URL: | https://onedrive.live.com/download?cid=22B7C997915C7868&resid=22B7C997915C7868%21270&authkey=ALPI7j38yQO26TE |
Full analysis: | https://app.any.run/tasks/8bc4b292-f0af-443b-a271-333bbd472988 |
Verdict: | Malicious activity |
Analysis date: | November 30, 2020, 06:50:03 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | FA44FE06D480967EF5CE47F6F906EC0A |
SHA1: | 5279DDAE74B0C608845B4DC4191AC4F6FF2CBE85 |
SHA256: | E59B5D15D0EECBF2BEF08030C0155D4C0AE305BC64297C2187EDD8AC02BB10F2 |
SSDEEP: | 3:N8Ck3CTwKblstASdlXAkFtASdmEiRxpgNS:2CkST/ZsttlXAkFttRmpgI |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2152 | "C:\Program Files\Internet Explorer\iexplore.exe" https://onedrive.live.com/download?cid=22B7C997915C7868&resid=22B7C997915C7868%21270&authkey=ALPI7j38yQO26TE | C:\Program Files\Internet Explorer\iexplore.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
2228 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2152 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
2624 | "C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Downloads\Toplu Satın Alma.tgz" "?\" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
2012 | "C:\Users\admin\Downloads\Toplu Satın Alma\Toplu Satın Alma.exe" | C:\Users\admin\Downloads\Toplu Satın Alma\Toplu Satın Alma.exe | — | explorer.exe |
User: admin Company: Adobe Inc. Integrity Level: MEDIUM Description: Creative Cloud Desktop Version: 5.2.1.441 | ||||
2268 | "C:\Users\admin\Downloads\Toplu Satın Alma\Toplu Satın Alma.exe" | C:\Users\admin\Downloads\Toplu Satın Alma\Toplu Satın Alma.exe | — | explorer.exe |
User: admin Company: Adobe Inc. Integrity Level: MEDIUM Description: Creative Cloud Desktop Version: 5.2.1.441 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2228 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Cab3496.tmp | — | |
MD5:— | SHA256:— | |||
2228 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Tar3497.tmp | — | |
MD5:— | SHA256:— | |||
2228 | iexplore.exe | C:\Users\admin\Downloads\Toplu Satın Alma.tgz.frafstd.partial | — | |
MD5:— | SHA256:— | |||
2152 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DFA36F2796EEC6B9A7.TMP | — | |
MD5:— | SHA256:— | |||
2152 | iexplore.exe | C:\Users\admin\Downloads\Toplu Satın Alma.tgz.frafstd.partial:Zone.Identifier | — | |
MD5:— | SHA256:— | |||
2228 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\04HATQXX.txt | text | |
MD5:8DCC6E893343CF5EB203F3CCA5A4FDE3 | SHA256:1A63138BE62F7FFDA5A22BC49BBEE89040204FD6FD397D05836CB28F6C1DBE7B | |||
2228 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442 | binary | |
MD5:CBCA707F0F0FBF820E557CCD4A457F5B | SHA256:2B7C24EFDA1CD191EB18C5E8C97E4A6B60B558D344E577ABEE500391ABDBAC04 | |||
2152 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{4C8E2B87-32D8-11EB-8D2F-12A9866C77DE}.dat | binary | |
MD5:DDE2D3ADDFC72B5D8538E6320F58922F | SHA256:0E5198191C9249B001700ACB54B688F083E71DCA42EC5EE3817BD5CF69FB4CCD | |||
2228 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\Toplu%20Satın%20Alma[1].tgz | compressed | |
MD5:A044E60C66972387C77DB968C4926C9A | SHA256:7F9B960E9792AAC18D3A7C393C4B6530F842B5F9273EF27D2D81145F3D3FC88D | |||
2152 | iexplore.exe | C:\Users\admin\Downloads\Toplu Satın Alma.tgz | compressed | |
MD5:A044E60C66972387C77DB968C4926C9A | SHA256:7F9B960E9792AAC18D3A7C393C4B6530F842B5F9273EF27D2D81145F3D3FC88D |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2228 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D | US | der | 471 b | whitelisted |
2228 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D | US | der | 471 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2228 | iexplore.exe | 13.107.42.12:443 | oybdia.am.files.1drv.com | Microsoft Corporation | US | suspicious |
2228 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2228 | iexplore.exe | 13.107.42.13:443 | onedrive.live.com | Microsoft Corporation | US | malicious |
Domain | IP | Reputation |
---|---|---|
onedrive.live.com |
| shared |
ocsp.digicert.com |
| whitelisted |
oybdia.am.files.1drv.com |
| whitelisted |