URL: | http://191.101.20.27/xp/sxdDxAVANExDJko.php |
Full analysis: | https://app.any.run/tasks/3b8c356c-fb3e-4459-910d-e609e2c669f2 |
Verdict: | Malicious activity |
Analysis date: | March 22, 2019, 04:10:49 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 22382B39F006D0D7CBE4FF9F72642C5B |
SHA1: | 9AE6A56EF84875E4C154108F042B15E774720C4E |
SHA256: | A24418389694ACF0D15A6765DEA8EBCBBAA7540C1E30F63C9BD480B2F400683A |
SSDEEP: | 3:N1KkU1BSCWvH:CkUrSCWvH |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1920 | "C:\Program Files\Internet Explorer\iexplore.exe" http://191.101.20.27/xp/sxdDxAVANExDJko.php | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2572 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1920 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 3221225477 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
1580 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" /o /eo /l /b /id 2572 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | — | iexplore.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe Acrobat Reader DC Exit code: 0 Version: 15.23.20070.215641 | ||||
2248 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" /o /eo /l /b /id 2572 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | — | iexplore.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe Acrobat Reader DC Exit code: 1 Version: 15.23.20070.215641 | ||||
2328 | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe | — | svchost.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Version: 26,0,0,131 | ||||
1588 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer /o /eo /l /b /id 2572 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | — | AcroRd32.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe Acrobat Reader DC Exit code: 1 Version: 15.23.20070.215641 | ||||
128 | "C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -cp "C:\PROGRA~1\Java\JRE18~1.0_9\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.11.92.2" "update" | C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe | — | iexplore.exe |
User: admin Company: Oracle Corporation Integrity Level: LOW Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.920.14 | ||||
2920 | "C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -cp "C:\PROGRA~1\Java\JRE18~1.0_9\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.timestamp.11.92.2" "1553227875" | C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe | — | iexplore.exe |
User: admin Company: Oracle Corporation Integrity Level: LOW Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.920.14 | ||||
3888 | "C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -cp "C:\PROGRA~1\Java\JRE18~1.0_9\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.suppression.11.92.2" "false" | C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe | — | iexplore.exe |
User: admin Company: Oracle Corporation Integrity Level: LOW Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.920.14 | ||||
928 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1920 CREDAT:71940 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
1920 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
1920 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
2572 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LS5S2NMY\windows_ie[1].jsp | — | |
MD5:— | SHA256:— | |||
2572 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@java[1].txt | text | |
MD5:8B7FD6A7524B08019BE36A9A0488773E | SHA256:14BCDAFFB938838F229F04AE5E5BEF9D3781DEA50D1FAC836E3C01E368B136C7 | |||
2572 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat | dat | |
MD5:F45FBEEA725D1D0E0499BA4DFC06211B | SHA256:5C7DDD936C07155B6DF1A9A69AFF8EAC7EB645C2D68C42BC106D2F9CF9557F84 | |||
2572 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LS5S2NMY\windows_ie[1].htm | html | |
MD5:36DC84FC969609E82F5FF8DDC14064D1 | SHA256:287DF8BF944BF2AFA2490AF0FBE85BA372201753A9D6A28FE2500BBF2653E985 | |||
2572 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019032220190323\index.dat | dat | |
MD5:ED49D54AD68FF7ED2C5AAB30B2C4EF81 | SHA256:6B4AC7D65EDBE3422EC2C73B9F81BD7BD299F71BE34E564C14888928DF983299 | |||
1920 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019032220190323\index.dat | dat | |
MD5:1046F2D27336557D2E71E6E4C85DAE8C | SHA256:B99A1526544CA111402461AF51D1E28E5F966C34995E91BAA8A0E29274218673 | |||
2572 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\IW3LJ1QR\global[1].js | text | |
MD5:6AB190472F5A9DE6E31A60171CFB3A14 | SHA256:89B82B7E2E33171400D3860477D7141A3549352C7C3ED2616A501F7C65E30753 | |||
2572 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.dat | dat | |
MD5:845DD688A5A6D58ECE07786B86E74B6B | SHA256:DC4C575DF1318C85EC647108DC6568776CFE56B1214027E212CDFD8B399C99F6 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2572 | iexplore.exe | GET | 301 | 184.31.91.194:80 | http://java.com/inst-dl-redirect | NL | — | — | whitelisted |
2572 | iexplore.exe | GET | 301 | 184.31.91.194:80 | http://java.com/inst-dl-redirect/ | NL | — | — | whitelisted |
2572 | iexplore.exe | GET | 200 | 191.101.20.27:80 | http://191.101.20.27/xp/sxdDxAVANExDJko.php | NL | html | 8.16 Kb | suspicious |
1920 | iexplore.exe | GET | 404 | 191.101.20.27:80 | http://191.101.20.27/favicon.ico | NL | html | 329 b | suspicious |
928 | iexplore.exe | GET | 200 | 191.101.20.27:80 | http://191.101.20.27/xp/sxdDxAVANExDJko.php | NL | html | 8.16 Kb | suspicious |
928 | iexplore.exe | GET | 200 | 191.101.20.27:80 | http://191.101.20.27/xp/sxdDxAVANExDJko.php | NL | html | 8.16 Kb | suspicious |
2060 | jp2launcher.exe | GET | 404 | 191.101.20.27:80 | http://191.101.20.27/xp/Show/class.class | NL | html | 337 b | suspicious |
2060 | jp2launcher.exe | GET | 404 | 191.101.20.27:80 | http://191.101.20.27/xp/Show/class.class | NL | html | 337 b | suspicious |
1920 | iexplore.exe | GET | 404 | 191.101.20.27:80 | http://191.101.20.27/favicon.ico | NL | html | 329 b | suspicious |
2060 | jp2launcher.exe | GET | 404 | 191.101.20.27:80 | http://191.101.20.27/xp/Show.class | NL | html | 331 b | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1920 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
— | — | 54.72.243.109:443 | consent.trustarc.com | Amazon.com, Inc. | IE | unknown |
2572 | iexplore.exe | 172.82.228.20:443 | oracle.112.2o7.net | Adobe Systems Inc. | US | whitelisted |
2572 | iexplore.exe | 54.72.243.109:443 | consent.trustarc.com | Amazon.com, Inc. | IE | unknown |
2572 | iexplore.exe | 2.16.186.58:443 | dyn-beacon.akamaized.net | Akamai International B.V. | — | whitelisted |
1920 | iexplore.exe | 184.31.91.194:443 | java.com | Akamai International B.V. | NL | whitelisted |
2572 | iexplore.exe | 23.45.74.86:443 | c.go-mpulse.net | Akamai Technologies, Inc. | NL | whitelisted |
1920 | iexplore.exe | 191.101.20.27:80 | — | Swiftway Sp. z o.o. | NL | suspicious |
2572 | iexplore.exe | 184.31.91.194:80 | java.com | Akamai International B.V. | NL | whitelisted |
2572 | iexplore.exe | 191.101.20.27:80 | — | Swiftway Sp. z o.o. | NL | suspicious |
Domain | IP | Reputation |
---|---|---|
www.bing.com |
| whitelisted |
java.com |
| whitelisted |
consent.trustarc.com |
| shared |
dyn-beacon.akamaized.net |
| whitelisted |
s.go-mpulse.net |
| whitelisted |
oracle.112.2o7.net |
| whitelisted |
c.go-mpulse.net |
| whitelisted |
364bf6cc.akstat.io |
| whitelisted |
javadl.oracle.com |
| whitelisted |
sdlc-esd.oracle.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
2060 | jp2launcher.exe | Potentially Bad Traffic | ET POLICY Vulnerable Java Version 1.8.x Detected |
2060 | jp2launcher.exe | Potentially Bad Traffic | ET POLICY Vulnerable Java Version 1.8.x Detected |