| URL: | https://training.tecocyberawareness.net?rid=AcWMvIH |
| Full analysis: | https://app.any.run/tasks/3ae38270-bc3a-46b4-8ae7-107636b563b7 |
| Verdict: | Malicious activity |
| Analysis date: | May 10, 2025, 04:52:43 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| MD5: | E10548095E734B421F439E4A1F3BA5D8 |
| SHA1: | CBE4210144F477E6F9A0FAAE1235109553AF149A |
| SHA256: | 59EE27CA85C182220035C5371A4E0B341990A9670C03C232D686271DBF7ABF87 |
| SSDEEP: | 3:N8flVLRhwXuMLAAM:2thHi1LAAM |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
151
Monitored processes
0
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
Total events
0
Read events
0
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
79
TCP/UDP connections
100
DNS requests
84
Threats
8
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.216.77.23:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.216.77.23:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.216.77.23:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 301 | 120.138.30.177:443 | https://www.focus.net.nz/news/themes/user/site/default/asset/img/blog/45658647_l.jpg | unknown | — | — | — |
— | — | GET | 200 | 146.75.121.155:443 | https://media.giphy.com/media/gg0sAafx4kZPrJff3K/giphy.gif?cid=ecf05e47jcoust0sbrm82qwh5r5dz91dlyoyqq0jhw0ap17p&rid=giphy.gif&ct=g | unknown | image | 4.43 Kb | whitelisted |
— | — | GET | 200 | 185.85.15.47:443 | https://latam.kaspersky.com/content/es-mx/images/repository/isc/2017-images/spam-phishing-img-02.jpg | unknown | image | 77.8 Kb | whitelisted |
— | — | GET | 200 | 172.64.153.55:443 | https://assets.website-files.com/5f27514986cfb678a16d1a98/css/catalyst-template.webflow.4b6c138bb.css | unknown | text | 83.6 Kb | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 239.255.255.250:1900 | — | — | — | whitelisted |
3464 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4356 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3080 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1396 | msedge.exe | 54.157.124.218:443 | training.tecocyberawareness.net | AMAZON-AES | US | unknown |
5508 | svchost.exe | 20.190.159.131:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1396 | msedge.exe | 92.123.104.33:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
1396 | msedge.exe | 146.75.121.155:443 | media.giphy.com | FASTLY | US | whitelisted |
1396 | msedge.exe | 104.18.34.201:443 | assets.website-files.com | — | — | whitelisted |
1396 | msedge.exe | 142.250.181.234:443 | ajax.googleapis.com | GOOGLE | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
training.tecocyberawareness.net |
| unknown |
login.live.com |
| whitelisted |
assets.website-files.com |
| whitelisted |
www.bing.com |
| whitelisted |
ajax.googleapis.com |
| whitelisted |
media.giphy.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
latam.kaspersky.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Possible Social Engineering Attempted | PHISHING [ANY.RUN] Possible GoPhish Toolkit Have been used to create a phishing page |
— | — | Misc activity | ET INFO Gophish X-Server |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare Network Error Logging (NEL) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare Network Error Logging (NEL) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com) |