URL:

https://go.onelink.me/v1xd?pid=Patch&c=MobileFooter&af_web_dp=https%3a%2f%2fr20.rs6.net/tn.jsp?f=00167rjhImwoT007bH0fetEaMO56H0eZpqfzg4W9QBsoDwV1iTP8VlcbeQlTUB1-ZDO0q474hEx64gw4cHZOEaSMGhrfpW7Q1G8cnbMhdoNUhelMp59LxGher4dkWB3lJ7_lE9yUQ7fAKRHfGKnnEZLPg==&c=JfMaEp_1UWn0CVKvN7TiRvFK1540ai28quc7rwfmj1MuQ9bZjFmvcQ==&ch=KvL92qoygx1qVrR_Tlgd8hVBSUmyZO_-s8H2Ji2QPxnM90fZbLRG4Q==#cGZlYmJvQGlsbHVtaW5hLmNvbQ==

Full analysis: https://app.any.run/tasks/3778e1fc-733f-4e48-9a0e-67af33ac244a
Verdict: Malicious activity
Analysis date: December 05, 2022, 21:32:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

CDE2AAB67E7053A96763DE647B5407FE

SHA1:

BEEAD02F0292BAA7470BBE7293EF7D78CDBB8D84

SHA256:

CF2A9FB1D22F47AAFC8C25A7EB6BB78D817B6EA155D399BD92D0CEB53971087E

SSDEEP:

12:2iuzJsQ4OgM/qFgY3aMVsadz689wH7zrGu:2baP4qFgYqCzv9Szyu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2056"C:\Program Files\Internet Explorer\iexplore.exe" "https://go.onelink.me/v1xd?pid=Patch&c=MobileFooter&af_web_dp=https%3a%2f%2fr20.rs6.net/tn.jsp?f=00167rjhImwoT007bH0fetEaMO56H0eZpqfzg4W9QBsoDwV1iTP8VlcbeQlTUB1-ZDO0q474hEx64gw4cHZOEaSMGhrfpW7Q1G8cnbMhdoNUhelMp59LxGher4dkWB3lJ7_lE9yUQ7fAKRHfGKnnEZLPg==&c=JfMaEp_1UWn0CVKvN7TiRvFK1540ai28quc7rwfmj1MuQ9bZjFmvcQ==&ch=KvL92qoygx1qVrR_Tlgd8hVBSUmyZO_-s8H2Ji2QPxnM90fZbLRG4Q==#cGZlYmJvQGlsbHVtaW5hLmNvbQ=="C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3152"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2056 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
14 249
Read events
14 132
Write events
115
Delete events
2

Modification events

(PID) Process:(2056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
600619168
(PID) Process:(2056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31000817
(PID) Process:(2056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
900776668
(PID) Process:(2056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31000817
(PID) Process:(2056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
20
Text files
11
Unknown types
13

