URL: | https://nam02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.adnocdistribution.ae%2F&data=05%7C01%7CMeshal.AlFaras%40JanusHenderson.com%7Cb35e2726aa5c4f6e802f08daa55c0d77%7C09d5c224c6244040ba7bdcfa64d7b17a%7C0%7C0%7C638004113417837859%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=yl6%2B9NGLRNLW6pcOKtK92Df1viCfzJShHOLBYGcJQ9M%3D&reserved=0 |
Full analysis: | https://app.any.run/tasks/f5a1e1fc-a5bf-474e-90d6-e81060720523 |
Verdict: | Malicious activity |
Analysis date: | October 05, 2022, 07:26:21 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | D068E0EA1A4D15C0BE49FE5A8687493C |
SHA1: | 02A28FA9FE71C2E0744099C295E89D849E7B0DBF |
SHA256: | 642D4DEFBBFB82E4727D0EA5B6E4A9B81985EBC3B63FF1135E000AE311A44270 |
SSDEEP: | 6:2bV9iRXPNHszBL7jyaJcubyAZIRXSGZVc+W0S8iMjcVaVbeAiJbUuRCmuFM3vXYm:2bqVsVGaJzyAZsFRRiMLKP7RJPYbNM |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
3132 | "C:\Program Files\Internet Explorer\iexplore.exe" "https://nam02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.adnocdistribution.ae%2F&data=05%7C01%7CMeshal.AlFaras%40JanusHenderson.com%7Cb35e2726aa5c4f6e802f08daa55c0d77%7C09d5c224c6244040ba7bdcfa64d7b17a%7C0%7C0%7C638004113417837859%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=yl6%2B9NGLRNLW6pcOKtK92Df1viCfzJShHOLBYGcJQ9M%3D&reserved=0" | C:\Program Files\Internet Explorer\iexplore.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3484 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3132 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
3132 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442 | binary | |
MD5:2D9D4C71939636C8AB7B3577D8A8DC2E | SHA256:A076841D1B98816A3DB157FD56BEB7B11E3D591B86DA90E91334B4B33654F0D5 | |||
3132 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442 | der | |
MD5:6A9C9AAAD47A858879A5655B175825C8 | SHA256:556C28AE4E43812B99A48D14E20D647BC6AF0F293429E3613C1ABCFBD249C16F | |||
3484 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA | der | |
MD5:730A4129BE3CEAF0FD2EABD552EFF5FE | SHA256:8D32F8D4B316C4B65C15BF0171D6AD826F590DBC842CE712897902B4ACA9448F | |||
3484 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6 | binary | |
MD5:8D7CD2EBCB505B93CF42B0AA9D560881 | SHA256:7805B32E034236C36B5A0607366B6A42A1931AB3A0F1CE516AD8FE56C37B3457 | |||
3484 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2F23D0F5E4D72862517E1CB26A329742_F6FACC49395CFA949BCE851E73323C49 | der | |
MD5:FC3590371542781688A0E00B5633FB09 | SHA256:9A3B60E421D01707341754521C847E2BFE5FC7D9032A8AA23435713052D86BB5 | |||
3484 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2F23D0F5E4D72862517E1CB26A329742_F6FACC49395CFA949BCE851E73323C49 | binary | |
MD5:9BDDFBEF9A059E9B4515B4D788CF0277 | SHA256:A13965E698A81502B4458EB4CED62239A2D418EF9365194758E14F01D27706B9 | |||
3132 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | image | |
MD5:DA597791BE3B6E732F0BC8B20E38EE62 | SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07 | |||
3484 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:7BF150F45CA5A1E825DFB16656D6FFCF | SHA256:93AC8C4324C66232F52EC5B8EE64B397E6C3B66680F8A418A16ACE605187458B | |||
3484 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA | der | |
MD5:5A11C6099B9E5808DFB08C5C9570C92F | SHA256:91291A5EDC4E10A225D3C23265D236ECC74473D9893BE5BD07E202D95B3FB172 | |||
3484 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_C89A7CE86B947A5BDDEC66331470004A | der | |
MD5:60DEA52ABE2437132A0387AD8BECC0AC | SHA256:AC998FB48810AEB183EC2D19CFD58B81F2243207ADD4C553E1E87F00FA6D5F3F |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3484 | iexplore.exe | GET | 301 | 2.22.89.135:80 | http://www.adnocdistribution.ae/ | unknown | — | — | malicious |
3132 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D | US | der | 1.47 Kb | whitelisted |
3484 | iexplore.exe | GET | 200 | 216.58.214.131:80 | http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB%2Fvu3PmotRDEvKn%2FiRyWpo%3D | US | der | 471 b | whitelisted |
3484 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAfy81yHqHeveu%2FpR5k1Jb0%3D | US | der | 471 b | whitelisted |
3484 | iexplore.exe | GET | 200 | 216.58.214.131:80 | http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D | US | der | 1.41 Kb | whitelisted |
3484 | iexplore.exe | GET | 200 | 108.138.2.10:80 | http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D | US | der | 1.70 Kb | whitelisted |
3484 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAGewca9P1l7sgwzOOVR2Hc%3D | US | der | 471 b | whitelisted |
3132 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
3484 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEA9iL28hwv9dUh9yOh1H1i0%3D | US | der | 471 b | whitelisted |
3484 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D | US | der | 471 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3484 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | EDGECAST | GB | whitelisted |
3132 | iexplore.exe | 204.79.197.200:443 | www.bing.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
— | — | 192.168.100.2:53 | — | — | — | whitelisted |
3484 | iexplore.exe | 93.184.221.240:80 | ctldl.windowsupdate.com | EDGECAST | GB | whitelisted |
— | — | 93.184.221.240:80 | ctldl.windowsupdate.com | EDGECAST | GB | whitelisted |
3484 | iexplore.exe | 104.47.57.28:443 | nam02.safelinks.protection.outlook.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | suspicious |
3132 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | EDGECAST | GB | whitelisted |
3484 | iexplore.exe | 2.22.89.135:80 | www.adnocdistribution.ae | Akamai International B.V. | AT | unknown |
3132 | iexplore.exe | 152.199.19.161:443 | iecvlist.microsoft.com | EDGECAST | US | whitelisted |
3484 | iexplore.exe | 2.22.89.135:443 | www.adnocdistribution.ae | Akamai International B.V. | AT | unknown |
Domain | IP | Reputation |
---|---|---|
nam02.safelinks.protection.outlook.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
www.adnocdistribution.ae |
| malicious |
www.googletagmanager.com |
| whitelisted |
www.google.com |
| whitelisted |
5p4rk13.com |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
3484 | iexplore.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
3484 | iexplore.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
3484 | iexplore.exe | Generic Protocol Command Decode | SURICATA STREAM CLOSEWAIT FIN out of window |