URL: | https://lovelydream.net/97jXsPCH?dir=cam&tag=Amelia%20&s1=Lily |
Full analysis: | https://app.any.run/tasks/1b66c90e-a04b-4d65-a1a1-72b5a369676e |
Verdict: | Malicious activity |
Analysis date: | June 27, 2022, 09:56:30 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 92A69DB52D44D1D96D4C66ABD0554127 |
SHA1: | 7043B369F09DC576130F042827D4719E30A945A6 |
SHA256: | DC53618D38B5CEF500125F5BDA94F8A7341F2E53EFF9FDF62370C39AC34A43DC |
SSDEEP: | 3:N8KIjEsAwPoBLLCY2Xhn:2KIjJA6oBnCYQ |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2908 | "C:\Program Files\Internet Explorer\iexplore.exe" "https://lovelydream.net/97jXsPCH?dir=cam&tag=Amelia%20&s1=Lily" | C:\Program Files\Internet Explorer\iexplore.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3340 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2908 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
3340 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:8FC4118727F204A3C1C95AD1E9DC0C00 | SHA256:88F92862CA7E584CDF6D59101DE060024321D7AD000DBF3FADCC4731AF5BEC76 | |||
3340 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\CabBF8B.tmp | compressed | |
MD5:308336E7F515478969B24C13DED11EDE | SHA256:889B832323726A9F10AD03F85562048FDCFE20C9FF6F9D37412CF477B4E92FF9 | |||
3340 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\1G2JFQWX.txt | text | |
MD5:E89005F5E17836D06EB10C8FD558FBC1 | SHA256:0476E4DB428F16188078A87A381425C98C74E3908A136D6F2DBBC3D401F22372 | |||
3340 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 | binary | |
MD5:EF49E47DD94F5291B29EA4C27526F45E | SHA256:4C60B655CA8BC65EFFDBB341FF4EC5CD43A3512AABC2B5129A79336F9AC4C700 | |||
3340 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 | binary | |
MD5:539C87436B3EAF5E39BB9E44B2119CAD | SHA256:D45343FE2AE952222573F892AEF30D5BBB41266005067F6603DA07EC2DDC0E8D | |||
3340 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\TarBF8A.tmp | cat | |
MD5:2D8A5090656DE9FB55DD0F3BA20F9299 | SHA256:44AE1E61A4E6305C15AAA52FD1B29DDB060E69233703CBA611F5E781D766442E | |||
3340 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 | der | |
MD5:FC887F7C5EF1EEAE3FB3BA651F77AC36 | SHA256:5F98609231B96FC1ECFEFF757089F66D6A74BBE8FED6B33D83A799790484AA56 | |||
2908 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63 | der | |
MD5:28CC3D4B0DA8A29A9DCD6D4755C84342 | SHA256:A4CA2DD1D4545838F7A9102623442BC76BDEB2185E9991A294BCB0B6456DDA0E | |||
3340 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\WRRLUMTG.txt | text | |
MD5:5084F4FBD16D3E796F7004D940A3082E | SHA256:A03542DC06607D67DF45D280276AD6294CBBB154D2445A836AA8E7FDFB3220F6 | |||
3340 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\885RYN3R.txt | text | |
MD5:3E5168C6B7509F74DEA4BCB84EA12B3C | SHA256:32132CAE30DF14C215B6A5067494B91CD5279AC9D116B5F10F5B44BFA041A669 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3340 | iexplore.exe | GET | 302 | 34.91.226.152:80 | http://t.luvmenow.com/sl?id=5fa1807a127bd6bcbd272004&pid=11249&sub3=ui9u4b5vccmf&sub1=17454&sub2=frd | US | — | — | suspicious |
3340 | iexplore.exe | GET | 200 | 8.252.73.126:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?083ea7dff19e872e | US | compressed | 60.0 Kb | whitelisted |
2908 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
2908 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D | US | der | 1.47 Kb | whitelisted |
3340 | iexplore.exe | GET | 200 | 8.252.73.126:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?10f771d6d1d2f4a5 | US | compressed | 60.0 Kb | whitelisted |
3340 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D | US | der | 1.47 Kb | whitelisted |
3340 | iexplore.exe | GET | 200 | 216.58.212.163:80 | http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D | US | der | 724 b | whitelisted |
3340 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D | US | der | 471 b | whitelisted |
3340 | iexplore.exe | GET | 200 | 216.58.212.163:80 | http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D | US | der | 1.41 Kb | whitelisted |
3340 | iexplore.exe | GET | 200 | 2.16.241.15:80 | http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgMfTzFHhsX%2F0wUUUqSp6%2FF2XQ%3D%3D | unknown | der | 503 b | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2908 | iexplore.exe | 204.79.197.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
2908 | iexplore.exe | 13.107.21.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
3340 | iexplore.exe | 104.21.89.215:443 | lovelydream.net | Cloudflare Inc | US | suspicious |
3340 | iexplore.exe | 8.252.73.126:80 | ctldl.windowsupdate.com | Level 3 Communications, Inc. | US | suspicious |
3340 | iexplore.exe | 172.67.165.49:443 | lovelydream.net | — | US | suspicious |
2908 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
3340 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
3340 | iexplore.exe | 34.91.226.152:80 | t.luvmenow.com | — | US | unknown |
3340 | iexplore.exe | 52.19.101.114:443 | xovzrd.findiover.net | Amazon.com, Inc. | IE | malicious |
3340 | iexplore.exe | 2.16.241.15:80 | r3.o.lencr.org | Akamai International B.V. | — | suspicious |
Domain | IP | Reputation |
---|---|---|
lovelydream.net |
| suspicious |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
t.luvmenow.com |
| suspicious |
xovzrd.findiover.net |
| malicious |
x1.c.lencr.org |
| whitelisted |
r3.o.lencr.org |
| shared |
cdn-bimi.akamaized.net |
| whitelisted |