URL: | https://dell.zoom.us/j/94866370300?pwd=WEtNQWVzVzF2aU5OMHFVMEdpRmRCdz09 |
Full analysis: | https://app.any.run/tasks/51ccab72-d22e-41fb-b5a1-1ea5ec4c7955 |
Verdict: | Malicious activity |
Analysis date: | April 01, 2023, 16:05:27 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 41D2ED077103298719117AE99A52D09D |
SHA1: | 7B301C765383C433D9E445084DD325A2225C0A82 |
SHA256: | BA1FC1627C918ABA95E73DF9F7B4D7EAEAED170F109CD1C184304CD9902A5DFB |
SSDEEP: | 3:N8YIQNzTTWhVVNBfnazfryj9cn:2YD/TOTazfuj+n |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2824 | "C:\Program Files\Internet Explorer\iexplore.exe" "https://dell.zoom.us/j/94866370300?pwd=WEtNQWVzVzF2aU5OMHFVMEdpRmRCdz09" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3220 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2824 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3504 | "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Zoom_cm_fbk88Z9vvrZo4_mjjqFJosOppE+b-FJbwzEvk+xyYhbhJO3d7lE@kA8rmE+0xZEUPkaG_k152805ddd477a952_.exe" | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Zoom_cm_fbk88Z9vvrZo4_mjjqFJosOppE+b-FJbwzEvk+xyYhbhJO3d7lE@kA8rmE+0xZEUPkaG_k152805ddd477a952_.exe | iexplore.exe | ||||||||||||
User: admin Company: Zoom Video Communications, Inc. Integrity Level: MEDIUM Description: Zoom Opener Exit code: 0 Version: 5,10,3,4851 Modules
| |||||||||||||||
2964 | "C:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Installer.exe" ZInstaller --conf.mode=silent --ipc_wnd=66066 | C:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Installer.exe | Zoom_cm_fbk88Z9vvrZo4_mjjqFJosOppE+b-FJbwzEvk+xyYhbhJO3d7lE@kA8rmE+0xZEUPkaG_k152805ddd477a952_.exe | ||||||||||||
User: admin Company: Zoom Video Communications, Inc. Integrity Level: MEDIUM Description: Zoom Installer Exit code: 0 Version: 5,14,0,13888 Modules
| |||||||||||||||
1704 | "C:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Installer.exe" /addfwexception --bin_home="C:\Users\admin\AppData\Roaming\Zoom\bin" | C:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Installer.exe | Installer.exe | ||||||||||||
User: admin Company: Zoom Video Communications, Inc. Integrity Level: HIGH Description: Zoom Installer Exit code: 0 Version: 5,14,0,13888 Modules
| |||||||||||||||
1020 | "C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe" "--url=zoommtg://win.launch?h.domain=dell.zoom.us&h.path=join&confid=dXNzPTdGUG8tRjUyR2tKeTh5Ym82aWZEYU8tV2ZfaEF6VE9seklpeUp5WDAyUGRNWk5BRTFXMTFadXVHQkhVSjFSRGR6SWVxSjc5VmRIOXVFYV90UElWZmhGaGcubllqalZqd0V6TWRYSkx4cyZ0aWQ9YWQ1ZDBhNjc2YWY1NDEwZDk3YTEyMzFjNWE2ZGQ3ZjQ%3D&mcv=0.92.11227.0929&stype=0&zc=0&browser=msie&action=join&confno=94866370300&pwd=WEtNQWVzVzF2aU5OMHFVMEdpRmRCdz09" | C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe | Zoom_cm_fbk88Z9vvrZo4_mjjqFJosOppE+b-FJbwzEvk+xyYhbhJO3d7lE@kA8rmE+0xZEUPkaG_k152805ddd477a952_.exe | ||||||||||||
User: admin Company: Zoom Video Communications, Inc. Integrity Level: MEDIUM Description: Zoom Meetings Version: 5,14,0,13888 Modules
| |||||||||||||||
2416 | "C:\Users\admin\AppData\Local\Temp\zm2C47.tmp" -DAF8C715436E44649F1312698287E6A5=C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Zoom_cm_fbk88Z9vvrZo4_mjjqFJosOppE+b-FJbwzEvk+xyYhbhJO3d7lE@kA8rmE+0xZEUPkaG_k152805ddd477a952_.exe | C:\Users\admin\AppData\Local\Temp\zm2C47.tmp | — | Zoom_cm_fbk88Z9vvrZo4_mjjqFJosOppE+b-FJbwzEvk+xyYhbhJO3d7lE@kA8rmE+0xZEUPkaG_k152805ddd477a952_.exe | |||||||||||
User: admin Company: Zoom Video Communications, Inc. Integrity Level: MEDIUM Description: Zoom Opener Exit code: 0 Version: 5,10,3,4851 Modules
| |||||||||||||||
2624 | "C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe" --action=join --runaszvideo=TRUE | C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe | Zoom.exe | ||||||||||||
User: admin Company: Zoom Video Communications, Inc. Integrity Level: MEDIUM Description: Zoom Meetings Version: 5,14,0,13888 Modules
| |||||||||||||||
3840 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
|
(PID) Process: | (2824) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPDaysSinceLastAutoMigration |
Value: 0 | |||
(PID) Process: | (2824) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPLastLaunchHighDateTime |
Value: 30847387 | |||
(PID) Process: | (2824) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 30847437 | |||
(PID) Process: | (2824) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (2824) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (2824) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
(PID) Process: | (2824) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (2824) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (2824) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (2824) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3220 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\SR1HV4GN.txt | text | |
