URL:

https://dynamoeu.netagesolutions.com/site/readreceipts.aspx?t=jstern&cid=0f5a2fcb-4039-4e8b-b117-90b68c07b25d&mcid=6c9a4316-e5cb-40bd-ae23-e0b5c3380d2a&ehid=92b57ed7-952b-4425-ac29-1c85bd94ca99&url=https%3a%2f%2fcmxzp.cpcaccounting.com/cmxzp/zxnoywhlzw5azg9oywjhbmsuy29tlnfh

Full analysis: https://app.any.run/tasks/ddecf8e4-0f51-4298-af8d-3f2e7454ae1a
Verdict: Malicious activity
Analysis date: November 16, 2023, 06:35:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
phishing
storm1575
dadsec
Indicators:
SHA1:

807EFD2A08A099D6DECC869A11E9CD051BFC9496

SHA256:

BD03DFC8C0C5577D4F5319279C0168A56B7BD0E78F4E81C9069F75602E36549F

SSDEEP:

6:2ESL/UQJrSXCoQHcgkdN1wYIAs3qgNRRGMTDCIN8yTn:2ESD7oXrgkHmYIAYcM/CUT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • PHISHING has been detected (SURICATA)

      • iexplore.exe (PID: 3140)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Checks supported languages

      • wmpnscfg.exe (PID: 3924)

    • Application launched itself

      • iexplore.exe (PID: 3460)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3924)

    • Reads the computer name

      • wmpnscfg.exe (PID: 3924)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3924)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe #PHISHING iexplore.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3140"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3460 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3460"C:\Program Files\Internet Explorer\iexplore.exe" "https://dynamoeu.netagesolutions.com/site/readreceipts.aspx?t=jstern&cid=0f5a2fcb-4039-4e8b-b117-90b68c07b25d&mcid=6c9a4316-e5cb-40bd-ae23-e0b5c3380d2a&ehid=92b57ed7-952b-4425-ac29-1c85bd94ca99&url=https%3a%2f%2fcmxzp.cpcaccounting.com/cmxzp/zxnoywhlzw5azg9oywjhbmsuy29tlnfh"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3924"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
Total events
16 156
Read events
16 087
Write events
64
Delete events
5

Modification events

(PID) Process:(3460) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3460) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3460) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3460) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3460) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3460) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3460) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3460) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3460) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3460) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
18
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
3140iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
3140iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:60FE01DF86BE2E5331B0CDBE86165686
SHA256:C08CCBC876CD5A7CDFA9670F9637DA57F6A1282198A9BC71FC7D7247A6E5B7A8
3140iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771binary
MD5:333B8EFFA4BCDB5DABAC82DC53A68FAF
SHA256:5009E701E58E1716C3FC9F29C07DF76F78F1F63BE994FAA376038FC7B8097A74
3140iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464binary
MD5:7CAB733989776159286EF48C10AF65EA
SHA256:5276D176CD576F34707C4364FDD1CCC808B93A4C4F6C0EAF30E20C678B4D7E63
3140iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:D92E4AD05A339DFB9ACB1CFC6C31DA83
SHA256:45A12268F847D21B501B91A22A25A24D167DE03A87D4DF2DE412FFFA14362D22
3140iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\vga4i[1].htmtext
MD5:9B293D521ABA1E4F5DC3EA36153EC3E0
SHA256:A22C018A39282DAF1A5D892A1FA3037BB1FAE17FD99992B41DB9DACEDAA0C156
3140iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464binary
MD5:8202A1CD02E7D69597995CABBE881A12
SHA256:58F381C3A0A0ACE6321DA22E40BD44A597BD98B9C9390AB9258426B5CF75A7A5
3140iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:3F8CC33B50657BBE3EEF9CCF05571011
SHA256:B329F814CDA0122DD83CBC8FACEFDB20B0EEBE0A89A74C1FA2D1B501CE42FE0D
3460iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868binary
MD5:71A14AC470C8AE33D634A4288727BC87
SHA256:0E386E2AFFC865BF7EBD618EBCC3F208D1DB0383D3501B0DB205F78C23D3E3FB
3140iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:FB93A21304A3903EF8CE99CF12FD4497
SHA256:620F906A68E8A6C227E4A0E6FFE17A1B401876B42B276413F9E76D2D291B1E41
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
31
DNS requests
17
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3140
iexplore.exe
GET
200
23.37.41.57:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
3140
iexplore.exe
GET
200
192.124.249.24:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
unknown
binary
2.01 Kb
unknown
3140
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e94bb274b63b057c
unknown
compressed
4.66 Kb
unknown
3140
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?872f6fbdc1e99bd4
unknown
compressed
4.66 Kb
unknown
3140
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
3140
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
binary
1.47 Kb
unknown
3140
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D
unknown
binary
724 b
unknown
3460
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D
unknown
binary
471 b
unknown
3460
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
der
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3140
iexplore.exe
3.10.48.236:443
dynamoeu.netagesolutions.com
AMAZON-02
GB
unknown
3140
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
3140
iexplore.exe
192.124.249.24:80
ocsp.godaddy.com
SUCURI-SEC
US
unknown
3140
iexplore.exe
198.252.102.146:443
cmxzp.cpcaccounting.com
HAWKHOST
US
unknown
3140
iexplore.exe
23.37.41.57:80
x1.c.lencr.org
AKAMAI-AS
DE
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3460
iexplore.exe
198.252.102.146:443
cmxzp.cpcaccounting.com
HAWKHOST
US
unknown

DNS requests

Domain
IP
Reputation
dynamoeu.netagesolutions.com
  • 3.10.48.236
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.godaddy.com
  • 192.124.249.24
  • 192.124.249.22
  • 192.124.249.23
  • 192.124.249.36
  • 192.124.249.41
whitelisted
cmxzp.cpcaccounting.com
  • 198.252.102.146
unknown
x1.c.lencr.org
  • 23.37.41.57
whitelisted
4gist53ykwm1ucr.iegjb0vrpf.ru
  • 104.21.65.66
  • 172.67.188.247
unknown
ocsp.pki.goog
  • 142.250.74.195
whitelisted
challenges.cloudflare.com
  • 104.17.3.184
  • 104.17.2.184
whitelisted
cdn.jsdelivr.net
  • 104.16.88.20
  • 104.16.87.20
  • 104.16.86.20
  • 104.16.85.20
  • 104.16.89.20
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

PID
Process
Class
Message
3140
iexplore.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
3140
iexplore.exe
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Phishing domain chain detected (DadSec)
3140
iexplore.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://dynamoeu.netagesolutions.com/site/readreceipts.aspx?t=jstern&cid=0f5a2fcb-4039-4e8b-b117-90b68c07b25d&mcid=6c9a4316-e5cb-40bd-ae23-e0b5c3380d2a&ehid=92b57ed7-952b-4425-ac29-1c85bd94ca99&url=https%3a%2f%2fcmxzp.cpcaccounting.com/cmxzp/zxnoywhlzw5azg9oywjhbmsuy29tlnfh