File name: | Payment Instruction.html |
Full analysis: | https://app.any.run/tasks/005593c9-c8c5-452d-a5bc-2abd860e0c5c |
Verdict: | Malicious activity |
Analysis date: | April 15, 2019, 13:11:38 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | text/html |
File info: | HTML document, ASCII text, with very long lines |
MD5: | 0EF052599902776F9DE3AD94929779DE |
SHA1: | 8DCB0599EA41091FCC8218D35ABA708BFC783784 |
SHA256: | 6A94FFE3F0377151B928A32A295C28BD6AEE462279DBB467151471B61FBB87F7 |
SSDEEP: | 192:XaalR3N3i4GVynq2gqXoqzqVqOs2rcoCqIcA:BoRQnq2gqXoqzqVqr21CqIcA |
.html | | | HyperText Markup Language (100) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1792 | "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\Payment Instruction.html | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
1708 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1792 CREDAT:79873 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) |
(PID) Process: | (1792) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
(PID) Process: | (1792) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (1792) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (1792) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones |
Operation: | write | Name: | SecuritySafe |
Value: 1 | |||
(PID) Process: | (1792) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
(PID) Process: | (1792) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
Operation: | write | Name: | SavedLegacySettings |
Value: 4600000071000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000 | |||
(PID) Process: | (1792) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active |
Operation: | write | Name: | {0D0954E1-5F80-11E9-A09E-5254004A04AF} |
Value: 0 | |||
(PID) Process: | (1792) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
Operation: | write | Name: | Type |
Value: 4 | |||
(PID) Process: | (1792) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
Operation: | write | Name: | Count |
Value: 1 | |||
(PID) Process: | (1792) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
Operation: | write | Name: | Time |
Value: E307040001000F000D000C000000E901 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1792 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
1792 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
1708 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\igma2[1].png | image | |
MD5:A31A610F1FE4E749BCED42BF015527E5 | SHA256:960DCE45D388F5C037EC81FC9FFAB6C8ADA1EF9ACC1BAAC36BF96357AA5A0315 | |||
1708 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\igma1[1].png | image | |
MD5:11E1AFCB5B8B06B7672E12B8358CD7CC | SHA256:D18FF1F5951552C4C3CA60F70CADF5F304C93663E2ECD4A75F0023E918EE67EC | |||
1708 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\igma5[1].png | image | |
MD5:D0BA8000F01444AFA23C1B63D303040A | SHA256:95DAB2087C6F5C6266BBE82DC6AADCBA47868CCD7797B3C971AE422443AFDC9A | |||
1708 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\jquery-1.11.3.min[1].js | text | |
MD5:895323ED2F7258AF4FAE2C738C8AEA49 | SHA256:ECB916133A9376911F10BC5C659952EB0031E457F5DF367CDE560EDBFBA38FB8 | |||
1708 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019041520190416\index.dat | dat | |
MD5:27D7A2ED5D893C1D3FB37F8E4C2201E8 | SHA256:F1A88087DBF8472E1E6888AEE9774B54DF90C8164140B4C85701A21992264177 | |||
1708 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\igma6[1].png | image | |
MD5:3879D6766021D78A425EFA2FDDFFC89F | SHA256:F91FA5E2EDB890F8D03759D1DDCB600EE883D9E4C46CC0F3F8BCCF05667ED0CC | |||
1708 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\styles[1].css | text | |
MD5:57E3D0FD067217938A5351B735C32394 | SHA256:22F3296E1F1CBA865D9C4A394F643EA066926803AD96A2610A204497838EA3F6 | |||
1708 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\igma3[1].png | image | |
MD5:A2A52B27EBA21F8D98A7EB9AE67962E3 | SHA256:3538D6B8B070C7878D9E8C66F5258E4FB3B5EE142AE8D75395706D4798CA1C6F |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1708 | iexplore.exe | GET | 200 | 143.95.252.49:80 | http://usmantea.com/html/css/styles.css | US | text | 977 b | malicious |
1708 | iexplore.exe | GET | 200 | 89.161.149.56:80 | http://vitalmania.eu/images/igma1.png | PL | image | 6.45 Kb | malicious |
1708 | iexplore.exe | GET | 200 | 89.161.149.56:80 | http://vitalmania.eu/images/igma2.png | PL | image | 18.7 Kb | malicious |
1708 | iexplore.exe | GET | 200 | 205.185.208.52:80 | http://code.jquery.com/jquery-1.11.3.min.js | US | text | 37.9 Kb | whitelisted |
1708 | iexplore.exe | GET | 200 | 89.161.149.56:80 | http://vitalmania.eu/images/igma4.png | PL | image | 371 Kb | malicious |
1708 | iexplore.exe | GET | 200 | 89.161.149.56:80 | http://vitalmania.eu/images/igma5.png | PL | image | 1.16 Kb | malicious |
1708 | iexplore.exe | GET | 404 | 143.95.252.49:80 | http://usmantea.com/html/css/error.js | US | html | 1.22 Kb | malicious |
1708 | iexplore.exe | GET | 200 | 89.161.149.56:80 | http://vitalmania.eu/images/igma6.png | PL | image | 1.71 Kb | malicious |
1708 | iexplore.exe | GET | 200 | 89.161.149.56:80 | http://vitalmania.eu/images/igma3.png | PL | image | 914 b | malicious |
1792 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1792 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
1708 | iexplore.exe | 143.95.252.49:80 | usmantea.com | Colo4, LLC | US | suspicious |
1708 | iexplore.exe | 205.185.208.52:80 | code.jquery.com | Highwinds Network Group, Inc. | US | unknown |
1708 | iexplore.exe | 89.161.149.56:80 | vitalmania.eu | home.pl S.A. | PL | malicious |
Domain | IP | Reputation |
---|---|---|
www.bing.com |
| whitelisted |
code.jquery.com |
| whitelisted |
usmantea.com |
| malicious |
vitalmania.eu |
| malicious |