Malware analysis https://u10817722.ct.sendgrid.net/wf/click?upn=w4gJimGE6OfjzU3knIJqd4tkXdU4FwxrErqVQL5P9PQKxaSaPlP8OeYmGFI35lfbd1B-2BhEBP5n9kWnk0NK5KdkLakpJl3DOpTYaBUZi7iFAVu0BiAQbWoYEtHNzyIuh-2FItM3QSUG8Bx0NxmvbGcTNQgrY690OJmYc9mTyDexi-2B5gYvw6o2GuPKemhk8Ttf0uvnqt5IZSizMcGFXMNSGaMj-2BsdLfRx1G9Ma-2BGim9BQYM-3D_RponfwD6SWCG-2FiVEIcoB4HjTrvP54Omdf-2BKfk78FDiHM-2FU5qTL5U-2Bj-2BVKVrZkbf97zT4H8YorIdHL92FTBuuMdqmMLMnGCwT-2FhoZGAhJdFKu-2FeBfw3Jrv3OInZiAU2SB5MIpmZtIY2KVvPL-2F-2F1Is6ScjD2NBgf7obWhWdTgeB2Ks8WhVZBUV8edUub4F-2BLyN99eIh89pScFUfBL-2BOffoeiuNI0WAtVKfZzJL0eieKSY-3D Malicious activity

Add for printing

URL:	https://u10817722.ct.sendgrid.net/wf/click?upn=w4gJimGE6OfjzU3knIJqd4tkXdU4FwxrErqVQL5P9PQKxaSaPlP8OeYmGFI35lfbd1B-2BhEBP5n9kWnk0NK5KdkLakpJl3DOpTYaBUZi7iFAVu0BiAQbWoYEtHNzyIuh-2FItM3QSUG8Bx0NxmvbGcTNQgrY690OJmYc9mTyDexi-2B5gYvw6o2GuPKemhk8Ttf0uvnqt5IZSizMcGFXMNSGaMj-2BsdLfRx1G9Ma-2BGim9BQYM-3D_RponfwD6SWCG-2FiVEIcoB4HjTrvP54Omdf-2BKfk78FDiHM-2FU5qTL5U-2Bj-2BVKVrZkbf97zT4H8YorIdHL92FTBuuMdqmMLMnGCwT-2FhoZGAhJdFKu-2FeBfw3Jrv3OInZiAU2SB5MIpmZtIY2KVvPL-2F-2F1Is6ScjD2NBgf7obWhWdTgeB2Ks8WhVZBUV8edUub4F-2BLyN99eIh89pScFUfBL-2BOffoeiuNI0WAtVKfZzJL0eieKSY-3D
Full analysis:	https://app.any.run/tasks/44d9995b-fdc6-485a-a059-f96ad13bf7f5
Verdict:	Malicious activity
Analysis date:	June 18, 2019, 21:46:21
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:	phishing
Indicators:
MD5:	FC365A8BA05195EBDC54094A0A140D33
SHA1:	A00EEB0FBB66139EE3E9E70D59D91D3B8EFD659D
SHA256:	DED556305E243182C79FFDF3D22B45297C82B8C03957F87317C1D33A38F38C43
SSDEEP:	12:2mDSspLW2EDXDXNXp62hMsql8JoZ2pliV6dpMy2j1phvhCMoGMyA:20hLxQD9p62hBGs4OliQdKyc1/8GdA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (73.0.3683.75)
Google Update Helper (1.3.33.23)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
Mozilla Firefox 65.0.2 (x86 en-US) (65.0.2)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
No suspicious indicators.
INFO
- Reads internet explorer settings
  - iexplore.exe (PID: 3696)
- Changes internet zones settings
  - iexplore.exe (PID: 1832)
- Application launched itself
  - iexplore.exe (PID: 1832)
- Creates files in the user directory
  - iexplore.exe (PID: 3696)
- Reads Internet Cache Settings
  - iexplore.exe (PID: 3696)
- Reads settings of System Certificates
  - iexplore.exe (PID: 1832)
- Adds / modifies Windows certificates
  - iexplore.exe (PID: 1832)
- Changes settings of System certificates
  - iexplore.exe (PID: 1832)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Parent process
1832	"C:\Program Files\Internet Explorer\iexplore.exe" https://u10817722.ct.sendgrid.net/wf/click?upn=w4gJimGE6OfjzU3knIJqd4tkXdU4FwxrErqVQL5P9PQKxaSaPlP8OeYmGFI35lfbd1B-2BhEBP5n9kWnk0NK5KdkLakpJl3DOpTYaBUZi7iFAVu0BiAQbWoYEtHNzyIuh-2FItM3QSUG8Bx0NxmvbGcTNQgrY690OJmYc9mTyDexi-2B5gYvw6o2GuPKemhk8Ttf0uvnqt5IZSizMcGFXMNSGaMj-2BsdLfRx1G9Ma-2BGim9BQYM-3D_RponfwD6SWCG-2FiVEIcoB4HjTrvP54Omdf-2BKfk78FDiHM-2FU5qTL5U-2Bj-2BVKVrZkbf97zT4H8YorIdHL92FTBuuMdqmMLMnGCwT-2FhoZGAhJdFKu-2FeBfw3Jrv3OInZiAU2SB5MIpmZtIY2KVvPL-2F-2F1Is6ScjD2NBgf7obWhWdTgeB2Ks8WhVZBUV8edUub4F-2BLyN99eIh89pScFUfBL-2BOffoeiuNI0WAtVKfZzJL0eieKSY-3D	C:\Program Files\Internet Explorer\iexplore.exe	explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)
3696	"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1832 CREDAT:71937	C:\Program Files\Internet Explorer\iexplore.exe	iexplore.exe
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)

