analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www.msn.com/en-us/feed?ocid=winp1taskbar

Full analysis: https://app.any.run/tasks/8d05352c-3d08-4d2f-9d83-5095586314d8
Verdict: Malicious activity
Analysis date: September 07, 2021, 18:33:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

911324E9ED7EE32EAF449E8294CE0380

SHA1:

B84040F3EE1D36B7C2831DC003E00E19717DA3C1

SHA256:

003B136153A9743167F94AF4D2F16C8DA4CEFDF83F23E6BDD238C3CA30810324

SSDEEP:

3:N8DSLfZw8wdKVzH+:2OLhw8RVr+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3132)
      • iexplore.exe (PID: 1612)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 2716)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 1612)
      • iexplore.exe (PID: 3728)
      • iexplore.exe (PID: 3132)
      • chrome.exe (PID: 1644)
      • chrome.exe (PID: 2716)
      • chrome.exe (PID: 2548)
      • chrome.exe (PID: 1556)
      • chrome.exe (PID: 3316)
      • chrome.exe (PID: 4076)
      • chrome.exe (PID: 512)
      • chrome.exe (PID: 2208)

    • Checks supported languages

      • iexplore.exe (PID: 1612)
      • iexplore.exe (PID: 3728)
      • chrome.exe (PID: 3176)
      • iexplore.exe (PID: 3132)
      • chrome.exe (PID: 2724)
      • chrome.exe (PID: 2716)
      • chrome.exe (PID: 1644)
      • chrome.exe (PID: 2548)
      • chrome.exe (PID: 3960)
      • chrome.exe (PID: 1404)
      • chrome.exe (PID: 2172)
      • chrome.exe (PID: 2608)
      • chrome.exe (PID: 1556)
      • chrome.exe (PID: 1972)
      • chrome.exe (PID: 304)
      • chrome.exe (PID: 512)
      • chrome.exe (PID: 3316)
      • chrome.exe (PID: 2140)
      • chrome.exe (PID: 960)
      • chrome.exe (PID: 2772)
      • chrome.exe (PID: 3640)
      • chrome.exe (PID: 3052)
      • chrome.exe (PID: 2208)
      • chrome.exe (PID: 3460)
      • chrome.exe (PID: 2152)
      • chrome.exe (PID: 2380)
      • chrome.exe (PID: 2960)
      • chrome.exe (PID: 3120)
      • chrome.exe (PID: 2328)
      • chrome.exe (PID: 4076)
      • chrome.exe (PID: 1012)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3728)
      • iexplore.exe (PID: 1612)
      • chrome.exe (PID: 2548)

    • Application launched itself

      • iexplore.exe (PID: 3728)
      • chrome.exe (PID: 2716)

    • Creates files in the user directory

      • iexplore.exe (PID: 1612)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3728)
      • iexplore.exe (PID: 1612)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1612)
      • iexplore.exe (PID: 3132)

    • Changes internet zones settings

      • iexplore.exe (PID: 3728)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 3728)
      • chrome.exe (PID: 2208)

    • Manual execution by user

      • chrome.exe (PID: 2716)

    • Reads the hosts file

      • chrome.exe (PID: 2548)
      • chrome.exe (PID: 2716)

    • Dropped object may contain Bitcoin addresses

      • chrome.exe (PID: 2716)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
67
Monitored processes
31
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3728"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.msn.com/en-us/feed?ocid=winp1taskbar"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
1612"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3728 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3132"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3728 CREDAT:2430219 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2716"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
Explorer.EXE
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
2724"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6de4d988,0x6de4d998,0x6de4d9a4C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
1644"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1032,7940696962169971464,17413495396971479717,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1028 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
2548"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1032,7940696962169971464,17413495396971479717,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1400 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
3960"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,7940696962169971464,17413495396971479717,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1924 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
3176"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,7940696962169971464,17413495396971479717,131072 --enable-features=PasswordImport --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1844 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
1404"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,7940696962169971464,17413495396971479717,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2188 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Total events
18 547
Read events
18 273
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
224
Text files
288
Unknown types
52