MD5:3E49A6B833697EC4C6E0973C93A1FFAC | SHA256:D2A716CF2957AA92B8E6C93FE1ABD539FC5D84C36DDAD4BF35F4A6BCF6107995 | |||
3220 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\2JKI8PXD.txt | text | |
MD5:7B5D45BDEBB879BD60879C4A97F93D6D | SHA256:1AE3C910FB035374B7472160602AE6512506619AB2B8EF397826D548CD1C1AED | |||
3220 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04 | der | |
MD5:21ED9CA0F4579A63723066FAB3CDB1E9 | SHA256:818A6653F6011A83D251998208826644FE68D228A739C87EC14E470E10817889 | |||
3220 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\BF776OK6.txt | text | |
MD5:D6E0F796260331E829B543FE5AE664AD | SHA256:36C25DBA4AA0BCDCB8027C9309F4E15233C910A5E0BD9A37019B1F9DB61CE003 | |||
3220 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\V68BFH8T.txt | text | |
MD5:ADE0F8953267695AB393C5BE636E3568 | SHA256:6A80CE01B669A6C4B7C26B1969022B6D2C3C7035EC46A47EDF6267EBE36DF6E4 | |||
3220 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04 | binary | |
MD5:909C96AB9C7F8E679665615664820014 | SHA256:759FCFAD5D5E41FD07A4B365F25C33B1FBD164654E8566B150FD61FC11F7C947 | |||
3220 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\D9TPDK0Q.txt | text | |
MD5:E9C880A14851DE444378737B94BB00A8 | SHA256:CC1CE5E3C256E55A5E5504603BF00B105196FF8D39234800A923BC422D4AB4AB | |||
3220 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C | der | |
MD5:380B19758247C856A0993E6336CE5A2B | SHA256:5FDFF5277E3BECE529517157C53854D2EE27B39EE2D881A9BDA0E4E6B7E2E887 | |||
3220 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\94866370300[1].htm | html | |
MD5:0DC944DC87ED80E2367C5861EBDAAD77 | SHA256:3FE1A7B942331867282C32424FBE966DB866CB519AE92162CB6EB0739627234C | |||
3220 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\8DOR32H2.txt | text | |
MD5:5C3AFF104B030C035D124DE0D5C9736D | SHA256:2AC60408529FBD0B26DBD1D9EB1BFB0FF7CB00BF02C30CB72E85F6E2064F1F34 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3220 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAbCsehAv%2FkAxBfkV5KvfLI%3D | US | der | 471 b | whitelisted |
2824 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
3220 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D | US | der | 471 b | whitelisted |
2824 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D | US | der | 1.47 Kb | whitelisted |
3220 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAhflMAthXvozBT%2FU%2B2iPio%3D | US | der | 471 b | whitelisted |
3220 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D | US | der | 1.47 Kb | whitelisted |
3220 | iexplore.exe | GET | 200 | 209.197.3.8:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?884ff7ffd71a194f | US | compressed | 4.70 Kb | whitelisted |
2824 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D | US | der | 1.47 Kb | whitelisted |
2824 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D | US | der | 471 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3220 | iexplore.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
3220 | iexplore.exe | 170.114.52.2:443 | dell.zoom.us | — | US | suspicious |
2824 | iexplore.exe | 204.79.197.200:443 | www.bing.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
3220 | iexplore.exe | 209.197.3.8:80 | ctldl.windowsupdate.com | STACKPATH-CDN | US | whitelisted |
3220 | iexplore.exe | 18.66.147.121:443 | static.ada.support | AMAZON-02 | US | suspicious |
3220 | iexplore.exe | 34.98.108.207:443 | cdn.solvvy.com | GOOGLE | US | unknown |
3220 | iexplore.exe | 18.66.130.242:443 | st3.zoom.us | AMAZON-02 | US | unknown |
3220 | iexplore.exe | 54.235.192.240:443 | log-gateway.zoom.us | AMAZON-AES | US | unknown |
3220 | iexplore.exe | 104.19.187.97:443 | cdn.cookielaw.org | CLOUDFLARENET | — | unknown |
2824 | iexplore.exe | 13.107.21.200:443 | www.bing.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
dell.zoom.us |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
static.ada.support |
| whitelisted |
cdn.solvvy.com |
| shared |
st3.zoom.us |
| whitelisted |
st1.zoom.us |
| whitelisted |
log-gateway.zoom.us |
| unknown |
Process | Message |
---|---|
Installer.exe | [ProductPathHelper::RecursiveRemoveDirA] Path is: |
Installer.exe | C:\Users\admin\AppData\Roaming\Zoom\zoom_install_src |
Installer.exe | |
Installer.exe | [ProductPathHelper::RecursiveRemoveDirA] Path is: |
Installer.exe | C:\Users\admin\AppData\Roaming\Zoom\zoom_install_src |
Installer.exe | |
Installer.exe | [ProductPathHelper::RecursiveRemoveDirA] Path is: |
Installer.exe | C:\Users\admin\AppData\Roaming\Zoom\tmp_uninstall |
Installer.exe | |
Installer.exe | [ProductPathHelper::RecursiveRemoveDirA] Path is: |