URL: | http://url6411.registrandoanual.com/ls/click?upn=SVDY8ROdAvhh4-2FltNUSvq3soDLbe0KSK5Rh6jZGXGKAGVp79yJWiYgyv3r8PNp0heNDlp1n1q6BWwIycwqRmznUyP6Qb6NlAyNS3DRFqmP37EV-2BWRc6daOGiJhSl4zM6DMwIGSn3D-2F7QvSzWZZHykQ-3D-3DMTML_kXeW-2F-2FPnIg8g4SSQHK3wrr0ESm3A4gB5VYHpdzq0Q-2B5PTMygQCEtlHyTko98en0ig6NvlGU6lqyiiCxtykDcHCoY64MZz5ZnWuBYxmgTNoHpz-2Fd8qEDlt7pxzm4GEwO1HLKl-2BVdc3SJIFFXLH9ao1JoJYrsHwNWk9Pcdh-2FTs-2Fog7lHnewBG4ieB6trocT7j0mPJZcGNUM96L-2BdyHAa6f9JTHsLbxFxlL5sLOHH6BqOGdQaRyRnzF-2FGq3Hzapk11hE1vF9nvjHT7KIHDyFS9WKcF0k-2BrJTbP9A-2FPyD4maYaVmjrDQijkyQgtwEYZlrWgw2NdCormp0cMMysm37sDTtw-3D-3D |
Full analysis: | https://app.any.run/tasks/e60211ec-e6eb-490b-bd92-042d39755826 |
Verdict: | Malicious activity |
Analysis date: | April 01, 2023, 07:03:30 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 1700A21B5A4476B6687618E41639D993 |
SHA1: | 396820C628490BA1C962540DEB33FE232234CA00 |
SHA256: | E2FF5F4FE4A8552311A0D094E6D388E4613E5E53DAB6F7953EEC1309836834FF |
SSDEEP: | 12:qLlSdVikD9Su5Eqnaf46GRIfh9ePMdlmaQJnwKa091/EVJfz0yWb:qELatGAhaMdwa7KVyVhk |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1916 | "C:\Program Files\Internet Explorer\iexplore.exe" "http://url6411.registrandoanual.com/ls/click?upn=SVDY8ROdAvhh4-2FltNUSvq3soDLbe0KSK5Rh6jZGXGKAGVp79yJWiYgyv3r8PNp0heNDlp1n1q6BWwIycwqRmznUyP6Qb6NlAyNS3DRFqmP37EV-2BWRc6daOGiJhSl4zM6DMwIGSn3D-2F7QvSzWZZHykQ-3D-3DMTML_kXeW-2F-2FPnIg8g4SSQHK3wrr0ESm3A4gB5VYHpdzq0Q-2B5PTMygQCEtlHyTko98en0ig6NvlGU6lqyiiCxtykDcHCoY64MZz5ZnWuBYxmgTNoHpz-2Fd8qEDlt7pxzm4GEwO1HLKl-2BVdc3SJIFFXLH9ao1JoJYrsHwNWk9Pcdh-2FTs-2Fog7lHnewBG4ieB6trocT7j0mPJZcGNUM96L-2BdyHAa6f9JTHsLbxFxlL5sLOHH6BqOGdQaRyRnzF-2FGq3Hzapk11hE1vF9nvjHT7KIHDyFS9WKcF0k-2BrJTbP9A-2FPyD4maYaVmjrDQijkyQgtwEYZlrWgw2NdCormp0cMMysm37sDTtw-3D-3D" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3108 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1916 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
(PID) Process: | (1916) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPDaysSinceLastAutoMigration |
Value: 0 | |||
(PID) Process: | (1916) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPLastLaunchHighDateTime |
Value: 30847387 | |||
(PID) Process: | (1916) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 30847437 | |||
(PID) Process: | (1916) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (1916) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (1916) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
(PID) Process: | (1916) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (1916) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (1916) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (1916) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3108 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C1374A5952A95E7EFD6A29E882F9C45E | binary | |
MD5:C060C2B0BA9D79C08162123E1E8F609E | SHA256:A1E1FD3C26555FB7EB49B32C4EEF1849321F6D721F6A76A9BD57CCAA2265A46A | |||
3108 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D | der | |
MD5:EE7AD9D8F28E0558A94E667206E8A271 | SHA256:9EEEEF2CBD8192C6586FFA64114AD0C3E8E5AB3A73817E1044895517C6EBA712 | |||
3108 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C1374A5952A95E7EFD6A29E882F9C45E | der | |
MD5:1699BBC7C5C2BEB4052EA7B149F59223 | SHA256:0284014C319C63063B8525B39C7727518CF919C69B2A6BEFB479C17780F2DDDA | |||
3108 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:720EC856E734BC5845FE3A766E2D792D | SHA256:B18EF651A0C515541DF03A50BE317210DCADBD3B9991228F4A9BDC06DDDAAC1F | |||
3108 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 | der | |
MD5:B6F26E04F86E4B1D4E2DEF7A28500064 | SHA256:51CDBEFE064909D87A8E1D4ACCE253C710AC15C670F49F389FD083C57B49DE20 | |||
1916 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 | binary | |
MD5:1E603D806E1D49D89DDFB45278301C15 | SHA256:1598A6DAD113625205E91C27EE41A80BA07B9C818671803360F3C7A4881EC511 | |||
1916 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 | der | |
MD5:BDBBD793778777706223B00A4EA24ED0 | SHA256:8B1034038298FAF34D3F580C1DED7212F40D146DE7E62CFF20826C8B53F80C36 | |||
3108 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D | binary | |
MD5:AD636507E08D0393477B06C7E913B6A6 | SHA256:24BFFB4F6CCF71829E90A15667326B2479BF08C9D8871BD693EE33A51FB548A5 | |||
3108 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565 | der | |
MD5:84B1F477C90DBEB15A36B2CCAC368A13 | SHA256:00AF63B52D5AB007911925C905AF313AEFB5F6B61E8DFD17BED35ABF8B0786EF | |||
1916 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\urlblockindex[1].bin | binary | |
MD5:FA518E3DFAE8CA3A0E495460FD60C791 | SHA256:775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3108 | iexplore.exe | GET | 200 | 172.64.155.188:80 | http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D | US | der | 2.18 Kb | whitelisted |
3108 | iexplore.exe | GET | 200 | 172.64.155.188:80 | http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQCI%2B8jA50qshI9kqyOKmkUR | US | der | 472 b | whitelisted |
3108 | iexplore.exe | GET | 302 | 167.89.123.124:80 | http://url6411.registrandoanual.com/ls/click?upn=SVDY8ROdAvhh4-2FltNUSvq3soDLbe0KSK5Rh6jZGXGKAGVp79yJWiYgyv3r8PNp0heNDlp1n1q6BWwIycwqRmznUyP6Qb6NlAyNS3DRFqmP37EV-2BWRc6daOGiJhSl4zM6DMwIGSn3D-2F7QvSzWZZHykQ-3D-3DMTML_kXeW-2F-2FPnIg8g4SSQHK3wrr0ESm3A4gB5VYHpdzq0Q-2B5PTMygQCEtlHyTko98en0ig6NvlGU6lqyiiCxtykDcHCoY64MZz5ZnWuBYxmgTNoHpz-2Fd8qEDlt7pxzm4GEwO1HLKl-2BVdc3SJIFFXLH9ao1JoJYrsHwNWk9Pcdh-2FTs-2Fog7lHnewBG4ieB6trocT7j0mPJZcGNUM96L-2BdyHAa6f9JTHsLbxFxlL5sLOHH6BqOGdQaRyRnzF-2FGq3Hzapk11hE1vF9nvjHT7KIHDyFS9WKcF0k-2BrJTbP9A-2FPyD4maYaVmjrDQijkyQgtwEYZlrWgw2NdCormp0cMMysm37sDTtw-3D-3D | US | html | 125 b | whitelisted |
1916 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
3108 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D | US | der | 1.47 Kb | whitelisted |
1916 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D | US | der | 1.47 Kb | whitelisted |
3108 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAfy81yHqHeveu%2FpR5k1Jb0%3D | US | der | 471 b | whitelisted |
3108 | iexplore.exe | GET | 200 | 41.63.96.128:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?df1fbb81b096ea25 | ZA | compressed | 4.70 Kb | whitelisted |
3108 | iexplore.exe | GET | 200 | 93.184.221.240:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?76ce3b6368335e5d | US | compressed | 4.70 Kb | whitelisted |
— | — | GET | 200 | 142.250.181.227:80 | http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQD%2FB2zZ7cy1JAocIdUzcD8Q | US | der | 472 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3108 | iexplore.exe | 41.63.96.128:80 | ctldl.windowsupdate.com | LLNW | ZA | suspicious |
3108 | iexplore.exe | 172.64.155.188:80 | ocsp.usertrust.com | CLOUDFLARENET | US | suspicious |
3108 | iexplore.exe | 167.89.123.124:80 | — | SENDGRID | US | suspicious |
3108 | iexplore.exe | 162.241.2.98:443 | registroanual.com | OIS1 | US | malicious |
3108 | iexplore.exe | 93.184.221.240:80 | ctldl.windowsupdate.com | EDGECAST | GB | whitelisted |
1916 | iexplore.exe | 204.79.197.200:443 | www.bing.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
1916 | iexplore.exe | 152.199.19.161:443 | r20swj13mr.microsoft.com | EDGECAST | US | whitelisted |
1916 | iexplore.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
3108 | iexplore.exe | 104.26.7.17:443 | logodownload.org | CLOUDFLARENET | US | malicious |
3108 | iexplore.exe | 172.67.162.180:443 | seeklogo.com | CLOUDFLARENET | US | malicious |
Domain | IP | Reputation |
---|---|---|
registroanual.com |
| unknown |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.usertrust.com |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.sectigo.com |
| whitelisted |
r20swj13mr.microsoft.com |
| whitelisted |
iecvlist.microsoft.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
www.googletagmanager.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Misc activity | ET INFO Custom Logo Domain Domain in DNS Lookup (logodownload .org) |
— | — | Misc activity | ET INFO Custom Logo Domain in DNS Lookup (seeklogo .com) |
3108 | iexplore.exe | Misc activity | ET INFO Observed Custom Logo Domain (seeklogo .com in TLS SNI) |
3108 | iexplore.exe | Misc activity | ET INFO Observed Custom Logo Domain (seeklogo .com in TLS SNI) |