File name:

2019-07-08-Ursnif-binary-retrieved-by-Word-macro.exe

Full analysis: https://app.any.run/tasks/b3513d04-8174-4fb9-b7da-c9f0ee57b905
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 04:10:42
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
gozi
ursnif
dreambot
banker
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

EF99338DF4078FAB6E9A8CF6797A1D14

SHA1:

FF57BFAED6DB3379BBF69A19404A6E21668A7A52

SHA256:

0894E82D9397D909099C98FE186354591AE86A73230700F462B72AE36C700DDF

SSDEEP:

98304:fYiW5hO49kx/RRJ+ACMancRCk54pwG77wV0LnMwHN5xADSGEtb/hPR7j+uc:

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • URSNIF has been detected (SURICATA)

      • iexplore.exe (PID: 5260)
      • iexplore.exe (PID: 3620)
      • iexplore.exe (PID: 3364)
      • iexplore.exe (PID: 1240)
      • iexplore.exe (PID: 6564)
      • iexplore.exe (PID: 5332)
      • iexplore.exe (PID: 1312)
      • iexplore.exe (PID: 3156)
      • iexplore.exe (PID: 6612)

    • Connects to the CnC server

      • iexplore.exe (PID: 5260)
      • iexplore.exe (PID: 3620)
      • iexplore.exe (PID: 3364)
      • iexplore.exe (PID: 1240)
      • iexplore.exe (PID: 6564)
      • iexplore.exe (PID: 5332)
      • iexplore.exe (PID: 6612)
      • iexplore.exe (PID: 1312)
      • iexplore.exe (PID: 3156)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • 2019-07-08-Ursnif-binary-retrieved-by-Word-macro.exe (PID: 2568)

    • Contacting a server suspected of hosting an CnC

      • iexplore.exe (PID: 5260)
      • iexplore.exe (PID: 3620)
      • iexplore.exe (PID: 5332)
      • iexplore.exe (PID: 3364)
      • iexplore.exe (PID: 1240)
      • iexplore.exe (PID: 6564)
      • iexplore.exe (PID: 1312)
      • iexplore.exe (PID: 3156)
      • iexplore.exe (PID: 6612)

  • INFO

    • Checks supported languages

      • 2019-07-08-Ursnif-binary-retrieved-by-Word-macro.exe (PID: 2568)
      • ielowutil.exe (PID: 6656)

    • The sample compiled with english language support

      • 2019-07-08-Ursnif-binary-retrieved-by-Word-macro.exe (PID: 2568)

    • Reads the computer name

      • 2019-07-08-Ursnif-binary-retrieved-by-Word-macro.exe (PID: 2568)
      • ielowutil.exe (PID: 6656)

    • Reads the software policy settings

      • slui.exe (PID: 3300)
      • slui.exe (PID: 1616)

    • Checks proxy server information

      • slui.exe (PID: 1616)

    • Local mutex for internet shortcut management

      • iexplore.exe (PID: 2772)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:07:08 09:06:54+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 3225088
InitializedDataSize: 904192
UninitializedDataSize: -
EntryPoint: 0x298b10
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2.1.83.15
ProductVersionNumber: 2.1.83.15
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: Cou
CompanyName: Cogniance Figureabout
FileVersion: 2.1.83.15
InternalName: Colony
ProductName: Colony
LegalCopyright: Copyright © 2006 Cogniance Figureabout. All rights reserved
FileDescription: Colony
ProductVersion: 2.1.83.15
OriginalFileName: Obj.exe
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
181
Monitored processes
34
Malicious processes
13
Suspicious processes
3

Behavior graph

Click at the process to see the details
start 2019-07-08-ursnif-binary-retrieved-by-word-macro.exe no specs sppextcomobj.exe no specs slui.exe ielowutil.exe no specs iexplore.exe #URSNIF iexplore.exe slui.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe ucpdmgr.exe no specs conhost.exe no specs ucpdmgr.exe no specs conhost.exe no specs iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
720"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
780"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5780 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
924\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—UCPDMgr.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
960"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5780 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
960"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1240"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6272 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1312"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5892 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1348"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1616C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2108\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—UCPDMgr.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
41 284
Read events
40 993
Write events
241
Delete events
50

