URL: | http://www.gdgzlty.com/ |
Full analysis: | https://app.any.run/tasks/fb4ff8d2-c09c-4fd5-b91b-4965c6bca127 |
Verdict: | Malicious activity |
Analysis date: | December 06, 2022, 02:28:52 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | EB468681C4FD5207859FC50BBDC32317 |
SHA1: | 8082674A811C8EAF9C6CCC332F77C00E7A1503A0 |
SHA256: | C8B89AAFDF29765F1F65546B7386A6F4DE2A816F2CB422939AEF7D874B01B711 |
SSDEEP: | 3:N1KJS4gRn:Cc4y |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
856 | "C:\Program Files\Internet Explorer\iexplore.exe" "http://www.gdgzlty.com/" | C:\Program Files\Internet Explorer\iexplore.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
2972 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:856 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
(PID) Process: | (856) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPDaysSinceLastAutoMigration |
Value: 1 | |||
(PID) Process: | (856) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPLastLaunchLowDateTime |
Value: | |||
(PID) Process: | (856) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPLastLaunchHighDateTime |
Value: 31000858 | |||
(PID) Process: | (856) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
Operation: | write | Name: | NextCheckForUpdateLowDateTime |
Value: | |||
(PID) Process: | (856) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 31000858 | |||
(PID) Process: | (856) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
Operation: | write | Name: | CachePrefix |
Value: | |||
(PID) Process: | (856) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (856) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (856) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
(PID) Process: | (856) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2972 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\mytheme-color2[1].css | text | |
MD5:61F467440719C5D54C3635BAC90F2699 | SHA256:C1E63B3B8BE65AFFECD7AB54D9C590B3EE034194177CDFCD671F55E9F0FDE6D4 | |||
2972 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\mytheme-site[1].js | text | |
MD5:A319267862D43D9B3441EE56C23B8131 | SHA256:5353B4FD57A0F255E29C55603CC93586CD810EA7217F1BEAF618F3012BDD247C | |||
2972 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\mytheme-font[1].css | text | |
MD5:59273D051C38F6DC1BA8482F80768BC5 | SHA256:2853DA972A6067167786354FEB150099D8DB419F155B394CBB84861996754B11 | |||
2972 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\mytheme-share[1].css | text | |
MD5:2BD5CBFBAB03165C47D329AD2E98BE4D | SHA256:1710F29A477D864010C3F139A743919192C2F5989AC9B0A09EE72B40ACA6B00E | |||
2972 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\layer[1].js | text | |
MD5:2ED9962EC5F7EBF93B632109C2E56243 | SHA256:170B8CE0363746B8807BB7C11EB6C0F17CEECF8C874542BCA791CCE35B013EC4 | |||
2972 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\mytheme-ui[1].css | text | |
MD5:249BCD24204DDD19F5E8EA379C7A12D2 | SHA256:89EB7465256B455C929B2481E6BBD11F5FC0EA18847ADCDD433379002B8A7238 | |||
2972 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\webdaohang[1].js | html | |
MD5:04E0BB3731C16BF1A6BBEC5976248DEF | SHA256:3174BB254D50B91BEBFFEC6C48BFCFECB0D19E985FDAE3DA70CB36A0740B33BF | |||
2972 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\rmss[1].js | text | |
MD5:7994DD39FB71C41AFC3B2AC249F14B3C | SHA256:94242924B1385D6DB5A4DEE500B83A538ACE9AB3581FF0CA569A8BC3064E1DC0 | |||
2972 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\mytheme-ui[1].js | text | |
MD5:BB88A93EEC3BF67747BB44A87ABE9582 | SHA256:BB1AB028C2D7562B249D4AD0144DB38CF2D24AF7B50E94395879C47E6527C915 | |||
2972 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\TW3JC7B9.htm | html | |
MD5:4CA440E391717B454DE11D1A5E51DF16 | SHA256:0C883F7FDD3914066F14C19099A5AD0730A4D79ED9F4BD07F05C3D0DDCF89121 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2972 | iexplore.exe | GET | 200 | 46.3.166.156:80 | http://www.gdgzlty.com/static223/css/mytheme-share.css | HK | text | 481 b | unknown |
2972 | iexplore.exe | GET | 200 | 46.3.166.156:80 | http://www.gdgzlty.com/static223/css/mytheme-ui.css | HK | text | 8.55 Kb | unknown |
2972 | iexplore.exe | GET | 200 | 46.3.166.156:80 | http://www.gdgzlty.com/static223/js/jquery.min.js | HK | text | 33.3 Kb | unknown |
2972 | iexplore.exe | GET | 200 | 46.3.166.156:80 | http://www.gdgzlty.com/static223/js/layer.js | HK | text | 8.21 Kb | unknown |
2972 | iexplore.exe | GET | 200 | 46.3.166.156:80 | http://www.gdgzlty.com/static223/css/mytheme-font.css | HK | text | 7.61 Kb | unknown |
2972 | iexplore.exe | GET | 200 | 46.3.166.156:80 | http://www.gdgzlty.com/static223/css/mytheme-color2.css | HK | text | 1.69 Kb | unknown |
2972 | iexplore.exe | GET | 200 | 46.3.166.156:80 | http://www.gdgzlty.com/ | HK | html | 34.7 Kb | unknown |
2972 | iexplore.exe | GET | 200 | 46.3.166.156:80 | http://www.gdgzlty.com/yyhgg/sxgdpfgg.js | HK | html | 1007 b | unknown |
2972 | iexplore.exe | GET | 200 | 46.3.166.156:80 | http://www.gdgzlty.com/yyhstatic/js/rmss.js | HK | text | 794 b | unknown |
2972 | iexplore.exe | GET | 200 | 46.3.166.156:80 | http://www.gdgzlty.com/yyhstatic/js/pcdaohang.js | HK | text | 473 b | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 204.79.197.200:443 | www.bing.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
856 | iexplore.exe | 13.107.21.200:443 | www.bing.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
856 | iexplore.exe | 204.79.197.200:443 | www.bing.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
2972 | iexplore.exe | 46.3.166.156:80 | — | CNSERVERS | HK | unknown |
2972 | iexplore.exe | 104.26.0.190:443 | s2.loli.net | CLOUDFLARENET | US | unknown |
— | — | 46.3.166.156:80 | — | CNSERVERS | HK | unknown |
856 | iexplore.exe | 8.238.29.254:80 | ctldl.windowsupdate.com | LEVEL3 | US | suspicious |
856 | iexplore.exe | 152.199.19.161:443 | iecvlist.microsoft.com | EDGECAST | US | whitelisted |
856 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | EDGECAST | GB | whitelisted |
2972 | iexplore.exe | 18.155.68.40:443 | kvevv.com | AMAZON-02 | US | unknown |
Domain | IP | Reputation |
---|---|---|
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
iecvlist.microsoft.com |
| whitelisted |
r20swj13mr.microsoft.com |
| whitelisted |
s2.loli.net |
| unknown |
223969ufy.com |
| unknown |
3p8801.co |
| unknown |
kvevv.com |
| suspicious |