analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://skidrowcpygames.com/password01

Full analysis: https://app.any.run/tasks/0e0f8ca0-8a72-46bb-b9d1-706f7bc4b187
Verdict: Malicious activity
Analysis date: February 12, 2023, 11:46:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

7034E3340260C6DEF14778B12292C80D

SHA1:

73023C00AF6F36B9A59130E23287B8EBF8F09515

SHA256:

01C1C91B583AEE7E574B08C1BA56A91EC4C8711FBA77FC1AB968ED3CA3EBF146

SSDEEP:

3:N8DyKfcCtzEWWSKXB+n:2lxoR5Xo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • The process checks LSA protection

      • iexplore.exe (PID: 3520)
      • wmpnscfg.exe (PID: 2836)
      • iexplore.exe (PID: 3936)
      • iexplore.exe (PID: 2448)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 2836)

    • Checks supported languages

      • wmpnscfg.exe (PID: 2836)

    • Reads the computer name

      • wmpnscfg.exe (PID: 2836)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2836)

    • Create files in a temporary directory

      • iexplore.exe (PID: 3520)
      • iexplore.exe (PID: 3936)

    • Application launched itself

      • iexplore.exe (PID: 3520)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
4
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wmpnscfg.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3520"C:\Program Files\Internet Explorer\iexplore.exe" "https://skidrowcpygames.com/password01"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3936"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3520 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2836"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
2448"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3520 CREDAT:464144 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
55 988
Read events
55 690
Write events
288
Delete events
10

Modification events

(PID) Process:(3520) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3520) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3520) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31014615
(PID) Process:(3520) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3520) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31014615
(PID) Process:(3520) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3520) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3520) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3520) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3520) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
56
Text files
80
Unknown types
50

Dropped files

PID
Process
Filename
Type
3936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:A288DF66573A233EB1CCDEE1423E10BB
SHA256:B6FD87DB4F82137828BFE3C5CF9E352697293F7BFBCEB7EB7B08CABBBF268D06
3936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:54B13AC020FE099A27C7441E3DBB0CA6
SHA256:759C2CA1412060CC79F96CCAABCAC41C1094986DD28D263E2875BAD0DE4FB299
3936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_83B8F093B5BC55D4DCF5048DC8795FA3der
MD5:4C425B8F3D1FF46DB10CED54F69B6643
SHA256:D3AA51589FACDD43071BD15BF90CD78D813B170260ECA2713C69FC659B97E348
3936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_CE2F0A1E5DF40B788EA08C89F604EB34binary
MD5:FC7924C3CC8A1CAEAB368AA909631FBA
SHA256:8AF5E70D8081414D57F537DCE00BF32E6190BD7818BB97D318D3478E76F27403
3520iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8Fder
MD5:60B9EEE18F0318BA56E33C41A80E4620
SHA256:B3897ABDC308EB2F09AF2F1146576875F8592116ABE59B487ECA11BE14A147A3
3520iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8Fbinary
MD5:30DD44A3B8984AC0CCD6BBFB924E8F92
SHA256:A64074812DEC5F3B1E621BE957842FAFBBD568C6082FD0DD00A9E8878EA58933
3936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_83B8F093B5BC55D4DCF5048DC8795FA3binary
MD5:1BB7E2CD864F93AD89DED06209DD595A
SHA256:0BA11B713577A65F8CA48624183A318AA23A549407DBD002241EB646DAF26F23
3936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:396A9E17CEA30BEE646E770C19C03A6C
SHA256:99DD10454F762B8A8DF7578D00678E29B942D5FE0C85D97960CC9366A9E54B60
3936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_CE2F0A1E5DF40B788EA08C89F604EB34der
MD5:25B2EB0267F3CB7D7B93A093EA646E1A
SHA256:216D7E2DF5E0DEF7ECF6B7B4CEFD813CCDD9FFA97FDCFBCCF99F57500883F885
3936iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\passwordtxt01[1].htmhtml
MD5:96858D7F3820EE2C8B195C90AB79EBBE
SHA256:7247B7082EF235C1E33ACF370CB9C49EB561E3B255C4ACADF01965DD947716DA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
71
DNS requests
33
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3936
iexplore.exe
GET
200
142.251.208.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC%2ByQ3HCGjSjxK2rAEAFE8%2F
US
der
472 b
whitelisted
3936
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEAcxaF%2FM%2FAqMiL%2FRlq0mxBg%3D
US
der
279 b
whitelisted
3520
iexplore.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/Omniroot2025.crl
US
der
7.78 Kb
whitelisted
3936
iexplore.exe
GET
200
178.79.242.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?f94802e48d820499
DE
compressed
61.4 Kb
whitelisted
3936
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEAzja4vAreEppugpYALm3lE%3D
US
der
280 b
whitelisted
3936
iexplore.exe
GET
200
178.79.242.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e52a9ded24e1e7d8
DE
compressed
4.70 Kb
whitelisted
2448
iexplore.exe
GET
200
104.18.32.68:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
2.18 Kb
whitelisted
2448
iexplore.exe
GET
200
172.64.155.188:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEEhcp0ACfnKpNNh1%2FZUtu4o%3D
US
der
471 b
whitelisted
3936
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
3936
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3936
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
3520
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
3520
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3936
iexplore.exe
178.79.242.0:80
ctldl.windowsupdate.com
LLNW
DE
whitelisted
3936
iexplore.exe
142.251.39.74:443
fonts.googleapis.com
GOOGLE
US
suspicious
—
—
104.21.32.36:443
trkfiles.com
CLOUDFLARENET
—
unknown
—
—
104.18.10.207:443
netdna.bootstrapcdn.com
CLOUDFLARENET
—
suspicious
3936
iexplore.exe
104.21.28.119:443
—
CLOUDFLARENET
—
unknown
3936
iexplore.exe
104.21.32.36:443
trkfiles.com
CLOUDFLARENET
—
unknown
3936
iexplore.exe
104.18.10.207:443
netdna.bootstrapcdn.com
CLOUDFLARENET
—
suspicious

DNS requests

Domain
IP
Reputation
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ctldl.windowsupdate.com
  • 178.79.242.0
  • 178.79.242.128
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
trkfiles.com
  • 104.21.32.36
  • 172.67.182.155
unknown
crl3.digicert.com
  • 93.184.220.29
whitelisted
ajax.googleapis.com
  • 172.217.19.106
whitelisted
netdna.bootstrapcdn.com
  • 104.18.10.207
  • 104.18.11.207
whitelisted
fonts.googleapis.com
  • 142.251.39.74
whitelisted
i.ibb.co
  • 162.19.58.160
  • 162.19.58.157
  • 162.19.58.156
  • 162.19.58.158
  • 162.19.58.161
  • 162.19.58.159
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://skidrowcpygames.com/password01