analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://falcon.us-2.crowdstrike.com/activity/detections?filter=status%3A%27new%27

Full analysis: https://app.any.run/tasks/f9db9214-192f-4260-ab30-9ef3110dafa2
Verdict: Malicious activity
Analysis date: October 05, 2022, 01:45:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

2FC7B441539DABCE92E977D334F00503

SHA1:

7A84F2B08F147055FB2B3B53ABE1E1CE96645A05

SHA256:

060F37285DCBBB8CEF4E95FD6BF298D7570527686F3D06F6B4BE8BD410B27BD2

SSDEEP:

3:N8JKLLOLTud0blLRfDsLWERDA8S:2i4hblLVgyEZS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3404)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 2912)
      • iexplore.exe (PID: 3404)

    • Reads the computer name

      • iexplore.exe (PID: 2912)
      • iexplore.exe (PID: 3404)

    • Application launched itself

      • iexplore.exe (PID: 2912)

    • Changes internet zones settings

      • iexplore.exe (PID: 2912)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2912)
      • iexplore.exe (PID: 3404)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3404)
      • iexplore.exe (PID: 2912)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3404)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2912"C:\Program Files\Internet Explorer\iexplore.exe" "https://falcon.us-2.crowdstrike.com/activity/detections?filter=status%3A%27new%27"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3404"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2912 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
12 127
Read events
12 016
Write events
111
Delete events
0

Modification events

(PID) Process:(2912) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2912) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
426669520
(PID) Process:(2912) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30988380
(PID) Process:(2912) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
726829520
(PID) Process:(2912) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30988380
(PID) Process:(2912) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2912) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2912) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2912) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2912) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
13
Text files
8
Unknown types
5

Dropped files

PID
Process
Filename
Type
3404iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2A7611428D62805A3E4E5BC4103D82E4_5D959FA9B6BFC115CDD0A579926FF5C4binary
MD5:CDB19B917D87C33515E1BF6C8FD06741
SHA256:8DE90C5B58FD9880AE91F0B6ABE8BF6EB94719D7F1C0FA0272404A5AF612238D
2912iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442der
MD5:B8BDA0B382A7D056A4241B388338B778
SHA256:7BAA967F6686CCE471826B20FFA5CB7FEB4BF3C5C0BF43F51F08E84EB5850DD2
2912iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:727C71381F46C096ED69D53D32C2273D
SHA256:C811D8AC422B7D4072EBBE9A2A5F2E2D625356291B89B386B94E447C65DDF0F2
3404iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C2C9ABA5445E530C1F65719A181595FC_DF467DB39F0B4ADDBF558F343126A531der
MD5:F7BCCD09548F3CC41D7941B0641B2506
SHA256:9CBC7809F3154D2AF90D748DED9DF2416C75949B7F8C0EB9B26B7DA5F496C464
3404iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C2C9ABA5445E530C1F65719A181595FC_909335EE4AD2424EC7A7EF737357CD7Bder
MD5:1D63CEFE6F79AEF19C30473DC6AF0D94
SHA256:857710F3D2EA316FDDE7EFD1EA093BF62096B3205344A815D31790F0B183F19B
3404iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\vendor-e3427609b1e0a40976f1486e45a9fe07[1].cssbinary
MD5:17B666B49F8FDC8126A0ED2383B2E6B9
SHA256:330AA1F2B182B2802940E51D5FB974E93FA1175D1AE821B14EDA85A0F98EB923
3404iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C2C9ABA5445E530C1F65719A181595FC_DF467DB39F0B4ADDBF558F343126A531binary
MD5:33E990D1C542A409EC2B19FEA4B7D6C7
SHA256:2B0B500E1D7019EF5851F61C37C8FA72554810F42E0254159A19D78ECAD724DD
3404iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\4.17.21-4be50a85424385e4f50b68645ec63262[1].jsini
MD5:75ABDEE2CA67E4CF1780B19408151384
SHA256:63D769C7F4740A556380690CB9FF7EE8A6E444E0D7069ECC973190ADC7FD292C
3404iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\vendor-78c80d5e7596721aa68abd86fa96d994[1].jsbinary
MD5:B69322CB4663D1BB1CE0C72471F93F8F
SHA256:C537F3EDC5EE18CD78E6D1B12D982030B4A38B9B7C581D39971FC4FA8D8B86DA
3404iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\login[1].htmhtml
MD5:3B800B8F0BADA72F0C527A53D553FAC7
SHA256:0143019F9A08A54AD58459AC6CC07B9D06BCB4DA1EBC6287F7EA230BCDDDDE2D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
24
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3404
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA8vE3vDxKKUEMYolwhnvcQ%3D
US
der
471 b
whitelisted
2912
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
2912
iexplore.exe
GET
200
95.140.236.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0f34031f9baf76de
GB
compressed
4.70 Kb
whitelisted
3404
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSegNvdpwVayGeR2RmIofY6eS8xwAQUgLeRNcgBkmiCJj1jvhhh%2B%2FTvIvsCEAlVgMNcg9QCdG4VINfxVLk%3D
US
der
471 b
whitelisted
2912
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2f858e4afebb5e2a
US
compressed
4.70 Kb
whitelisted
3404
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSegNvdpwVayGeR2RmIofY6eS8xwAQUgLeRNcgBkmiCJj1jvhhh%2B%2FTvIvsCEAXEyB4Ox8pMFlF31qwfYOc%3D
US
der
471 b
whitelisted
2912
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3404
iexplore.exe
44.227.251.226:443
falcon.us-2.crowdstrike.com
AMAZON-02
US
unknown
2912
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2912
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
2912
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
2912
iexplore.exe
95.140.236.128:80
ctldl.windowsupdate.com
LLNW
US
malicious
3404
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
3404
iexplore.exe
44.227.83.73:443
falcon.us-2.crowdstrike.com
AMAZON-02
US
unknown
3404
iexplore.exe
34.223.189.85:443
falcon.us-2.crowdstrike.com
AMAZON-02
US
unknown
3404
iexplore.exe
13.225.78.50:443
assets-public.falcon.us-2.crowdstrike.com
AMAZON-02
US
malicious
2912
iexplore.exe
152.199.19.161:443
r20swj13mr.microsoft.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
falcon.us-2.crowdstrike.com
  • 44.227.251.226
  • 44.227.83.73
  • 34.223.189.85
unknown
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ctldl.windowsupdate.com
  • 95.140.236.128
  • 178.79.242.128
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
assets-public.falcon.us-2.crowdstrike.com
  • 13.225.78.50
  • 13.225.78.81
  • 13.225.78.94
  • 13.225.78.58
malicious
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://falcon.us-2.crowdstrike.com/activity/detections?filter=status%3A%27new%27