URL: | https://u10817722.ct.sendgrid.net/wf/click?upn=w4gJimGE6OfjzU3knIJqd4tkXdU4FwxrErqVQL5P9PQKxaSaPlP8OeYmGFI35lfbd1B-2BhEBP5n9kWnk0NK5KdkLakpJl3DOpTYaBUZi7iFAVu0BiAQbWoYEtHNzyIuh-2FItM3QSUG8Bx0NxmvbGcTNQgrY690OJmYc9mTyDexi-2B5gYvw6o2GuPKemhk8Ttf0uvnqt5IZSizMcGFXMNSGaMj-2BsdLfRx1G9Ma-2BGim9BQYM-3D_RponfwD6SWCG-2FiVEIcoB4HjTrvP54Omdf-2BKfk78FDiHM-2FU5qTL5U-2Bj-2BVKVrZkbf97zT4H8YorIdHL92FTBuuMdqmMLMnGCwT-2FhoZGAhJdFKu-2FeBfw3Jrv3OInZiAU2SB5MIpmZtIY2KVvPL-2F-2F1Is6ScjD2NBgf7obWhWdTgeB2Ks8WhVZBUV8edUub4F-2BLyN99eIh89pScFUfBL-2BOffoeiuNI0WAtVKfZzJL0eieKSY-3D |
Full analysis: | https://app.any.run/tasks/10c0af06-cb55-47f3-8384-8cb325160e91 |
Verdict: | Malicious activity |
Analysis date: | June 18, 2019, 21:57:17 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MD5: | FC365A8BA05195EBDC54094A0A140D33 |
SHA1: | A00EEB0FBB66139EE3E9E70D59D91D3B8EFD659D |
SHA256: | DED556305E243182C79FFDF3D22B45297C82B8C03957F87317C1D33A38F38C43 |
SSDEEP: | 12:2mDSspLW2EDXDXNXp62hMsql8JoZ2pliV6dpMy2j1phvhCMoGMyA:20hLxQD9p62hBGs4OliQdKyc1/8GdA |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2888 | "C:\Program Files\Internet Explorer\iexplore.exe" https://u10817722.ct.sendgrid.net/wf/click?upn=w4gJimGE6OfjzU3knIJqd4tkXdU4FwxrErqVQL5P9PQKxaSaPlP8OeYmGFI35lfbd1B-2BhEBP5n9kWnk0NK5KdkLakpJl3DOpTYaBUZi7iFAVu0BiAQbWoYEtHNzyIuh-2FItM3QSUG8Bx0NxmvbGcTNQgrY690OJmYc9mTyDexi-2B5gYvw6o2GuPKemhk8Ttf0uvnqt5IZSizMcGFXMNSGaMj-2BsdLfRx1G9Ma-2BGim9BQYM-3D_RponfwD6SWCG-2FiVEIcoB4HjTrvP54Omdf-2BKfk78FDiHM-2FU5qTL5U-2Bj-2BVKVrZkbf97zT4H8YorIdHL92FTBuuMdqmMLMnGCwT-2FhoZGAhJdFKu-2FeBfw3Jrv3OInZiAU2SB5MIpmZtIY2KVvPL-2F-2F1Is6ScjD2NBgf7obWhWdTgeB2Ks8WhVZBUV8edUub4F-2BLyN99eIh89pScFUfBL-2BOffoeiuNI0WAtVKfZzJL0eieKSY-3D | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3652 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2888 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3884 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2888 CREDAT:71938 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2224 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2888 CREDAT:71939 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2348 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" /o /eo /l /b /id 3652 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | — | iexplore.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe Acrobat Reader DC Exit code: 0 Version: 15.23.20070.215641 | ||||
2376 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" /o /eo /l /b /id 3652 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | iexplore.exe | |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe Acrobat Reader DC Exit code: 1 Version: 15.23.20070.215641 | ||||
1260 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer /o /eo /l /b /id 3652 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | — | AcroRd32.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe Acrobat Reader DC Exit code: 1 Version: 15.23.20070.215641 | ||||
1076 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16448250 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | — | AcroRd32.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe RdrCEF Exit code: 3221225547 Version: 15.23.20053.211670 | ||||
2296 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="1076.0.388104459\1307400641" --allow-no-sandbox-job /prefetch:673131151 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | — | RdrCEF.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe RdrCEF Exit code: 0 Version: 15.23.20053.211670 | ||||
3008 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="1076.1.2012807468\1028775394" --allow-no-sandbox-job /prefetch:673131151 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | — | RdrCEF.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe RdrCEF Exit code: 0 Version: 15.23.20053.211670 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2888 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
2888 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
3652 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:C0AA0BF676E4B902CECDD126C8AB0C1B | SHA256:79BE00816885C9A395CCD1C922B4EC060D0E3AFF7100F3C25BE140BEEBD448E7 | |||
3652 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\desktop.ini | ini | |
MD5:4A3DEB274BB5F0212C2419D3D8D08612 | SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38 | |||
3652 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4USXVLNX\ja0tdw0pjzg7b7x6t7imtcbn[1].php | — | |
MD5:— | SHA256:— | |||
3652 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\ZCFTFX24\favcenter[1] | image | |
MD5:25D76EE5FB5B890F2CC022D94A42FE19 | SHA256:07D07A467E4988D3C377ACD6DC9E53ABCA6B64E8FBF70F6BE19D795A1619289B | |||
3652 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\ZCFTFX24\httpErrorPagesScripts[1] | text | |
MD5:E7CA76A3C9EE0564471671D500E3F0F3 | SHA256:58268CA71A28973B756A48BBD7C9DC2F6B87B62AE343E582CE067C725275B63C | |||
3652 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat | dat | |
MD5:143979040A1FC5E66BDDE87361E68960 | SHA256:BCFE8C934631B02DC9116A18FA119A08CB4791BD0E72F0B19EFA50FFF51E7EA2 | |||