Dropped files

PID
Process
Filename
Type
1612iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:99904F7A2AD84897DA66D5DCF0047A10
SHA256:509414A9F4E1A320F2B52C749AA165AA3C4405EBEB59EA5CB062E1F474C8B979
1612iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5ABder
MD5:8E60A379D2A22E691AA163D6BE3A0C9B
SHA256:B95A76B6C9F9566F5CE938A647C6516022A11AA8E5D8601E0BECA985048024D9
1612iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\js[1].jstext
MD5:FA421E1F054445B5008211B71884DE4D
SHA256:3B16459F5FE6CD858EA2F26C4EB246E9AB3AE6FDF5E4E326E083B41BFB8AE71B
1612iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\TN33N4Z3.txttext
MD5:E48F28BA4BEDADDE58F799B1DC8C8E11
SHA256:32E1D6D7515E5D0537A2399F415618ABD1C0CAB452407315E4659B555AB79647
1612iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442binary
MD5:86BA213EAB53D65251B86F6E1C10C83D
SHA256:8F06B88EDA7066DE7F6817BD565B103B99BB7752F4F55922BA426D3E69676B5C
1612iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5ABbinary
MD5:8594FD10BCF0AD5B85852C0D374540C5
SHA256:CE126474D0E0967A70C12A7250073C3FFBBD0C920A9C7594D9D7F61DD30CD9A7
1612iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\3b-5fdca4-f41d9e92[1].jstext
MD5:90D0A71E16E68E587E812A9ED73B1BD9
SHA256:945DF1EEF5BFA1FDDC816903D87A72D6183A0A45DDC5A40F25B4EC7195B826E9
1612iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\jac[1].jstext
MD5:27216F91F826D09F5B899EE50C9B9E1F
SHA256:80DDD620DE6D2982D76AC2E9A1A17A70041A23225990D1669F3C77534502E4D2
1612iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\startredirect[1].htmhtml
MD5:5CD9FEDB78171918A7AD9A354466DED3
SHA256:48A928E8593ED69CEFC43DA4B4162AFD76F6462C5C59C4AE37F5F3DE0E30AABB
1612iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442der
MD5:30968477E03DAB26F3E1BA4B719B81D6
SHA256:8C45066E51325B8B0CD8AE6620905CCC5373263BD2DD9625AAF005784F3A390E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
41
TCP/UDP connections
188
DNS requests
77
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1612
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
1612
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
3728
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
1612
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
US
der
471 b
whitelisted
1612
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
1612
iexplore.exe
GET
200
142.250.185.227:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQD%2B%2BWdCObVnLQoAAAAA%2BmIn
US
der
472 b
whitelisted
1612
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
1612
iexplore.exe
GET
200
142.250.185.227:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
1612
iexplore.exe
GET
200
143.204.101.124:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
1612
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1612
iexplore.exe
204.79.197.203:443
www.msn.com
Microsoft Corporation
US
whitelisted
1612
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1612
iexplore.exe
87.248.118.23:443
jill.fc.yahoo.com
Yahoo! UK Services Limited
GB
malicious
3728
iexplore.exe
13.107.21.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
1612
iexplore.exe
92.123.195.50:443
static-global-s-msn-com.akamaized.net
Akamai International B.V.
—
whitelisted
—
—
92.123.195.50:443
static-global-s-msn-com.akamaized.net
Akamai International B.V.
—
whitelisted
1612
iexplore.exe
69.16.175.42:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
malicious
1612
iexplore.exe
87.248.118.22:443
jill.fc.yahoo.com
Yahoo! UK Services Limited
GB
shared
1612
iexplore.exe
152.195.51.15:443
tag.idsync.analytics.yahoo.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
unknown
1612
iexplore.exe
212.82.100.182:443
cms.analytics.yahoo.com
Yahoo! UK Services Limited
CH
suspicious

DNS requests

Domain
IP
Reputation
www.msn.com
  • 204.79.197.203
whitelisted
ctldl.windowsupdate.com
  • 69.16.175.42
  • 69.16.175.10
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
static-global-s-msn-com.akamaized.net
  • 92.123.195.50
  • 92.123.195.57
whitelisted
jill.fc.yahoo.com
  • 87.248.118.22
  • 87.248.118.23
whitelisted
www.bing.com
  • 13.107.21.200
  • 204.79.197.200
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
jac.yahoosandbox.com
  • 87.248.118.23
  • 87.248.118.22
suspicious
tag.idsync.analytics.yahoo.com
  • 152.195.51.15
whitelisted
cms.analytics.yahoo.com
  • 212.82.100.182
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.msn.com/en-us/feed?ocid=winp1taskbar