URL: | http://link.info.myaudioteam.com/ss/c/cPgbxujDPfADR_WykzhXmfx1h_yecxKJYu07fAIVavH1VnsmBs79gwoUuQEvgnm6HXj-v8M65bq7noVJhU-v4S7K-f36ix27WXzuq3QD_Ljqf0ISycSWulM3Zs1MW9zLtJPf9W8M9P2n_5fnKTt6Jz7lKOptIvunVzZ9b2w1iQCbeHdVWB9cyhJSxhwGWQ3a2Fd7tqwzLa5fbnX_X1ZAuGP0aKektAT-LQ7Hy7RU24CO6KxI6n8VIcFyPfYA05qBuA0aINgW77eI_ofWpKh2HclVjO9naL86USiB_FX6ZZx4xjdzy-dldaPBhk7KjU9ghNQOYyALH0liyijBWtuRP-XrhUHJ-HWbKLHBvHMxjpKPxyk3PepUhfnbIY7vb1dNKdUavYKogJDu_FF4JPBK5G9QWOmCeyFafEe6ide-8v4__D3focwon1TDyJdn5guo9llSpUgIqDLSiisiWf29JoaM-yGhb8k8EO2nt39gtEs7vIDcDwU2CyUDUFQEWVW5ChWpTu0FLD6LAJrWCEqnMnivWJZesD2Z8UFYpekHT2ulspHPsn8R_WEfdIyrFOc13mlRtIp9FBY1N27LwhlrAOb0bn6ys6MbyO2GmTA3gzXUOd8keQzZ5PUvc_yxpCJwrTsUHpyZQSW1YOqK3OcIX6ElkIdE02tAto6lETErpXeXxKa8-7UB0buzYo6YhaKWSFBWoWNDrLC2oz87FbaVQHoypAlCfX-toO8iI6DXd0Izppk7g2HFaM0QneLzVWYmud6gNQ8pB4cKBzSq6gkX3zpUX1RNlNYPNvLFpKIg-0Bv6GiABAF5F7G8xrv0bwRF3-EL9Y0zEiY0GWYvKK1pOiUijdfGX4ZId3hMF7EiHki1G6exg5A_xo-PMlo4nmG2ErDaErrawHudY-lbYaFs4Xp_jodCaQQ9sozLjDP_vQZorv2hLGB0yBStrm-3EQVwgAlxstg6WrERmDr8o8aH5_hM4kvLfRCXtcGkxETVRS1LkWN9_18e18NRGBGW0LYEqqwaoM9IojOYSwnOyf6uYSXLP3qV9hYWj-vI8IVtP_Qbo0fevDKWCYya45-3IJBSJPRfYqmFqCW3UpJkfZ928w/3oi/ji_WBiY_Ruq1KWREbODhDw/h1/8ci8C8kzvhciuYo0y2WeNnrSwSqsDObwEWGJ26HB9-0 |
Full analysis: | https://app.any.run/tasks/8bb8c7b4-8cf8-40f5-902a-f10f29dcc05f |
Verdict: | Malicious activity |
Analysis date: | August 12, 2022, 18:10:46 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 0C0E46594271A8B2643753A36FD5E236 |
SHA1: | DE0EFAE54189C8F1E749CCC547475721B86E36FB |
SHA256: | 76415AAFD903EF5BA245C05E79F9AB3B672A46D5D0CAD74CE801185DA258425E |
SSDEEP: | 24:BqZGk57KL5HAvelhAbzVO1u1heL0oNSrd6RWeOTEFxChr1kI:7YmLeelWbzk16eLwcEeOoqT |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
3444 | "C:\Program Files\Internet Explorer\iexplore.exe" "http://link.info.myaudioteam.com/ss/c/cPgbxujDPfADR_WykzhXmfx1h_yecxKJYu07fAIVavH1VnsmBs79gwoUuQEvgnm6HXj-v8M65bq7noVJhU-v4S7K-f36ix27WXzuq3QD_Ljqf0ISycSWulM3Zs1MW9zLtJPf9W8M9P2n_5fnKTt6Jz7lKOptIvunVzZ9b2w1iQCbeHdVWB9cyhJSxhwGWQ3a2Fd7tqwzLa5fbnX_X1ZAuGP0aKektAT-LQ7Hy7RU24CO6KxI6n8VIcFyPfYA05qBuA0aINgW77eI_ofWpKh2HclVjO9naL86USiB_FX6ZZx4xjdzy-dldaPBhk7KjU9ghNQOYyALH0liyijBWtuRP-XrhUHJ-HWbKLHBvHMxjpKPxyk3PepUhfnbIY7vb1dNKdUavYKogJDu_FF4JPBK5G9QWOmCeyFafEe6ide-8v4__D3focwon1TDyJdn5guo9llSpUgIqDLSiisiWf29JoaM-yGhb8k8EO2nt39gtEs7vIDcDwU2CyUDUFQEWVW5ChWpTu0FLD6LAJrWCEqnMnivWJZesD2Z8UFYpekHT2ulspHPsn8R_WEfdIyrFOc13mlRtIp9FBY1N27LwhlrAOb0bn6ys6MbyO2GmTA3gzXUOd8keQzZ5PUvc_yxpCJwrTsUHpyZQSW1YOqK3OcIX6ElkIdE02tAto6lETErpXeXxKa8-7UB0buzYo6YhaKWSFBWoWNDrLC2oz87FbaVQHoypAlCfX-toO8iI6DXd0Izppk7g2HFaM0QneLzVWYmud6gNQ8pB4cKBzSq6gkX3zpUX1RNlNYPNvLFpKIg-0Bv6GiABAF5F7G8xrv0bwRF3-EL9Y0zEiY0GWYvKK1pOiUijdfGX4ZId3hMF7EiHki1G6exg5A_xo-PMlo4nmG2ErDaErrawHudY-lbYaFs4Xp_jodCaQQ9sozLjDP_vQZorv2hLGB0yBStrm-3EQVwgAlxstg6WrERmDr8o8aH5_hM4kvLfRCXtcGkxETVRS1LkWN9_18e18NRGBGW0LYEqqwaoM9IojOYSwnOyf6uYSXLP3qV9hYWj-vI8IVtP_Qbo0fevDKWCYya45-3IJBSJPRfYqmFqCW3UpJkfZ928w/3oi/ji_WBiY_Ruq1KWREbODhDw/h1/8ci8C8kzvhciuYo0y2WeNnrSwSqsDObwEWGJ26HB9-0" | C:\Program Files\Internet Explorer\iexplore.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
2604 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3444 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
(PID) Process: | (3444) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPDaysSinceLastAutoMigration |
Value: 1 | |||
(PID) Process: | (3444) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPLastLaunchLowDateTime |
Value: | |||
(PID) Process: | (3444) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPLastLaunchHighDateTime |
Value: 30977654 | |||
(PID) Process: | (3444) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
Operation: | write | Name: | NextCheckForUpdateLowDateTime |
Value: | |||
(PID) Process: | (3444) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 30977654 | |||
(PID) Process: | (3444) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
Operation: | write | Name: | CachePrefix |
Value: | |||
(PID) Process: | (3444) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (3444) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (3444) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
(PID) Process: | (3444) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3444 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63 | der | |
MD5:EE87BB11E233C12009CC11725035DBDC | SHA256:D82930A5B051B3C3F1639C24E83BDDF41D5AA66E467A0944D1AC3D59AE6330C5 | |||
3444 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:05320906DF2F74610F0E4209B2E022C3 | SHA256:F3E11AA7F087BD61612ADB86577F679139E8ACB98C942D2E39BED98FCA244DC7 | |||
2604 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D | binary | |
MD5:305C271830F946BA0D12D797588CF26F | SHA256:99242E80737778C87C6C831897C40047DF6B34886413C7020C30DCE073D7083C | |||
2604 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771 | binary | |
MD5:664E4256E986E8A1313EC0F6873D66A1 | SHA256:2B4339F7881969B194486D30A31DDA0FB77876427438796375CB4FD19DA70756 | |||
3444 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 | binary | |
MD5:1C7CB09E3CAAF1D436736713C0D1B1B2 | SHA256:F2DC09C5AC3A887DCEBF2A62736F8EF04E7AA73B876C885A74C261AA51F3FBB9 | |||
2604 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771 | der | |
MD5:EAE315910DF7E04D7386FEB6E156E0C3 | SHA256:2AE573190FA210FFD635047D18EC4D54993772FCC00F8D24A191D9542B58DACD | |||
2604 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4E38003947918DBDA4DD876FA1951C22_46332856A4066A35235938BC0D4E480F | binary | |
MD5:8D5707584AFA07515A76FD0502FB2606 | SHA256:E12BF2D8086A8272DA4EBC635D6F7095765DAF84936FE948F14D822A415B0DAA | |||
3444 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63 | binary | |
MD5:BC93CE4BA426DC5592020E47BEE551EE | SHA256:883F9CC583473F26E450B220B632B0A04756BAC25A929BD6FB618CAA1F839112 | |||
2604 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D | der | |
MD5:731961DEA42A253E0D50F88E7C104352 | SHA256:BDEF2FB73CC39298479BC53D1B3EE1BE54B0E940A7F3150E85031F9B1FA61324 | |||
2604 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4E38003947918DBDA4DD876FA1951C22_46332856A4066A35235938BC0D4E480F | der | |
MD5:92996D57E09B80AA79A8A040B5F127E4 | SHA256:624FF052CC11FA30DF72471A61D2FF15DB49501052C5A62C35A62FF27D4B9432 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2604 | iexplore.exe | GET | 200 | 192.124.249.36:80 | http://ocsp.godaddy.com//MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQDqr%2FjdzYd3qw%3D%3D | US | der | 1.74 Kb | whitelisted |
