URL:

https://edcasteu.okta-emea.com/app/domo/exk34whqq5wrYndkI0i7/sso/saml

Full analysis: https://app.any.run/tasks/9342b214-59bd-415d-a63b-6cc792775ed4
Verdict: Malicious activity
Analysis date: September 05, 2023, 11:20:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

B21E17D9504AF40987B1C14D2D31D107

SHA1:

4A24086FF62D059AE1EDFC5CA1C432FE30CD37D3

SHA256:

C28A1CEA8004029239568EE322665A7AE54429CFD850C81899CC3FF2B4026673

SSDEEP:

3:N8tRaIthPK52Cka40BNKWf:2tRaI/qD4U

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3536)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3536"C:\Program Files\Internet Explorer\iexplore.exe" "https://edcasteu.okta-emea.com/app/domo/exk34whqq5wrYndkI0i7/sso/saml"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3560"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3536 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
12 185
Read events
12 118
Write events
67
Delete events
0

Modification events

(PID) Process:(3536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3536) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
17
Text files
21
Unknown types
1

Dropped files

PID
Process
Filename
Type
3560iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_7ABEF143602189F054D3C3A1AC247690binary
MD5:7F66E2CCB3A95807457C85648E16E552
SHA256:8ABA951F7BC29C8E076F723F18CF3C95C541E1FD7E157A99FCB91F98FDC0CEC2
3560iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\gfs5azs2i02JrV7yO0i7[1].pngimage
MD5:DC4960C9B317EBDCE47344B6E8EDB5D7
SHA256:B09B92A5EEB88EEACAE009886A41ED7C1590BDAEE836D18E517C5CA90854C5CA
3560iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5ABder
MD5:189B701E36FEC4C56ABF6D5D14386235
SHA256:9EFE39A10808A6D439621E61E10E2C5AEA3A0C83F8A7C77922957DF801F996A2
3560iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_7ABEF143602189F054D3C3A1AC247690binary
MD5:7DA4FF007CC83568D673F799CFDFD993
SHA256:8A663251BEC6037225B134E5E757FCF815DD988D890D13EEAF08516703DA1429
3560iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5ABbinary
MD5:98305F13441A4EDA09505AE500EB56AF
SHA256:4F6960AA1CB1B65C3BF8DBB5DBB1E595C819EC661F033FF48449CADC14BC2D38
3560iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:0DD710E3550BCC0511E87AAEAD524D3F
SHA256:5F97B174989D6FAE8A887917C1FF760FDD0D9313AEB89E476AB12C44790CE1D5
3560iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\FCJNW27A.txttext
MD5:0C5106BB4565F5B59340D282DAA44EC6
SHA256:C37DF6EA44EDE98237C3E349DCFAAFD0979E70C95AD4FAE0F30350A9A62C8336
3560iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_A30EA9B4E1BC5DBF09A8EF399E086D27binary
MD5:574CD2647AFFEF655E26B11EE6DDF690
SHA256:C828263FC50DF5264628C997BDD4A893DC356F24216F5D3E9CC0DFFB91E6B4C0
3560iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\login[1].htmhtml
MD5:4F97F9168AFE20983D3FFC9845B5ACBB
SHA256:E329F4D067B3ED5203CBF81E46A49FDDA8E0FE356649C52ED75E7A144FE59858
3560iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_A30EA9B4E1BC5DBF09A8EF399E086D27binary
MD5:BF87CE0B396E0BC201D941DF96BE7AE2
SHA256:EB03EF5C2B88BE01A1A4D7E02433839BF94A4F4567925A80203CCF245654442C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
35
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3560
iexplore.exe
GET
200
67.27.159.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3d74319c189c96a5
unknown
compressed
4.66 Kb
unknown
3560
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
unknown
der
471 b
unknown
3560
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAtP6KgflVkQx%2B8UZETMyKU%3D
unknown
der
471 b
unknown
3560
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAo1CNVcKSsBffitZcAP9%2BQ%3D
unknown
der
471 b
unknown
3536
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
unknown
der
1.47 Kb
unknown
3536
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
der
471 b
unknown
3560
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
der
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
3560
iexplore.exe
76.223.2.241:443
edcasteu.okta-emea.com
AMAZON-02
US
unknown
3560
iexplore.exe
67.27.159.126:80
ctldl.windowsupdate.com
LEVEL3
US
malicious
3560
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3560
iexplore.exe
13.225.78.91:443
eu1static.oktacdn.com
AMAZON-02
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3560
iexplore.exe
108.138.7.85:443
login.okta.com
AMAZON-02
US
unknown
3536
iexplore.exe
76.223.2.241:443
edcasteu.okta-emea.com
AMAZON-02
US
unknown
3536
iexplore.exe
104.126.37.153:443
www.bing.com
Akamai International B.V.
DE
unknown
3536
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
edcasteu.okta-emea.com
  • 76.223.2.241
  • 13.248.134.123
unknown
ctldl.windowsupdate.com
  • 67.27.159.126
  • 8.241.11.126
  • 67.27.157.126
  • 8.241.9.254
  • 67.27.235.126
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
eu1static.oktacdn.com
  • 13.225.78.91
  • 13.225.78.2
  • 13.225.78.8
  • 13.225.78.27
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.162
  • 104.126.37.153
  • 104.126.37.178
  • 104.126.37.147
  • 104.126.37.186
  • 104.126.37.146
  • 104.126.37.185
  • 104.126.37.171
  • 104.126.37.179
whitelisted
login.okta.com
  • 108.138.7.85
  • 108.138.7.41
  • 108.138.7.107
  • 108.138.7.126
shared
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://edcasteu.okta-emea.com/app/domo/exk34whqq5wrYndkI0i7/sso/saml