URL: | http://www.bildungsberatung-noe.at |
Full analysis: | https://app.any.run/tasks/95788b3c-ee47-4302-97f9-4ec60e67502d |
Verdict: | Malicious activity |
Analysis date: | April 15, 2019, 08:11:57 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 837206AECBE7F84966BDAD652220D532 |
SHA1: | 45DDD12ADBF15293AB4113BF7778F43B5F10713D |
SHA256: | A134FA124734A40C7E438E60750EBA971140AD3AFE4C8C93914AC7F010288340 |
SSDEEP: | 3:N1KJS4sJCI+l:Cc4sJCtl |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2888 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3104 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2888 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3108 | "C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -cp "C:\PROGRA~1\Java\JRE18~1.0_9\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.11.92.2" "later" | C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe | — | iexplore.exe |
User: admin Company: Oracle Corporation Integrity Level: LOW Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.920.14 | ||||
3640 | "C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -cp "C:\PROGRA~1\Java\JRE18~1.0_9\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.timestamp.11.92.2" "1555315951" | C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe | — | iexplore.exe |
User: admin Company: Oracle Corporation Integrity Level: LOW Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.920.14 | ||||
3836 | "C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -cp "C:\PROGRA~1\Java\JRE18~1.0_9\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.suppression.11.92.2" "false" | C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe | — | iexplore.exe |
User: admin Company: Oracle Corporation Integrity Level: LOW Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.920.14 | ||||
1520 | "C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -cp "C:\PROGRA~1\Java\JRE18~1.0_9\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.11.92.2" "later" | C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe | — | iexplore.exe |
User: admin Company: Oracle Corporation Integrity Level: LOW Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.920.14 | ||||
3320 | "C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -cp "C:\PROGRA~1\Java\JRE18~1.0_9\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.timestamp.11.92.2" "1555315956" | C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe | — | iexplore.exe |
User: admin Company: Oracle Corporation Integrity Level: LOW Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.920.14 | ||||
3916 | "C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -cp "C:\PROGRA~1\Java\JRE18~1.0_9\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.suppression.11.92.2" "false" | C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe | — | iexplore.exe |
User: admin Company: Oracle Corporation Integrity Level: LOW Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.920.14 | ||||
3008 | "C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -cp "C:\PROGRA~1\Java\JRE18~1.0_9\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.11.92.2" "later" | C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe | — | iexplore.exe |
User: admin Company: Oracle Corporation Integrity Level: LOW Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.920.14 | ||||
3544 | "C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -cp "C:\PROGRA~1\Java\JRE18~1.0_9\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.timestamp.11.92.2" "1555315961" | C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe | — | iexplore.exe |
User: admin Company: Oracle Corporation Integrity Level: LOW Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.920.14 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2888 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
2888 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
3104 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019041520190416\index.dat | dat | |
MD5:66C88D5C40051FC50AE9FD298B3C309D | SHA256:B78DF0F78495C373BD32A48DF3F18DAA2AEA3E486EA61AD91ADB281A677CB463 | |||
3104 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:B0A248B8161EC6A8CA7F93FE074CCD7C | SHA256:72E124B2D534E42FF7D9E051418755EADE69B5BA8CA9462F15F1B64EC4D2B446 | |||
3104 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W1DRKYUF\caption[1].js | text | |
MD5:CA61727D1AD69452256B4DA3911A7888 | SHA256:2A2562E71192A2064885B2A97823AAB206717DEF533175F085EA7248B4B6BFE0 | |||
3104 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W1DRKYUF\jquery.event.hover[1].js | text | |
MD5:B7F140F9E505CBD01410630E6E0DF465 | SHA256:5BF138CBF27B6E64EAF824C79C589CC5372C90337FFD069FA33F4CBCAD2BEA29 | |||
3104 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W1DRKYUF\desktop.ini | ini | |
MD5:4A3DEB274BB5F0212C2419D3D8D08612 | SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38 | |||
2888 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini | ini | |
MD5:4A3DEB274BB5F0212C2419D3D8D08612 | SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38 | |||
2888 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].png | image | |
MD5:9FB559A691078558E77D6848202F6541 | SHA256:6D8A01DC7647BC218D003B58FE04049E24A9359900B7E0CEBAE76EDF85B8B914 | |||
3104 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\2T6LVJ4N\position[1].css | text | |
MD5:2B2D377E4255DD2DF9F11CAC90554152 | SHA256:04747760EC59CE4D7664E08254F4BD83AD71A55035BFFDB0599B39CFC9E64C4B |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3104 | iexplore.exe | GET | 200 | 62.99.143.44:80 | http://www.bildungsberatung-noe.at/netzwerk/media/system/js/caption.js | AT | text | 2.17 Kb | suspicious |
3104 | iexplore.exe | GET | 200 | 62.99.143.44:80 | http://www.bildungsberatung-noe.at/netzwerk/modules/mod_superfishmenu/tmpl/js/jquery.event.hover.js | AT | text | 3.51 Kb | suspicious |
3104 | iexplore.exe | GET | 200 | 62.99.143.44:80 | http://www.bildungsberatung-noe.at/netzwerk/index.php | AT | xml | 21.7 Kb | suspicious |
3104 | iexplore.exe | GET | 200 | 62.99.143.44:80 | http://www.bildungsberatung-noe.at/ | AT | html | 6.08 Kb | suspicious |
3104 | iexplore.exe | GET | 200 | 62.99.143.44:80 | http://www.bildungsberatung-noe.at/netzwerk/modules/mod_superfishmenu/tmpl/css/superfish.css | AT | text | 4.15 Kb | suspicious |
2888 | iexplore.exe | GET | 200 | 62.99.143.44:80 | http://www.bildungsberatung-noe.at/favicon.ico | AT | image | 1.12 Kb | suspicious |
3104 | iexplore.exe | GET | 200 | 62.99.143.44:80 | http://www.bildungsberatung-noe.at/netzwerk/templates/tt-bf/css/ie9only.css | AT | text | 1.55 Kb | suspicious |
3104 | iexplore.exe | GET | 200 | 62.99.143.44:80 | http://www.bildungsberatung-noe.at/netzwerk/templates/tt-bf/css/position.css | AT | text | 3.69 Kb | suspicious |
3104 | iexplore.exe | GET | 200 | 62.99.143.44:80 | http://www.bildungsberatung-noe.at/netzwerk/modules/mod_superfishmenu/tmpl/js/superfish_width_mod.js | AT | text | 5.70 Kb | suspicious |
3104 | iexplore.exe | GET | 200 | 62.99.143.44:80 | http://www.bildungsberatung-noe.at/netzwerk/templates/tt-bf/css/ie8only.css | AT | text | 1.52 Kb | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3104 | iexplore.exe | 151.101.2.109:443 | cdn.jsdelivr.net | Fastly | US | suspicious |
2888 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3104 | iexplore.exe | 172.217.18.170:80 | ajax.googleapis.com | Google Inc. | US | whitelisted |
2888 | iexplore.exe | 62.99.143.44:80 | www.bildungsberatung-noe.at | Liberty Global Operations B.V. | AT | suspicious |
3104 | iexplore.exe | 172.217.23.163:80 | fonts.gstatic.com | Google Inc. | US | whitelisted |
3104 | iexplore.exe | 172.217.22.74:80 | ajax.googleapis.com | Google Inc. | US | whitelisted |
3104 | iexplore.exe | 62.99.143.44:80 | www.bildungsberatung-noe.at | Liberty Global Operations B.V. | AT | suspicious |
3104 | iexplore.exe | 104.20.209.21:443 | pastebin.com | Cloudflare Inc | US | shared |
3104 | iexplore.exe | 172.217.23.163:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
3104 | iexplore.exe | 216.58.207.78:443 | www.youtube.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
www.bing.com |
| whitelisted |
www.bildungsberatung-noe.at |
| suspicious |
ajax.googleapis.com |
| whitelisted |
cdn.jsdelivr.net |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
pastebin.com |
| shared |
www.youtube.com |
| whitelisted |
s.ytimg.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
3104 | iexplore.exe | Misc activity | SUSPICIOUS [PTsecurity] JS obfuscation (obfuscator.io) |
3104 | iexplore.exe | Misc activity | SUSPICIOUS [PTsecurity] Redirection JScript Obfuscated (seen Banload) |
3104 | iexplore.exe | Misc activity | ET INFO JAVA - ClassID |
3104 | iexplore.exe | Generic Protocol Command Decode | SURICATA STREAM excessive retransmissions |
3104 | iexplore.exe | Generic Protocol Command Decode | SURICATA STREAM excessive retransmissions |