URL: | https://app.letsdefend.io/download/downloadfile/50459310eded4c520ab5c9e3626a9300.zip/ |
Full analysis: | https://app.any.run/tasks/b79efeeb-5b5d-48c2-a0bb-713c8b35e43c |
Verdict: | Malicious activity |
Analysis date: | December 05, 2022, 16:58:13 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 02123829E5CD785EC569F9396C65294F |
SHA1: | 3F3427F03A10D6A2F7E5301FC327AA2744C5C668 |
SHA256: | 78D5BFAF3FA6293781ECDB7B6460CAF98550C866E3C0282EF3B105FA57186240 |
SSDEEP: | 3:N8aiwBADA14n4XJtIAHJW3EXuzGXhShfMgn:2aF2DA68vxJW3bGxOTn |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1872 | "C:\Program Files\Internet Explorer\iexplore.exe" "https://app.letsdefend.io/download/downloadfile/50459310eded4c520ab5c9e3626a9300.zip/" | C:\Program Files\Internet Explorer\iexplore.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3128 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1872 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
3128 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 | binary | |
MD5:859AE0459089E1E055884C64C122B48B | SHA256:E2ADC6F35B5F3DE2911A0E211728E09A2AB1C3D45C8BF3776983673CFA8152C7 | |||
3128 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0632D4BD13CD16A1964B60B19DCF1CC3 | der | |
MD5:53ED5941C8EFFC7CB43E08E8E6AB62EF | SHA256:4F768592D434C44FE21FE8793F8C2FAEC65FE1CCA9DE7308DDC1D803E71B67AC | |||
3128 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 | binary | |
MD5:141D95A1368A6195ED6E18C880A9D667 | SHA256:E3D01B49B3218F18D53932E47E7A2D8003D4716CC05B047ADB2D8240612D0E26 | |||
3128 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\06E898218256DCC4B376A66633723074 | binary | |
MD5:17D243F2C48E01A8ACB5D94E44134942 | SHA256:B8DF1A5BD766E9DAA69CC7D1A610EA03B675BD09C852C1BF04A5628E4FEE75C4 | |||
3128 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:EABCE0E4297544E9200BD21C864AE996 | SHA256:47983CDA60A8038D2D76633277A091E0CC365C8BBBFE502721812F933A42A552 | |||
3128 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\Y9RKBTXC.txt | text | |
MD5:CD4FE4F1E32D323261E8D50FF4241A08 | SHA256:9E7936756C31CA625E1303B31D95A4240888BA2A90360265CD14B2B5484C4BDD | |||
3128 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\form-1[1].css | text | |
MD5:4563569F5840FD7D253F772ECA9B265B | SHA256:2A585B00A38E66767888ACEDC0C57EE69673848766C0FB1FB633B4938589D1CE | |||
3128 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61 | binary | |
MD5:729310C9B1EB8E24241E23A1537343DE | SHA256:3824F47CDDD17006D5BDD6C81BDDDB5F583BD8098307C11DBD95EFBA622BA03C | |||
3128 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | compressed | |
MD5:F7DCB24540769805E5BB30D193944DCE | SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA | |||
3128 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\06E898218256DCC4B376A66633723074 | der | |
MD5:A7577BE652F3ACD92002964C4472AABA | SHA256:5ABDFFAB981820344D66A34406CD6C6514444172C167AD98987E75AD5C1ECB85 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3128 | iexplore.exe | GET | 200 | 2.16.107.32:80 | http://e1.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTvkAFw3ViPKmUeIVEf3NC7b1ErqwQUWvPtK%2Fw2wjd5uVIw6lRvz1XLLqwCEgT%2B%2BZUHOWhxB7vOiDA9723XpQ%3D%3D | unknown | der | 346 b | whitelisted |
1872 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://crl3.digicert.com/Omniroot2025.crl | US | der | 7.78 Kb | whitelisted |
1872 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D | US | der | 1.47 Kb | whitelisted |
3128 | iexplore.exe | GET | 200 | 93.184.221.240:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?879097356f0bc050 | US | compressed | 4.70 Kb | whitelisted |
3128 | iexplore.exe | GET | 200 | 23.45.105.185:80 | http://x2.c.lencr.org/ | NL | der | 300 b | whitelisted |
3128 | iexplore.exe | GET | 200 | 2.16.107.113:80 | http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgMXdAAcNsy95LXErJsXF45aZg%3D%3D | unknown | der | 503 b | shared |
1872 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
3128 | iexplore.exe | GET | 200 | 2.16.107.32:80 | http://e1.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTvkAFw3ViPKmUeIVEf3NC7b1ErqwQUWvPtK%2Fw2wjd5uVIw6lRvz1XLLqwCEgTh%2BRh1vqfplATjPaTLQikenw%3D%3D | unknown | der | 346 b | whitelisted |
3128 | iexplore.exe | GET | 200 | 142.250.186.67:80 | http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D | US | der | 724 b | whitelisted |
3128 | iexplore.exe | GET | 200 | 23.45.105.185:80 | http://x1.c.lencr.org/ | NL | der | 717 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3128 | iexplore.exe | 172.67.72.235:443 | — | CLOUDFLARENET | US | unknown |
3128 | iexplore.exe | 2.16.107.32:80 | e1.o.lencr.org | Akamai International B.V. | DE | suspicious |
1872 | iexplore.exe | 93.184.221.240:80 | ctldl.windowsupdate.com | EDGECAST | GB | whitelisted |
1872 | iexplore.exe | 13.107.22.200:443 | www.bing.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
3128 | iexplore.exe | 93.184.221.240:80 | ctldl.windowsupdate.com | EDGECAST | GB | whitelisted |
3128 | iexplore.exe | 23.45.105.185:80 | x1.c.lencr.org | AKAMAI-AS | DE | unknown |
1872 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | EDGECAST | GB | whitelisted |
3128 | iexplore.exe | 142.250.186.67:80 | ocsp.pki.goog | GOOGLE | US | whitelisted |
3128 | iexplore.exe | 142.250.181.234:443 | fonts.googleapis.com | GOOGLE | US | whitelisted |
3128 | iexplore.exe | 138.199.37.227:443 | cdn.websitepolicies.io | Datacamp Limited | DE | suspicious |
Domain | IP | Reputation |
---|---|---|
ctldl.windowsupdate.com |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
x1.c.lencr.org |
| whitelisted |
x2.c.lencr.org |
| whitelisted |
e1.o.lencr.org |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
www.googletagmanager.com |
| whitelisted |
cdn.wpcc.io |
| whitelisted |