URL: | http://37.48.82.67/updates/kdb/i386/diffs/vho008d.kdc.bat |
Full analysis: | https://app.any.run/tasks/e1ef6ac1-42eb-4638-8595-2f72066ba39e |
Verdict: | Malicious activity |
Analysis date: | June 27, 2022, 11:44:49 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | F0C8DA19C3DDC7BE64EE78919E3319EA |
SHA1: | 48DD3636571DCC3727A4C6A17A65EDE0D1A31BB7 |
SHA256: | 52ADBBDE8877C64EF914611A360603674F94C9273947DE57715A583B7D83F8E4 |
SSDEEP: | 3:N1KAwNIKMe76DLOBt:CAiMm6XOBt |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2944 | "C:\Program Files\Internet Explorer\iexplore.exe" "http://37.48.82.67/updates/kdb/i386/diffs/vho008d.kdc.bat" | C:\Program Files\Internet Explorer\iexplore.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
964 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2944 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
2704 | C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\vho008d.kdc.bat" " | C:\Windows\system32\cmd.exe | — | iexplore.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3248 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
2956 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
3904 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2956.0.1257177297\1093537660" -parentBuildID 20201112153044 -prefsHandle 1096 -prefMapHandle 844 -prefsLen 1 -prefMapSize 238726 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2956 "\\.\pipe\gecko-crash-server-pipe.2956" 1172 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 1 Version: 83.0 Modules
| |||||||||||||||
2652 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2956.6.854556077\743653226" -childID 1 -isForBrowser -prefsHandle 2732 -prefMapHandle 2728 -prefsLen 181 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2956 "\\.\pipe\gecko-crash-server-pipe.2956" 2744 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
388 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2956.13.1403812088\886606250" -childID 2 -isForBrowser -prefsHandle 3176 -prefMapHandle 2924 -prefsLen 6644 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2956 "\\.\pipe\gecko-crash-server-pipe.2956" 3188 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
2184 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2956.20.240961075\684343220" -childID 3 -isForBrowser -prefsHandle 3776 -prefMapHandle 3772 -prefsLen 7639 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2956 "\\.\pipe\gecko-crash-server-pipe.2956" 3780 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
3920 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2956.21.487504888\1406005717" -childID 4 -isForBrowser -prefsHandle 3792 -prefMapHandle 3788 -prefsLen 7639 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2956 "\\.\pipe\gecko-crash-server-pipe.2956" 3888 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 Modules
|
(PID) Process: | (2944) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPDaysSinceLastAutoMigration |
Value: 1 | |||
(PID) Process: | (2944) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPLastLaunchLowDateTime |
Value: | |||
(PID) Process: | (2944) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPLastLaunchHighDateTime |
Value: 30968347 | |||
(PID) Process: | (2944) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
Operation: | write | Name: | NextCheckForUpdateLowDateTime |
Value: | |||
(PID) Process: | (2944) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 30968347 | |||
(PID) Process: | (2944) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
Operation: | write | Name: | CachePrefix |
Value: | |||
(PID) Process: | (2944) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (2944) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (2944) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
(PID) Process: | (2944) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2956 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin | — | |
MD5:— | SHA256:— | |||
2944 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{8EDD2D3D-F60E-11EC-B13F-12A9866C77DE}.dat | binary | |
MD5:22C7182FB7DB03E80A3CFA6E859B2260 | SHA256:636C7888565F9885B16FA8F5EC2877B06E25BE2AB7CCAFF437360CD53884F493 | |||
