URL:

res.cdn.office.net

Full analysis: https://app.any.run/tasks/98acebc5-3837-4c4c-adbc-cdcb8dce3aad
Verdict: Malicious activity
Analysis date: March 13, 2024, 19:41:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
phishing
Indicators:
MD5:

61268D3FDA0A2A1C45934D3BFA69B803

SHA1:

ED376940705BFAF5BE5D109A1184C94638F49905

SHA256:

A21255AB06E59862D5D99F25F7D82A260625183CD58E334E559AE40E4722985A

SSDEEP:

3:lpR:PR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3652)

    • Checks supported languages

      • wmpnscfg.exe (PID: 3940)

    • Reads the computer name

      • wmpnscfg.exe (PID: 3940)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3940)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3652"C:\Program Files\Internet Explorer\iexplore.exe" "res.cdn.office.net"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3720"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3652 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3940"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
17 398
Read events
17 286
Write events
83
Delete events
29

Modification events

(PID) Process:(3652) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3652) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3652) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31094142
(PID) Process:(3652) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3652) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31094142
(PID) Process:(3652) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3652) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3652) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3652) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3652) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
8
Text files
7
Unknown types
2

Dropped files

PID
Process
Filename
Type
3720iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04der
MD5:F0BFF4A4BEEBF31BA2B67221E5DABCFA
SHA256:B95D356E16F08293BCC9BDB0A8365DBB70A6BEC7A007B20E41284F2B65B3E3AF
3720iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\UxFxStableCssWesternEuropean_6724ABFCA058F28804A76FD40AD14C9D7A6031D9[1].csstext
MD5:B3FACF280AD7C12124415DFDC290BC96
SHA256:FB384CDEB37D9E15FF825977806172D13F5FC9D5289D07DC81C5407C08B82F2B
3720iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\cloud_drop[1].svgimage
MD5:4EC53B63F37493ABF7FB9CE7EDC73C34
SHA256:B14CB354AF6DE250CC71C032A897A9F75EC2E5D3A6BFF64D7002CAE7A2BCB920
3720iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\ErrorBackground[1].pngimage
MD5:0F115D2C19D9C485EB8FF39AAC44AFE5
SHA256:A6CBAA934A88444E751973109C0675982883A2768656FB17A292F2F557E5A96C
3720iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2CB6B8BACCDF3D4DD9099BF71ACA4698_18354F7E7EFB3915AA8121408F449F38binary
MD5:6DFB601B1AA30792DC6B5E34F120EAA6
SHA256:1417BDDA89B9EE48315DD5ACD61A8B3952804B7A73A494FA710BF3CE642B4E6E
3720iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2CB6B8BACCDF3D4DD9099BF71ACA4698_18354F7E7EFB3915AA8121408F449F38binary
MD5:A7ABB0A6AA3248E0F0EF4E432DA95DAB
SHA256:E2B57FD7C75728598A465722744978AB6C45ECD8F6D65F20CAA011117453FCD2
3720iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\UxFxErrorCss_8097D4DBB3B4874308CB3816C1762BED98637360[1].csstext
MD5:88E1336D359F8FC204863E2230FDB266
SHA256:F702775B4C9ADC1E8FA61169A437B6F22556B44B9F2A975464E02432B547C13B
3720iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:15A26CA5123E1E62C07E31188C269EE4
SHA256:F024836CC075951E4DFC02ECE841D9F4AA4DF166E45BABFD6939AAFFB266AEF1
3720iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04binary
MD5:3C94420D20BEFC6AD97F6BB7EB3E45A1
SHA256:12935D6967B32B024FCB669D852566865489A4947A3581E207092AB13AFB36C1
3652iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verA35F.tmpxml
MD5:CBD0581678FA40F0EDCBC7C59E0CAD10
SHA256:159BD4343F344A08F6AF3B716B6FA679859C1BD1D7030D26FF5EF0255B86E1D9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
38
DNS requests
14
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3720
iexplore.exe
GET
404
13.107.246.62:80
http://res.cdn.office.net/
unknown
html
1.05 Kb
unknown
3720
iexplore.exe
GET
304
2.19.126.163:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?46a3771404230298
unknown
—
—
unknown
3720
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
binary
471 b
unknown
3720
iexplore.exe
GET
304
2.19.126.163:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b896de0a430f1ce1
unknown
—
—
unknown
3720
iexplore.exe
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBR2JNtr0JxEvYySpbyBWaqBmealCgQUzhUWO%2BoCo6Zr2tkr%2FeWMUr56UKgCEzMAJuYb%2Fs%2Bkz6JykEsAAAAm5hs%3D
unknown
binary
1.74 Kb
unknown
3652
iexplore.exe
GET
304
2.22.242.122:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?18014fff35250a83
unknown
—
—
unknown
3652
iexplore.exe
GET
304
2.22.242.122:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?76ad697231f9b13b
unknown
—
—
unknown
3652
iexplore.exe
GET
200
192.229.221.95:80
http://crl3.digicert.com/DigiCertGlobalRootCA.crl
unknown
binary
779 b
unknown
3652
iexplore.exe
GET
200
192.229.221.95:80
http://crl3.digicert.com/DigiCertGlobalRootG3.crl
unknown
binary
862 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3720
iexplore.exe
13.107.246.62:80
res.cdn.office.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3720
iexplore.exe
13.107.246.45:443
azurefrontdoorpages.azureedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3720
iexplore.exe
2.19.126.163:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3720
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3720
iexplore.exe
204.79.197.203:80
oneocsp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3652
iexplore.exe
2.19.120.21:443
www.bing.com
Akamai International B.V.
DE
unknown
3652
iexplore.exe
2.22.242.105:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
res.cdn.office.net
  • 13.107.246.62
  • 13.107.213.62
whitelisted
azurefrontdoorpages.azureedge.net
  • 13.107.246.45
  • 13.107.213.45
unknown
ctldl.windowsupdate.com
  • 2.19.126.163
  • 2.19.126.137
  • 2.22.242.105
  • 2.22.242.122
  • 2.22.242.121
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 2.19.120.21
  • 2.19.120.29
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
crl3.digicert.com
  • 192.229.221.95
whitelisted

Threats

PID
Process
Class
Message
3720
iexplore.exe
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Suspicious message detected (saved from)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
res.cdn.office.net