URL: | https://www.msn.com/spartan/dhp?locale=en-US&market=EG&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=enterprise |
Full analysis: | https://app.any.run/tasks/f2c9548c-a7ce-4f26-ad6b-0cf46ef43a86 |
Verdict: | Malicious activity |
Analysis date: | June 01, 2021, 17:28:31 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | BD5C7E42F69702C4D5547387D1B63EC1 |
SHA1: | 477BE89BF4D65748C4993FE5ED3D79726BBE1F0F |
SHA256: | D361D464A573AEE8C3BB791F468A6A680D3BE0549524F8D2E3EB80854C8E846B |
SSDEEP: | 3:N8DSLfZmVuvpGFYAgDL2zQQKsM8luy7jkX3S66QmG/A+WAn:2OLhmVuhGjgDazQx8E+jsi61mGI+WA |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2552 | "C:\Program Files\Internet Explorer\iexplore.exe" "https://www.msn.com/spartan/dhp?locale=en-US&market=EG&enableregulatorypsm=0&enablecpsm=0&ishostisolationenforced=0&targetexperience=enterprise" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
828 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2552 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
536 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2552 CREDAT:2299150 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
(PID) Process: | (2552) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
Operation: | write | Name: | NextCheckForUpdateLowDateTime |
Value: 2808929256 | |||
(PID) Process: | (2552) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 30889739 | |||
(PID) Process: | (2552) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
Operation: | write | Name: | CachePrefix |
Value: | |||
(PID) Process: | (2552) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (2552) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (2552) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
(PID) Process: | (2552) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
(PID) Process: | (2552) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
Operation: | write | Name: | SavedLegacySettings |
Value: 46000000A6000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000 | |||
(PID) Process: | (2552) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (2552) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
828 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Cab79BD.tmp | — | |
MD5:— | SHA256:— | |||
828 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Tar79BE.tmp | — | |
MD5:— | SHA256:— | |||
828 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442 | der | |
MD5:9723E654CE4FF933C60BEC5EF89E4183 | SHA256:781485B76EDCFE99722B726EE9BB0376214454BC88E7273B748919FF07325430 | |||
828 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63 | binary | |
MD5:94542C1FC24F9F6CC646C524C8F85234 | SHA256:5A41292367FFFFA4DC9AB9F37748E2E5B877C94B9A6B56F5236DCEFA05F66D50 | |||
828 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\820MR2NN.txt | text | |
MD5:CD585F84E5C5EC014173EDBA374FBEF3 | SHA256:48CC041956149AE9F5CD1A416A253AEA5B7AC326E2833727E3593062AFC22366 | |||
828 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\5QCJL4I2.txt | text | |
MD5:F2FD60438D93E71E971B35A5BF59730B | SHA256:6E077A577B0013B5D5F4E9F591EF8B9E10C66B7C0B02E35A4F7CCFCF2449955C | |||
828 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\dhp[1].htm | html | |
MD5:6C30B82FB908EE7AE80BA87A2E06E72B | SHA256:9BC4BC9010F9DC2CB9610E2494FDAB17D1ACBA2E11CBA5F2436B0AA0A39CD17D | |||
828 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_5FDD03068CBBD8A96F3AB9595BA10093 | binary | |
MD5:697E940CC06442F0B6690906B2FA45F0 | SHA256:997008F59C35DE37D6BF4C5CFE041FAD8B5421CA152BFAF141999F0516D18438 | |||
828 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\BB1gPsLO[1].jpg | image | |
MD5:9A6808EF4FCD4718A48361E39D3C34BA | SHA256:EC6EBF86374FB5DBC27A1DBA5C73B8883AF2687098572F4C567E329054D4B832 | |||
828 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63 | der | |
MD5:1B4073CE0EEF30A083F3E553221B5AE2 | SHA256:C7657D9A960CCBD07420C65565202CF2D5AE8CE407B9A43E6799C64786597287 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
828 | iexplore.exe | GET | 304 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAtb9ltrp%2FvQiykNkEU33uA%3D | US | — | — | whitelisted |
828 | iexplore.exe | GET | 304 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAtb9ltrp%2FvQiykNkEU33uA%3D | US | — | — | whitelisted |
828 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D | US | der | 471 b | whitelisted |
828 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D | US | der | 1.47 Kb | whitelisted |
828 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAtb9ltrp%2FvQiykNkEU33uA%3D | US | der | 471 b | whitelisted |
828 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAtb9ltrp%2FvQiykNkEU33uA%3D | US | der | 471 b | whitelisted |
828 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAo1CNVcKSsBffitZcAP9%2BQ%3D | US | der | 471 b | whitelisted |
828 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
828 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D | US | der | 471 b | whitelisted |
828 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D | US | der | 471 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
828 | iexplore.exe | 204.79.197.203:443 | www.msn.com | Microsoft Corporation | US | whitelisted |
828 | iexplore.exe | 2.16.186.32:443 | img-s-msn-com.akamaized.net | Akamai International B.V. | — | whitelisted |
828 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
— | — | 2.16.186.9:443 | static-spartan-neu-s-msn-com.akamaized.net | Akamai International B.V. | — | whitelisted |
828 | iexplore.exe | 2.16.186.9:443 | static-spartan-neu-s-msn-com.akamaized.net | Akamai International B.V. | — | whitelisted |
828 | iexplore.exe | 95.101.186.14:443 | c.s-microsoft.com | CW Vodafone Group PLC | — | suspicious |
828 | iexplore.exe | 40.77.226.250:443 | web.vortex.data.msn.com | Microsoft Corporation | IE | whitelisted |
828 | iexplore.exe | 2.16.186.27:443 | img-prod-cms-rt-microsoft-com.akamaized.net | Akamai International B.V. | — | whitelisted |
828 | iexplore.exe | 131.253.33.203:443 | srtb.msn.com | Microsoft Corporation | US | whitelisted |
828 | iexplore.exe | 204.79.197.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
www.msn.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
static-spartan-neu-s-msn-com.akamaized.net |
| whitelisted |
c.s-microsoft.com |
| whitelisted |
img-s-msn-com.akamaized.net |
| whitelisted |
web.vortex.data.msn.com |
| whitelisted |
arc.msn.com |
| whitelisted |
img-prod-cms-rt-microsoft-com.akamaized.net |
| whitelisted |
srtb.msn.com |
| whitelisted |
api.bing.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
536 | iexplore.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
536 | iexplore.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |