URL: | https://liveshareeast3.seismic.com/i/qmBviuPXKAu7CBA2PDa1OsmNGDPWmafSQKYau7pQ5gq2sxGn3sCINh5rXikkkYz0Fy4VClKUhL2KVbZzKurGQPLUSSIGNKXFD33fF4JdqNnD0Aq6a81DIyVjZuiUUqA8ttOzeBw2QwwKV7NJfyz9eFBqQCkvzWAJgAl52YoupgMQKLKwDAEQUALSIGN?source=outreach |
Full analysis: | https://app.any.run/tasks/e5a33246-c78a-4291-8ae8-6e20afed6d46 |
Verdict: | Malicious activity |
Analysis date: | May 21, 2022, 00:37:36 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | A1C3B989F7B60E5734A62C9ACD53FD11 |
SHA1: | D4929FC739DEEEF31C102F119C505D24EF9DE94A |
SHA256: | E533212DA8B7E48FA89C90540EF3E36F708FB16C935F437A7226420345B223C7 |
SSDEEP: | 6:2MGk4SGiVnqtlh1y540pB2Z/QXfBvdiJdcUd3gve9ZXDY3IRRa:2MGk5HVniljy54z/QvBvGd3g2zMKRa |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2968 | "C:\Program Files\Internet Explorer\iexplore.exe" "https://liveshareeast3.seismic.com/i/qmBviuPXKAu7CBA2PDa1OsmNGDPWmafSQKYau7pQ5gq2sxGn3sCINh5rXikkkYz0Fy4VClKUhL2KVbZzKurGQPLUSSIGNKXFD33fF4JdqNnD0Aq6a81DIyVjZuiUUqA8ttOzeBw2QwwKV7NJfyz9eFBqQCkvzWAJgAl52YoupgMQKLKwDAEQUALSIGN?source=outreach" | C:\Program Files\Internet Explorer\iexplore.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
1260 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2968 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
1876 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
2180 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 83.0 Modules
| |||||||||||||||
3916 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2180.0.701456964\1541577544" -parentBuildID 20201112153044 -prefsHandle 1100 -prefMapHandle 1092 -prefsLen 1 -prefMapSize 238726 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2180 "\\.\pipe\gecko-crash-server-pipe.2180" 1172 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 83.0 Modules
| |||||||||||||||
1280 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2180.6.1224434246\1100826551" -childID 1 -isForBrowser -prefsHandle 2956 -prefMapHandle 2952 -prefsLen 181 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2180 "\\.\pipe\gecko-crash-server-pipe.2180" 2968 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 83.0 Modules
| |||||||||||||||
3620 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2180.13.366950514\305014063" -childID 2 -isForBrowser -prefsHandle 1872 -prefMapHandle 1940 -prefsLen 6644 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2180 "\\.\pipe\gecko-crash-server-pipe.2180" 1436 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 83.0 Modules
| |||||||||||||||
2764 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2180.20.1122467950\1935996405" -childID 3 -isForBrowser -prefsHandle 3532 -prefMapHandle 3244 -prefsLen 7399 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2180 "\\.\pipe\gecko-crash-server-pipe.2180" 3544 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 83.0 Modules
| |||||||||||||||
1436 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2180.21.1312015046\103503526" -childID 4 -isForBrowser -prefsHandle 3556 -prefMapHandle 3552 -prefsLen 7399 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2180 "\\.\pipe\gecko-crash-server-pipe.2180" 3592 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
2524 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2180.34.2042327081\1920748101" -childID 5 -isForBrowser -prefsHandle 3992 -prefMapHandle 3984 -prefsLen 8715 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2180 "\\.\pipe\gecko-crash-server-pipe.2180" 4004 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 83.0 Modules
|
(PID) Process: | (2968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPDaysSinceLastAutoMigration |
Value: 1 | |||
(PID) Process: | (2968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPLastLaunchLowDateTime |
Value: | |||
(PID) Process: | (2968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPLastLaunchHighDateTime |
Value: 30960810 | |||
(PID) Process: | (2968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
Operation: | write | Name: | NextCheckForUpdateLowDateTime |
Value: 200910444 | |||
(PID) Process: | (2968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 30960811 | |||
(PID) Process: | (2968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
Operation: | write | Name: | CachePrefix |
Value: | |||
(PID) Process: | (2968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (2968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (2968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
(PID) Process: | (2968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1260 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04 | der | |
MD5:3CBF71B4678EC98888BEA333DF6BDAD7 | SHA256:A16CB040948C7F3883FEA14B83A8BE2FD35994B2F0AEEA6285B59B14B41E6749 | |||