Add for printing

Total events

492

Read events

391

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
1832	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico		—
		MD5:—	SHA256:—
1832	iexplore.exe	C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico		—
		MD5:—	SHA256:—
3696	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat		dat
		MD5:C4F8AFD05AA8E9D9B7C9B76CBDF16CBB	SHA256:10C23494E32B1F4EE3AF4E8593919856879D42FCA152038F014530F4566D474E
3696	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OWJ9EDML\desktop.ini		ini
		MD5:4A3DEB274BB5F0212C2419D3D8D08612	SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
3696	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat		dat
		MD5:42A5090815E2CCFC0E1C3086EE23A1EB	SHA256:658867763E7E1FD28541D5C6FC3D17531B8706902E84B99CC6B4A98B142A6821
3696	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OWJ9EDML\rk0vfsn9yeadqjp45d2292vu[1].php		—
		MD5:—	SHA256:—
3696	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1E6OU0ZB\desktop.ini		ini
		MD5:4A3DEB274BB5F0212C2419D3D8D08612	SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
1832	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini		ini
		MD5:4A3DEB274BB5F0212C2419D3D8D08612	SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
3696	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\R9F3WJKX\noConnect[1]		image
		MD5:3CB8FACCD5DE434D415AB75C17E8FD86	SHA256:6976C426E3AC66D66303C114B22B2B41109A7DE648BA55FFC3E5A53BD0DB09E7
1832	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].png		image
		MD5:9FB559A691078558E77D6848202F6541	SHA256:6D8A01DC7647BC218D003B58FE04049E24A9359900B7E0CEBAE76EDF85B8B914

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
3696	iexplore.exe	GET	200	72.29.67.240:80	http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/prefetch_data/boot_002_002.js	US	text	639 Kb	malicious
3696	iexplore.exe	GET	200	72.29.67.240:80	http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/convergedloginpaginatedstrings-en.js	US	text	11.1 Kb	malicious
3696	iexplore.exe	GET	200	72.29.67.240:80	http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/cmd-login=6d534ddb031fd3806a7fd8b85505c292/rk0vfsn9yeadqjp45d2292vu.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&[email protected]&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4	US	html	37.0 Kb	malicious
3696	iexplore.exe	GET	200	72.29.67.240:80	http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/converged.css	US	text	85.3 Kb	malicious
3696	iexplore.exe	GET	200	72.29.67.240:80	http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/prefetch.htm	US	html	3.93 Kb	malicious
3696	iexplore.exe	GET	200	72.29.67.240:80	http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/prefetch_data/boot_007.js	US	text	642 Kb	malicious
3696	iexplore.exe	GET	200	72.29.67.240:80	http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/prefetch_data/boot_003.js	US	text	640 Kb	malicious
3696	iexplore.exe	GET	200	72.29.67.240:80	http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/convergedlogin_pcore.js	US	text	422 Kb	malicious
3696	iexplore.exe	GET	200	72.29.67.240:80	http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/prefetch_data/boot_004.js	US	txt	643 Kb	malicious
3696	iexplore.exe	GET	200	72.29.67.240:80	http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/prefetch_data/sprite1_002.css	US	text	7.43 Kb	malicious

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
3696	iexplore.exe	184.31.91.84:443	secure.aadcdn.microsoftonline-p.com	Akamai International B.V.	NL	whitelisted
3696	iexplore.exe	72.29.67.240:80	login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com	HostDime.com, Inc.	US	suspicious
3696	iexplore.exe	167.89.118.35:443	u10817722.ct.sendgrid.net	SendGrid, Inc.	US	suspicious
1832	iexplore.exe	204.79.197.200:80	www.bing.com	Microsoft Corporation	US	whitelisted
1832	iexplore.exe	184.31.91.84:443	secure.aadcdn.microsoftonline-p.com	Akamai International B.V.	NL	whitelisted
3696	iexplore.exe	2.18.232.137:443	r4.res.office365.com	Akamai International B.V.	—	whitelisted

DNS requests

Domain	IP	Reputation
u10817722.ct.sendgrid.net	167.89.118.35 167.89.123.16 167.89.115.54	malicious
www.bing.com	204.79.197.200 13.107.21.200	whitelisted
login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com	72.29.67.240	malicious
secure.aadcdn.microsoftonline-p.com	184.31.91.84	whitelisted
r4.res.office365.com	2.18.232.137	whitelisted

Threats

PID	Process	Class	Message
3696	iexplore.exe	A Network Trojan was detected	MALWARE [PTsecurity] Adobe PDF Phishing Landing
3696	iexplore.exe	Potentially Bad Traffic	ET CURRENT_EVENTS Microsoft Phishing Landing 2018-08-07

1 ETPRO signatures available at the full report

Add for printing

No debug info

General Info

FC365A8BA05195EBDC54094A0A140D33

A00EEB0FBB66139EE3E9E70D59D91D3B8EFD659D

DED556305E243182C79FFDF3D22B45297C82B8C03957F87317C1D33A38F38C43

12:2mDSspLW2EDXDXNXp62hMsql8JoZ2pliV6dpMy2j1phvhCMoGMyA:20hLxQD9p62hBGs4OliQdKyc1/8GdA

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

INFO

Reads internet explorer settings

Changes internet zones settings

Application launched itself

Creates files in the user directory

Reads Internet Cache Settings

Reads settings of System Certificates

Adds / modifies Windows certificates

Changes settings of System certificates

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings