URL: | https://vm.tiktok.com/ZMF4cm5aj/ |
Full analysis: | https://app.any.run/tasks/84b388d7-53d2-4386-81e2-5c723c7fdb39 |
Verdict: | Malicious activity |
Analysis date: | December 06, 2022, 01:18:17 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 9976CF3EC0CBE2BDC820BA490AD530B1 |
SHA1: | 4980A31D32841B6EDA1A35D90B281E06337A1194 |
SHA256: | C0FD1D1F2084990D4A4F6ABE944A1DF6650281023C4CFA93FD50BD0E49FC4725 |
SSDEEP: | 3:N8wbhGTkojgoKn:2fThjgXn |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1328 | "C:\Program Files\Internet Explorer\iexplore.exe" "https://vm.tiktok.com/ZMF4cm5aj/" | C:\Program Files\Internet Explorer\iexplore.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
404 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1328 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
404 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_86C2A03C133240EC4C95180B9FD368BB | binary | |
MD5:957E8BC0CE4D5FAD0B4526B320BDF5E8 | SHA256:6EE2A1487DFFFBD50A29CBB86CDDB8604AD0955A017663EB836BDDD3E88E38A7 | |||
404 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_86C2A03C133240EC4C95180B9FD368BB | der | |
MD5:59CD2A3F22619C29ABED7481E2B566D0 | SHA256:3BDD355FD6631384C7B37BC408DA41CB65A13CBFDB6C60FE1A89DB5100234C88 | |||
1328 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442 | binary | |
MD5:D9C1943D13640329F350208FF88484F0 | SHA256:7F2F6884175D31601D7DDC1F1960CA9912D31427128CAF3CBC344F0B30593A21 | |||
1328 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 | der | |
MD5:AC572CBBC82D6D652CDBE2596AEAC4EE | SHA256:50B6D8F62150A7BD25FB3E462130E8E054A0F1FB619487E8C426A4C8BF6BDCA8 | |||
404 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:16D867027D3D6C730DB7CDB4B961C1F1 | SHA256:095D19B93BFE87D94273A98C702C22951ECF75F45A87FBF8424CB212FD689B62 | |||
404 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\ZMF4cm5aj[1].htm | html | |
MD5:F624497457D8C67EA4607C4CC69DABF9 | SHA256:C238D829CB7C7411DEF42465C62DF94672B403A72AB46B0A545AEDB4070F0FC8 | |||
404 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\G0NRZL3X.txt | text | |
MD5:DB382DC730032238873CB7CA6B12DCB2 | SHA256:76A02B4362A7ECF71FBD4476FA5D82227882E79590B163A5FBC68B7FE8A20321 | |||
1328 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442 | der | |
MD5:503AD061073A29CEE4CB12D552F6A5B3 | SHA256:D2A97423F8B71CA1DAAC39F8A037DCA022303C1ADFBD49995EFF3B36AFFF33F9 | |||
404 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\QFIL6QUO.txt | text | |
MD5:5BE0F573D1948CED86A54ED8C32D93AF | SHA256:2768CBAFC3DB54804B4CB119B6A59B8C35112962BBB9CCE300C8F31683F8B581 | |||
404 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\7172361394963188997[1].htm | html | |
MD5:FBB91737CF26E8F42C33187863D2FE89 | SHA256:02A2EB276CAFD8AF78880F8BD9BD6E2112C19B0E36557E1F5CCFED2DD8443CCE |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1328 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
404 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D | US | der | 471 b | whitelisted |
1328 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D | US | der | 1.47 Kb | whitelisted |
404 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAeYNgOt45kIIZygDCe8imw%3D | US | der | 471 b | whitelisted |
404 | iexplore.exe | GET | 200 | 209.197.3.8:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c9c31791d21caa7f | US | compressed | 4.70 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1328 | iexplore.exe | 209.197.3.8:80 | ctldl.windowsupdate.com | STACKPATH-CDN | US | whitelisted |
404 | iexplore.exe | 209.197.3.8:80 | ctldl.windowsupdate.com | STACKPATH-CDN | US | whitelisted |
1328 | iexplore.exe | 204.79.197.200:443 | www.bing.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
1328 | iexplore.exe | 13.107.21.200:443 | www.bing.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
404 | iexplore.exe | 23.36.163.32:443 | — | Akamai International B.V. | DE | suspicious |
1328 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | EDGECAST | GB | whitelisted |
404 | iexplore.exe | 23.36.163.5:443 | — | Akamai International B.V. | DE | suspicious |
404 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | EDGECAST | GB | whitelisted |
1328 | iexplore.exe | 152.199.19.161:443 | iecvlist.microsoft.com | EDGECAST | US | whitelisted |
404 | iexplore.exe | 2.16.202.64:443 | lf16-tiktok-web.ttwstatic.com | Akamai International B.V. | NL | suspicious |
Domain | IP | Reputation |
---|---|---|
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
www.tiktok.com |
| whitelisted |
iecvlist.microsoft.com |
| whitelisted |
r20swj13mr.microsoft.com |
| whitelisted |
s20.tiktokcdn.com |
| whitelisted |
lf16-tiktok-web.ttwstatic.com |
| whitelisted |
p16-sign-va.tiktokcdn.com |
| whitelisted |