1260 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_4B11E5F86C0CFAB30FF229AA6E73BE19 | der | |
MD5:4A73B2F1FFD456D1D47EA945A3F51658 | SHA256:AB1E8E1790C937B442B242CC9939559B19B19D1F8BC383B04F1C9E0B3908A84F | |||
1260 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:7D98EA7076FCDEC7F60E678EE2F70112 | SHA256:81B4EC18035D50AD4EAE55D45AB888D6DB5C0135DD044161317125A81F6C9E84 | |||
1260 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_42D518C245FE7F2F9F026AD6DD212548 | der | |
MD5:387ADA14EBD51A2652B18D3E4083B745 | SHA256:1240FB52F92EF68E783E0825405FAAAF6D2F700F75022B48338EDD2D53517905 | |||
1260 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\qmBviuPXKAu7CBA2PDa1OsmNGDPWmafSQKYau7pQ5gq2sxGn3sCINh5rXikkkYz0Fy4VClKUhL2KVbZzKurGQPLUSSIGNKXFD33fF4JdqNnD0Aq6a81DIyVjZuiUUqA8ttOzeBw2QwwKV7NJfyz9eFBqQC[1].htm | html | |
MD5:F650ABA201E6E875D624E2AC2C644ECB | SHA256:C24CDB340B41389F513C0925F6386048F5C17686AA2538FC395B3EBDB5E10912 | |||
1260 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E573CDF4C6D731D56A665145182FD759_FCA2CA6E4DF32679DE913AA8A859329F | binary | |
MD5:993D40DCE6D1F2BE649B8734841C158A | SHA256:43B6E44E1FC1B3722BD9AA2E8D2D34E3AF60AAC6E8FCE1712256810756978B35 | |||
1260 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\fetch.min[1].js | text | |
MD5:F6C542D472DDB3FCEC54C925EC0375F6 | SHA256:CF514CAC173FA72BF3E60DEB859E8B3B476447B49BDFAB13A83D657932A7E0BF | |||
1260 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\bluebird.min[1].js | text | |
MD5:A2FE8905EABBA29FA7126B7F6B367147 | SHA256:74788C091CFACBC9C29187C7D9BD41C7851017B6C47D09B144106368F814E73D | |||
1260 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04 | binary | |
MD5:05E2535E4C6E6E394EF7BFEBC6D5E518 | SHA256:6284D135D143C1743B94C226B0FDE76A3F4C23A6CAB61DA8D0313A66CFE23A9F | |||
1260 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_FCA2CA6E4DF32679DE913AA8A859329F | der | |
MD5:5FF3570D1668FA1759BF34858DF96A33 | SHA256:5D02F43C6768D254E8EDD373D32F378D25B8AEB38ECE371D602874A99D28E099 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1260 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAq8OIHnzLSr2KkUf52Yg8I%3D | US | der | 471 b | whitelisted |
1260 | iexplore.exe | GET | 200 | 104.18.20.226:80 | http://ocsp2.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEHophRq39F1meVBmQbb%2F1x0%3D | US | der | 1.40 Kb | whitelisted |
1260 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAZ5EJ1rUP%2Fx%2BzxDotV0V4Q%3D | US | der | 471 b | whitelisted |
2968 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
2968 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D | US | der | 1.47 Kb | whitelisted |
2180 | firefox.exe | POST | 200 | 172.217.18.99:80 | http://ocsp.pki.goog/gts1c3 | US | der | 472 b | whitelisted |
1260 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D | US | der | 471 b | whitelisted |
2180 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
2180 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
2180 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1260 | iexplore.exe | 104.18.20.226:80 | ocsp2.globalsign.com | Cloudflare Inc | US | shared |
1260 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
1260 | iexplore.exe | 20.79.229.214:443 | service-discovery.seismic.com | — | US | unknown |
2968 | iexplore.exe | 40.84.6.162:443 | liveshareeast3.seismic.com | Microsoft Corporation | US | unknown |
1260 | iexplore.exe | 40.84.6.162:443 | liveshareeast3.seismic.com | Microsoft Corporation | US | unknown |
1260 | iexplore.exe | 23.216.77.69:80 | ctldl.windowsupdate.com | NTT DOCOMO, INC. | US | suspicious |
1260 | iexplore.exe | 151.101.2.137:443 | js-agent.newrelic.com | Fastly | US | suspicious |
1260 | iexplore.exe | 162.247.243.147:443 | bam-cell.nr-data.net | New Relic | US | unknown |
2968 | iexplore.exe | 204.79.197.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
2968 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
liveshareeast3.seismic.com |
| unknown |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
service-discovery.seismic.com |
| suspicious |
js-agent.newrelic.com |
| whitelisted |
ocsp2.globalsign.com |
| whitelisted |
bam-cell.nr-data.net |
| whitelisted |
cdn-prod.seismic.com |
| suspicious |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
2180 | firefox.exe | Potentially Bad Traffic | ET INFO Terse Request for .txt - Likely Hostile |
2180 | firefox.exe | Potentially Bad Traffic | ET INFO Terse Request for .txt - Likely Hostile |
2180 | firefox.exe | Potentially Bad Traffic | ET INFO Terse Request for .txt - Likely Hostile |
2180 | firefox.exe | Potentially Bad Traffic | ET INFO Terse Request for .txt - Likely Hostile |