URL: | https://thepolicytimes.com/[email protected] |
Full analysis: | https://app.any.run/tasks/bfd7812e-2bab-41a7-bf3a-d47c4adcac53 |
Verdict: | Malicious activity |
Analysis date: | December 06, 2022, 00:55:55 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | F7D454FE4482A5A41A168836622DFA6D |
SHA1: | 6F16E518F6208047467D79D498D3615E5754A7DC |
SHA256: | 9DEAB3B352648588BBECBF416091B89D836C7F6A8ECE8AA2F901A2995273E819 |
SSDEEP: | 3:N8FAVSMGGLdjSpnJOnbWOgRA9n:2QhSp8Jgm9 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1808 | "C:\Program Files\Internet Explorer\iexplore.exe" "https://thepolicytimes.com/[email protected]" | C:\Program Files\Internet Explorer\iexplore.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
2424 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1808 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
2892 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1808 CREDAT:988459 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | — | iexplore.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
972 | C:\Windows\system32\IEEtwCollector.exe /V | C:\Windows\system32\IEEtwCollector.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: IE ETW Collector Service Version: 11.00.9600.19597 (winblue_ltsb_escrow.191216-1311) Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
2424 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5F48706060C9AB7DF4EA7D87F55ED33A | binary | |
MD5:D637D3F4937CA6B06276A2340116359E | SHA256:9094DF542A204B0FE3FC6468785814F15F099CA3BF29CD2699BA407DFF35B8EE | |||
2424 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\main[1].htm | html | |
MD5:B3ECE679F683427E78F01F22C11E1C19 | SHA256:CBAB9D5739A19E29D3136A872D7BE9CC6313C8635BAA473E549849ACBACCAF6C | |||
2424 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5F48706060C9AB7DF4EA7D87F55ED33A | der | |
MD5:27B6B1860B85E0EB5C7388A6D4AAB199 | SHA256:6C6BCBCD0E412E29A3F8FB28DDABDCE36CBF31E0B89010A873076B5CAB07F62A | |||
2424 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 | binary | |
MD5:8A05219A15306FD66E84B20E7086FEAA | SHA256:09B46A197DB2958781A334BA6B667C683E2F01DF59882BCF32387EA3D0875F99 | |||
2424 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 | binary | |
MD5:2ABF337D0B0C5A99C40BCA08B041F08B | SHA256:469FB7517A6E19AEB3C332244879CC1A80D5FCE96813BB467F8EB5702D4B6863 | |||
1808 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 | der | |
MD5:AC572CBBC82D6D652CDBE2596AEAC4EE | SHA256:50B6D8F62150A7BD25FB3E462130E8E054A0F1FB619487E8C426A4C8BF6BDCA8 | |||
2424 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:E3900D7C25CC9B6DB5CF5DA30329A25A | SHA256:0CA08F280BBBE22C6674DDF82F65971A12A44B835F6BE7B7C9C9F0D3E6F94B81 | |||
2424 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 | der | |
MD5:C4CD028E77DC29D429BA8B5626F59821 | SHA256:5661D0CC5DD7A0E55F0C9004E60BF72A991DC0F3134FA36000FE67BEC4F0BEEE | |||
1808 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xml | xml | |
MD5:CBD0581678FA40F0EDCBC7C59E0CAD10 | SHA256:159BD4343F344A08F6AF3B716B6FA679859C1BD1D7030D26FF5EF0255B86E1D9 | |||
1808 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | image | |
MD5:DA597791BE3B6E732F0BC8B20E38EE62 | SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1808 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
2424 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEAqHk4lNi9U1ZMz9RWjamvc%3D | US | der | 279 b | whitelisted |
2424 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D | US | der | 1.47 Kb | whitelisted |
2424 | iexplore.exe | GET | 200 | 184.24.77.79:80 | http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgRnGaV6izHQpY7Ru05LjrVmdA%3D%3D | US | der | 503 b | shared |
2424 | iexplore.exe | GET | 200 | 67.27.158.254:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c2c153e57c9013e9 | US | compressed | 4.70 Kb | whitelisted |
2424 | iexplore.exe | GET | 200 | 67.27.158.254:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?879097356f0bc050 | US | compressed | 61.4 Kb | whitelisted |
1808 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D | US | der | 1.47 Kb | whitelisted |
2424 | iexplore.exe | GET | 200 | 184.24.77.79:80 | http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgP6wVG1MC06T8jArjJ3L%2FTx%2Fg%3D%3D | US | der | 503 b | shared |
1808 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D | US | der | 471 b | whitelisted |
1808 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D | US | der | 1.47 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2424 | iexplore.exe | 96.16.145.230:80 | x1.c.lencr.org | AKAMAI-AS | DE | suspicious |
1808 | iexplore.exe | 204.79.197.200:443 | www.bing.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
2424 | iexplore.exe | 184.24.77.79:80 | r3.o.lencr.org | Akamai International B.V. | DE | suspicious |
2424 | iexplore.exe | 103.86.176.36:443 | — | MilesWeb Internet Services Pvt Ltd | IN | unknown |
1808 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | EDGECAST | GB | whitelisted |
2424 | iexplore.exe | 67.27.158.254:80 | ctldl.windowsupdate.com | LEVEL3 | US | malicious |
2424 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | EDGECAST | GB | whitelisted |
1808 | iexplore.exe | 13.107.21.200:443 | www.bing.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
2424 | iexplore.exe | 104.16.168.131:443 | www.hcaptcha.com | CLOUDFLARENET | — | unknown |
1808 | iexplore.exe | 103.86.176.36:443 | — | MilesWeb Internet Services Pvt Ltd | IN | unknown |
Domain | IP | Reputation |
---|---|---|
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
x1.c.lencr.org |
| whitelisted |
crl3.digicert.com |
| whitelisted |
r3.o.lencr.org |
| shared |
www.hcaptcha.com |
| whitelisted |
iecvlist.microsoft.com |
| whitelisted |
r20swj13mr.microsoft.com |
| whitelisted |