URL: | https://f002.backblazeb2.com/file/loxolophodon-simplest-sporoblast/index.html |
Full analysis: | https://app.any.run/tasks/5497ac8e-1da7-43ce-b432-7e94d8d79480 |
Verdict: | Malicious activity |
Analysis date: | September 21, 2021, 17:32:21 |
OS: | Windows 10 Professional (build: 16299, 64 bit) |
Indicators: | |
MD5: | 0B0E2159D3C7206A1312602E0B6A978A |
SHA1: | CC57F869576FD7AE8301C9EF27C43708EB6649EA |
SHA256: | E8C4A0FF439D8EC991AA0327A7F0C3DF0F41D4588AE40703E7E6FA28B624DAE4 |
SSDEEP: | 3:N8n9oX3ZzonIj9ISzKe1aG:29oXJjKe8G |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
5372 | "C:\Program Files\internet explorer\iexplore.exe" "https://f002.backblazeb2.com/file/loxolophodon-simplest-sporoblast/index.html" | C:\Program Files\internet explorer\iexplore.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.16299.15 (WinBuild.160101.0800) Modules
| |||||||||||||||
4392 | "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5372 CREDAT:9474 /prefetch:2 | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.16299.15 (WinBuild.160101.0800) Modules
| |||||||||||||||
2544 | "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5372 CREDAT:9476 /prefetch:2 | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.16299.15 (WinBuild.160101.0800) Modules
| |||||||||||||||
4328 | C:\WINDOWS\system32\ApplicationFrameHost.exe -Embedding | C:\WINDOWS\system32\ApplicationFrameHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Application Frame Host Version: 10.0.16299.15 (WinBuild.160101.0800) Modules
| |||||||||||||||
5588 | "C:\WINDOWS\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca | C:\WINDOWS\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 1 Version: 11.00.16299.402 (WinBuild.160101.0800) Modules
| |||||||||||||||
5208 | C:\WINDOWS\system32\browser_broker.exe -Embedding | C:\WINDOWS\system32\browser_broker.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Browser_Broker Exit code: 2147500037 Version: 11.00.16299.15 (WinBuild.160101.0800) Modules
| |||||||||||||||
3704 | "C:\WINDOWS\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca | C:\WINDOWS\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Content Process Exit code: 1 Version: 11.00.16299.402 (WinBuild.160101.0800) Modules
| |||||||||||||||
4628 | "C:\WINDOWS\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca | C:\WINDOWS\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Content Process Exit code: 0 Version: 11.00.16299.402 (WinBuild.160101.0800) Modules
| |||||||||||||||
5520 | "C:\WINDOWS\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftPdfReader.exe" -ServerName:PdfReader.AppXt4g7dx0jktgcrhe5cw5qf7t4q86jznsh.mca | C:\WINDOWS\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftPdfReader.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft PDF Reader Component Exit code: 1 Version: 11.00.16299.402 (WinBuild.160101.0800) Modules
| |||||||||||||||
3012 | "C:\WINDOWS\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca | C:\WINDOWS\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Content Process Exit code: 0 Version: 11.00.16299.402 (WinBuild.160101.0800) Modules
|
(PID) Process: | (5372) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlock |
Operation: | write | Name: | L1WatermarkLowPart |
Value: 956341420 | |||
(PID) Process: | (5372) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlock |
Operation: | write | Name: | L1WatermarkHighPart |
Value: 148313293 | |||
(PID) Process: | (5372) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlock |
Operation: | write | Name: | NextCheckForUpdateLowDateTime |
Value: | |||
(PID) Process: | (5372) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlock |
Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 30912270 | |||
(PID) Process: | (5372) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
Operation: | write | Name: | CachePrefix |
Value: | |||
(PID) Process: | (5372) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (5372) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (5372) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
(PID) Process: | (5372) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (5372) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
4392 | IEXPLORE.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 | binary | |
MD5:83348884983722DAEF51B7D9D3D49978 | SHA256:35FF30B662EA4DFED36FB7532FA88E1FCC86B779ABBF715A15B46798C56AD5C2 | |||
4392 | IEXPLORE.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\517663DFCF7D11043E01F2CB03FE0BFD | der | |
MD5:433988000E6F453CAA1B14BBA6E141EA | SHA256:6F06082693624AC40E8A6C364E8AECE5E415402238EDDE8D73BF208245AEAE94 | |||
