URL: | https://www.bingapis.com/api/v7/followweb/isfollowable?appId=F1E45C4A7B95B48AC3F411C6214F6B861D0C276B&mediaUrl=https://my.doculivery.com/External/familydollar/Login.aspx&edgechannel=stable |
Full analysis: | https://app.any.run/tasks/8a2a9a41-903e-4e81-a3eb-7e0230d45615 |
Verdict: | Malicious activity |
Analysis date: | April 10, 2023, 13:48:06 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 503541F9B55C58616BA70340924AD079 |
SHA1: | 1ED13C45B3BE9832F045C64D9C5706A7BB5111CE |
SHA256: | D79C8032A28A00D5B8E19BBE83DCC5355C4546BB48AFF395979CE36165835836 |
SSDEEP: | 3:N8DSLsjdi9eYKpz3ESqAP6TSnheFTyP/FiWDzYhdcmGK3xLP4e8MnDABaNEhWuJA:2OLsjoUnR0SqAP6TSheFTyHFiWD03VGK |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
940 | "C:\Program Files\Internet Explorer\iexplore.exe" "https://www.bingapis.com/api/v7/followweb/isfollowable?appId=F1E45C4A7B95B48AC3F411C6214F6B861D0C276B&mediaUrl=https://my.doculivery.com/External/familydollar/Login.aspx&edgechannel=stable" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
1352 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:940 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
(PID) Process: | (940) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPDaysSinceLastAutoMigration |
Value: 0 | |||
(PID) Process: | (940) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPLastLaunchHighDateTime |
Value: 30847387 | |||
(PID) Process: | (940) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 30847437 | |||
(PID) Process: | (940) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (940) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (940) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
(PID) Process: | (940) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (940) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (940) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (940) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1352 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\PG4J6UI7.txt | text | |
MD5:39EFBB6724272055FBCAEB4BA3297C03 | SHA256:06656993DDABC35E9AD1F89C95921D8A5A2352FCAA96F38267C310C4230EDDCD | |||
1352 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\OB53N68R.txt | text | |
MD5:A47E0098E0DBC29F712B9F8E9B3D31AB | SHA256:E5A2F5A32F11F6804881B7D25B9E8329692F74D776324AE3FAC09D91BD0D28F4 | |||
1352 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\TRL9HA05.txt | text | |
MD5:E803AF2FE5ECD1C11A47DB432D9BA343 | SHA256:696F1F0411E3228BD72AA54AD4AD0791463FF200D3CDD0B6BC662D9F0944CB70 | |||
1352 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\isfollowable[1].json | binary | |
MD5:659F3EBF4D99688036C0ABEF98C1B5ED | SHA256:3B5C56AE13DF262CDC38514567BFB9A84C1C876FAED4B7D8C725E9BDE86C6B56 | |||
1352 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\GE4491KM.txt | text | |
MD5:34E8E978ECA39C6799C5FEBF8CDE7E84 | SHA256:D905DABD5BA581F6E0BC96273BF86518C8C60F62B7E2D2FC754D459138C59DDF | |||
1352 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\6FN0EDLI.txt | text | |
MD5:0967E60A693675AABFEAA9C1699BC34F | SHA256:80DA2193D4090350AF45BBDD1F6455B3F9F0F8EBF3AE4DEACDC7191910F7C185 | |||
940 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF7AC6585285AB1430.TMP | gmc | |
MD5:A93DA224CFDC0E698D45A69CA01F0ED6 | SHA256:7BADEEB79450B8B78E1724B5494EB4F90AB2193D5BB3F6EBD6836EAEB06D4865 | |||
1352 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\MSCP24WR.txt | text | |
MD5:39DE168D5FD6453D4650F192224D7D4E | SHA256:E8806FC43BED8E14E74D49BBFACE6ECFFC3F4657E1360CA89E091BEE7E27C376 | |||
1352 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442 | binary | |
MD5:9DFDF0B5ABB4745CC6AA4D93964B9C91 | SHA256:D882CA71333C4A6302D1BF479C11BB5F751CD9153218E88B8570C3F591ABFE12 | |||
940 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{5DE373A6-D7A6-11ED-B2B4-12A9866C77DE}.dat | binary | |
MD5:E212D090D4917A17DE51626C15E50D8B | SHA256:B00A15E52143A0920860A1A734602F6E93F3BEEDDE2AD08A823688CC1B4DA395 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1352 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D | US | der | 1.47 Kb | whitelisted |
940 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
940 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D | US | der | 1.47 Kb | whitelisted |
1076 | svchost.exe | GET | 200 | 67.27.233.254:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b2f445e81166d0a8 | US | compressed | 4.70 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1352 | iexplore.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
940 | iexplore.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
1352 | iexplore.exe | 13.107.5.80:443 | www.bingapis.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
940 | iexplore.exe | 152.199.19.161:443 | iecvlist.microsoft.com | EDGECAST | US | whitelisted |
1076 | svchost.exe | 67.27.233.254:80 | ctldl.windowsupdate.com | LEVEL3 | US | suspicious |
1352 | iexplore.exe | 93.184.221.240:80 | ctldl.windowsupdate.com | EDGECAST | GB | whitelisted |
940 | iexplore.exe | 93.184.221.240:80 | ctldl.windowsupdate.com | EDGECAST | GB | whitelisted |
940 | iexplore.exe | 2.23.209.189:443 | www.bing.com | Akamai International B.V. | GB | malicious |
Domain | IP | Reputation |
---|---|---|
www.bingapis.com |
| suspicious |
ctldl.windowsupdate.com |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
iecvlist.microsoft.com |
| whitelisted |
r20swj13mr.microsoft.com |
| whitelisted |