3652 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4USXVLNX\ja0tdw0pjzg7b7x6t7imtcbn[1].htm | html | |
MD5:BBA92BE4F2564E65AE871841E40BFF93 | SHA256:203BC58AA4E4784EFE94C46B5D019D3D4AE3B99FA493F6C781DB2F7EC7C09C2F | |||
3652 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9K6URZS3\dnserror[1] | html | |
MD5:68E03ED57EC741A4AFBBCD11FAB1BDBE | SHA256:1FF3334C3EB27033F8F37029FD72F648EDD4551FCE85FC1F5159FEAEA1439630 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3652 | iexplore.exe | GET | — | 72.29.67.240:80 | http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/picker_account_add.svg | US | — | — | malicious |
3652 | iexplore.exe | GET | — | 72.29.67.240:80 | http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/ellipsis_white.svg | US | — | — | malicious |
3652 | iexplore.exe | GET | — | 72.29.67.240:80 | http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/prefetch.htm | US | — | — | malicious |
3652 | iexplore.exe | GET | 200 | 72.29.67.240:80 | http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/prefetch.htm | US | html | 3.93 Kb | malicious |
3652 | iexplore.exe | GET | 200 | 72.29.67.240:80 | http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/cmd-login=9c8e23868b79cf1b07cefa2032c8cf7f/ja0tdw0pjzg7b7x6t7imtcbn.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&[email protected]&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4 | US | html | 37.0 Kb | malicious |
3652 | iexplore.exe | GET | 200 | 72.29.67.240:80 | http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/ellipsis_white.svg | US | image | 915 b | malicious |
2888 | iexplore.exe | GET | 200 | 13.107.21.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
3652 | iexplore.exe | GET | 200 | 72.29.67.240:80 | http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/prefetch_data/boot_003.js | US | text | 640 Kb | malicious |
3652 | iexplore.exe | GET | 200 | 72.29.67.240:80 | http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/prefetch_data/boot_004.js | US | txt | 643 Kb | malicious |
3652 | iexplore.exe | GET | 200 | 72.29.67.240:80 | http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/prefetch_data/boot_002_002.js | US | text | 639 Kb | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2888 | iexplore.exe | 13.107.21.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2888 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3652 | iexplore.exe | 72.29.67.240:80 | login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com | HostDime.com, Inc. | US | suspicious |
3652 | iexplore.exe | 184.31.91.84:443 | secure.aadcdn.microsoftonline-p.com | Akamai International B.V. | NL | whitelisted |
3884 | iexplore.exe | 20.190.137.0:443 | passwordreset.microsoftonline.com | Microsoft Corporation | US | unknown |
2888 | iexplore.exe | 20.190.137.0:443 | passwordreset.microsoftonline.com | Microsoft Corporation | US | unknown |
3884 | iexplore.exe | 23.96.111.19:443 | client.hip.live.com | Microsoft Corporation | US | whitelisted |
3884 | iexplore.exe | 152.199.19.160:443 | ajax.aspnetcdn.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
3652 | iexplore.exe | 2.18.232.137:443 | r4.res.office365.com | Akamai International B.V. | — | whitelisted |
3652 | iexplore.exe | 167.89.123.16:443 | u10817722.ct.sendgrid.net | SendGrid, Inc. | US | malicious |
Domain | IP | Reputation |
---|---|---|
u10817722.ct.sendgrid.net |
| malicious |
www.bing.com |
| whitelisted |
login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com |
| malicious |
secure.aadcdn.microsoftonline-p.com |
| whitelisted |
r4.res.office365.com |
| whitelisted |
passwordreset.microsoftonline.com |
| whitelisted |
ajax.aspnetcdn.com |
| whitelisted |
client.hip.live.com |
| whitelisted |
eus.client.hip.live.com |
| whitelisted |
wut.smartscreen.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
3652 | iexplore.exe | A Network Trojan was detected | MALWARE [PTsecurity] Adobe PDF Phishing Landing |
3652 | iexplore.exe | Potentially Bad Traffic | ET CURRENT_EVENTS Microsoft Phishing Landing 2018-08-07 |
3652 | iexplore.exe | Potential Corporate Privacy Violation | ET POLICY Http Client Body contains passwd= in cleartext |
3652 | iexplore.exe | Potentially Bad Traffic | ET CURRENT_EVENTS Microsoft Phishing Landing 2018-08-07 |
3652 | iexplore.exe | Potential Corporate Privacy Violation | ET POLICY Http Client Body contains passwd= in cleartext |
3652 | iexplore.exe | Potential Corporate Privacy Violation | ET POLICY Http Client Body contains passwd= in cleartext |
3652 | iexplore.exe | Potential Corporate Privacy Violation | ET POLICY Http Client Body contains passwd= in cleartext |
2760 | chrome.exe | A Network Trojan was detected | MALWARE [PTsecurity] Adobe PDF Phishing Landing |
2760 | chrome.exe | Potentially Bad Traffic | ET CURRENT_EVENTS Microsoft Phishing Landing 2018-08-07 |
2760 | chrome.exe | Potential Corporate Privacy Violation | ET POLICY Http Client Body contains passwd= in cleartext |