4392 | IEXPLORE.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\2WUUROS3\index[1].htm | html | |
MD5:416E19856061560EC0DE9EA308EE904C | SHA256:65C13B43F1C084A0EEF41DB770E74EA3F3F92CBDFE184AC6512D144762909E49 | |||
4392 | IEXPLORE.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53 | binary | |
MD5:4F3C99FCA4F4ECA8AFF4DDFD08CCBB48 | SHA256:DA26FC44C0B9427C2B44CF8053FDC8257D397F71E11F4213730B77649E446AEC | |||
4392 | IEXPLORE.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53 | der | |
MD5:D8D27D9D9D697630A27F193D26124D71 | SHA256:5C0393882ED27A47371DD5C75A7A2D163BA54562ACD7A09853EC0562FE5AF106 | |||
4392 | IEXPLORE.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\517663DFCF7D11043E01F2CB03FE0BFD | binary | |
MD5:0741CDA16C74671D01726F451D811D7F | SHA256:73EC9572ED460126351F47742410A707388D0B5EE5F79E44E2D43628C4D641AC | |||
2544 | IEXPLORE.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63 | der | |
MD5:7978E45F507ACC69ED5F8A0057F250E1 | SHA256:EA0CC32D7A35410748924F2789AE77D572CDB99E6427536B9B207DF4D334972C | |||
4392 | IEXPLORE.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_3B9C2111EAE052C5BA0EC1CBB6D70DEA | der | |
MD5:C6F2B1B2F96C4D632B8DA3B8A162F056 | SHA256:F3AF742C96047249149E047CE50F96ED6AC513F3B30C6664D8A7105784937B0B | |||
4392 | IEXPLORE.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4 | binary | |
MD5:337F97322F83A32502E975F1CB48AB2A | SHA256:8451C814DDF368ADC98015BB475D259A999F7914B3296E8457536593D8DF84C8 | |||
4392 | IEXPLORE.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_3B9C2111EAE052C5BA0EC1CBB6D70DEA | binary | |
MD5:C48CB1A79D6818F8CC816535C4C463AC | SHA256:D9033F6F1C104209F45D498C3094AE3341D1A924904E91A31C2861B050F3C818 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2544 | IEXPLORE.EXE | GET | 302 | 104.126.25.23:80 | http://go.microsoft.com/fwlink/?LinkId=838604 | US | — | — | whitelisted |
4392 | IEXPLORE.EXE | GET | 200 | 23.205.154.179:80 | http://crl.identrust.com/DSTROOTCAX3CRL.crl | US | der | 1.16 Kb | whitelisted |
2544 | IEXPLORE.EXE | GET | 200 | 72.21.91.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D | US | der | 1.47 Kb | whitelisted |
4392 | IEXPLORE.EXE | GET | 200 | 142.250.72.131:80 | http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D | US | der | 724 b | whitelisted |
4392 | IEXPLORE.EXE | GET | 200 | 142.250.72.131:80 | http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D | US | der | 1.41 Kb | whitelisted |
4392 | IEXPLORE.EXE | GET | 200 | 142.250.72.131:80 | http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQD%2FlD3sEhDdGAoAAAAA%2FPSV | US | der | 472 b | whitelisted |
4392 | IEXPLORE.EXE | GET | 200 | 23.205.154.137:80 | http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgQ1W1lpapa7oF1p167WpoReBQ%3D%3D | US | der | 503 b | shared |
2544 | IEXPLORE.EXE | GET | 200 | 72.21.91.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA9bw6F2y3ieICDHiTyBZ7Q%3D | US | der | 1.47 Kb | whitelisted |
4392 | IEXPLORE.EXE | GET | 200 | 151.139.128.14:80 | http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D | US | der | 471 b | whitelisted |
2544 | IEXPLORE.EXE | GET | 200 | 72.21.91.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D | US | der | 471 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4392 | IEXPLORE.EXE | 104.80.96.219:80 | x1.c.lencr.org | Akamai Technologies, Inc. | NL | unknown |
4392 | IEXPLORE.EXE | 13.68.247.210:443 | urs.microsoft.com | Microsoft Corporation | US | unknown |
4392 | IEXPLORE.EXE | 23.205.154.137:80 | r3.o.lencr.org | NTT America, Inc. | US | unknown |
5372 | iexplore.exe | 206.190.215.16:443 | f002.backblazeb2.com | Unwired | US | suspicious |
4392 | IEXPLORE.EXE | 72.21.91.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2544 | IEXPLORE.EXE | 104.126.25.23:443 | go.microsoft.com | GTT Communications Inc. | US | unknown |
4392 | IEXPLORE.EXE | 23.205.154.179:80 | crl.identrust.com | NTT America, Inc. | US | unknown |
4392 | IEXPLORE.EXE | 206.190.215.16:443 | f002.backblazeb2.com | Unwired | US | suspicious |
2544 | IEXPLORE.EXE | 104.126.25.23:80 | go.microsoft.com | GTT Communications Inc. | US | unknown |
4392 | IEXPLORE.EXE | 142.250.188.234:443 | ajax.googleapis.com | Google Inc. | US | unknown |
Domain | IP | Reputation |
---|---|---|
f002.backblazeb2.com |
| suspicious |
crl.identrust.com |
| whitelisted |
x1.c.lencr.org |
| whitelisted |
r3.o.lencr.org |
| shared |
urs.microsoft.com |
| whitelisted |
ajax.googleapis.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
ocsp.pki.goog |
| whitelisted |
www.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
2544 | IEXPLORE.EXE | Generic Protocol Command Decode | SURICATA HTTP unable to match response to request |