| URL: | http://hebrasdepaz.org |
| Full analysis: | https://app.any.run/tasks/f8c12951-04e2-44bf-aeb9-292fe4777ecd |
| Verdict: | Malicious activity |
| Analysis date: | April 26, 2023, 12:11:32 |
| OS: | Windows 10 Professional (build: 19044, 32 bit) |
| Indicators: | |
| MD5: | 1622A7B0E5CBE1707BC2C8BEBAB7BC63 |
| SHA1: | 372491C6DF5FD37E2A94823523692F0A18C0B57C |
| SHA256: | E88545BB726F66378E56235938C1B185E3CA4346B19443E8A00A2D2A146BA1EE |
| SSDEEP: | 3:N1KWA3/2u3:CW0/ |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
Create files in a temporary directory
- msedge.exe (PID: 8)
- iexplore.exe (PID: 2016)
- msedge.exe (PID: 2160)
Checks supported languages
- identity_helper.exe (PID: 4832)
- cookie_exporter.exe (PID: 5852)
The process checks LSA protection
- identity_helper.exe (PID: 4832)
- cookie_exporter.exe (PID: 5852)
Application launched itself
- iexplore.exe (PID: 2016)
- msedge.exe (PID: 8)
Reads the computer name
- identity_helper.exe (PID: 4832)
- cookie_exporter.exe (PID: 5852)
Checks proxy server information
- cookie_exporter.exe (PID: 5852)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
108
Monitored processes
32
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 8 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=60220 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | ie_to_edge_stub.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 111.0.1661.62 Modules
| |||||||||||||||
| 228 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5136 --field-trial-handle=2052,i,15269856144885119696,15988039692460097130,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 111.0.1661.62 Modules
| |||||||||||||||
| 544 | "C:\Program Files\Microsoft\Edge\Application\111.0.1661.62\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=60220 | C:\Program Files\Microsoft\Edge\Application\111.0.1661.62\BHO\ie_to_edge_stub.exe | — | iexplore.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: IEToEdge BHO Exit code: 0 Version: 111.0.1661.62 Modules
| |||||||||||||||
| 616 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4308 --field-trial-handle=2052,i,15269856144885119696,15988039692460097130,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 111.0.1661.62 Modules
| |||||||||||||||
| 696 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2016 CREDAT:9474 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1288 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5788 --field-trial-handle=2052,i,15269856144885119696,15988039692460097130,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 111.0.1661.62 Modules
| |||||||||||||||
| 1516 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6700 --field-trial-handle=2052,i,15269856144885119696,15988039692460097130,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 111.0.1661.62 Modules
| |||||||||||||||
| 1652 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4608 --field-trial-handle=2052,i,15269856144885119696,15988039692460097130,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 111.0.1661.62 Modules
| |||||||||||||||
| 2016 | "C:\Program Files\Internet Explorer\iexplore.exe" "http://hebrasdepaz.org" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 11.00.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2136 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5760 --field-trial-handle=2052,i,15269856144885119696,15988039692460097130,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 111.0.1661.62 Modules
| |||||||||||||||
Total events
20 332
Read events
20 094
Write events
204
Delete events
34
Modification events
| (PID) Process: | (2016) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2016) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (2016) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | OperationalData |
Value: 0C00000000000000 | |||
| (PID) Process: | (2016) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation |
| Operation: | write | Name: | CVListXMLVersionLow |
Value: 395196024 | |||
| (PID) Process: | (2016) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation |
| Operation: | write | Name: | CVListXMLVersionHigh |
Value: 268435456 | |||
| (PID) Process: | (2016) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Spartan |
| Operation: | write | Name: | RAC_LaunchFlags |
Value: 53 | |||
| (PID) Process: | (2016) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\GPU |
| Operation: | write | Name: | SoftwareFallback |
Value: 0 | |||
| (PID) Process: | (2016) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\GPU |
| Operation: | write | Name: | VendorId |
