analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Keep password for [email protected] .htm.zip

Full analysis: https://app.any.run/tasks/7b0ff3e1-4d79-40c1-8283-f2822156c4ec
Verdict: Malicious activity
Analysis date: September 30, 2020, 12:53:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
phishing
phish-outlook
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

7F881DC04AA78DD3E45B46BFC7B6236D

SHA1:

3B9160E7111F48584C930EC5A8B220BEBCF26231

SHA256:

088041E4FE6F94E811250A4D64D243AF1D090973CD22CD3CD91EF12CA9373AB3

SSDEEP:

384:sfqmpFfBOjPb1r6INW5jCXBkWsM1sq63mLFUEHsBK:MKz1mIN/xtsMu3sDM0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Outlook phishing page detected

      • WinRAR.exe (PID: 1336)
  • SUSPICIOUS

    • Starts Internet Explorer

      • WinRAR.exe (PID: 1336)
  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2880)
      • iexplore.exe (PID: 3176)
    • Application launched itself

      • iexplore.exe (PID: 2880)
      • iexplore.exe (PID: 2688)
    • Changes internet zones settings

      • iexplore.exe (PID: 2880)
    • Reads settings of System Certificates

      • iexplore.exe (PID: 2688)
      • iexplore.exe (PID: 2880)
    • Reads internet explorer settings

      • iexplore.exe (PID: 2688)
    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2688)
      • iexplore.exe (PID: 2880)
    • Changes settings of System certificates

      • iexplore.exe (PID: 2688)
      • iexplore.exe (PID: 2880)
    • Creates files in the user directory

      • iexplore.exe (PID: 2880)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2020:09:30 12:52:10
ZipCRC: 0xc7d264e6
ZipCompressedSize: 13674
ZipUncompressedSize: 23109
ZipFileName: Keep password for [email protected] .htm
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs iexplore.exe iexplore.exe iexplore.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1336"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Keep password for [email protected] .htm.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2880"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1336.27196\Keep password for [email protected] .htmC:\Program Files\Internet Explorer\iexplore.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2688"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2880 CREDAT:144385 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3176"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2880 CREDAT:398593 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exeiexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Total events
1 653
Read events
1 534
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
15
Text files
6
Unknown types
4

Dropped files

PID
Process
Filename
Type
2688iexplore.exeC:\Users\admin\AppData\Local\Temp\CabAB7D.tmp
MD5:
SHA256:
2688iexplore.exeC:\Users\admin\AppData\Local\Temp\TarAB7E.tmp
MD5:
SHA256:
2880iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
MD5:
SHA256:
2688iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver1F95.tmp
MD5:
SHA256:
2880iexplore.exeC:\Users\admin\AppData\Local\Temp\Cab8023.tmp
MD5:
SHA256:
2880iexplore.exeC:\Users\admin\AppData\Local\Temp\Cab8022.tmp
MD5:
SHA256:
2880iexplore.exeC:\Users\admin\AppData\Local\Temp\Tar8025.tmp
MD5:
SHA256:
2880iexplore.exeC:\Users\admin\AppData\Local\Temp\Tar8024.tmp
MD5:
SHA256:
2880iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\KB5T3BR1.txt
MD5:
SHA256:
2880iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\RFWH2H3N.txt
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
24
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2688
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
2688
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
1052
svchost.exe
GET
104.18.24.243:80
http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIGkp0%2Fv9GUvNUu1EP06Tu7%2BChyAQUkZ47RGw9V5xCdyo010%2FRzEqXLNoCEyAAASWxwt68EQiA3cUAAAABJbE%3D
US
whitelisted
2688
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
2688
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
1052
svchost.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEA7yTSbUNi7CXXtef0luXqk%3D
US
der
279 b
whitelisted
1052
svchost.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
2880
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2688
iexplore.exe
209.197.3.15:443
stackpath.bootstrapcdn.com
Highwinds Network Group, Inc.
US
whitelisted
4
System
92.122.253.175:445
c.s-microsoft.com
GTT Communications Inc.
suspicious
2688
iexplore.exe
151.139.128.14:80
ocsp.comodoca.com
Highwinds Network Group, Inc.
US
suspicious
4
System
92.122.253.175:139
c.s-microsoft.com
GTT Communications Inc.
suspicious
2688
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2880
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2688
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2880
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2880
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
stackpath.bootstrapcdn.com
  • 209.197.3.15
whitelisted
maxcdn.bootstrapcdn.com
  • 209.197.3.15
whitelisted
ocsp.comodoca.com
  • 151.139.128.14
whitelisted
ocsp.usertrust.com
  • 151.139.128.14
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
api.bing.com
  • 13.107.13.80
whitelisted
c.s-microsoft.com
  • 92.122.253.175
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info