URL: | https://u10817722.ct.sendgrid.net/wf/click?upn=w4gJimGE6OfjzU3knIJqd4tkXdU4FwxrErqVQL5P9PQKxaSaPlP8OeYmGFI35lfbd1B-2BhEBP5n9kWnk0NK5KdkLakpJl3DOpTYaBUZi7iFAVu0BiAQbWoYEtHNzyIuh-2FItM3QSUG8Bx0NxmvbGcTNQgrY690OJmYc9mTyDexi-2B5gYvw6o2GuPKemhk8Ttf0uvnqt5IZSizMcGFXMNSGaMj-2BsdLfRx1G9Ma-2BGim9BQYM-3D_RponfwD6SWCG-2FiVEIcoB4HjTrvP54Omdf-2BKfk78FDiHM-2FU5qTL5U-2Bj-2BVKVrZkbf97zT4H8YorIdHL92FTBuuMdqmMLMnGCwT-2FhoZGAhJdFKu-2FeBfw3Jrv3OInZiAU2SB5MIpmZtIY2KVvPL-2F-2F1Is6ScjD2NBgf7obWhWdTgeB2Ks8WhVZBUV8edUub4F-2BLyN99eIh89pScFUfBL-2BOffoeiuNI0WAtVKfZzJL0eieKSY-3D |
Full analysis: | https://app.any.run/tasks/a3bd3678-cdff-4bbb-b36f-9de69fc44f53 |
Verdict: | Malicious activity |
Analysis date: | June 18, 2019, 21:35:58 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MD5: | FC365A8BA05195EBDC54094A0A140D33 |
SHA1: | A00EEB0FBB66139EE3E9E70D59D91D3B8EFD659D |
SHA256: | DED556305E243182C79FFDF3D22B45297C82B8C03957F87317C1D33A38F38C43 |
SSDEEP: | 12:2mDSspLW2EDXDXNXp62hMsql8JoZ2pliV6dpMy2j1phvhCMoGMyA:20hLxQD9p62hBGs4OliQdKyc1/8GdA |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2956 | "C:\Program Files\Internet Explorer\iexplore.exe" https://u10817722.ct.sendgrid.net/wf/click?upn=w4gJimGE6OfjzU3knIJqd4tkXdU4FwxrErqVQL5P9PQKxaSaPlP8OeYmGFI35lfbd1B-2BhEBP5n9kWnk0NK5KdkLakpJl3DOpTYaBUZi7iFAVu0BiAQbWoYEtHNzyIuh-2FItM3QSUG8Bx0NxmvbGcTNQgrY690OJmYc9mTyDexi-2B5gYvw6o2GuPKemhk8Ttf0uvnqt5IZSizMcGFXMNSGaMj-2BsdLfRx1G9Ma-2BGim9BQYM-3D_RponfwD6SWCG-2FiVEIcoB4HjTrvP54Omdf-2BKfk78FDiHM-2FU5qTL5U-2Bj-2BVKVrZkbf97zT4H8YorIdHL92FTBuuMdqmMLMnGCwT-2FhoZGAhJdFKu-2FeBfw3Jrv3OInZiAU2SB5MIpmZtIY2KVvPL-2F-2F1Is6ScjD2NBgf7obWhWdTgeB2Ks8WhVZBUV8edUub4F-2BLyN99eIh89pScFUfBL-2BOffoeiuNI0WAtVKfZzJL0eieKSY-3D | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3452 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2956 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3484 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2956 CREDAT:71938 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
3620 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2956 CREDAT:71939 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2348 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" /o /eo /l /b /id 3452 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | — | iexplore.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe Acrobat Reader DC Exit code: 0 Version: 15.23.20070.215641 | ||||
1296 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" /o /eo /l /b /id 3452 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | iexplore.exe | |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe Acrobat Reader DC Version: 15.23.20070.215641 | ||||
2388 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer /o /eo /l /b /id 3452 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | — | AcroRd32.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe Acrobat Reader DC Version: 15.23.20070.215641 | ||||
2776 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16448250 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | — | AcroRd32.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe RdrCEF Version: 15.23.20053.211670 | ||||
1476 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="2776.0.1701715304\113421057" --allow-no-sandbox-job /prefetch:673131151 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | — | RdrCEF.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe RdrCEF Exit code: 0 Version: 15.23.20053.211670 | ||||
2496 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="2776.1.1176555314\1117183931" --allow-no-sandbox-job /prefetch:673131151 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | — | RdrCEF.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe RdrCEF Version: 15.23.20053.211670 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2956 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
2956 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
3452 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat | dat | |
MD5:956C0288F68175AFD655F639ED4B436E | SHA256:46D7EB2B3DBB00B01F3D8B1FB6B7A8C9179EBA82AB2351E342AF256CD8DD6981 | |||
3452 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:E17619D39A234CF02A949C253240C537 | SHA256:86824D074AB3605D51A59036D7C578AB91A0B337EFC16586572A3FD23ED1C891 | |||
3452 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1RDCD0NC\desktop.ini | ini | |
MD5:4A3DEB274BB5F0212C2419D3D8D08612 | SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38 | |||
2956 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].png | image | |
MD5:9FB559A691078558E77D6848202F6541 | SHA256:6D8A01DC7647BC218D003B58FE04049E24A9359900B7E0CEBAE76EDF85B8B914 | |||
3452 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PPAEALXW\desktop.ini | ini | |
MD5:4A3DEB274BB5F0212C2419D3D8D08612 | SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38 | |||
3452 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\desktop.ini | ini | |
MD5:4A3DEB274BB5F0212C2419D3D8D08612 | SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38 | |||
3452 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1RDCD0NC\dnserror[1] | html | |
MD5:68E03ED57EC741A4AFBBCD11FAB1BDBE | SHA256:1FF3334C3EB27033F8F37029FD72F648EDD4551FCE85FC1F5159FEAEA1439630 | |||
3452 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DP6V5JFD\desktop.ini | ini | |
MD5:4A3DEB274BB5F0212C2419D3D8D08612 | SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3452 | iexplore.exe | GET | 200 | 72.29.67.240:80 | http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/cmd-login=cd01efe09a3c34091edcbd69433f3bbc/bguzwnl9jbbsm18hxzju2lyg.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&[email protected]&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4 | US | html | 37.0 Kb | malicious |
3452 | iexplore.exe | GET | 200 | 72.29.67.240:80 | http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/converged.css | US | text | 85.3 Kb | malicious |
3452 | iexplore.exe | GET | — | 72.29.67.240:80 | http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/prefetch_data/boot_003.js | US | — | — | malicious |
3452 | iexplore.exe | GET | 200 | 72.29.67.240:80 | http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/prefetch_data/boot.css | US | text | 226 Kb | malicious |
3452 | iexplore.exe | GET | 200 | 72.29.67.240:80 | http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/convergedloginpaginatedstrings-en.js | US | text | 11.1 Kb | malicious |
3452 | iexplore.exe | GET | 200 | 72.29.67.240:80 | http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/prefetch.htm | US | html | 3.93 Kb | malicious |
3452 | iexplore.exe | GET | 200 | 72.29.67.240:80 | http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/picker_more.svg | US | image | 899 b | malicious |
3452 | iexplore.exe | GET | 200 | 72.29.67.240:80 | http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/prefetch_data/boot_002_002.js | US | text | 639 Kb | malicious |
3452 | iexplore.exe | GET | 200 | 72.29.67.240:80 | http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/ellipsis_white.svg | US | image | 915 b | malicious |
3452 | iexplore.exe | GET | 200 | 72.29.67.240:80 | http://login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com/321/empty_files/convergedlogin_pcore.js | US | text | 422 Kb | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3452 | iexplore.exe | 167.89.118.35:443 | u10817722.ct.sendgrid.net | SendGrid, Inc. | US | suspicious |
2956 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3452 | iexplore.exe | 72.29.67.240:80 | login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com | HostDime.com, Inc. | US | suspicious |
3484 | iexplore.exe | 40.126.9.97:443 | passwordreset.microsoftonline.com | Microsoft Corporation | US | unknown |
2956 | iexplore.exe | 184.31.91.84:443 | secure.aadcdn.microsoftonline-p.com | Akamai International B.V. | NL | whitelisted |
3452 | iexplore.exe | 184.31.91.84:443 | secure.aadcdn.microsoftonline-p.com | Akamai International B.V. | NL | whitelisted |
3452 | iexplore.exe | 2.18.232.137:443 | r4.res.office365.com | Akamai International B.V. | — | whitelisted |
3484 | iexplore.exe | 104.210.51.228:443 | client.hip.live.com | Microsoft Corporation | US | unknown |
2956 | iexplore.exe | 40.126.9.97:443 | passwordreset.microsoftonline.com | Microsoft Corporation | US | unknown |
3484 | iexplore.exe | 152.199.19.160:443 | ajax.aspnetcdn.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
u10817722.ct.sendgrid.net |
| malicious |
www.bing.com |
| whitelisted |
login.microsoftonline.com-common-oatuth2-authorize-client-dent00590002-0000-0jh1-fz00.wolkenfreitel.com |
| malicious |
dns.msftncsi.com |
| shared |
secure.aadcdn.microsoftonline-p.com |
| whitelisted |
r4.res.office365.com |
| whitelisted |
passwordreset.microsoftonline.com |
| whitelisted |
ajax.aspnetcdn.com |
| whitelisted |
client.hip.live.com |
| whitelisted |
wus.client.hip.live.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
3452 | iexplore.exe | A Network Trojan was detected | MALWARE [PTsecurity] Adobe PDF Phishing Landing |
3452 | iexplore.exe | Potentially Bad Traffic | ET CURRENT_EVENTS Microsoft Phishing Landing 2018-08-07 |
3452 | iexplore.exe | Potential Corporate Privacy Violation | ET POLICY Http Client Body contains passwd= in cleartext |
3452 | iexplore.exe | Potentially Bad Traffic | ET CURRENT_EVENTS Microsoft Phishing Landing 2018-08-07 |
3452 | iexplore.exe | Potential Corporate Privacy Violation | ET POLICY Http Client Body contains passwd= in cleartext |