2604 | iexplore.exe | GET | 302 | 167.89.123.124:80 | http://link.info.myaudioteam.com/ss/c/cPgbxujDPfADR_WykzhXmfx1h_yecxKJYu07fAIVavH1VnsmBs79gwoUuQEvgnm6HXj-v8M65bq7noVJhU-v4S7K-f36ix27WXzuq3QD_Ljqf0ISycSWulM3Zs1MW9zLtJPf9W8M9P2n_5fnKTt6Jz7lKOptIvunVzZ9b2w1iQCbeHdVWB9cyhJSxhwGWQ3a2Fd7tqwzLa5fbnX_X1ZAuGP0aKektAT-LQ7Hy7RU24CO6KxI6n8VIcFyPfYA05qBuA0aINgW77eI_ofWpKh2HclVjO9naL86USiB_FX6ZZx4xjdzy-dldaPBhk7KjU9ghNQOYyALH0liyijBWtuRP-XrhUHJ-HWbKLHBvHMxjpKPxyk3PepUhfnbIY7vb1dNKdUavYKogJDu_FF4JPBK5G9QWOmCeyFafEe6ide-8v4__D3focwon1TDyJdn5guo9llSpUgIqDLSiisiWf29JoaM-yGhb8k8EO2nt39gtEs7vIDcDwU2CyUDUFQEWVW5ChWpTu0FLD6LAJrWCEqnMnivWJZesD2Z8UFYpekHT2ulspHPsn8R_WEfdIyrFOc13mlRtIp9FBY1N27LwhlrAOb0bn6ys6MbyO2GmTA3gzXUOd8keQzZ5PUvc_yxpCJwrTsUHpyZQSW1YOqK3OcIX6ElkIdE02tAto6lETErpXeXxKa8-7UB0buzYo6YhaKWSFBWoWNDrLC2oz87FbaVQHoypAlCfX-toO8iI6DXd0Izppk7g2HFaM0QneLzVWYmud6gNQ8pB4cKBzSq6gkX3zpUX1RNlNYPNvLFpKIg-0Bv6GiABAF5F7G8xrv0bwRF3-EL9Y0zEiY0GWYvKK1pOiUijdfGX4ZId3hMF7EiHki1G6exg5A_xo-PMlo4nmG2ErDaErrawHudY-lbYaFs4Xp_jodCaQQ9sozLjDP_vQZorv2hLGB0yBStrm-3EQVwgAlxstg6WrERmDr8o8aH5_hM4kvLfRCXtcGkxETVRS1LkWN9_18e18NRGBGW0LYEqqwaoM9IojOYSwnOyf6uYSXLP3qV9hYWj-vI8IVtP_Qbo0fevDKWCYya45-3IJBSJPRfYqmFqCW3UpJkfZ928w/3oi/ji_WBiY_Ruq1KWREbODhDw/h1/8ci8C8kzvhciuYo0y2WeNnrSwSqsDObwEWGJ26HB9-0 | US | html | 870 b | suspicious |
3444 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
3444 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D | US | der | 1.47 Kb | whitelisted |
2604 | iexplore.exe | GET | 200 | 192.124.249.36:80 | http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D | US | der | 1.69 Kb | whitelisted |
2604 | iexplore.exe | GET | 200 | 192.124.249.36:80 | http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D | US | der | 1.66 Kb | whitelisted |
2604 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://crl3.digicert.com/Omniroot2025.crl | US | der | 7.78 Kb | whitelisted |
2604 | iexplore.exe | GET | 200 | 104.18.32.68:80 | http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEBblhnjgcJQ5S9%2FbTvymO98%3D | US | der | 1.42 Kb | whitelisted |
2604 | iexplore.exe | GET | 200 | 104.18.32.68:80 | http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D | US | der | 2.18 Kb | whitelisted |
2604 | iexplore.exe | GET | 200 | 142.250.181.227:80 | http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D | US | der | 1.41 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 204.79.197.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
2604 | iexplore.exe | 167.89.118.83:80 | link.info.myaudioteam.com | SendGrid, Inc. | US | suspicious |
3444 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
3444 | iexplore.exe | 204.79.197.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
2604 | iexplore.exe | 167.89.123.124:80 | link.info.myaudioteam.com | SendGrid, Inc. | US | suspicious |
3444 | iexplore.exe | 23.216.77.69:80 | ctldl.windowsupdate.com | NTT DOCOMO, INC. | US | suspicious |
2604 | iexplore.exe | 91.199.212.52:80 | crt.sectigo.com | Comodo CA Ltd | GB | suspicious |
— | — | 152.199.19.161:443 | iecvlist.microsoft.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
— | — | 91.199.212.52:80 | crt.sectigo.com | Comodo CA Ltd | GB | suspicious |
3444 | iexplore.exe | 13.107.21.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
link.info.myaudioteam.com |
| suspicious |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
api-01.moengage.com |
| unknown |
ocsp.godaddy.com |
| whitelisted |
www.myaudioteam.com |
| suspicious |
iecvlist.microsoft.com |
| whitelisted |
r20swj13mr.microsoft.com |
| whitelisted |