URL: | https://captcha.bot/verify/guild/497312527093334036/SKLCK52TV5JJDOLRLPCNJPEKTT2WSE5U2SWIFTHFJERQZBGMTPSKKWVD7TGNCETU7SMTHNHFJV6KZVEE6EA |
Full analysis: | https://app.any.run/tasks/268deed6-4ab8-4086-82f5-51181db211c3 |
Verdict: | Malicious activity |
Analysis date: | May 20, 2022, 23:11:25 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 1AACD4A457605C710E10360272BEA631 |
SHA1: | 962A4B6FB4956A79140107B193DB087BF717AFA0 |
SHA256: | ABACAA0B291B7E1F01F60BD1A6BB5A58B836E6E4DE7E1CB3EF84F399922220BA |
SSDEEP: | 3:N8ZV5LHND7CZCcSWOQXmcn4mxzQGctrx4lFsj3fvL0gExirhPlK/hsk:2zDs60XmcnnxOtrxyWj3fAb69K/v |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
788 | "C:\Program Files\Internet Explorer\iexplore.exe" "https://captcha.bot/verify/guild/497312527093334036/SKLCK52TV5JJDOLRLPCNJPEKTT2WSE5U2SWIFTHFJERQZBGMTPSKKWVD7TGNCETU7SMTHNHFJV6KZVEE6EA" | C:\Program Files\Internet Explorer\iexplore.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
4040 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:788 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
4040 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\SKLCK52TV5JJDOLRLPCNJPEKTT2WSE5U2SWIFTHFJERQZBGMTPSKKWVD7TGNCETU7SMTHNHFJV6KZVEE6EA[1].htm | html | |
MD5:C6324DD31E33BDBAA8D63CA18E0A975E | SHA256:73835EAB02837C0A88E14868EF7B7E1C0A1B67199EFB414DFEBB70D99A314829 | |||
4040 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\app.5f61f389[1].js | text | |
MD5:B123DD675EF975F9845D3EC2E40314DC | SHA256:F4E1F46EA332C307E96065E0147B52A2E57BA730132B0FC94A79A1FA9B002A06 | |||
4040 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 | der | |
MD5:47020B685E77ECD74ABC9ADCE105AD13 | SHA256:558C89968EE2679A433CC03190339A000DEDD32D1E7A21B9929DD7631C4211BD | |||
4040 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:0F80D39D5E72150B7354DCA60F00B874 | SHA256:35CD2C6C7AF3AD6A4495FC92AFED60A40C0212AA587DE1C8B918CD883AB6F1F8 | |||
4040 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA | der | |
MD5:876BB087B3EB935A4DA2E5E7B74DC034 | SHA256:0B332FABB7D73FBA30142FB2A062431AC432BD49FBF7BD71416B00A368770E64 | |||
4040 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA | der | |
MD5:5A11C6099B9E5808DFB08C5C9570C92F | SHA256:91291A5EDC4E10A225D3C23265D236ECC74473D9893BE5BD07E202D95B3FB172 | |||
4040 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\chunk-0a6dc46f.41c67663[1].js | text | |
MD5:C57EB046088B6AB1054530BC8A372DFD | SHA256:F8506208C3295A0C3FFCECEC6E6B1C0BB8E7CE301E75131FC3F0902E10532FD9 | |||
4040 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\app.a9cc3197[1].css | text | |
MD5:B8C313A7A45BF9EACAFC7AF635F63278 | SHA256:D1D474D4C196D8D59B74CC560E69F2D0E15F109E635A12494BE97E1EF26CB1EA | |||
4040 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA | binary | |
MD5:2AE956831E0C02681776B3AA2EA49C8E | SHA256:A6A68ECCF869D182F622722D201E025576B02EEDE979DB5E75D04833AEFEA22B | |||
4040 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 | binary | |
MD5:E20EA9648560572C96FE8FA909FE5BB5 | SHA256:C3D03B6063F3B5D96D5F374FA6E7432F27865AE455A20E1FB93F68CD0325ACA1 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
4040 | iexplore.exe | GET | 200 | 142.250.184.195:80 | http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D | US | der | 1.41 Kb | whitelisted |
4040 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D | US | der | 1.47 Kb | whitelisted |
4040 | iexplore.exe | GET | 200 | 142.250.184.195:80 | http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D | US | der | 724 b | whitelisted |
788 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D | US | der | 1.47 Kb | whitelisted |
4040 | iexplore.exe | GET | 200 | 142.250.184.195:80 | http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCdUrA%2FwvrytArhIvu6cF3d | US | der | 472 b | whitelisted |
4040 | iexplore.exe | GET | 200 | 142.250.184.195:80 | http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDExSUZ712qmxLhqE9UUaDV | US | der | 472 b | whitelisted |
4040 | iexplore.exe | GET | 200 | 142.250.184.195:80 | http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEG3aTvFLTYzNCmxS2fUJutw%3D | US | der | 471 b | whitelisted |
4040 | iexplore.exe | GET | 200 | 142.250.184.195:80 | http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCHXS%2FWwGsOSRJbmAIB8NC3 | US | der | 472 b | whitelisted |
4040 | iexplore.exe | GET | 200 | 209.197.3.8:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5d7b03af8a3f6997 | US | compressed | 4.70 Kb | whitelisted |
4040 | iexplore.exe | GET | 200 | 209.197.3.8:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?84e65fa95d72fa7a | US | compressed | 4.70 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4040 | iexplore.exe | 172.217.16.130:443 | pagead2.googlesyndication.com | Google Inc. | US | whitelisted |
4040 | iexplore.exe | 209.197.3.8:80 | ctldl.windowsupdate.com | Highwinds Network Group, Inc. | US | whitelisted |
4040 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
4040 | iexplore.exe | 104.18.47.230:443 | static.cloudflareinsights.com | Cloudflare Inc | US | malicious |
4040 | iexplore.exe | 142.250.184.195:80 | ocsp.pki.goog | Google Inc. | US | whitelisted |
4040 | iexplore.exe | 188.114.97.10:443 | captcha.bot | Cloudflare Inc | US | malicious |
788 | iexplore.exe | 188.114.97.10:443 | captcha.bot | Cloudflare Inc | US | malicious |
788 | iexplore.exe | 204.79.197.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
4040 | iexplore.exe | 142.250.185.163:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
4040 | iexplore.exe | 142.250.185.138:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
captcha.bot |
| malicious |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
pagead2.googlesyndication.com |
| whitelisted |
static.cloudflareinsights.com |
| whitelisted |
ocsp.pki.goog |
| whitelisted |
googleads.g.doubleclick.net |
| whitelisted |
fundingchoicesmessages.google.com |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
api.bing.com |
| whitelisted |