URL: | http://click.mail.rogersdigitalmedia.com/?qs=c56fc1e7e6ab8f36b128794c03543005dd2d18aa54e93cc78102a71791d89559a91c35e46d72cd6ed9ec6ab8865ac18ab016bfe5839bcef9 |
Full analysis: | https://app.any.run/tasks/fc7f5bd9-c4a8-4e9f-8888-1205c0a6a635 |
Verdict: | Malicious activity |
Analysis date: | April 25, 2019, 15:24:54 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 94C0AF411D6ED7CAFC839C141B64AE83 |
SHA1: | 4762BA7817596E75A0B715B5D3911E92BE09E4FF |
SHA256: | AA743182E5FCAD20C7E5C1D93FD91A5D5C69E8F732C1FA3BE749294892BDADD7 |
SSDEEP: | 3:N1KdJM1IEIcmMJEyNgHPgLUAcRVQRnBXhAGFdMXbdLoVRTBPaqA53XjGAA:Cg66EyNcgtnBR7MXbBiVa753X6AA |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2824 | "C:\Program Files\Internet Explorer\iexplore.exe" http://click.mail.rogersdigitalmedia.com/?qs=c56fc1e7e6ab8f36b128794c03543005dd2d18aa54e93cc78102a71791d89559a91c35e46d72cd6ed9ec6ab8865ac18ab016bfe5839bcef9 | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3324 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2824 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2864 | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe | — | svchost.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Version: 26,0,0,131 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2824 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
2824 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
3324 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\78RPK0DP\edit-profile[1].txt | — | |
MD5:— | SHA256:— | |||
3324 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\desktop.ini | ini | |
MD5:4A3DEB274BB5F0212C2419D3D8D08612 | SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38 | |||
3324 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\78RPK0DP\rdm-daac-notice-public[1].css | text | |
MD5:49802E1D101BE4F1A70B8306F16F27ED | SHA256:739D9EE10E9BA83FE821F8C9984EF18E8BB6E304E00356C5EAFFF9545DA10F26 | |||
3324 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:489F7BEB8A188F13A3D6C44E81632153 | SHA256:4CFA8566013AA4600993E0C2803B65F2414FA83626C0E58CF11804A5026F7F7A | |||
3324 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\78RPK0DP\style[1].css | text | |
MD5:256EDCA012B83C26E0891F7DD59D0CE4 | SHA256:FF140F38888BC685FAA9C7D0FDFDBF262397314F573E71C23CCD050C7632CA13 | |||
3324 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat | dat | |
MD5:680BFDC1AA4E089625D1542052E976FC | SHA256:782320EE82786E746C4A7AF0756328515C886684D06E650A8ACAB53B4F5938EF | |||
3324 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9E9PXUKI\stickyads[1].css | text | |
MD5:E3423ACFD9A87D1CF4B583160E2B9D4F | SHA256:28D5EB3E173B9662CB75DD33663398661B2F372A4D42EAAA095E2B312C6BD7A3 | |||
3324 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CUOS3H85\desktop.ini | ini | |
MD5:4A3DEB274BB5F0212C2419D3D8D08612 | SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3324 | iexplore.exe | GET | 200 | 8.253.207.120:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | US | compressed | 55.6 Kb | whitelisted |
3324 | iexplore.exe | GET | 302 | 68.232.203.70:80 | http://click.mail.rogersdigitalmedia.com/?qs=c56fc1e7e6ab8f36b128794c03543005dd2d18aa54e93cc78102a71791d89559a91c35e46d72cd6ed9ec6ab8865ac18ab016bfe5839bcef9 | US | html | 199 b | suspicious |
2824 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
3324 | iexplore.exe | GET | 200 | 52.85.188.202:80 | http://x.ss2.us/x.cer | US | der | 1.27 Kb | whitelisted |
3324 | iexplore.exe | GET | 404 | 74.125.206.82:80 | http://html5shim.googlecode.com/svn/trunk/html5.js | US | html | 1.54 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3324 | iexplore.exe | 68.232.203.70:80 | click.mail.rogersdigitalmedia.com | ExactTarget, Inc. | US | suspicious |
2824 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3324 | iexplore.exe | 2.19.38.27:443 | www.570news.com | Akamai International B.V. | — | whitelisted |
3324 | iexplore.exe | 74.125.206.82:80 | html5shim.googlecode.com | Google Inc. | US | whitelisted |
3324 | iexplore.exe | 104.19.199.151:443 | cdnjs.cloudflare.com | Cloudflare Inc | US | shared |
3324 | iexplore.exe | 2.18.232.23:443 | assets.adobedtm.com | Akamai International B.V. | — | whitelisted |
3324 | iexplore.exe | 216.58.206.10:443 | ajax.googleapis.com | Google Inc. | US | whitelisted |
3324 | iexplore.exe | 54.230.93.98:443 | utility.rogersmedia.com | Amazon.com, Inc. | US | unknown |
3324 | iexplore.exe | 52.203.61.122:443 | dsm-pet.herokuapp.com | Amazon.com, Inc. | US | unknown |
3324 | iexplore.exe | 23.45.98.72:443 | use.typekit.net | Akamai International B.V. | NL | whitelisted |
Domain | IP | Reputation |
---|---|---|
click.mail.rogersdigitalmedia.com |
| suspicious |
www.bing.com |
| whitelisted |
www.570news.com |
| unknown |
html5shim.googlecode.com |
| whitelisted |
cdnjs.cloudflare.com |
| whitelisted |
assets.adobedtm.com |
| whitelisted |
rpxnow.com |
| shared |
ajax.googleapis.com |
| whitelisted |
s7.addthis.com |
| whitelisted |
dsm-pet.herokuapp.com |
| unknown |