2432 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3168 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2432 CREDAT:6403 | C:\Program Files\Internet Explorer\iexplore.exe | — | iexplore.exe |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2764 | "C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\Face_f0800130426.rar" C:\Users\admin\Desktop\ | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
3568 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\Face_f0800130426.vbs" | C:\Windows\System32\WScript.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
3368 | "C:\Windows\System32\wscript.exe" //B "C:\Users\admin\AppData\Roaming\lyuSsopQui.vbs" | C:\Windows\System32\wscript.exe | WScript.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Version: 5.8.7600.16385 | ||||
2584 | "C:\Windows\System32\wscript.exe" //B "C:\Users\admin\AppData\Local\Temp\Face_f0800130426.vbs" | C:\Windows\System32\wscript.exe | WScript.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Version: 5.8.7600.16385 | ||||
3664 | "C:\Windows\system32\cmd.exe" /c schtasks /create /sc minute /mo 30 /tn Skypee /tr "C:\Users\admin\AppData\Local\Temp\meee.vbs" | C:\Windows\system32\cmd.exe | — | wscript.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2896 | schtasks /create /sc minute /mo 30 /tn Skypee /tr "C:\Users\admin\AppData\Local\Temp\meee.vbs" | C:\Windows\system32\schtasks.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2328 | "C:\Windows\System32\wscript.exe" //B "C:\Users\admin\AppData\Roaming\lyuSsopQui.vbs" | C:\Windows\System32\wscript.exe | — | wscript.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 1 Version: 5.8.7600.16385 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2432 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
2432 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
3084 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\ZQHA4420\Face_f0800130426[1].rar | — | |
MD5:— | SHA256:— | |||
3084 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019042520190426\index.dat | dat | |
MD5:F0DC8E0AA2E09793E65662CE791637A4 | SHA256:BC6DD678A09D904AB6B9C353DEC6EFC077883E1CCE49830ED742B9CF5691A8F9 | |||
3084 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1A7VN9ZP\4[1].htm | html | |
MD5:AD0122475CBFC264748F3D4C988B3C16 | SHA256:656D4EEB35386A55572FA8572901AF4EF0824C38B4EBE0C59040EF85AD3BCCF0 | |||
3084 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat | dat | |
MD5:953F997F09729C2E26733E444A393C4A | SHA256:DF101FFF5EC446C8F8D56C2266BD81D10685AFECCA24B11CDB4A34D4F2E4E657 | |||
3084 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:F16AA77453F41A7F6C62657131498301 | SHA256:38E805040A71B06DAE21D803FE96B95F1BFC8089D52A78100A60C582931BBF64 | |||
3084 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\7B6KCDJF\Face_f0800130426[1].rar | — | |
MD5:— | SHA256:— | |||
2432 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019042520190426\index.dat | dat | |
MD5:6076A5C0777F9186B22B574D058BC9C6 | SHA256:C70FFD45018F2A108F234FB032907E24B2C5A1063D5452E10A7DC052C2A4BCB2 | |||
3084 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\desktop.ini | ini | |
MD5:4A3DEB274BB5F0212C2419D3D8D08612 | SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2432 | iexplore.exe | GET | 200 | 93.159.210.2:80 | http://hospitalsanjosedemariquita.mailrelay-iv.es/favicon.ico | ES | — | — | suspicious |
3084 | iexplore.exe | GET | 200 | 190.8.176.173:80 | http://equiconstruccion.com/Face_f0800130426.rar | CO | compressed | 23.6 Kb | malicious |
3084 | iexplore.exe | GET | — | 190.8.176.173:80 | http://equiconstruccion.com/Face_f0800130426.rar | CO | — | — | malicious |
2432 | iexplore.exe | GET | 200 | 93.159.210.2:80 | http://hospitalsanjosedemariquita.mailrelay-iv.es/favicon.ico | ES | — | — | suspicious |
3084 | iexplore.exe | GET | — | 190.8.176.173:80 | http://equiconstruccion.com/Face_f0800130426.rar | CO | — | — | malicious |
2432 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
3084 | iexplore.exe | GET | 200 | 93.159.210.2:80 | http://hospitalsanjosedemariquita.mailrelay-iv.es/newslink/3605/4.html | ES | html | 280 b | suspicious |
3084 | iexplore.exe | POST | 302 | 93.159.210.2:80 | http://hospitalsanjosedemariquita.mailrelay-iv.es/newslink/3605/4.html | ES | — | — | suspicious |
3084 | iexplore.exe | POST | 302 | 93.159.210.2:80 | http://hospitalsanjosedemariquita.mailrelay-iv.es/newslink/3605/4.html | ES | compressed | 280 b | suspicious |
3084 | iexplore.exe | POST | 302 | 93.159.210.2:80 | http://hospitalsanjosedemariquita.mailrelay-iv.es/newslink/3605/4.html | ES | — | — | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2584 | wscript.exe | 186.85.86.227:8105 | socketw3.duckdns.org | Telmex Colombia S.A. | CO | malicious |
3084 | iexplore.exe | 190.8.176.173:80 | equiconstruccion.com | Colombia Hosting | CO | malicious |
3084 | iexplore.exe | 93.159.210.2:80 | hospitalsanjosedemariquita.mailrelay-iv.es | Core-Backbone GmbH | ES | suspicious |
2432 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3368 | wscript.exe | 23.105.131.191:3355 | brothersjoy.nl | Nobis Technology Group, LLC | US | malicious |
2432 | iexplore.exe | 93.159.210.2:80 | hospitalsanjosedemariquita.mailrelay-iv.es | Core-Backbone GmbH | ES | suspicious |
— | — | 23.105.131.191:3355 | brothersjoy.nl | Nobis Technology Group, LLC | US | malicious |
Domain | IP | Reputation |
---|---|---|
hospitalsanjosedemariquita.mailrelay-iv.es |
| suspicious |
www.bing.com |
| whitelisted |
equiconstruccion.com |
| malicious |
socketw3.duckdns.org |
| malicious |
brothersjoy.nl |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
— | — | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
— | — | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |