URL:

https://rediscovergroup.com/#sales@rix.co.uk

Full analysis: https://app.any.run/tasks/6d783422-ea48-4cd2-9c2d-8d5647f2030a
Verdict: Malicious activity
Analysis date: December 18, 2024, 13:53:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
possible-phishing
phishing
Indicators:
MD5:

502A58B3B99920F37FB8A86991321E2D

SHA1:

714CCAE91FD197268159884A28AC8AE3B70C2722

SHA256:

899C280380235A753D1EF96B17FCDE5BAA3045EB2297ECC228BA5CE51321C3FE

SSDEEP:

3:N8qaQyAiFO:2rlAV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Phishing has been detected

      • iexplore.exe (PID: 1560)

  • SUSPICIOUS

    • Possibly a phishing URL contains email has been detected

      • iexplore.exe (PID: 1560)

  • INFO

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1040)
      • wmpnscfg.exe (PID: 1924)

    • Application launched itself

      • iexplore.exe (PID: 1560)

    • Checks supported languages

      • wmpnscfg.exe (PID: 1040)
      • wmpnscfg.exe (PID: 1924)

    • Reads the computer name

      • wmpnscfg.exe (PID: 1924)
      • wmpnscfg.exe (PID: 1040)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #POSSIBLE-PHISHING iexplore.exe wmpnscfg.exe no specs iexplore.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1040"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1560"C:\Program Files\Internet Explorer\iexplore.exe" "https://rediscovergroup.com/#sales@rix.co.uk"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1620"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1560 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1924"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
17 201
Read events
17 061
Write events
113
Delete events
27

Modification events

(PID) Process:(1620) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1620) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1620) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1560) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(1560) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(1560) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31150420
(PID) Process:(1560) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(1560) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31150420
(PID) Process:(1560) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1560) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
0
Suspicious files
19
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
1620iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:77B20B5CD41BC6BB475CCA3F91AE6E3C
SHA256:5511A9B9F9144ED7BDE4CCB074733B7C564D918D2A8B10D391AFC6BE5B3B1509
1620iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:D57174F78DB81555624C2B54861AB66F
SHA256:1C3C3538681A68CC57AEC7A5133E86E909BF4A58980BDBD3E7B6DAF156467D65
1620iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:FDD3E769141DBE6A1225273E20BE75AA
SHA256:E90475C9B97E22767518C602157615F2B4A99FDEB657DC0F5B740BC8D2D299DB
1620iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:5BB9C9B7E3954782B5E42C3077862BAB
SHA256:0514049085E6B249F2C48496E8CDA531FC58F9997DC89F3F8B9E520570A203FC
1620iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\O37FWXR3.htmbinary
MD5:FB9EFC6242FE24CABFFF01D2643CC829
SHA256:902FC0B643E3256E1309B2C04AADE8A7B0172629F4475D13B1CB7F77D8BD21F5
1620iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199binary
MD5:E935BC5762068CAF3E24A2683B1B8A88
SHA256:A8ACCFCFEB51BD73DF23B91F4D89FF1A9EB7438EF5B12E8AFDA1A6FF1769E89D
1620iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:E192462F281446B5D1500D474FBACC4B
SHA256:F1BA9F1B63C447682EBF9DE956D0DA2A027B1B779ABEF9522D347D3479139A60
1620iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:83E91714F5F20CF01BF5093C0EEF35F0
SHA256:AF435FAFFFDEFAFBFD737FA9EEEC960F01D95917515D32D7B1964A7E3BA09326
1620iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\icon-exclamation[1].pngimage
MD5:C33DE66281E933259772399D10A6AFE8
SHA256:F1591A5221136C49438642155691AE6C68E25B7241F3D7EBE975B09A77662016
1620iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:67E486B2F148A3FCA863728242B6273E
SHA256:FACAF1C3A4BF232ABCE19A2D534E495B0D3ADC7DBE3797D336249AA6F70ADCFB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
26
DNS requests
16
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1620
iexplore.exe
GET
200
84.201.210.23:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f00a5a9349651800
unknown
—
—
whitelisted
1620
iexplore.exe
GET
200
84.201.210.23:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5e22539541d96f8b
unknown
—
—
whitelisted
—
—
GET
200
195.138.255.18:80
http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgOkEGwMjMDkxXhdkzg2Wjm4Xg%3D%3D
unknown
—
—
whitelisted
1620
iexplore.exe
GET
200
104.76.201.34:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
1620
iexplore.exe
GET
200
142.250.185.163:80
http://c.pki.goog/r/r1.crl
unknown
—
—
whitelisted
1620
iexplore.exe
GET
200
142.250.186.67:80
http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEBq45CZh5KL8ELKDxLAxb88%3D
unknown
—
—
whitelisted
1620
iexplore.exe
GET
200
142.250.185.163:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
1620
iexplore.exe
GET
200
142.250.186.67:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
whitelisted
1620
iexplore.exe
GET
200
142.250.185.163:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
1560
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
1108
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
1620
iexplore.exe
199.188.205.61:443
rediscovergroup.com
NAMECHEAP-NET
US
unknown
1620
iexplore.exe
84.201.210.23:80
ctldl.windowsupdate.com
IP4NET Sp. z o.o.
PL
whitelisted
1620
iexplore.exe
104.76.201.34:80
x1.c.lencr.org
AKAMAI-AS
DE
whitelisted
1620
iexplore.exe
195.138.255.18:80
r10.o.lencr.org
AS33891 Netzbetrieb GmbH
DE
whitelisted
1620
iexplore.exe
172.217.18.10:443
fonts.googleapis.com
GOOGLE
US
whitelisted
1620
iexplore.exe
142.250.186.67:80
ocsp.pki.goog
GOOGLE
US
whitelisted
1620
iexplore.exe
188.114.96.3:443
b3c14af2.eujncps.pages.dev
CLOUDFLARENET
NL
shared

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.74.206
whitelisted
rediscovergroup.com
  • 199.188.205.61
unknown
ctldl.windowsupdate.com
  • 84.201.210.23
  • 217.20.57.19
  • 217.20.57.35
  • 84.201.210.39
  • 217.20.57.36
  • 217.20.57.20
  • 217.20.57.18
  • 217.20.57.34
whitelisted
x1.c.lencr.org
  • 104.76.201.34
whitelisted
r10.o.lencr.org
  • 195.138.255.18
whitelisted
fonts.googleapis.com
  • 172.217.18.10
whitelisted
ocsp.pki.goog
  • 142.250.186.67
whitelisted
b3c14af2.eujncps.pages.dev
  • 188.114.96.3
  • 188.114.97.3
shared
c.pki.goog
  • 142.250.185.163
whitelisted
o.pki.goog
  • 142.250.186.67
whitelisted

Threats

PID
Process
Class
Message
1108
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Pages platform for frontend developers to collaborate and deploy websites (pages .dev)
1108
svchost.exe
Misc activity
ET INFO DNS Query to Cloudflare Page Developer Domain (pages .dev)
1620
iexplore.exe
Misc activity
ET INFO Observed Cloudflare Page Developer Domain (pages .dev in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://rediscovergroup.com/#sales@rix.co.uk