Dropped files

PID
Process
Filename
Type
3152iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\620BEF1064BD8E252C599957B3C91896binary
MD5:9A3F8D7E789EFAD78C46998D7CBD3FE2
SHA256:0E702108CAE90094916D7540351A7C4FFA43ACEBD940C89743B23E14C086D1BD
2056iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:AC572CBBC82D6D652CDBE2596AEAC4EE
SHA256:50B6D8F62150A7BD25FB3E462130E8E054A0F1FB619487E8C426A4C8BF6BDCA8
2056iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:062FE12CE286B52B081F376659470F0C
SHA256:E038C9EABAAC8D361D171C4BB1B1BA6F085DF4CC9B14A524EFE1B9F5D7BD3C52
3152iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3binary
MD5:E2799FBB217BE20DFD80B2FB2B170BA1
SHA256:0F4284FD4669972AD4DC5B02AAAD859073E604C5ADE9093BF2B0837F17BFAF07
3152iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3der
MD5:52F066A7E96EC14B5E42E4F745AF9713
SHA256:329954C81D759417EA20DCB9459F038F531F93B75209884016A8083C576A5579
3152iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894binary
MD5:FC20BE5503BA21C8E3AC10EB1DA14FD1
SHA256:E24BEDDBC3B6BA52637890901A977B0CCF39A077EAEB42C7CA46E56D1279CFEF
2056iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver662D.tmpxml
MD5:CBD0581678FA40F0EDCBC7C59E0CAD10
SHA256:159BD4343F344A08F6AF3B716B6FA679859C1BD1D7030D26FF5EF0255B86E1D9
3152iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\620BEF1064BD8E252C599957B3C91896der
MD5:4F75DFFA6D9C79B1BC41345F214D361C
SHA256:6CFD249D68E878BF3A0EE094519AEDF4BE02B3A8B36163B04D33DE281129AD22
3152iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4C74D3A297548316FF1FC843CCCBA3ABbinary
MD5:0DE9DADCE0DFDE14FC0F8D5B4BB6F244
SHA256:8848D330646A29CA2CD041ECFDED8484294381562B2B1CF349BA93A5DB84B668
3152iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
45
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3152
iexplore.exe
GET
200
104.18.20.226:80
http://ocsp2.globalsign.com/rootr3/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCDQHuXyId%2FGI71DM6hVc%3D
US
der
1.40 Kb
whitelisted
3152
iexplore.exe
GET
200
13.225.84.58:80
http://crl.rootca1.amazontrust.com/rootca1.crl
US
der
493 b
whitelisted
3152
iexplore.exe
GET
200
67.27.234.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c2c153e57c9013e9
US
compressed
4.70 Kb
whitelisted
3152
iexplore.exe
GET
200
13.225.84.68:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
3152
iexplore.exe
GET
200
13.225.84.13:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
2056
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
3152
iexplore.exe
GET
200
104.18.21.226:80
http://crl.globalsign.com/gsrsaovsslca2018.crl
US
binary
125 Kb
whitelisted
2056
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3152
iexplore.exe
GET
200
8.248.145.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?caf90c04573537da
US
compressed
61.4 Kb
whitelisted
3152
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3152
iexplore.exe
13.225.84.68:80
o.ss2.us
AMAZON-02
US
unknown
2056
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
13.225.84.175:80
ocsp.rootg2.amazontrust.com
AMAZON-02
US
whitelisted
3152
iexplore.exe
13.225.84.13:80
ocsp.rootg2.amazontrust.com
AMAZON-02
US
whitelisted
3152
iexplore.exe
104.18.20.226:80
ocsp2.globalsign.com
CLOUDFLARENET
shared
3152
iexplore.exe
13.224.189.56:443
AMAZON-02
US
unknown
3152
iexplore.exe
184.24.9.54:80
x1.c.lencr.org
AKAMAI-AS
DE
unknown
3152
iexplore.exe
13.225.84.58:80
crl.rootca1.amazontrust.com
AMAZON-02
US
whitelisted
3152
iexplore.exe
67.27.234.126:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
2056
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 67.27.234.126
  • 8.248.145.254
  • 67.27.233.126
  • 67.26.83.254
  • 67.27.235.254
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
o.ss2.us
  • 13.225.84.68
  • 13.225.84.66
  • 13.225.84.42
  • 13.225.84.97
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ocsp.rootg2.amazontrust.com
  • 13.225.84.13
  • 13.225.84.175
  • 13.225.84.145
  • 13.225.84.49
whitelisted
ocsp.rootca1.amazontrust.com
  • 13.225.84.175
  • 13.225.84.49
  • 13.225.84.145
  • 13.225.84.13
shared
crl.rootca1.amazontrust.com
  • 13.225.84.58
  • 13.225.84.14
  • 13.225.84.120
  • 13.225.84.149
whitelisted
r20.rs6.net
  • 208.75.122.11
whitelisted
ocsp2.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted

Threats

No threats detected
No debug info