analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://brightdata.com

Full analysis: https://app.any.run/tasks/c6599ca2-16ac-41b7-a1e6-51b09adb4045
Verdict: Malicious activity
Analysis date: October 04, 2022, 20:16:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

3D295BD4717546B0CEF273F8A05AC846

SHA1:

D0FECAB18CA2DC5ADFCF3671040EEF4658722CB4

SHA256:

075FAF07FF1066722F09C87643B91238A9AFB5E5C2BFAC05D9AB4C2193299820

SSDEEP:

3:N8SORrGT:2lST

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 1064)
  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 1064)
      • iexplore.exe (PID: 2632)
    • Reads the computer name

      • iexplore.exe (PID: 1064)
      • iexplore.exe (PID: 2632)
    • Reads settings of System Certificates

      • iexplore.exe (PID: 2632)
      • iexplore.exe (PID: 1064)
    • Changes internet zones settings

      • iexplore.exe (PID: 2632)
    • Application launched itself

      • iexplore.exe (PID: 2632)
    • Reads internet explorer settings

      • iexplore.exe (PID: 1064)
    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2632)
      • iexplore.exe (PID: 1064)
    • Changes settings of System certificates

      • iexplore.exe (PID: 2632)
    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2632"C:\Program Files\Internet Explorer\iexplore.exe" "https://brightdata.com"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1064"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2632 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
Total events
15 598
Read events
15 471
Write events
123
Delete events
4

Modification events

(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
574195136
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30988334
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
874358886
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30988334
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
9
Text files
151
Unknown types
13

Dropped files

PID
Process
Filename
Type
2632iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442der
MD5:B8BDA0B382A7D056A4241B388338B778
SHA256:7BAA967F6686CCE471826B20FFA5CB7FEB4BF3C5C0BF43F51F08E84EB5850DD2
1064iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\9GCZRX7A.htmhtml
MD5:AFB83D325DE28A6A63DFA2980A64D253
SHA256:9F6AEC8C71CA80370DF679FCCC5EF0DE1705639989286805DDB328884B5592A5
1064iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dder
MD5:596D2FDCEBB9285D08C83E8C66F21DC9
SHA256:0231BC4602667FF24BFA1CAAB1D56C225A54031C452C9DE84B810BE18628A3E3
2632iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442binary
MD5:80569D88549EF0759CDF5B3BF4E3B402
SHA256:4FCADBD3816756D5B299EBD7C6240529822FAC6A0463013D5A65A9D665DA5AA4
1064iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:33DD668EB10C41DD4493BF564CF4D1D2
SHA256:72DF7EDEAEB5030D2796632B9192EE72289B90BB9C715AD4B1256CC12789908F
1064iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\brd_home.min[1].csstext
MD5:21F16AE5A0FC563510BF6725112F135F
SHA256:4A6704807921B74D71C5E191B157BF23532FD06359845B0717F8FF10BBFCF760
1064iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\brd_footer.min[1].csstext
MD5:B1FD7B8E74945A2997E407D960DC743C
SHA256:46B8DEB2B481F6208941BDEEA09F1A66AB4904178B3CE702F26E55F54FAB786F
2632iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:88C6869BC8B6ED448F5BE02F79B9CDF7
SHA256:077ADE768FB2DDA0F5EFE817A9A60D8830FEBC0616C1E2D34FD707CD2592AC02
1064iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\EUO8XL1V.htmhtml
MD5:77C39F4EFFF8AAAF7ABC150A3F797982
SHA256:0B8639F43291A8BB1C2EE2D7178D704FEDE344099FD2DFA9A83D9D400636E103
1064iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\brd_header.min[1].csstext
MD5:4883DCE801CDEE1C13B60B3DEE42B5C8
SHA256:79FEAA08A9AB033FF96BA628066ADF8208430A13D2429E17397303174D80829E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
40
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1064
iexplore.exe
GET
200
172.64.155.188:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
2.18 Kb
whitelisted
1064
iexplore.exe
GET
200
104.18.32.68:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
1.42 Kb
whitelisted
1064
iexplore.exe
GET
200
172.64.155.188:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEE28yPGiQQP1tTwz2q5cBwk%3D
US
der
471 b
whitelisted
2632
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
2632
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2632
iexplore.exe
GET
200
178.79.242.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?bce0704a7d2b9c9f
DE
compressed
4.70 Kb
whitelisted
2632
iexplore.exe
GET
200
178.79.242.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?325939f444205851
DE
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2632
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1064
iexplore.exe
104.22.27.189:443
brightdata.com
CLOUDFLARENET
unknown
1064
iexplore.exe
172.64.155.188:80
ocsp.usertrust.com
CLOUDFLARENET
US
suspicious
2632
iexplore.exe
178.79.242.0:80
ctldl.windowsupdate.com
LLNW
DE
whitelisted
2632
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
1064
iexplore.exe
104.22.26.189:443
brightdata.com
CLOUDFLARENET
unknown
1064
iexplore.exe
104.18.32.68:80
ocsp.usertrust.com
CLOUDFLARENET
suspicious
2632
iexplore.exe
104.22.27.189:443
brightdata.com
CLOUDFLARENET
unknown
2632
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
1064
iexplore.exe
151.139.237.32:443
luminati-holanetworksltd.netdna-ssl.com
StackPath LLC
US
malicious

DNS requests

Domain
IP
Reputation
brightdata.com
  • 104.22.27.189
  • 104.22.26.189
  • 172.67.12.97
unknown
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ctldl.windowsupdate.com
  • 178.79.242.0
  • 95.140.236.0
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ocsp.usertrust.com
  • 172.64.155.188
  • 104.18.32.68
whitelisted
luminati-holanetworksltd.netdna-ssl.com
  • 151.139.237.32
malicious
ocsp.comodoca.com
  • 104.18.32.68
  • 172.64.155.188
whitelisted
ocsp.sectigo.com
  • 172.64.155.188
  • 104.18.32.68
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info