download: | XYWNk0aW9uPWuNsaWNrJntVybD1ohbdHRwsczovL2NlfcnsRpZmljYXRlLnN0cm9ufZ2VuY3J5cHRpb24ub3JnL3BhZ2VzL2Y3N2ExMzBhYzBkMGQmcmVjaXBpZW50X2lkPTU0MTUzNzg0MyZjYW1wYWlnbl9ydW5faWQ9MjYxNDM1OQ== |
Full analysis: | https://app.any.run/tasks/68a8ad73-ad5d-4bce-8133-107a0950dc5e |
Verdict: | Malicious activity |
Analysis date: | December 06, 2019, 17:09:41 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | text/html |
File info: | HTML document, ASCII text |
MD5: | 92EAC1BB4D9A1261E867F34145155AC5 |
SHA1: | A5F19DBA842FC13A8FFEA155ED9C4C936F55AF1A |
SHA256: | AFDF178C70E194A6DD397CECFA753F5ACB69AEC042FCE4EB375AD37175BD3FA2 |
SSDEEP: | 6:qF/UGVmmgtW+PjaAlXaH3+WrwDwXfbGF12fDsZwPDtwAEdB6X4QL:MxgtWWNaH3prdjGG7Dt1EdYoQL |
.html | | | HyperText Markup Language (100) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2512 | "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\XYWNk0aW9uPWuNsaWNrJntVybD1ohbdHRwsczovL2NlfcnsRpZmljYXRlLnN0cm9ufZ2VuY3J5cHRpb24ub3JnL3BhZ2VzL2Y3N2ExMzBhYzBkMGQmcmVjaXBpZW50X2lkPTU0MTUzNzg0MyZjYW1wYWlnbl9ydW5faWQ9MjYxNDM1OQ==.html | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
292 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2512 CREDAT:79873 | C:\Program Files\Internet Explorer\iexplore.exe | — | iexplore.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2264 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2512 CREDAT:137473 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2512 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
2512 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
2264 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Cab1E8A.tmp | — | |
MD5:— | SHA256:— | |||
2264 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Tar1E8B.tmp | — | |
MD5:— | SHA256:— | |||
2264 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Cab1E9B.tmp | — | |
MD5:— | SHA256:— | |||
2264 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Tar1E9C.tmp | — | |
MD5:— | SHA256:— | |||
2264 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Cab2C59.tmp | — | |
MD5:— | SHA256:— | |||
2264 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Tar2C5A.tmp | — | |
MD5:— | SHA256:— | |||
2512 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DFE017888FEB77A1EC.TMP | — | |
MD5:— | SHA256:— | |||
292 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019120620191207\index.dat | dat | |
MD5:65B145D943625FA997CD55AD111183C9 | SHA256:10C86589223B9053D6ABEC769996D1D9613E7F0D22642CD1AA15799CC5FE007B |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2264 | iexplore.exe | GET | 200 | 13.224.197.167:80 | http://x.ss2.us/x.cer | US | der | 1.27 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2512 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2264 | iexplore.exe | 13.224.197.167:80 | x.ss2.us | — | US | unknown |
2264 | iexplore.exe | 54.88.231.54:443 | certificate.strongencryption.org | Amazon.com, Inc. | US | unknown |
2264 | iexplore.exe | 92.122.213.201:80 | www.download.windowsupdate.com | Akamai International B.V. | — | whitelisted |
Domain | IP | Reputation |
---|---|---|
www.bing.com |
| whitelisted |
certificate.strongencryption.org |
| malicious |
x.ss2.us |
| whitelisted |
www.download.windowsupdate.com |
| whitelisted |