URL:

https://edcasteu.okta-emea.com/app/domo/exk34whqq5wrYndkI0i7/sso/saml

Full analysis: https://app.any.run/tasks/9342b214-59bd-415d-a63b-6cc792775ed4
Verdict: Malicious activity
Analysis date: September 05, 2023, 11:20:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

B21E17D9504AF40987B1C14D2D31D107

SHA1:

4A24086FF62D059AE1EDFC5CA1C432FE30CD37D3

SHA256:

C28A1CEA8004029239568EE322665A7AE54429CFD850C81899CC3FF2B4026673

SSDEEP:

3:N8tRaIthPK52Cka40BNKWf:2tRaI/qD4U

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3536)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3536"C:\Program Files\Internet Explorer\iexplore.exe" "https://edcasteu.okta-emea.com/app/domo/exk34whqq5wrYndkI0i7/sso/saml"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3560"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3536 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
12 185
Read events
12 118
Write events
67
Delete events
0

Modification events

(PID) Process:(3536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
17
Text files
21
Unknown types
1

Dropped files

PID
Process
Filename
Type
3560iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5ABder
MD5:189B701E36FEC4C56ABF6D5D14386235
SHA256:9EFE39A10808A6D439621E61E10E2C5AEA3A0C83F8A7C77922957DF801F996A2
3560iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:0DD710E3550BCC0511E87AAEAD524D3F
SHA256:5F97B174989D6FAE8A887917C1FF760FDD0D9313AEB89E476AB12C44790CE1D5
3560iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_7ABEF143602189F054D3C3A1AC247690binary
MD5:7DA4FF007CC83568D673F799CFDFD993
SHA256:8A663251BEC6037225B134E5E757FCF815DD988D890D13EEAF08516703DA1429
3560iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_7ABEF143602189F054D3C3A1AC247690binary
MD5:7F66E2CCB3A95807457C85648E16E552
SHA256:8ABA951F7BC29C8E076F723F18CF3C95C541E1FD7E157A99FCB91F98FDC0CEC2
3560iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5ABbinary
MD5:98305F13441A4EDA09505AE500EB56AF
SHA256:4F6960AA1CB1B65C3BF8DBB5DBB1E595C819EC661F033FF48449CADC14BC2D38
3560iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\login[1].htmhtml
MD5:4F97F9168AFE20983D3FFC9845B5ACBB
SHA256:E329F4D067B3ED5203CBF81E46A49FDDA8E0FE356649C52ED75E7A144FE59858
3560iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\okta-sign-in.min[1].jstext
MD5:2886ED018E3F5882013A05E53D0FCF63
SHA256:B078B4439AC28390FA15C166A410D9D317A7CB528F4162491B2E2169122100ED
3560iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:24BE8A92460B5B7A555B1DA559296958
SHA256:77A3CFE6B7EB676AF438D5DE88C7EFCB6ABCC494E0B65DA90201969E6D79B2A3
3560iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\montserrat-okta-regular-webfont[1].eotbinary
MD5:362FFE720BA40BE359302CAB7F83C517
SHA256:AC7318314845C868352A7C1ABE1B3A6BFD1A5C586A04B25DE994932B758D8BA6
3560iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\okta-sign-in.min[1].csstext
MD5:07655B3F2B8B24A071727F94F566A06E
SHA256:B072D9B98BFC6D4992E142B940F4F4860156C4464227C9E1E5E5C37E53CF1457
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
35
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3560
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
unknown
der
471 b
unknown
3560
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAtP6KgflVkQx%2B8UZETMyKU%3D
unknown
der
471 b
unknown
3560
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAo1CNVcKSsBffitZcAP9%2BQ%3D
unknown
der
471 b
unknown
3560
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
der
471 b
unknown
3560
iexplore.exe
GET
200
67.27.159.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3d74319c189c96a5
unknown
compressed
4.66 Kb
unknown
3536
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
unknown
der
1.47 Kb
unknown
3536
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
der
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
3560
iexplore.exe
76.223.2.241:443
edcasteu.okta-emea.com
AMAZON-02
US
unknown
3560
iexplore.exe
67.27.159.126:80
ctldl.windowsupdate.com
LEVEL3
US
malicious
3560
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3560
iexplore.exe
13.225.78.91:443
eu1static.oktacdn.com
AMAZON-02
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3560
iexplore.exe
108.138.7.85:443
login.okta.com
AMAZON-02
US
unknown
3536
iexplore.exe
76.223.2.241:443
edcasteu.okta-emea.com
AMAZON-02
US
unknown
3536
iexplore.exe
104.126.37.153:443
www.bing.com
Akamai International B.V.
DE
unknown
3536
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
edcasteu.okta-emea.com
  • 76.223.2.241
  • 13.248.134.123
unknown
ctldl.windowsupdate.com
  • 67.27.159.126
  • 8.241.11.126
  • 67.27.157.126
  • 8.241.9.254
  • 67.27.235.126
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
eu1static.oktacdn.com
  • 13.225.78.91
  • 13.225.78.2
  • 13.225.78.8
  • 13.225.78.27
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.162
  • 104.126.37.153
  • 104.126.37.178
  • 104.126.37.147
  • 104.126.37.186
  • 104.126.37.146
  • 104.126.37.185
  • 104.126.37.171
  • 104.126.37.179
whitelisted
login.okta.com
  • 108.138.7.85
  • 108.138.7.41
  • 108.138.7.107
  • 108.138.7.126
shared
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://edcasteu.okta-emea.com/app/domo/exk34whqq5wrYndkI0i7/sso/saml