URL: | http://training.prosystemfx.net/downloads/ProdDownloadTest.zip |
Full analysis: | https://app.any.run/tasks/c3315955-84fe-45b7-9968-1ea62ec583de |
Verdict: | Malicious activity |
Analysis date: | October 14, 2019, 20:44:35 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | DE333D072BF75FDEE1AC14B0AE90F6AC |
SHA1: | 5F319C696F071A338482F0B00A70F7812EE0120E |
SHA256: | 55E5A7AB7D1BB080A3624CE8CAF1BE21B68B6CCF1391804E4A318B224571D9EC |
SSDEEP: | 3:N1KKXEMVLVaWr8XKaLtHpfMVn:CKXlhoA8aQHpfU |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2484 | "C:\Program Files\Internet Explorer\iexplore.exe" "http://training.prosystemfx.net/downloads/ProdDownloadTest.zip" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3852 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2484 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2116 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VJFWAMNH\ProdDownloadTest[1].zip" | C:\Program Files\WinRAR\WinRAR.exe | — | iexplore.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
2840 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | WinRAR.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
2384 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /Embedding | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
1740 | C:\Windows\System32\Ping.exe -n 1 download.prosystemfx.com | C:\Windows\System32\Ping.exe | — | EXCEL.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
4088 | "C:\Program Files\Internet Explorer\iexplore.exe" | C:\Program Files\Internet Explorer\iexplore.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2140 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:4088 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | — | iexplore.exe |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2484 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
2484 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
2484 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF6F4F99E1E7A3AB0A.TMP | — | |
MD5:— | SHA256:— | |||
2484 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF27A93F5FEE87DD17.TMP | — | |
MD5:— | SHA256:— | |||
2484 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{773BD8BB-EEC3-11E9-AB41-5254004A04AF}.dat | — | |
MD5:— | SHA256:— | |||
2840 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVREA7A.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2840 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\Rar$DIa2116.40874\~$Bandwidth Test.xlsm | — | |
MD5:— | SHA256:— | |||
2840 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\OICE_0A35287D-7DE5-4FD4-8247-91F468305A27.0\1BB4A887.xlsm\:Zone.Identifier:$DATA | — | |
MD5:— | SHA256:— | |||
2384 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\OICE_0A35287D-7DE5-4FD4-8247-91F468305A27.0\~DF6D7292F4275824C5.TMP | — | |
MD5:— | SHA256:— | |||
2116 | WinRAR.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VJFWAMNH\__rzi_2116.43168 | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3852 | iexplore.exe | GET | 200 | 152.199.19.161:80 | http://training.prosystemfx.net/downloads/ProdDownloadTest.zip | US | compressed | 30.9 Kb | malicious |
2484 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2484 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3852 | iexplore.exe | 152.199.19.161:80 | training.prosystemfx.net | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2840 | EXCEL.EXE | 107.154.76.47:443 | download.prosystemfx.com | Incapsula Inc | US | unknown |
Domain | IP | Reputation |
---|---|---|
training.prosystemfx.net |
| malicious |
www.bing.com |
| whitelisted |
download.prosystemfx.com |
| unknown |
z003download.cchaxcess.com |
| unknown |