URL: | http://www.bing.com/search?q=ascii+troll&FORM=HDRSC1 |
Full analysis: | https://app.any.run/tasks/110a929a-162a-4d0e-aac3-200afc23ff62 |
Verdict: | Malicious activity |
Analysis date: | March 20, 2019, 23:00:16 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 7F36BE55F85256E4992672F2F69C0066 |
SHA1: | 40857CBCD119B4F27C94814F32705DA8A4B4D847 |
SHA256: | F1141BD5CB5477C486AA5CCCC9996F0123D02C8414A8131510F1DCEDE255339E |
SSDEEP: | 3:N1KJS4sBAEXGpL9mgmU:Cc4sBBGPmjU |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1360 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
1296 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1360 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2640 | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe | — | svchost.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Version: 26,0,0,131 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1360 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
1360 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
1296 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@bing[2].txt | — | |
MD5:— | SHA256:— | |||
1296 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\XN85CDL9\search[1].txt | — | |
MD5:— | SHA256:— | |||
1360 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
1296 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:34C64A0E0331F0AB6CCEDD1FF2080BD3 | SHA256:05DEFFF61FF17C6985BF316A0B3761C2705B8EF8FC5EBD45A615433F41564353 | |||
1296 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.dat | dat | |
MD5:3B08FEC1A2BD8A5E3C6202BEAA1C5C23 | SHA256:26EBBAA2E4C7B652F824AD91642B9C5945AEBCB28D1BF8B1864892C5FBAFD961 | |||
1296 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt | text | |
MD5:75CE7262C85A1B2FDAFE4A74DB2204D0 | SHA256:FBAF0F8599F6E7415F8097ED3ADB5CDB73FF72349DFC575DCA571FEBA1AD272D | |||
1296 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@bing[1].txt | text | |
MD5:9C83C5508739997D929524B0EFAF33BA | SHA256:5B80454C90686917625B391A46D2808FF0AE254B3929B3511CFC076D3BE1D54E | |||
1296 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat | dat | |
MD5:7DA0D6D765B7307467BCD3FFBE85581C | SHA256:6AE1A32C4CFBA2BFF39514763CA045639BB36B1634D4A18D1EC61874636348DA |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1296 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/rb/16/cj,nj/1b7dfb88/cc8437ad.js?bu=DikuXGxwdGhgZKwBsAEuoAEu | US | text | 7.54 Kb | whitelisted |
1296 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/sa/simg/SharedSpriteDesktopRewards_022118.png | US | image | 5.73 Kb | whitelisted |
1296 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/rs/6r/4W/cj,nj/347afee2/33036ea1.js | US | text | 1.77 Kb | whitelisted |
1296 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/fd/ls/l?IG=7300D115C1E14B5D86694097CF257B7A&CID=134DD501D8FE677539B1D824D94B6682&Type=Event.ClientInst&DATA=[{"T":"CI.GetError","FID":"CI","Name":"JSGetError","Text":"%27SVGElement%27%20is%20undefined","Meta":"http%3A//www.bing.com/search%3Fq%3Dascii+troll%26FORM%3DHDRSC1","Line":9242847,"Char":%20undefined}] | US | compressed | 1.77 Kb | whitelisted |
1296 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/rs/5g/2r/cj,nj/bab57e12/ea8fe300.js | US | text | 2.75 Kb | whitelisted |
1296 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/rs/3S/Vy/cj,nj/ef2d523b/1f497ebd.js | US | text | 365 b | whitelisted |
1296 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/rs/30/1H/cj,nj/5983aa50/f8c6dd44.js | US | text | 773 b | whitelisted |
1296 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/search?q=ascii+troll&FORM=HDRSC1 | US | html | 42.6 Kb | whitelisted |
1296 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/rs/30/1X/cj,nj/4c7364c5/40e1b425.js | US | text | 816 b | whitelisted |
1296 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/rms/BingCore.Bundle/cj,nj/3e6a7d75/9a358300.js?bu=rms+answers+Shared+BingCore%24ClientInstV2%24DuplicateXlsDefaultConfig*BingCore%24ClientInstV2%24SharedLocalStorageConfigDefault*BingCore%24shared*BingCore%24env.override*Empty*BingCore%24event.custom.fix*BingCore%24event.native*BingCore%24onHTML*BingCore%24dom*BingCore%24cookies*BingCore%24rmsajax*BingCore%24ClientInstV2%24LogUploadCapFeatureDisabled*BingCore%24ClientInstV2%24ClientInstConfigSeparateOfflineQueue*BingCore%24clientinst*BingCore%24replay*BingCore%24Animation*BingCore%24fadeAnimation*BingCore%24framework | US | text | 4.95 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1360 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
1296 | iexplore.exe | 204.79.197.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
1296 | iexplore.exe | 204.11.109.78:443 | tags.expo9.exponential.com | Exponential Interactive, Inc. | US | unknown |
1296 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
1296 | iexplore.exe | 2.16.186.97:80 | a4.bing.com | Akamai International B.V. | — | whitelisted |
1296 | iexplore.exe | 104.20.209.21:443 | pastebin.com | Cloudflare Inc | US | shared |
1296 | iexplore.exe | 157.55.134.136:443 | login.live.com | Microsoft Corporation | US | whitelisted |
1296 | iexplore.exe | 108.177.15.155:443 | stats.g.doubleclick.net | Google Inc. | US | whitelisted |
1296 | iexplore.exe | 172.217.18.14:443 | www.google-analytics.com | Google Inc. | US | whitelisted |
1296 | iexplore.exe | 108.161.189.78:443 | m.servedby-buysellads.com | netDNA | US | unknown |
Domain | IP | Reputation |
---|---|---|
www.bing.com |
| whitelisted |
tse1.mm.bing.net |
| whitelisted |
login.live.com |
| whitelisted |
a4.bing.com |
| whitelisted |
pastebin.com |
| shared |
www.googletagmanager.com |
| whitelisted |
tags.expo9.exponential.com |
| whitelisted |
cdn.carbonads.com |
| whitelisted |
m.servedby-buysellads.com |
| whitelisted |
www.google-analytics.com |
| whitelisted |