| URL: | https://thesellingchampionconsulting.com/yhe |
| Full analysis: | https://app.any.run/tasks/3141a12e-2c28-44d5-b234-4bb9cce078f8 |
| Verdict: | Malicious activity |
| Analysis date: | December 13, 2024, 20:12:22 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 1F73E2935F80DA8264A9358E02363678 |
| SHA1: | 1E99E26B6367F86FE7A4020ED6B05A6620CE07E4 |
| SHA256: | 88AB1BF70CFD5B9CC7E926BFD3D9BBB91DFEFE5FFC9D31BC85C0990D9D8A8E2B |
| SSDEEP: | 3:N8FAWoAQGlRZLGLS:29oAQGQLS |
MALICIOUS
PHISHING has been detected (SURICATA)
- msedge.exe (PID: 4792)
SUSPICIOUS
No suspicious indicators.INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
138
Monitored processes
1
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 4792 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2604 --field-trial-handle=2320,i,16194277592197507296,15814343983252007256,262144 --variations-seed-version /prefetch:3 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | msedge.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 122.0.2365.59 | ||||
Total events
0
Read events
0
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
21
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4792 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2c4d4f.TMP | binary | |
MD5:ED74D0CC3CAB53CA501F3CD6C50FAA1A | SHA256:331BB0DA5A3BE7843A14503DA9547E7309F3631916C6112882FF36D75025E7EE | |||
| 4792 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF2b7389.TMP | binary | |
MD5:15D26FA4E16467BE658F42074AC0DBAA | SHA256:D287407BD901A32E3F38F4392984507184D596C3694FAA69DD0B2E68F9F3A8FE | |||
| 4792 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ba | compressed | |
MD5:CA6E0DCAF6FE11E3B4D4D299ECBAB7A6 | SHA256:F4A93CF3834C5F3BBBAB2BA619425FB1415050A847F5BC12CD6B0BAB5E68074E | |||
| 4792 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2eb5a4.TMP | binary | |
MD5:610FDA4037DBB7F928FD68F8BBA0A0B8 | SHA256:E7B50117897E5F493BAB6FA9FCCA8D704533B82C1A3615BE90412866A453ABA1 | |||
| 4792 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b02a5b2b-01e8-4c83-8926-f55024bd786d.tmp | binary | |
MD5:53E6D9319AD04516CDE60D31358539BD | SHA256:088D9A8419DD48D2360E44CD3B8CD7A5C493EA5DDB943DD0D027FC7CDCFB9285 | |||
| 4792 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity | binary | |
MD5:0AD9B0138208910DE0B5CFE5A86464C6 | SHA256:9FA38A51506807970334AA145016EDC046B6827E0CE72513C2283669237A0CD4 | |||
| 4792 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2fa0b0.TMP | binary | |
MD5:53E6D9319AD04516CDE60D31358539BD | SHA256:088D9A8419DD48D2360E44CD3B8CD7A5C493EA5DDB943DD0D027FC7CDCFB9285 | |||
| 4792 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\27d67033-cd2e-40df-ad14-9aebcd8699af.tmp | binary | |
MD5:ED74D0CC3CAB53CA501F3CD6C50FAA1A | SHA256:331BB0DA5A3BE7843A14503DA9547E7309F3631916C6112882FF36D75025E7EE | |||
| 4792 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2b6fc0.TMP | binary | |
MD5:2A21453795942FD88CBB06714604B9FD | SHA256:5DFE0384325B556EE4B8668E502312B9BA6ADC298CD9213DDFA528CB959ADC06 | |||
| 4792 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a90e5cd9-8afa-4790-9f4b-37b45548fd63.tmp | binary | |
MD5:6AA280DCE692DE3CF8BC1548415E3B6D | SHA256:FAB416178620743A38CDAA097425B7D44D415220D63BF2E89ED18DAEC2361DDD | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
41
TCP/UDP connections
62
DNS requests
45
Threats
9
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | HEAD | 200 | 23.218.208.109:443 | https://fs.microsoft.com/fs/windows/config.json | unknown | — | — | — |
— | — | GET | 302 | 207.174.213.131:443 | https://thesellingchampionconsulting.com/yhe/ | unknown | — | — | — |
1900 | RUXIMICS.exe | GET | 200 | 23.32.238.107:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
3804 | svchost.exe | GET | 200 | 23.32.238.107:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1900 | RUXIMICS.exe | GET | 200 | 23.37.202.100:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4304 | MoUsoCoreWorker.exe | GET | 200 | 23.37.202.100:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
3804 | svchost.exe | GET | 200 | 23.37.202.100:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4304 | MoUsoCoreWorker.exe | GET | 200 | 23.32.238.107:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 302 | 104.18.95.41:443 | https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit | unknown | — | — | — |
— | — | OPTIONS | 200 | 35.190.80.1:443 | https://a.nel.cloudflare.com/report/v4?s=WhhqMPd7kIA4WHvYAy3TfzF2A6ZVWxu7hIagdLGSRvoKJ49wO9xpY0vndJZCOuMwr6l462trAn06nmjk9F1LtJpU1d3lDGWH8stur%2B1%2BQ%2Bbr%2BBM2%2FDC681DeYQ6hvA%3D%3D | unknown | — | — | — |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4792 | msedge.exe | 20.50.80.209:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
— | — | 224.0.0.251:5353 | — | — | — | unknown |
1900 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4304 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3804 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5988 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4792 | msedge.exe | 207.174.213.131:443 | thesellingchampionconsulting.com | UNIFIEDLAYER-AS-1 | US | unknown |
5668 | svchost.exe | 23.218.208.109:443 | fs.microsoft.com | AKAMAI-AS | DE | whitelisted |
4792 | msedge.exe | 172.67.192.167:443 | ynmd.avarice5.com | — | — | unknown |
1900 | RUXIMICS.exe | 23.32.238.107:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
thesellingchampionconsulting.com |
| unknown |
fs.microsoft.com |
| whitelisted |
ynmd.avarice5.com |
| unknown |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
code.jquery.com |
| whitelisted |
challenges.cloudflare.com |
| whitelisted |
cdnjs.cloudflare.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Possible Social Engineering Attempted | PHISHING [ANY.RUN] Domain has been identified as part of Storm-1747's infrastructure ( .avarice5 .com) |
— | — | Possible Social Engineering Attempted | PHISHING [ANY.RUN] Domain has been identified as part of Storm-1747's infrastructure ( .avarice5 .com) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code .jquery .com) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code .jquery .com) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare Network Error Logging (NEL) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare Network Error Logging (NEL) |