URL: | https://msn.com |
Full analysis: | https://app.any.run/tasks/5d6bc025-38c7-40c7-9591-a59fb37fe18b |
Verdict: | Malicious activity |
Analysis date: | September 18, 2019, 23:51:20 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | C9FB8056737DA188F99586AC8BA8604F |
SHA1: | 1715DDBDBFBABA1AE92E9137DDD1A2B60FE8B3F6 |
SHA256: | 5C19622DAED778B8E351FCDBE5018AF04522562D22003DF77A51D02999B8DEEB |
SSDEEP: | 3:N8d2:24 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2756 | "C:\Program Files\Internet Explorer\iexplore.exe" "https://msn.com" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3396 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2756 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3500 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | — | explorer.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 68.0.1 Modules
| |||||||||||||||
2428 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 68.0.1 Modules
| |||||||||||||||
3344 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2428.0.2059158855\1504758966" -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2428 "\\.\pipe\gecko-crash-server-pipe.2428" 1152 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 68.0.1 Modules
| |||||||||||||||
2564 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2428.3.974765136\1582343930" -childID 1 -isForBrowser -prefsHandle 1316 -prefMapHandle 1336 -prefsLen 1 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2428 "\\.\pipe\gecko-crash-server-pipe.2428" 1712 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 68.0.1 Modules
| |||||||||||||||
3776 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2428.13.785817975\1819422975" -childID 2 -isForBrowser -prefsHandle 2836 -prefMapHandle 2840 -prefsLen 5996 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2428 "\\.\pipe\gecko-crash-server-pipe.2428" 2852 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 68.0.1 Modules
| |||||||||||||||
3208 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2428.20.1340749744\1374293391" -childID 3 -isForBrowser -prefsHandle 3820 -prefMapHandle 3824 -prefsLen 7233 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2428 "\\.\pipe\gecko-crash-server-pipe.2428" 3832 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 68.0.1 Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
2756 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
2756 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
3396 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@msn[1].txt | — | |
MD5:— | SHA256:— | |||
3396 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\78MDJI9U\de-ch[1].txt | — | |
MD5:— | SHA256:— | |||
3396 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat | dat | |
MD5:EF03AAA9564E4ACDECEF015D335B38E8 | SHA256:85102C11BC88D9EE01B7983A1019FDECC595F176797FBE4C36BB56646E109419 | |||
3396 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat | dat | |
MD5:05A1DDE85A56960A696EFDD58CD0BDAA | SHA256:711F26914C689558EB929E091BFC9D3F253F1C083F0DB649FDA5081FF79FF13B | |||
3396 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@msn[2].txt | text | |
MD5:FE219230B61573D5653586A78B20B1AD | SHA256:DC5C83CB5398525B6775C029F4A4BCB33211118B94F176DFD564902694C38ABC | |||
3396 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\78MDJI9U\de-ch[1].htm | html | |
MD5:7E56FDC8AF52FCBD848EE55562B52359 | SHA256:714A4882100EE0567200D49DCBBF0FE621D598F7F2D86A0247FE30F7A618FAB3 | |||
3396 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\NEW9FVMR\BBiwNf[1].png | image | |
MD5:98AA0D4C3552D47E16563B353B0152FC | SHA256:A7B3C2F1BCD9839CC41289C0D8E7EF28793AAE21B306C25DB2815E35F54D6A3B | |||
3396 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\NEW9FVMR\0a3221[1].eot | eot | |
MD5:409C3CC617F986AF2E64AF0F0FCBC532 | SHA256:7E367E5E62FFF8E3F6F268748184C1E8215CB2B834E2BB401D33963E2AB66DC3 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2428 | firefox.exe | POST | 200 | 172.217.16.131:80 | http://ocsp.pki.goog/gts1o1 | US | der | 471 b | whitelisted |
2428 | firefox.exe | GET | 200 | 2.16.186.112:80 | http://detectportal.firefox.com/success.txt | unknown | text | 8 b | whitelisted |
2428 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
2428 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
2428 | firefox.exe | POST | 200 | 172.217.16.131:80 | http://ocsp.pki.goog/gts1o1 | US | der | 471 b | whitelisted |
2428 | firefox.exe | POST | 200 | 172.217.16.131:80 | http://ocsp.pki.goog/gts1o1 | US | der | 471 b | whitelisted |
2756 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
2428 | firefox.exe | GET | 403 | 205.185.216.42:80 | http://downloadc.icecreamapps.com/ | US | html | 202 b | malicious |
2428 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
2428 | firefox.exe | GET | 404 | 205.185.216.42:80 | http://downloadc.icecreamapps.com/favicon.ico | US | html | 162 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3396 | iexplore.exe | 204.79.197.203:443 | www.msn.com | Microsoft Corporation | US | whitelisted |
3396 | iexplore.exe | 2.18.233.62:443 | c.s-microsoft.com | Akamai International B.V. | — | whitelisted |
3396 | iexplore.exe | 13.82.28.61:443 | msn.com | Microsoft Corporation | US | whitelisted |
3396 | iexplore.exe | 2.16.186.35:443 | static-global-s-msn-com.akamaized.net | Akamai International B.V. | — | whitelisted |
3396 | iexplore.exe | 40.77.226.250:443 | web.vortex.data.msn.com | Microsoft Corporation | IE | whitelisted |
2756 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2756 | iexplore.exe | 2.16.186.35:443 | static-global-s-msn-com.akamaized.net | Akamai International B.V. | — | whitelisted |
2428 | firefox.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
3396 | iexplore.exe | 2.18.232.244:443 | uhf.microsoft.com | Akamai International B.V. | — | whitelisted |
2428 | firefox.exe | 2.16.186.112:80 | detectportal.firefox.com | Akamai International B.V. | — | whitelisted |
Domain | IP | Reputation |
---|---|---|
msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
www.msn.com |
| whitelisted |
static-global-s-msn-com.akamaized.net |
| whitelisted |
c.s-microsoft.com |
| whitelisted |
web.vortex.data.msn.com |
| whitelisted |
uhf.microsoft.com |
| whitelisted |
detectportal.firefox.com |
| whitelisted |
a1089.dscd.akamai.net |
| whitelisted |
search.services.mozilla.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET INFO Observed DNS Query to .cloud TLD |
— | — | Potentially Bad Traffic | ET INFO Observed DNS Query to .cloud TLD |