URL: | http://az745087.vo.msecnd.net/downloadguides/e0da600f-e809-4b05-a05e-9c47a668d7e7/SnippingToolPlusv3-4-1-0_CB-DL-Manager.exe |
Full analysis: | https://app.any.run/tasks/e85832d0-ef5b-4a8b-9fd6-b429a35497fb |
Verdict: | Malicious activity |
Analysis date: | September 30, 2020, 13:36:57 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 2E7469AD0F97146465D51F935875D7D3 |
SHA1: | 01B0960DC876FDD84C781D0A530E6DA6327817F4 |
SHA256: | 6174A827581ADE108D876254B24BB2C9EE1A71C60765CAF07C1D51DA59728940 |
SSDEEP: | 3:N1KfMGLrAcBIsBKDINZD/Vdpk6tiZS1eUpmVTW:CUcrF8aZjVdp7tiZSD0VTW |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2080 | "C:\Program Files\Internet Explorer\iexplore.exe" "http://az745087.vo.msecnd.net/downloadguides/e0da600f-e809-4b05-a05e-9c47a668d7e7/SnippingToolPlusv3-4-1-0_CB-DL-Manager.exe" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
2404 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2080 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
3180 | "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\SnippingToolPlusv3-4-1-0_CB-DL-Manager.exe" | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\SnippingToolPlusv3-4-1-0_CB-DL-Manager.exe | — | iexplore.exe |
User: admin Integrity Level: MEDIUM Exit code: 3221226540 | ||||
1128 | "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\SnippingToolPlusv3-4-1-0_CB-DL-Manager.exe" | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\SnippingToolPlusv3-4-1-0_CB-DL-Manager.exe | iexplore.exe | |
User: admin Integrity Level: HIGH | ||||
996 | "C:\Windows\system32\taskmgr.exe" /4 | C:\Windows\system32\taskmgr.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2080 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DFF0F1B49D2C99671F.TMP | — | |
MD5:— | SHA256:— | |||
2080 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\SnippingToolPlusv3-4-1-0_CB-DL-Manager.exe.yfunqyh.partial:Zone.Identifier | — | |
MD5:— | SHA256:— | |||
2080 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Cab18A4.tmp | — | |
MD5:— | SHA256:— | |||
2080 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Tar18A5.tmp | — | |
MD5:— | SHA256:— | |||
2080 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver18D5.tmp | — | |
MD5:— | SHA256:— | |||
2404 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\SnippingToolPlusv3-4-1-0_CB-DL-Manager.exe.yfunqyh.partial | executable | |
MD5:27DC7038C0B4A895ADF988AE51672B01 | SHA256:E4FF71ABA8B867C799A0F704E5D67417F3DAB0DAF5C1514A910B6E83D20988F1 | |||
2080 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{123291CF-0322-11EB-9060-12A9866C77DE}.dat | binary | |
MD5:08CAA89BF14E57E8373C5810635F48B0 | SHA256:C1A3974FE2381524FC50F070B8DEC8CFA8491357A51BBEB6510A0218B7C079DF | |||
2404 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\SnippingToolPlusv3-4-1-0_CB-DL-Manager[1].exe | executable | |
MD5:27DC7038C0B4A895ADF988AE51672B01 | SHA256:E4FF71ABA8B867C799A0F704E5D67417F3DAB0DAF5C1514A910B6E83D20988F1 | |||
2080 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\SnippingToolPlusv3-4-1-0_CB-DL-Manager.exe | executable | |
MD5:27DC7038C0B4A895ADF988AE51672B01 | SHA256:E4FF71ABA8B867C799A0F704E5D67417F3DAB0DAF5C1514A910B6E83D20988F1 | |||
2080 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203 | binary | |
MD5:168816D86545F8AFE249284E182B4F19 | SHA256:733B604576C02F883E668132FC14C539C526B8804014FB8F8DAA1743FE093684 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2080 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D | US | der | 1.47 Kb | whitelisted |
2080 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D | US | der | 1.47 Kb | whitelisted |
2080 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D | US | der | 1.47 Kb | whitelisted |
1128 | SnippingToolPlusv3-4-1-0_CB-DL-Manager.exe | POST | — | 104.41.149.192:80 | http://dlg-configs.buzzrin.de/config-from-production | US | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2080 | iexplore.exe | 152.199.19.161:443 | iecvlist.microsoft.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
1128 | SnippingToolPlusv3-4-1-0_CB-DL-Manager.exe | 104.41.149.192:80 | dlg-configs.buzzrin.de | Microsoft Corporation | US | whitelisted |
2080 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2404 | iexplore.exe | 152.199.21.175:80 | az745087.vo.msecnd.net | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
az745087.vo.msecnd.net |
| malicious |
www.bing.com |
| whitelisted |
api.bing.com |
| whitelisted |
dlg-configs.buzzrin.de |
| unknown |
iecvlist.microsoft.com |
| whitelisted |
r20swj13mr.microsoft.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
2404 | iexplore.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |