URL: | https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwangwenli.cc%2Fwp-includes%2FDDbky-dUFLglnVe1gj3y_OYxxXunR-3P%2F&data=02%7C01%7Cinformation-security%40puma.com%7Ca3234602606c403012fc08d6c809ed57%7Ccf404960c50f46d28bf3a3c957283b86%7C0%7C0%7C636916342291534696&sdata=AZbEXx015N0cX7GqKvivN1P%2FnFrnmdExBINu7jcapOo%3D&reserved=0 |
Full analysis: | https://app.any.run/tasks/bc6147d3-7a25-4d99-abb9-f24df0a2c052 |
Verdict: | Malicious activity |
Analysis date: | April 24, 2019, 01:05:50 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 456D06B8C839246196E527DB53E70775 |
SHA1: | 20D45803E745459FEF667EFE4728D7556B7F67A8 |
SHA256: | 6F00D9559E309653B43F26C4A290D92DBF1864C1197E4995E6A1C20B679DA65C |
SSDEEP: | 6:2c5V9iRXPN3z69HLW60uMK8cRb38bEVdPUFxMfPVRMemAFL+M:2yqxe9HF0W8cR3QEPFfPVRvmAFL |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2176 | "C:\Program Files\Internet Explorer\iexplore.exe" https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwangwenli.cc%2Fwp-includes%2FDDbky-dUFLglnVe1gj3y_OYxxXunR-3P%2F&data=02%7C01%7Cinformation-security%40puma.com%7Ca3234602606c403012fc08d6c809ed57%7Ccf404960c50f46d28bf3a3c957283b86%7C0%7C0%7C636916342291534696&sdata=AZbEXx015N0cX7GqKvivN1P%2FnFrnmdExBINu7jcapOo%3D&reserved=0 | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2364 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2176 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
4080 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2176 CREDAT:6406 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) |
(PID) Process: | (2176) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
(PID) Process: | (2176) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (2176) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (2176) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones |
Operation: | write | Name: | SecuritySafe |
Value: 1 | |||
(PID) Process: | (2176) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
(PID) Process: | (2176) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
Operation: | write | Name: | SavedLegacySettings |
Value: 4600000071000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000 | |||
(PID) Process: | (2176) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active |
Operation: | write | Name: | {2202C3A1-662D-11E9-A370-5254004A04AF} |
Value: 0 | |||
(PID) Process: | (2176) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
Operation: | write | Name: | Type |
Value: 4 | |||
(PID) Process: | (2176) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
Operation: | write | Name: | Count |
Value: 1 | |||
(PID) Process: | (2176) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
Operation: | write | Name: | Time |
Value: E307040003001800010006000500D001 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2176 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
2176 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
2364 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\S5DLO32K\eur03_safelinks_protection_outlook_com[1].txt | — | |
MD5:— | SHA256:— | |||
2364 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Q7PE2NWK\eur03_safelinks_protection_outlook_com[1].htm | html | |
MD5:715D64A791C7B2ECD7123CA3F4E52FAE | SHA256:4A75FA48EEE3ABF5F87409FAEABAA33330D76AF414EEFF727D4D906A0CD18D17 | |||
2364 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:853F1387BE3B40CCA2A148B43983C6AF | SHA256:7B67ED68C0B7CF24298A9942826C4E05399708033BD1C749C4CD3CFEAA683BB1 | |||
2364 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\S5DLO32K\site[1].js | text | |
MD5:2B6DF8C9D82658B8C42D6F6FE5376B2B | SHA256:F1B7A3D14A1275FC37C9C6393F74A6FAC9034DB73D44C1E1DEFC34F9666BF6D6 | |||
2364 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\S5DLO32K\safelinksv2[1].css | text | |
MD5:955BD574AEA5C196750C5779F2F89600 | SHA256:23861370472248E068061677B30A993C0DA84BA011D585C7F8D9B00077A90EE6 | |||
2364 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat | dat | |
MD5:AC5AF3FE75DDE22FB1769CF035BB3D57 | SHA256:14BFA9194F0A05C68B9C055428BAF8D78E2340D973D93277546BA553AD7E42DC | |||
2364 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019042420190425\index.dat | dat | |
MD5:12DD7B2CCA7884F8C529C14C4C042A5F | SHA256:923DD76A1026639A1A014DABC131FA10E15FF69402532F08EDB8F40C2E7D542B | |||
2176 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019042420190425\index.dat | dat | |
MD5:0F94CB6F41AED02D2102ADF7448D5E46 | SHA256:2B6AF5719AB86AA3942A4ED17A9EA5C1878F50B1455B25447A716143CDD42EB5 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
4080 | iexplore.exe | GET | 200 | 95.110.232.65:80 | http://yourtabsservices.su/images/cp/search_go.png | IT | image | 5.30 Kb | suspicious |
4080 | iexplore.exe | GET | — | 95.110.232.65:80 | http://yourtabsservices.su/js/jquery.js | IT | — | — | suspicious |
4080 | iexplore.exe | GET | 200 | 95.110.232.65:80 | http://yourtabsservices.su/ | IT | html | 14.0 Kb | suspicious |
4080 | iexplore.exe | GET | 200 | 95.110.232.65:80 | http://yourtabsservices.su/images/cp/language_DE.png | IT | image | 1.28 Kb | suspicious |
4080 | iexplore.exe | GET | 200 | 95.110.232.65:80 | http://yourtabsservices.su/images/cp/logo.gif | IT | image | 3.43 Kb | suspicious |
4080 | iexplore.exe | GET | 200 | 95.110.232.65:80 | http://yourtabsservices.su/images/cp/cart_icon.gif | IT | image | 1.30 Kb | suspicious |
4080 | iexplore.exe | GET | 200 | 95.110.232.65:80 | http://yourtabsservices.su/images/cp/m_how_to_order.gif | IT | image | 2.45 Kb | suspicious |
4080 | iexplore.exe | GET | 200 | 95.110.232.65:80 | http://yourtabsservices.su/images/cp/language_FR.png | IT | image | 1.33 Kb | suspicious |
4080 | iexplore.exe | GET | 404 | 95.110.232.65:80 | http://yourtabsservices.su/e873e08e7825229b70f3f4049cc20696d00f.gif?1556068274 | IT | html | 571 b | suspicious |
4080 | iexplore.exe | GET | — | 95.110.232.65:80 | http://yourtabsservices.su/images/cp/bgl_free_bonus.png | IT | — | — | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2176 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2176 | iexplore.exe | 13.107.21.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
4080 | iexplore.exe | 95.110.232.65:80 | yourtabsservices.su | Aruba S.p.A. | IT | suspicious |
2364 | iexplore.exe | 104.47.8.28:443 | eur03.safelinks.protection.outlook.com | Microsoft Corporation | NL | whitelisted |
4080 | iexplore.exe | 101.132.47.190:443 | wangwenli.cc | Hangzhou Alibaba Advertising Co.,Ltd. | CN | unknown |
— | — | 104.47.9.28:443 | eur03.safelinks.protection.outlook.com | Microsoft Corporation | US | whitelisted |
2364 | iexplore.exe | 104.47.9.28:443 | eur03.safelinks.protection.outlook.com | Microsoft Corporation | US | whitelisted |
2176 | iexplore.exe | 104.47.10.28:443 | eur03.safelinks.protection.outlook.com | Microsoft Corporation | IE | whitelisted |
2176 | iexplore.exe | 95.110.232.65:80 | yourtabsservices.su | Aruba S.p.A. | IT | suspicious |
Domain | IP | Reputation |
---|---|---|
eur03.safelinks.protection.outlook.com |
| whitelisted |
www.bing.com |
| whitelisted |
wangwenli.cc |
| unknown |
yourtabsservices.su |
| suspicious |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET DNS Query for .su TLD (Soviet Union) Often Malware Related |
4080 | iexplore.exe | Potentially Bad Traffic | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |
4080 | iexplore.exe | Potentially Bad Traffic | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |
4080 | iexplore.exe | Potentially Bad Traffic | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |
4080 | iexplore.exe | Potentially Bad Traffic | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |
4080 | iexplore.exe | Potentially Bad Traffic | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |
4080 | iexplore.exe | Potentially Bad Traffic | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |
4080 | iexplore.exe | Potentially Bad Traffic | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |
4080 | iexplore.exe | Potentially Bad Traffic | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |
4080 | iexplore.exe | Potentially Bad Traffic | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |