URL:

https://t.edm.bell.ca/r/?id=h269b3dc5,6c873f9,2d68ab3&utm_campaign=MOB_EDM_Q1Bconnected_RET_032823_TS&utm_medium=eDM&utm_source=eDM&ext=MOB_EDM_Q1Bconnected_RET_032823_TS

Full analysis: https://app.any.run/tasks/d978832f-0278-4b0a-bffd-9e1ad2796178
Verdict: Malicious activity
Analysis date: April 10, 2023, 07:46:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

88F8EF0FC15C7738D34D37BEF48D947A

SHA1:

39808A9F22B38ECCEEA0298CB0E8368FA32BD8ED

SHA256:

A3F9EF809E321845EB537F915590059CE7301BE4C9830E3B0EE5DFCFAC666B30

SSDEEP:

3:N8DQGELHBZH2hfQzomQ6gOULUxZRokRIYmNQWrcTY3nqULUx2:2UGEDBZYQcmQq9xvyQWrt3q9x2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 888)

    • Create files in a temporary directory

      • iexplore.exe (PID: 888)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
888"C:\Program Files\Internet Explorer\iexplore.exe" "https://t.edm.bell.ca/r/?id=h269b3dc5,6c873f9,2d68ab3&utm_campaign=MOB_EDM_Q1Bconnected_RET_032823_TS&utm_medium=eDM&utm_source=eDM&ext=MOB_EDM_Q1Bconnected_RET_032823_TS"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1360"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:888 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
40 280
Read events
40 060
Write events
216
Delete events
4

Modification events

(PID) Process:(888) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(888) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(888) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(888) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(888) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(888) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(888) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(888) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(888) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(888) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
86
Text files
200
Unknown types
76

Dropped files

PID
Process
Filename
Type
1360iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
1360iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5054D3D7526395AFD1BB54714B2BD386_A03B472173FEA3B2FB0F139F91683498binary
MD5:—
SHA256:—
1360iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\NB00J02E.txttext
MD5:—
SHA256:—
1360iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5054D3D7526395AFD1BB54714B2BD386_A03B472173FEA3B2FB0F139F91683498der
MD5:—
SHA256:—
1360iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\IQ7BA06O.txttext
MD5:—
SHA256:—
1360iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\IL7IQBWQ.txttext
MD5:—
SHA256:—
1360iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\6Y88M9GS.txttext
MD5:—
SHA256:—
1360iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A37B8BA80004D3266CB4D93B2052DC10_9930CFFA1A8DC7DD2E91B8BAFFAF726Dder
MD5:—
SHA256:—
1360iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\BGW2F2KR.txttext
MD5:—
SHA256:—
1360iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A37B8BA80004D3266CB4D93B2052DC10_9930CFFA1A8DC7DD2E91B8BAFFAF726Dbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
40
TCP/UDP connections
135
DNS requests
63
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1360
iexplore.exe
GET
200
142.250.186.35:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
1360
iexplore.exe
GET
200
88.221.62.197:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTMbSIc9rRVLC%2BHkV9a%2FvDh7s6DzAQUgqJwdN28Uz%2FPe9T3zX%2BnYMYKTL8CEBF8g34hlw0y7wS4XGxkkQM%3D
unknown
der
1.55 Kb
whitelisted
1360
iexplore.exe
GET
200
88.221.62.197:80
http://ocsp.entrust.net/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBTLXNCzDvBhHecWjg70iJhBW0InywQUanImetAe733nO2lR1GyNn5ASZqsCDA7pTMMAAAAAUdN3hQ%3D%3D
unknown
der
1.55 Kb
whitelisted
1360
iexplore.exe
GET
200
88.221.62.197:80
http://ocsp.entrust.net/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTLXNCzDvBhHecWjg70iJhBW0InywQUanImetAe733nO2lR1GyNn5ASZqsCBFHTYO4%3D
unknown
der
1.54 Kb
whitelisted
1360
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQrHR6YzPN2BNbByL0VoiTIBBMAOAQUCrwIKReMpTlteg7OM8cus%2B37w3oCEAQcn8A9ePZieeu4iqwMIms%3D
US
der
312 b
whitelisted
1360
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQrHR6YzPN2BNbByL0VoiTIBBMAOAQUCrwIKReMpTlteg7OM8cus%2B37w3oCEAUJ5KI5yEFnQrM2PaBHYwk%3D
US
der
312 b
whitelisted
1360
iexplore.exe
GET
200
88.221.62.197:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTMbSIc9rRVLC%2BHkV9a%2FvDh7s6DzAQUgqJwdN28Uz%2FPe9T3zX%2BnYMYKTL8CEEKJgMUzq7QCJq4HpFusys8%3D
unknown
der
1.55 Kb
whitelisted
1360
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?96d09070068e559f
US
compressed
4.70 Kb
whitelisted
1360
iexplore.exe
GET
200
108.138.2.107:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
1360
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1360
iexplore.exe
88.221.62.197:80
ocsp.entrust.net
AKAMAI-AS
DE
unknown
1360
iexplore.exe
104.106.186.36:443
www.bell.ca
AKAMAI-AS
US
unknown
1360
iexplore.exe
3.96.245.34:443
—
AMAZON-02
CA
unknown
1360
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
1360
iexplore.exe
2.19.228.222:443
assets.adobedtm.com
AKAMAI-AS
FR
unknown
888
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1360
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
—
—
52.210.192.50:443
dpm.demdex.net
AMAZON-02
IE
unknown
888
iexplore.exe
2.23.209.149:443
www.bing.com
Akamai International B.V.
GB
suspicious
1360
iexplore.exe
46.137.128.22:443
somni.bell.ca
AMAZON-02
IE
unknown

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.entrust.net
  • 88.221.62.197
whitelisted
www.bell.ca
  • 104.106.186.36
  • 23.4.42.69
  • 104.124.156.249
  • 23.35.165.102
  • 23.7.132.149
  • 96.6.225.105
  • 184.29.164.70
suspicious
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 2.23.209.149
  • 2.23.209.130
  • 2.23.209.140
  • 2.23.209.165
  • 2.23.209.182
  • 2.23.209.133
  • 2.23.209.187
whitelisted
assets.adobedtm.com
  • 2.19.228.222
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
s.go-mpulse.net
  • 2.23.196.132
whitelisted
dpm.demdex.net
  • 52.210.192.50
  • 99.80.123.25
  • 34.249.44.119
  • 34.243.155.182
  • 54.228.21.106
  • 52.51.141.47
  • 34.241.198.189
  • 52.18.161.223
whitelisted
c.go-mpulse.net
  • 23.215.21.253
whitelisted

Threats

PID
Process
Class
Message
1360
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1360
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1360
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1360
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://t.edm.bell.ca/r/?id=h269b3dc5,6c873f9,2d68ab3&utm_campaign=MOB_EDM_Q1Bconnected_RET_032823_TS&utm_medium=eDM&utm_source=eDM&ext=MOB_EDM_Q1Bconnected_RET_032823_TS