URL: | https://url736.slinks.paperlesspost.com/ls/click?upn=VKKUq34M-2BFHK-2F1kwiaMxxtK7-2BbsSm1gAoThFdH-2FRDLGYvLF0fTS0uyBrwkpKOPIM9Y3jVX1GFQ6FTfb-2B7CzxGk-2Fl3shbu7jVmJkJaOsg2N-2B00INtq0dBR6IFDioIESGfslxXjDsor-2FbiCUvzRt3wUA-3D-3DnR2s_dhSXzBLUHLDbh-2BADNakwRiAM8r0madyIevsUL3tdq6pDCtBoV904aMZ3NjZc00k1HiLx0v6bjR-2B-2BgLNbb902hwRIJnIBqgNnz148paCLT-2B7gSnOLNM1Jw0gv0soxokZSivrXEkYXgRUvTW8UquC-2FZeX7DeLE9iLgt9MOgxdLGmetBtdHdVpC4HRQbDbSK4uw-2F1A42gTd6rWmOjSlRCX9NLK4MTVV01aelT8zBJt7JvVLJp9qiDm2GCVNVhGyPB1AYNNIaDRf-2Bdt3vgfDL-2Bcx-2BS4PQXhq3WvwJiUVGYjMzYxyWNvI-2F-2BvL93oxJyqoo1tomhk6ud9HWHkdSfK2SJvNlJy2R-2BLpoydo8lNskVlPiPI-3D |
Full analysis: | https://app.any.run/tasks/a3fb3997-e2a5-44b5-970a-11aea6016d09 |
Verdict: | Malicious activity |
Analysis date: | December 05, 2022, 19:10:39 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | C9FE46C87E01A82D24A7ABB032B41394 |
SHA1: | C75251A10DFB840B0027769DB59D99624F43BB0A |
SHA256: | 946FA777EF79FD12A71BF65F96FA99D4A843764593B520B84B2BEA29008E85A4 |
SSDEEP: | 12:2U5SsRuKEEsSUQVq2gGrHjNg0BaZHNxoQqZ3HOXTL+qqSFQa4xRyRBlQ:2IUVEFVWGlg0EHgzXODL+7HalQ |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1244 | "C:\Program Files\Internet Explorer\iexplore.exe" "https://url736.slinks.paperlesspost.com/ls/click?upn=VKKUq34M-2BFHK-2F1kwiaMxxtK7-2BbsSm1gAoThFdH-2FRDLGYvLF0fTS0uyBrwkpKOPIM9Y3jVX1GFQ6FTfb-2B7CzxGk-2Fl3shbu7jVmJkJaOsg2N-2B00INtq0dBR6IFDioIESGfslxXjDsor-2FbiCUvzRt3wUA-3D-3DnR2s_dhSXzBLUHLDbh-2BADNakwRiAM8r0madyIevsUL3tdq6pDCtBoV904aMZ3NjZc00k1HiLx0v6bjR-2B-2BgLNbb902hwRIJnIBqgNnz148paCLT-2B7gSnOLNM1Jw0gv0soxokZSivrXEkYXgRUvTW8UquC-2FZeX7DeLE9iLgt9MOgxdLGmetBtdHdVpC4HRQbDbSK4uw-2F1A42gTd6rWmOjSlRCX9NLK4MTVV01aelT8zBJt7JvVLJp9qiDm2GCVNVhGyPB1AYNNIaDRf-2Bdt3vgfDL-2Bcx-2BS4PQXhq3WvwJiUVGYjMzYxyWNvI-2F-2BvL93oxJyqoo1tomhk6ud9HWHkdSfK2SJvNlJy2R-2BLpoydo8lNskVlPiPI-3D" | C:\Program Files\Internet Explorer\iexplore.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
2972 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1244 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
120 | "C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /ical "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\calendar.ics" | C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Outlook Version: 14.0.6025.1000 Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
2972 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 | binary | |
MD5:FC819347C9F611CC467341DBED4E6CBC | SHA256:D3940D60D35528CC952015A25B7D1AC42870096DEC2D15011DA6F85C745D2350 | |||
2972 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:98A9EEF1473AE7488F9DD04EF830B31F | SHA256:2493AA3B5C70CE862267C4E697D35C1BF6CD7CF515629866645CED812B60E7BA | |||
1244 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442 | der | |
MD5:503AD061073A29CEE4CB12D552F6A5B3 | SHA256:D2A97423F8B71CA1DAAC39F8A037DCA022303C1ADFBD49995EFF3B36AFFF33F9 | |||
2972 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\calendar[1].ics | text | |