Value: 5140 | |||
| (PID) Process: | (2016) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\GPU |
| Operation: | write | Name: | DeviceId |
Value: 140 | |||
| (PID) Process: | (2016) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\GPU |
| Operation: | write | Name: | SubSysId |
Value: 0 | |||
Executable files
0
Suspicious files
160
Text files
192
Unknown types
80
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 8 | msedge.exe | C:\USERS\ADMIN\APPDATA\LOCAL\MICROSOFT\EDGE\USER DATA\CRASHPAD\SETTINGS.DAT | binary | |
MD5:EB47346CA7428F0A534B2C7639EFD344 | SHA256:A5A3A7B62E8E9364943C9813A7D365B5A5635E3DC0523ECC6631B1B9320F79A5 | |||
| 8 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF31f28f.TMP | — | |
MD5:— | SHA256:— | |||
| 696 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\XPIOF5VQ\0E5IRSLR.htm | html | |
MD5:4E04331BF298C688E344F5D30AACB674 | SHA256:67178D3AD6AFA21E0748C03BCF4DEE19A8DC0FC71DDAAD0E5C32A4CBCADCD811 | |||
| 8 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old | — | |
MD5:— | SHA256:— | |||
| 8 | msedge.exe | C:\USERS\ADMIN\APPDATA\LOCAL\MICROSOFT\EDGE\USER DATA\VARIATIONS | binary | |
MD5:67408267EF01ED6B9372F04C029B602A | SHA256:B5AA30B0D3E08F80F60EFFA00FE335D2295FA494B36F33A2E8D8C66E0A34234A | |||
| 8 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index | binary | |
MD5:B0DF5C17B9644E8ABEACCC13ED74A35C | SHA256:DBB51606A2B9D8C55DF5288EAC0CAF06DCE70D03AE598506C46B2C653A2DDE31 | |||
| 696 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DAT | smt | |
MD5:0392ADA071EB68355BED625D8F9695F3 | SHA256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7 | |||
| 8 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal | — | |
MD5:— | SHA256:— | |||
| 8 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0 | vxd | |
MD5:CF89D16BB9107C631DAABF0C0EE58EFB | SHA256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E | |||
| 8 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old | text | |
MD5:2B6E2D86DEAE274098A1D36C4F2D5BC4 | SHA256:03EE65F530C129C4B3D883FD70CB84CC9C0265F7A00545F26ECEF6CB7582A371 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
65
DNS requests
53
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
696 | iexplore.exe | GET | 200 | 172.67.203.139:80 | http://hebrasdepaz.org/cdn-cgi/images/icon-exclamation.png?1376755637 | US | image | 452 b | suspicious |
696 | iexplore.exe | GET | 200 | 172.67.203.139:80 | http://hebrasdepaz.org/cdn-cgi/styles/cf.errors.css | US | text | 4.42 Kb | suspicious |
696 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D | US | der | 471 b | whitelisted |
2016 | iexplore.exe | GET | 410 | 172.67.203.139:80 | http://hebrasdepaz.org/favicon.ico | US | html | 109 b | suspicious |
696 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D | US | der | 471 b | whitelisted |
2016 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
696 | iexplore.exe | GET | 200 | 172.67.203.139:80 | http://hebrasdepaz.org/ | US | html | 1.73 Kb | suspicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
696 | iexplore.exe | 172.67.203.139:80 | — | CLOUDFLARENET | US | suspicious |
696 | iexplore.exe | 23.38.22.250:443 | go.microsoft.com | AKAMAI-AS | NL | malicious |
2016 | iexplore.exe | 172.67.203.139:80 | — | CLOUDFLARENET | US | suspicious |
2016 | iexplore.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
2016 | iexplore.exe | 23.38.22.250:443 | go.microsoft.com | AKAMAI-AS | NL | malicious |
2172 | msedge.exe | 20.8.16.139:443 | nav-edge.smartscreen.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2172 | msedge.exe | 23.38.22.250:443 | go.microsoft.com | AKAMAI-AS | NL | malicious |
2172 | msedge.exe | 20.40.24.37:443 | microsoftedgewelcome.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
2172 | msedge.exe | 13.107.237.67:443 | edgestatic-ehf9gbe6gfdfdec4.z01.azurefd.net | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
2172 | msedge.exe | 20.105.73.143:443 | data-edge.smartscreen.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
go.microsoft.com |
| whitelisted |
config.edge.skype.com |
| malicious |
ocsp.digicert.com |
| whitelisted |
edge.microsoft.com |
| whitelisted |
officeclient.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
ieonline.microsoft.com |
| whitelisted |
nav-edge.smartscreen.microsoft.com |
| whitelisted |
microsoftedgewelcome.microsoft.com |
| whitelisted |
data-edge.smartscreen.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
696 | iexplore.exe | A Network Trojan was detected | AV POLICY CloudFlare Anti-Phishing Protection Warning in HTML Inbound |