URL: | https://www.trellix.com/en-us/about/legal/cloud-terms-of-service.html |
Full analysis: | https://app.any.run/tasks/f559400a-971e-4e17-9d05-1ffbe2750149 |
Verdict: | Malicious activity |
Analysis date: | April 01, 2023, 11:22:54 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | B50AF243E80FA7548BCFEFA94E3C673E |
SHA1: | 20F15A10CF604B1E1A42E53055EC3ECC313A1C3F |
SHA256: | 5C0EF40B39D08A2745FCA716709D6A45075BDDD92239221EAD8B548B85D1B2FD |
SSDEEP: | 3:N8DSLeURA8flEQ+RbQraJ:2OLlRA8OQ+Nz |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1272 | "C:\Program Files\Internet Explorer\iexplore.exe" "https://www.trellix.com/en-us/about/legal/cloud-terms-of-service.html" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3052 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1272 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
(PID) Process: | (1272) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPDaysSinceLastAutoMigration |
Value: 0 | |||
(PID) Process: | (1272) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPLastLaunchHighDateTime |
Value: 30847387 | |||
(PID) Process: | (1272) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 30847437 | |||
(PID) Process: | (1272) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (1272) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (1272) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
(PID) Process: | (1272) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (1272) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (1272) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (1272) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3052 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25 | binary | |
MD5:1BC96B4B2B49FAA264A86E5BBE532A8E | SHA256:16842F06E87AD474B29EA41F23B435DE3548B6C97DCBF4433788DD6CADA4CCCD | |||
3052 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\common.min[1].css | text | |
MD5:972EE964B0F223EDBF4B734CC3A991BC | SHA256:228F6701EF7AB18049DF2764A11527864E914F8347DEF3E1145240F99DF27678 | |||
3052 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\VN2BGKLA.txt | text | |
MD5:5866AD04BFF08FEB5043E1D61613CCBA | SHA256:A92371BE8CC2555F3CEAFE4E25EEFF1C709D1491CDBD849089CCBD46ACAF52FF | |||
3052 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_F5CD53C0F75D2EB154F7AB8FA5FE7C80 | der | |
MD5:55C24A048A7A7D4CF8CEB29AE21893F6 | SHA256:F12F42B99CF663E735311D15EBF3A18AAAA615B1F71007E6E3B22A1EC3FA3268 | |||
3052 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:DCDD284CA565F5AC47EAAC097A31BF14 | SHA256:09980CE537741DA4706679DC45EB302BCE7FE06A92B6F06FA500A96BA7CC7A51 | |||
3052 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_F5CD53C0F75D2EB154F7AB8FA5FE7C80 | binary | |
MD5:0369982C0A26B9AFE26BF88CACA1EB06 | SHA256:3793CFB15ECA239418A0992314B1E1219B0D1648E248B91450E4B75A503E8B20 | |||
3052 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25 | der | |
MD5:59C691C39E650BECA6272084B7DF78FD | SHA256:96FC46B10AE53C2F741531B23663A7959556C5C7E5981FBCAC11B13800D60246 | |||
3052 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\cloud-terms-of-service[1].htm | html | |
MD5:1592058F1CDAF33CB88E020FD16321C6 | SHA256:8E45216D868E7DE68E77B701FC88C154F00B8B11432EB2A718FDC568CDA00AD0 | |||
3052 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\newco.min[1].js | text | |
MD5:A6BF878BE4F19A7E2EB2A47EB39DB766 | SHA256:3B55FC932CCB7483627334C74AA93A9CCFC05E27B7663EF7917090A959892458 | |||
3052 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | compressed | |
MD5:F7DCB24540769805E5BB30D193944DCE | SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3052 | iexplore.exe | GET | 200 | 172.64.155.188:80 | http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D | US | der | 1.42 Kb | whitelisted |
3052 | iexplore.exe | GET | 200 | 104.18.20.226:80 | http://ocsp.globalsign.com/gsgccr3dvtlsca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQoKOHJRQbCE%2B3DXqwFiztBxLYdhwQUDZjAc3%2Brvb3ZR0tJrQpKDKw%2Bx3wCDC3apvNZ1M5Fj%2BmD8Q%3D%3D | US | der | 1.38 Kb | whitelisted |
3052 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D | US | der | 471 b | whitelisted |
3052 | iexplore.exe | GET | 200 | 52.222.226.205:80 | http://ocsp.r2m01.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBShdVEFnSEQ0gG5CBtzM48cPMe9XwQUgbgOY4qJEhjl%2Bjs7UJWf5uWQE4UCEAwieAU6H1P2l0l%2BUAhCV6w%3D | US | der | 471 b | whitelisted |
3052 | iexplore.exe | GET | 200 | 52.222.250.174:80 | http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D | US | der | 1.39 Kb | shared |
3052 | iexplore.exe | GET | 200 | 104.18.21.226:80 | http://ocsp2.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEHe9DgdC1dnp0EnXdNAqb5o%3D | US | der | 1.40 Kb | whitelisted |
3052 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D | US | der | 1.47 Kb | whitelisted |
3052 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEA95Ok0GmrFdC8AJhrPYb3E%3D | US | der | 471 b | whitelisted |
3052 | iexplore.exe | GET | 200 | 104.18.32.68:80 | http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEDW%2BdGOMs%2BneKAVwt5eAs2c%3D | US | der | 978 b | whitelisted |
3052 | iexplore.exe | GET | 200 | 108.138.2.107:80 | http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D | US | der | 1.70 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3052 | iexplore.exe | 172.64.155.188:80 | ocsp.comodoca.com | CLOUDFLARENET | US | suspicious |
3052 | iexplore.exe | 2.16.187.33:443 | www.trellix.com | Akamai International B.V. | DE | whitelisted |
3052 | iexplore.exe | 67.26.137.254:80 | ctldl.windowsupdate.com | LEVEL3 | US | malicious |
3052 | iexplore.exe | 13.32.99.34:443 | platform-api.sharethis.com | AMAZON-02 | US | suspicious |
3052 | iexplore.exe | 104.18.32.68:80 | ocsp.comodoca.com | CLOUDFLARENET | — | suspicious |
3052 | iexplore.exe | 23.35.236.237:443 | assets.adobedtm.com | AKAMAI-AS | DE | unknown |
3052 | iexplore.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
3052 | iexplore.exe | 142.250.185.195:80 | ocsp.pki.goog | GOOGLE | US | whitelisted |
3052 | iexplore.exe | 104.16.94.80:443 | 991-ckg-638.mktoweb.com | CLOUDFLARENET | — | shared |
3052 | iexplore.exe | 34.249.39.203:443 | dpm.demdex.net | AMAZON-02 | IE | unknown |
Domain | IP | Reputation |
---|---|---|
www.trellix.com |
| suspicious |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.comodoca.com |
| whitelisted |
ocsp.usertrust.com |
| whitelisted |
991-ckg-638.mktoweb.com |
| suspicious |
assets.adobedtm.com |
| whitelisted |
platform-api.sharethis.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
3052 | iexplore.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
3052 | iexplore.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
3052 | iexplore.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
3052 | iexplore.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
3052 | iexplore.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
3052 | iexplore.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
3052 | iexplore.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
3052 | iexplore.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |