analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChcSEwj9tK2rtu7xAhWmHq0GHa7-B6EYABABGgJwdg&ohost=www.google.com&cid=CAESQOD2eiqp4q_3v6p4ojOwyHE3h-yiB-EPsQVZwD4v_qPlAldjkb6Fi8AjhhKxI4vhNMsjLar3jRFyOyeVRV66xEA&sig=AOD64_3SeGdhQFoXWdf0DGRWs--Vr6qZWQ&q&adurl&ved=2ahUKEwi73KWrtu7xAhWLvZ4KHbhABJIQ0Qx6BAgEEAE

Full analysis: https://app.any.run/tasks/976c3623-f1f8-43fb-a15b-d991310aff3f
Verdict: Malicious activity
Analysis date: July 19, 2021, 05:42:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

E7DABB306B82CAE877455985241AD4F1

SHA1:

0733C7B58F032CE9E849C63D614741F4B9F29C7B

SHA256:

066B57A1AE38850AE690D3BE8E9407DE9A6FBE944179516F0657632D6B79537D

SSDEEP:

6:2OLAAmrDX2x2uldVasQg5qqZ+FcrDZPMGx6dJaupeQXmvNfSX4:2DGx2uHssQg5SwtMTfyNfSI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 4008)
      • iexplore.exe (PID: 2512)
      • iexplore.exe (PID: 2988)

    • Disables Form Suggestion in IE

      • iexplore.exe (PID: 2512)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 4008)
      • iexplore.exe (PID: 2512)
      • iexplore.exe (PID: 2988)

    • Changes internet zones settings

      • iexplore.exe (PID: 2512)

    • Reads the computer name

      • iexplore.exe (PID: 4008)
      • iexplore.exe (PID: 2512)
      • iexplore.exe (PID: 2988)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2512)
      • iexplore.exe (PID: 4008)
      • iexplore.exe (PID: 2988)

    • Application launched itself

      • iexplore.exe (PID: 2512)

    • Reads internet explorer settings

      • iexplore.exe (PID: 4008)
      • iexplore.exe (PID: 2988)

    • Creates files in the user directory

      • iexplore.exe (PID: 2512)
      • iexplore.exe (PID: 2988)
      • iexplore.exe (PID: 4008)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2512)
      • iexplore.exe (PID: 2988)
      • iexplore.exe (PID: 4008)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 4008)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2512)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2512)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2512"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChcSEwj9tK2rtu7xAhWmHq0GHa7-B6EYABABGgJwdg&ohost=www.google.com&cid=CAESQOD2eiqp4q_3v6p4ojOwyHE3h-yiB-EPsQVZwD4v_qPlAldjkb6Fi8AjhhKxI4vhNMsjLar3jRFyOyeVRV66xEA&sig=AOD64_3SeGdhQFoXWdf0DGRWs--Vr6qZWQ&q&adurl&ved=2ahUKEwi73KWrtu7xAhWLvZ4KHbhABJIQ0Qx6BAgEEAE"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
4008"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2512 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2988"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2512 CREDAT:1840425 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
43 646
Read events
43 173
Write events
471
Delete events
2

Modification events

(PID) Process:(2512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30899296
(PID) Process:(2512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(2512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30899296
(PID) Process:(2512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
89
Text files
693
Unknown types
97

Dropped files

PID
Process
Filename
Type
4008iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_17ECF6BB9BC7203943BDC2F5667F6020der
MD5:3FAC334E4814EE2F8022B0E8ACAB9FEC
SHA256:57551842EF4BFD8657790718EFB81B69A14981032C4A187A34A7A8A612C11C33
4008iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_66CAE3F56EC6BF680226A35D24FE0AEEbinary
MD5:EB27CF80CEF44CBEFE4BD1A76A9B8268
SHA256:7521E1F5A9C1CDDF6AC2F1B6564067269394E6255DCAC6053828829D69479639
4008iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:8FE33C69E089687044DA0630C19530C7
SHA256:D74EF6CCD56E528EA75B1BB1A18279555636F7C24A5F3C8EE5BE6FF8A54C7131
2512iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:2E8070847782E9E5026E066DDB79A52F
SHA256:2CEF6FFEEBEF6058BC8AD73E2AB51457DCEA0CFD054E4FA5DCA8BA9EBA7A5BB4
4008iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:25E301C6EB942E7954C795270ED68455
SHA256:D366C56F981988C7D8786E91DEADF4EAB9DDC8933A9E0F16932482DEC094C3EE
4008iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_EECA347BA21A7A4C4974883DF12CE888binary
MD5:F802E2C7792ABB20BC04EFFDD39495E0
SHA256:457B84D5AE46CC2B97BEC1B7521A3F11EC1474A291E3B0616E7AC14709378865
4008iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\click[1].htmcompressed
MD5:D100713D0B707C79B3E1E884719B803E
SHA256:1B1652A574AB9B19E77C0F7908514C8CD572C5FA9C3639364F68DE3B0A229EA4
4008iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:AE6A598E9D295BE6359F3DAC2B6833C1
SHA256:53822731FDF1A8DCC51F0808C0C71B984B9CCC9B68768B9313767CF7D7A1C573
4008iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_66CAE3F56EC6BF680226A35D24FE0AEEder
MD5:934EBA202B16C821844332F92ADFD9E1
SHA256:B47A7ABE598E65056284CFEC24618AB338CE506E29CF3C0D7958FA8BD6E81319
4008iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_17ECF6BB9BC7203943BDC2F5667F6020binary
MD5:6B7FAEE891D808E0BB2AFDA0493EEC6B
SHA256:ABC2CFE5D13C85F2857038C115E0FE0E592B1BBD6FC0746E9122090FBE572323
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
79
TCP/UDP connections
383
DNS requests
149
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4008
iexplore.exe
GET
200
192.124.249.24:80
http://ocsp.godaddy.com//MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQD5vk41iVrkVQ%3D%3D
US
der
1.74 Kb
whitelisted
4008
iexplore.exe
GET
200
192.124.249.24:80
http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D
US
der
1.66 Kb
whitelisted
4008
iexplore.exe
GET
200
142.250.184.227:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDSJAfSJCzgVAoAAAAA6D44
US
der
472 b
whitelisted
4008
iexplore.exe
GET
200
142.250.184.227:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
4008
iexplore.exe
GET
200
192.124.249.24:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
US
der
1.69 Kb
whitelisted
4008
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
4008
iexplore.exe
GET
200
142.250.184.227:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
4008
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAo1CNVcKSsBffitZcAP9%2BQ%3D
US
der
471 b
whitelisted
4008
iexplore.exe
GET
200
142.250.184.227:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEDklLiDhjNkMCgAAAADoMj8%3D
US
der
471 b
whitelisted
4008
iexplore.exe
GET
200
142.250.184.227:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDDfpYKwbXhgAoAAAAA6DPx
US
der
472 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4008
iexplore.exe
172.217.16.130:443
www.googleadservices.com
Google Inc.
US
whitelisted
4008
iexplore.exe
205.185.216.10:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
4008
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
4008
iexplore.exe
142.250.185.70:443
ad.doubleclick.net
Google Inc.
US
unknown
2512
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
4008
iexplore.exe
142.250.184.227:80
ocsp.pki.goog
Google Inc.
US
whitelisted
4008
iexplore.exe
216.58.212.174:443
clickserve.dartsearch.net
Google Inc.
US
whitelisted
4008
iexplore.exe
192.124.249.24:80
ocsp.godaddy.com
Sucuri
US
suspicious
2512
iexplore.exe
205.185.216.10:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
2512
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
www.googleadservices.com
  • 172.217.16.130
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ctldl.windowsupdate.com
  • 205.185.216.10
  • 205.185.216.42
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ocsp.pki.goog
  • 142.250.184.227
whitelisted
clickserve.dartsearch.net
  • 216.58.212.174
whitelisted
ad.doubleclick.net
  • 142.250.185.70
whitelisted
t.myvisualiq.net
  • 18.196.210.39
  • 52.28.183.151
  • 18.158.209.84
  • 3.120.68.251
  • 18.195.172.223
whitelisted
ocsp.godaddy.com
  • 192.124.249.24
  • 192.124.249.22
  • 192.124.249.36
  • 192.124.249.23
  • 192.124.249.41
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChcSEwj9tK2rtu7xAhWmHq0GHa7-B6EYABABGgJwdg&ohost=www.google.com&cid=CAESQOD2eiqp4q_3v6p4ojOwyHE3h-yiB-EPsQVZwD4v_qPlAldjkb6Fi8AjhhKxI4vhNMsjLar3jRFyOyeVRV66xEA&sig=AOD64_3SeGdhQFoXWdf0DGRWs--Vr6qZWQ&q&adurl&ved=2ahUKEwi73KWrtu7xAhWLvZ4KHbhABJIQ0Qx6BAgEEAE