URL: | https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fortus-dot-yamm-track.appspot.com%2F1mZ-tGDOOVaTXdQJZFtuQJHSef4ErlGk3IcxmBVqB9fqJGHEgfwEY4PErZytu6UVUU1m6gmxVi1TA6bEIpCa3aMiuwhx-5_hMV9BXh8zd_-2qHp1BN_0a2B9jsr2-_MHol-IqoriKJgOCVoWPCsWmo-fGgsnMupLCQdXvlxwrWPmF56s7vKXa5c4yLl8HeoJtY4wzFkNVZCbFjMOFAVtpanRMON2orFZyhn4PSWkuoYAsqZmXndCH5BXBuPAhHFnK&data=04%7C01%7C%7C1f4439b044e84f800a0408d9f5d93cc3%7C7007305e26644e6bb9a4c4d5ccfd1524%7C0%7C0%7C637811137518660321%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=UjnY6HpXkh6iR0ZeTdql2DoR2QMsKDCDzbA3FdU60L0%3D&reserved=0 |
Full analysis: | https://app.any.run/tasks/cd4c3e82-a2c6-4130-9c2f-3e17d2833896 |
Verdict: | Malicious activity |
Analysis date: | February 23, 2022, 00:11:15 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 081D3EC04308F9686E9B734BD237D661 |
SHA1: | 0400C7BCD876F1A53B776CDB8931801B34EB775B |
SHA256: | E91EAB52D7667ECE6AFC1052F4626D1671CF4ACB727AB4BE7A89EC9E974CC03F |
SSDEEP: | 12:2byqxpteL+UgAqWNsVxVjmeXEA3EHcVgoUBKxKP7RDgJUbwiW:2byqzkKH1WUjREcTyoU8wP7ia5W |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2824 | "C:\Program Files\Internet Explorer\iexplore.exe" "https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fortus-dot-yamm-track.appspot.com%2F1mZ-tGDOOVaTXdQJZFtuQJHSef4ErlGk3IcxmBVqB9fqJGHEgfwEY4PErZytu6UVUU1m6gmxVi1TA6bEIpCa3aMiuwhx-5_hMV9BXh8zd_-2qHp1BN_0a2B9jsr2-_MHol-IqoriKJgOCVoWPCsWmo-fGgsnMupLCQdXvlxwrWPmF56s7vKXa5c4yLl8HeoJtY4wzFkNVZCbFjMOFAVtpanRMON2orFZyhn4PSWkuoYAsqZmXndCH5BXBuPAhHFnK&data=04%7C01%7C%7C1f4439b044e84f800a0408d9f5d93cc3%7C7007305e26644e6bb9a4c4d5ccfd1524%7C0%7C0%7C637811137518660321%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=UjnY6HpXkh6iR0ZeTdql2DoR2QMsKDCDzbA3FdU60L0%3D&reserved=0" | C:\Program Files\Internet Explorer\iexplore.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3096 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2824 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
3096 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2F23D0F5E4D72862517E1CB26A329742_F6FACC49395CFA949BCE851E73323C49 | der | |
MD5:6C7E59028643D6E2D926916053DF0E50 | SHA256:94B41A0F3DABCD0BEE12A8C7222BB77B616B1B6775381C57D0F92D0EB8480345 | |||
3096 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA | der | |
MD5:02F32845DDFA967B6CDD265B95AAF7DD | SHA256:06F438578B4ACCF670110C811944268D070E7E80D18F10E49E9D4ED6970D0423 | |||
2824 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 | der | |
MD5:1FDF7061215B783FA48F4EF8FE7D3F06 | SHA256:9062D01F3A3F966DBE3464BD8A03742EFEB9E0CF9B2AC02C84E03062B03EB5E4 | |||
2824 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:5644B39878022547A4B150C06EF59A26 | SHA256:707614CBDD6FFABDC4D12E883FAE246ABAEDD771745295DE17860A15F321C67A | |||
2824 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].ico | image | |
MD5:DA597791BE3B6E732F0BC8B20E38EE62 | SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07 | |||
2824 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 | binary | |
MD5:EE803A277D7A070645B1EB16195BFBFC | SHA256:E519E697EDA914DBF43D64D5AD33F5594A473CD13FC6D453E3FAE3D47FD0480E | |||
3096 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_20543FC7EB7901B83C465108C81E9629 | der | |
MD5:5C47F9F935155FEF49E13A8E921116E9 | SHA256:ABDD00431875B39E819F64414E58EC5DFA43CA0B1ACCB9C0B93B226767A4DBAF | |||
