URL: | http://update.aligntech.com/ClinCheck_na.exe |
Full analysis: | https://app.any.run/tasks/faffcf63-5f10-4745-9263-d25ac1b63598 |
Verdict: | Malicious activity |
Analysis date: | February 21, 2020, 19:03:47 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | B38288C0BEEE6500B120B5EE6234D5D1 |
SHA1: | 672F94FE2B1264959FFED7E2EAF1161B3E3FEFAC |
SHA256: | C221A8440157DE7412C9C2A8C639DE9EC1D2F9B2974AFEE0ABDC424A0C798AA7 |
SSDEEP: | 3:N1KLQRAdsj4Hy9Nn:CUwQqUNn |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2804 | "C:\Program Files\Internet Explorer\iexplore.exe" http://update.aligntech.com/ClinCheck_na.exe | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
2664 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2804 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
3964 | "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\ClinCheck_na.exe" | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\ClinCheck_na.exe | iexplore.exe | |
User: admin Company: Align Technology, Inc. Integrity Level: MEDIUM Description: InstallScript Setup Launcher Exit code: 0 Version: 5.7.4.71 | ||||
3860 | C:\Windows\System32\taskkill.exe /F /IM CCLauncher.exe | C:\Windows\System32\taskkill.exe | — | ClinCheck_na.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
332 | C:\Windows\System32\cscript.exe C:\Users\admin\AppData\Local\Temp\{7B05C00A-E39C-4A14-BB76-17FE044DBF2C}\{ACEF76B4-4CF1-48E3-93EF-1B2782D8DB59}\videodrv.vbs | C:\Windows\System32\cscript.exe | — | ClinCheck_na.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Console Based Script Host Exit code: 4294967295 Version: 5.8.7600.16385 | ||||
2684 | C:\Windows\System32\cscript.exe C:\Users\admin\AppData\Local\Temp\{7B05C00A-E39C-4A14-BB76-17FE044DBF2C}\{ACEF76B4-4CF1-48E3-93EF-1B2782D8DB59}\reloadIE.vbs | C:\Windows\System32\cscript.exe | — | ClinCheck_na.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Console Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
1392 | C:\Windows\System32\cscript.exe C:\Users\admin\AppData\Local\Temp\{7B05C00A-E39C-4A14-BB76-17FE044DBF2C}\{ACEF76B4-4CF1-48E3-93EF-1B2782D8DB59}\addNewXmlNodes.vbs "C:\Users\admin\AppData\Local\Temp\{7B05C00A-E39C-4A14-BB76-17FE044DBF2C}\{ACEF76B4-4CF1-48E3-93EF-1B2782D8DB59}\settings.xml" "C:\Users\admin\AppData\Roaming\Align\ClinCheck Pro\5.7.4.71\Application\resources\settings.xml" | C:\Windows\System32\cscript.exe | — | ClinCheck_na.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Console Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
1092 | "C:\Users\admin\AppData\Roaming\Align\ClinCheck Pro\5.7.4.71\Application\bin\LPDViewer.exe" | C:\Users\admin\AppData\Roaming\Align\ClinCheck Pro\5.7.4.71\Application\bin\LPDViewer.exe | explorer.exe | |
User: admin Company: Align Technology, Inc. Integrity Level: MEDIUM Description: Invisalign Patients Viewer Version: 5.7.4.71 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2664 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\ClinCheck_na[1].exe | — | |
MD5:— | SHA256:— | |||
2804 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Cab7070.tmp | — | |
MD5:— | SHA256:— | |||
2804 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Tar7071.tmp | — | |
MD5:— | SHA256:— | |||
2804 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\U2815OK4.txt | — | |
MD5:— | SHA256:— | |||
2804 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\81TW19CB.txt | — | |
MD5:— | SHA256:— | |||
2664 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\ClinCheck_na.exe.qcw5v5x.partial | — | |
MD5:— | SHA256:— | |||
2804 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DFD2BC7BD58C7A9648.TMP | — | |
MD5:— | SHA256:— | |||
2804 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\ClinCheck_na.exe.qcw5v5x.partial:Zone.Identifier | — | |
MD5:— | SHA256:— | |||
2804 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\ClinCheck_na.exe | — | |
MD5:— | SHA256:— | |||
2804 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203 | binary | |
MD5:0A2EC5A09076B04510CD22D123D73AB1 | SHA256:F59F07317C275EDE5E54A29E2904630BEFC02279263F8D865C77DF38DACD3BD3 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2664 | iexplore.exe | GET | — | 143.204.202.129:80 | http://update.aligntech.com/ClinCheck_na.exe | US | — | — | malicious |
2804 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D | US | der | 1.47 Kb | whitelisted |
2804 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D | US | der | 1.47 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2804 | iexplore.exe | 204.79.197.200:443 | ieonline.microsoft.com | Microsoft Corporation | US | whitelisted |
2804 | iexplore.exe | 152.199.19.161:443 | iecvlist.microsoft.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2804 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2664 | iexplore.exe | 143.204.202.129:80 | update.aligntech.com | — | US | suspicious |
Domain | IP | Reputation |
---|---|---|
update.aligntech.com |
| malicious |
iecvlist.microsoft.com |
| whitelisted |
r20swj13mr.microsoft.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
ieonline.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
2664 | iexplore.exe | Potentially Bad Traffic | ET POLICY Executable served from Amazon S3 |
2664 | iexplore.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
Process | Message |
---|---|
LPDViewer.exe | Creating ILpdSerializerFeature
|