2944 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF0E8CBEC44DF66D33.TMP | gmc | |
MD5:B54FF0D9A0E846C4ADFFB8EBE7E8668A | SHA256:FD45A2A3687F27017C9DC0FAFDDB7EB3AF27134640386262AA7AD894DFB6F02C | |||
2944 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 | binary | |
MD5:4D9C480C791FCD02E21701DFE9DA61AF | SHA256:A49CB153FA27C5D5BE6C82593856ECEFBD2887C7EF5FF4BE2EC2546960098A4C | |||
2944 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:83E0E8118BA95878C815488CADB892C9 | SHA256:42FB06A22190BA76D4A19E7D6C21CED7B52DC6B8D20434E7CF01763F02DFC4BA | |||
2944 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DFFD694C996A209855.TMP | gmc | |
MD5:E01CEE2BB374FE67C7E1520EDFCBE0C4 | SHA256:16147E3E72C8B1169C951C0285BCA0000A9D1EE2051D08472404FA48CE578895 | |||
2944 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 | der | |
MD5:790E40386A5478B54787C28956E029D7 | SHA256:2A14CA44FA89C53F53111C7CAAE9155A460FA162BD822CCEAF7B7F74B8390557 | |||
964 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\vho008d.kdc.bat.b13b2w7.partial | binary | |
MD5:2E0A28ECE1D9702DBADF5D01049487A5 | SHA256:7D94BD8E9014230E329CE67D0F0EC406C9D8925B0DB8B455477DE214970C2BF6 | |||
964 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\vho008d.kdc[1].bat | binary | |
MD5:2E0A28ECE1D9702DBADF5D01049487A5 | SHA256:7D94BD8E9014230E329CE67D0F0EC406C9D8925B0DB8B455477DE214970C2BF6 | |||
2944 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\vho008d.kdc.bat | binary | |
MD5:2E0A28ECE1D9702DBADF5D01049487A5 | SHA256:7D94BD8E9014230E329CE67D0F0EC406C9D8925B0DB8B455477DE214970C2BF6 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
964 | iexplore.exe | GET | 200 | 37.48.82.67:80 | http://37.48.82.67/updates/kdb/i386/diffs/vho008d.kdc.bat | NL | binary | 9.30 Kb | malicious |
2944 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
2956 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
2956 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
2956 | firefox.exe | POST | 200 | 142.250.185.67:80 | http://ocsp.pki.goog/gts1c3 | US | der | 472 b | whitelisted |
2944 | iexplore.exe | GET | 200 | 209.197.3.8:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f014c27bad912757 | US | compressed | 4.70 Kb | whitelisted |
2956 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt | US | text | 8 b | whitelisted |
2956 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | US | text | 8 b | whitelisted |
2944 | iexplore.exe | GET | 200 | 209.197.3.8:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8f616cb3e283d2cd | US | compressed | 4.70 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2956 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | — | US | whitelisted |
964 | iexplore.exe | 37.48.82.67:80 | — | LeaseWeb Netherlands B.V. | NL | malicious |
2944 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2944 | iexplore.exe | 152.199.19.161:443 | iecvlist.microsoft.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2956 | firefox.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2956 | firefox.exe | 143.204.89.103:443 | firefox.settings.services.mozilla.com | — | US | unknown |
2944 | iexplore.exe | 209.197.3.8:80 | ctldl.windowsupdate.com | Highwinds Network Group, Inc. | US | whitelisted |
2956 | firefox.exe | 34.208.249.219:443 | location.services.mozilla.com | Amazon.com, Inc. | US | unknown |
2956 | firefox.exe | 142.250.185.67:80 | ocsp.pki.goog | Google Inc. | US | whitelisted |
2956 | firefox.exe | 143.204.89.89:443 | firefox-settings-attachments.cdn.mozilla.net | — | US | unknown |
Domain | IP | Reputation |
---|---|---|
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
dns.msftncsi.com |
| shared |
iecvlist.microsoft.com |
| whitelisted |
r20swj13mr.microsoft.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
detectportal.firefox.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
location.services.mozilla.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
2956 | firefox.exe | Potentially Bad Traffic | ET INFO Terse Request for .txt - Likely Hostile |
2956 | firefox.exe | Potentially Bad Traffic | ET INFO Terse Request for .txt - Likely Hostile |