MD5:2A1DC8A6A4550EBB12BAA2E7C37CD990 | SHA256:6BFBEBE9BD21D91BC12D00A3B814A1D5C173F914806575F1955AC85595C0512B | |||
1244 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 | der | |
MD5:AC572CBBC82D6D652CDBE2596AEAC4EE | SHA256:50B6D8F62150A7BD25FB3E462130E8E054A0F1FB619487E8C426A4C8BF6BDCA8 | |||
1244 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442 | binary | |
MD5:A6720CAD4CDDF21D790F31A9A6228D74 | SHA256:F1AF8D94A9FBABD2B90EA43F28BA728A92B250E005D7EB1866C6DBB71D9FA1F0 | |||
1244 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{8D92F452-74D0-11ED-80DA-12A9866C77DE}.dat | binary | |
MD5:D0A051F69978922A5FF112F7EB324C73 | SHA256:07D7378EFF506359C19F45F895FDEB375703DD474375E8CF21D71741DB4B87D6 | |||
120 | OUTLOOK.EXE | C:\Users\admin\AppData\Local\Temp\CVR8CCF.tmp.cvr | — | |
MD5:— | SHA256:— | |||
120 | OUTLOOK.EXE | C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst | — | |
MD5:— | SHA256:— | |||
2972 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\calendar.ics.3i83my6.partial | text | |
MD5:2A1DC8A6A4550EBB12BAA2E7C37CD990 | SHA256:6BFBEBE9BD21D91BC12D00A3B814A1D5C173F914806575F1955AC85595C0512B |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
120 | OUTLOOK.EXE | GET | — | 64.4.26.155:80 | http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig | US | — | — | whitelisted |
1244 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
1244 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D | US | der | 1.47 Kb | whitelisted |
2972 | iexplore.exe | GET | 200 | 93.184.221.240:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?a6345407635414c2 | US | compressed | 61.4 Kb | whitelisted |
2972 | iexplore.exe | GET | 200 | 93.184.221.240:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?54162df0b2e02304 | US | compressed | 4.70 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1244 | iexplore.exe | 204.79.197.200:443 | www.bing.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
2972 | iexplore.exe | 151.101.2.80:443 | www.paperlesspost.com | FASTLY | US | unknown |
2972 | iexplore.exe | 151.101.66.80:443 | www.paperlesspost.com | FASTLY | US | unknown |
2972 | iexplore.exe | 184.24.9.54:80 | x1.c.lencr.org | AKAMAI-AS | DE | unknown |
2972 | iexplore.exe | 93.184.221.240:80 | ctldl.windowsupdate.com | EDGECAST | GB | whitelisted |
1244 | iexplore.exe | 93.184.221.240:80 | ctldl.windowsupdate.com | EDGECAST | GB | whitelisted |
1244 | iexplore.exe | 13.107.21.200:443 | www.bing.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
— | — | 64.4.26.155:80 | config.messenger.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
1244 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | EDGECAST | GB | whitelisted |
1244 | iexplore.exe | 152.199.19.161:443 | iecvlist.microsoft.com | EDGECAST | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
x1.c.lencr.org |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
iecvlist.microsoft.com |
| whitelisted |
r20swj13mr.microsoft.com |
| whitelisted |
www.paperlesspost.com |
| unknown |
config.messenger.msn.com |
| whitelisted |