analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://links.m2mediagroup.mkt5971.com/ctt?ms=MzQ1NTU2NzcS1&kn=2&r=NTMzMjU4MzMzNzczS0&b=0&j=MjI4MzE1NDg2MgS2&mt=1&rt=0

Full analysis: https://app.any.run/tasks/779ef5ab-584b-4bb2-9dda-5a3f50d181cc
Verdict: Malicious activity
Analysis date: October 05, 2022, 01:02:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

1B4F58BD3C473A8D2852AFCCD866ABC1

SHA1:

2A2257C28EF29D17B2EF06FD1633D8942A3794F8

SHA256:

080DFED74AB4F09D9082BBEC1752882DE865274123D6BAF2BD75F70C36FED171

SSDEEP:

3:N8MLxAAfRJyKITRIr5IruqhADL2HPixoCwsa:2MJ7yTTJfAv2HPiNwsa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3876)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 3396)
      • iexplore.exe (PID: 3876)

    • Reads the computer name

      • iexplore.exe (PID: 3876)
      • iexplore.exe (PID: 3396)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3876)
      • iexplore.exe (PID: 3396)

    • Creates files in the user directory

      • iexplore.exe (PID: 3876)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3876)

    • Application launched itself

      • iexplore.exe (PID: 3396)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3396)
      • iexplore.exe (PID: 3876)

    • Changes internet zones settings

      • iexplore.exe (PID: 3396)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3396"C:\Program Files\Internet Explorer\iexplore.exe" "https://links.m2mediagroup.mkt5971.com/ctt?ms=MzQ1NTU2NzcS1&kn=2&r=NTMzMjU4MzMzNzczS0&b=0&j=MjI4MzE1NDg2MgS2&mt=1&rt=0"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
3876"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3396 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
11 214
Read events
11 074
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
19
Text files
23
Unknown types
19

Dropped files

PID
Process
Filename
Type
3396iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:022CE36692359BFA706428596F8FF0FC
SHA256:8272CA1F2D31DD26731C7EA35B50863F86A19A537D40547210448FE4EF41AD2C
3876iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62der
MD5:EA255872E73FB697BC8D09DAB5BBF5D4
SHA256:B5AE1C08ACCCB952335F77ED4058FEE54D5F5929CCAC1612F41C5F064C21D51A
3396iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8Fder
MD5:706D6538FD37693AD6E2784B2EA35218
SHA256:3BE2AF083FFD1E6BF9762687183226AA01EC65B391AFDFAE8ECDAFC247F5C77E
3876iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6A2279C2CA42EBEE26F14589F0736E50der
MD5:F1443597FCFF43E98CF17EB8F9B1093A
SHA256:B822350AA6B79E19042217701C714CFC02B80E404C85B158724C516849BD7137
3876iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62binary
MD5:B40777B72236EA760AC95C54D23BF260
SHA256:232D83F01C62CE34C14E8EB33DBDD3910F9772BAD3E6B81743EEEBA61CD0C541
3876iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4Fder
MD5:FCCDD7010386F27BC94A82BBA6081813
SHA256:D8B3AB356EBBA0C37A2A6ED07119C722EADCC78F5EB7B0938665F239F3243499
3876iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6A2279C2CA42EBEE26F14589F0736E50binary
MD5:734B135DB8FCC552DB22FAE90C99AFA1
SHA256:0D1165E9855FF3004AC2934913812252A32EB8B9555872C38AE3D13C9941EE25
3396iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:1D9E4175449A76F70EF61987CB95F84B
SHA256:39A3F6A94F8681336A2503C1FC0202CF1BD3496EDE2335BACB5E0935740EC987
3876iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4Fbinary
MD5:74CCF82073C87D199B3EF98B72821197
SHA256:77023C4789E67A1FC5645177EF1D1144383F0E268D5E3E4E0EC608F72492BD6C
3876iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BCB67D7ECB470284AF35679F339E879Fbinary
MD5:3E493A4218494769BE2000A998326281
SHA256:73705DBD57DBB1DE07243E796EB26066BEF74970E4BFE226C73E50EEB3A572D1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
46
DNS requests
30
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3876
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
3876
iexplore.exe
GET
200
13.225.84.107:80
http://ocsp.sca1b.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEA53ohdPwa4M7ZkTAWzSMKg%3D
US
der
471 b
whitelisted
3876
iexplore.exe
GET
200
192.124.249.23:80
http://ocsp.godaddy.com//MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQDC7mwXHZt%2FCQ%3D%3D
US
der
1.74 Kb
whitelisted
3396
iexplore.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/Omniroot2025.crl
US
der
7.78 Kb
whitelisted
3876
iexplore.exe
GET
200
13.225.84.50:80
http://s.ss2.us/r.crl
US
der
434 b
whitelisted
3876
iexplore.exe
GET
200
192.124.249.23:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
US
der
1.69 Kb
whitelisted
3396
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3876
iexplore.exe
GET
200
13.225.84.13:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D
US
der
1.39 Kb
shared
3876
iexplore.exe
GET
200
13.225.84.97:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
3876
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3396
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3396
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
—
—
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
—
—
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
3876
iexplore.exe
52.222.236.31:443
links.m2mediagroup.mkt5971.com
AMAZON-02
US
suspicious
3876
iexplore.exe
52.222.236.36:443
links.m2mediagroup.mkt5971.com
AMAZON-02
US
suspicious
3396
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
3876
iexplore.exe
13.225.84.175:80
ocsp.rootg2.amazontrust.com
AMAZON-02
US
whitelisted
3396
iexplore.exe
41.63.96.128:80
ctldl.windowsupdate.com
LLNW
ZA
suspicious
3396
iexplore.exe
41.63.96.0:80
ctldl.windowsupdate.com
LLNW
ZA
suspicious

DNS requests

Domain
IP
Reputation
links.m2mediagroup.mkt5971.com
  • 52.222.236.31
  • 52.222.236.36
  • 52.222.236.98
  • 52.222.236.86
suspicious
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ctldl.windowsupdate.com
  • 41.63.96.0
  • 41.63.96.128
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
crl3.digicert.com
  • 93.184.220.29
whitelisted
o.ss2.us
  • 13.225.84.97
  • 13.225.84.68
  • 13.225.84.42
  • 13.225.84.66
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
s.ss2.us
  • 13.225.84.50
  • 13.225.84.92
  • 13.225.84.172
  • 13.225.84.53
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://links.m2mediagroup.mkt5971.com/ctt?ms=MzQ1NTU2NzcS1&kn=2&r=NTMzMjU4MzMzNzczS0&b=0&j=MjI4MzE1NDg2MgS2&mt=1&rt=0