2824 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63 | der | |
MD5:C941047A465C1EC650C75A3D92D59361 | SHA256:8D72A2AB6E05AAB81C9E0A953A06168A328B7CCE54C1567CAEA6D199D099E439 | |||
2824 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63 | binary | |
MD5:4F54A11ACF8FE8041C95591CF82E4446 | SHA256:253AEE97A061E559095803D7D807A4A5B2789E518504886E78B3F9FC80834800 | |||
3096 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA | der | |
MD5:64E9B8BB98E2303717538CE259BEC57D | SHA256:76BD459EC8E467EFC3E3FB94CB21B9C77A2AA73C9D4C0F3FAF823677BE756331 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2824 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
3096 | iexplore.exe | GET | 200 | 92.123.195.57:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1834b0c6d4e90cd7 | unknown | compressed | 4.70 Kb | whitelisted |
2824 | iexplore.exe | GET | 200 | 92.123.195.57:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?dfd2323337e6cf85 | unknown | compressed | 4.70 Kb | whitelisted |
3096 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAGewca9P1l7sgwzOOVR2Hc%3D | US | der | 471 b | whitelisted |
3096 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D | US | der | 1.47 Kb | whitelisted |
2824 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D | US | der | 1.47 Kb | whitelisted |
3096 | iexplore.exe | GET | 200 | 142.250.184.195:80 | http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D | US | der | 1.41 Kb | whitelisted |
3096 | iexplore.exe | GET | 200 | 142.250.184.195:80 | http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D | US | der | 724 b | whitelisted |
3096 | iexplore.exe | GET | 200 | 92.123.195.57:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4a60cee1206ff0b1 | unknown | compressed | 4.70 Kb | whitelisted |
3096 | iexplore.exe | GET | 301 | 35.214.14.33:80 | http://ortusclub.com/wp-content/uploads/2021/06/laptop_framed_white-1.gif | US | html | 162 b | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2824 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2824 | iexplore.exe | 92.123.195.41:80 | ctldl.windowsupdate.com | Akamai International B.V. | — | whitelisted |
2824 | iexplore.exe | 92.123.195.57:80 | ctldl.windowsupdate.com | Akamai International B.V. | — | whitelisted |
3096 | iexplore.exe | 104.47.124.28:443 | apc01.safelinks.protection.outlook.com | Microsoft Corporation | US | whitelisted |
3096 | iexplore.exe | 104.47.110.28:443 | apc01.safelinks.protection.outlook.com | Microsoft Corporation | US | suspicious |
2824 | iexplore.exe | 204.79.197.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
3096 | iexplore.exe | 92.123.195.57:80 | ctldl.windowsupdate.com | Akamai International B.V. | — | whitelisted |
3096 | iexplore.exe | 142.250.186.116:443 | ortus-dot-yamm-track.appspot.com | Google Inc. | US | suspicious |
3096 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2824 | iexplore.exe | 152.199.19.161:443 | r20swj13mr.microsoft.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
apc01.safelinks.protection.outlook.com |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
r20swj13mr.microsoft.com |
| whitelisted |
iecvlist.microsoft.com |
| whitelisted |
ortus-dot-yamm-track.appspot.com |
| malicious |
ocsp.pki.goog |
| whitelisted |
www.ortusclub.com |
| malicious |