Modification events

(PID) Process:(2772) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2772) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{35853CD8-092F-11F0-B4ED-18F7786F96EE}
Value:
0
(PID) Process:(2772) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch
Operation:writeName:Version
Value:
WS not running
(PID) Process:(2772) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2772) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:FullScreen
Value:
no
(PID) Process:(5260) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5260) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Content
Operation:writeName:CacheLimit
Value:
337920
(PID) Process:(5260) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2772) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2772) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
0
Suspicious files
50
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5260iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\SmartScreenCache.datbinary
MD5:C81ECBF1D95465F0E6494128A2754CCC
SHA256:F64186222C18DDEEA7700BFB8A28FD66A61BB25762B951693C2150D3BEAA56A4
5260iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DATbinary
MD5:0392ADA071EB68355BED625D8F9695F3
SHA256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
2772iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{35853CD8-092F-11F0-B4ED-18F7786F96EE}.datbinary
MD5:625FD5DD2F4BA8B522FC1D33DA84BDA8
SHA256:FED91A8B41292363452BDE0087D0A0D58A3185C69EBD9397DF46C4F024D9F49B
1348iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{68AFFBD2-092F-11F0-B4ED-18F7786F96EE}.datbinary
MD5:77E988A2ED29F41DDD256D3E587C0CBF
SHA256:4690DE325B6BFF94301610C473E1BAE41463498710869B856A862C33F0BC12F5
5780iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{4EC25C79-092F-11F0-B4ED-18F7786F96EE}.datbinary
MD5:32155D91EE036730C4A8532B947DFF5E
SHA256:FF60677858DA8554AE262169CA2D791F5DAD9B19D08EA6C32CC0E2F0E927F101
2772iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFFBA3099F9F6CC2A6.TMPbinary
MD5:6A75CCEB36DA57DD10B4E09D098C0DC5
SHA256:C40BD557ACD1D84663EA0BE6A57D22693B3CAA531D3499816AA74339A72A0467
3896iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFD973448C00366507.TMPbinary
MD5:FE04B116608B38AEE6645C6641B5DF29
SHA256:1BB6F380AF261B275232CB5AD8CA8D815D85509B40D71F052AC4E53BA32E37F4
3896iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{5BBB9511-092F-11F0-B4ED-18F7786F96EE}.datbinary
MD5:2909F0C50B6B56764553FA840787D4CE
SHA256:9EDD20BDC1955EEAB0F0BF2C1C2D96B09348BA74E53ACA191DCA5201C3708228
3896iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF28740D6B9CC3C1CE.TMPbinary
MD5:5710BF2C6FB51686E7169C9DADAB4EAA
SHA256:8B28B66B4582EB31177EA943CF573057F1A0AFD7F516C0B5566ECE0D412D1CB7
1348iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFECCCBE5C8A17D52A.TMPbinary
MD5:8C8153CC7B189CAF1A733EC95793326D
SHA256:9A051B1156381F907EAEB0F00E20CF0E6E9A0E3F16793EC5B1B53DC4692E0703
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
109
DNS requests
30
Threats
17

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1240
iexplore.exe
GET
404
23.58.105.127:80
http://avast.com/images/37_2BxESpe8fT6j/Kh_2F_2BOhz_2BgvR3/k2kSFzXoI/4BAgTHPnX3DFeee_2F_2/BEPP8DSsky_2F4h_2BY/nz7HqASlfxaYGprXOaeTgq/yYvOg_2FruCkW/a8cNiyHC/X9FCTHe5L1MI74reMAna3gh/2Bydr4Hr/bdSxF3e8iZH5/S.avi
unknown
—
—
whitelisted
3620
iexplore.exe
GET
404
49.13.77.253:80
http://hlilaf44erick.xyz/images/etjJAOktHiaaIpmvc_2Fa7m/fuCygNUN71/B3dn5632K4ofbdncf/A5AJYv3Vu9t8/ZqAgL_2FHSv/O4Zg_2BWDIiMNS/nknUjKqGcM48Zp6dygzjB/d6TWgw7lfq4daWDv/I9ilRg27K17cLD0/X79rLjwj_2F/lmsjfCxD.avi
unknown
—
—
malicious
5332
iexplore.exe
GET
404
20.76.201.171:80
http://microsoft.com/images/ttd_2BCDfdoK7Y_2F_2B/XfdQdZuOdZsGyKV59Pl/N_2Fd17rxQMb6qPeiq3eQP/s3xnrAJw2fson/8YF9Mgep/bSgow8V11icYZ46DD_2BPGh/KVPSbOo3bf/_2FUTVNqcBTgVbQpk/4PhaTMZVX_2B/cJi3B4ZlfsS/Llv6f8_2FGxA6J/_2BmOpUkh/mUTonS9IB/OB.avi
unknown
—
—
whitelisted
780
iexplore.exe
GET
404
49.13.77.253:80
http://x72omaripfcd.com/images/531ZTffoNHcpJZo/hlPaLRKS_2Fzr9NxJd/hcajoMDun/YhJ2xCEsBLV2A64EJpeQ/WCUiLDzrwwTHXbZUCin/gkHKSELVPKcKNwuNgCbrXc/bn3RUsYD0n2hR/xSh4FTkS/ktt3zxJCX8w6gGFtSS35WlC/eYll_2B.avi
unknown
—
—
unknown
6564
iexplore.exe
GET
404
49.13.77.253:80
http://redyth57k4.top/images/x5yZbQGYonbr_2Bmt/38tgb_2BpGG7/Qr2yBAUtzH1/g7Nb_2BgxMmIEY/uJHWo1EimfFvEsuz3wpZp/pcYmWBdj9lWRfHzN/n_2FC_2FYERKQGT/pmgIcZvDm7ImAajaN4/c7I8Qrpvc/yB_2FUewlZ2BVdMkRxQ0/UJjLPV2c66KYWw0Ple0/_2FPnLu4N_2B/EOl.avi
unknown
—
—
malicious
5260
iexplore.exe
GET
404
20.76.201.171:80
http://microsoft.com/images/jiLY_2FU6HwvrRRBpuGJF/BdAZmo4MNZL_2FT8/iUIxvLoxlXlm3w9/xY0W_2BKFKcngpruiP/Tms5KH7jh/oKNc69tqSPjzPrkmP83h/bpwQ33eh79ZJAsgJVou/zNJ3bPNV8v_2Fkpg_2Fmip/5S0WpZjyeCO/kP_2BsSc/X6y.avi
unknown
—
—
whitelisted
960
iexplore.exe
GET
404
23.58.105.127:80
http://avast.com/images/mqNsNemoEJQaVo/kw7HUmCAQMD5oa75U7uHW/6wdGint2iGe9OXra/2rdZvIlXZNRAbot/P3cxmvo9vPWJsezSa7/8vawxIp0P/pHLDW_2BxzmzXXjVZlp8/WjZ2VViUVsFS22FtrO_/2FFrSnjkzTCMkH/FQUag2ha.avi
unknown
—
—
whitelisted
3364
iexplore.exe
GET
404
20.109.209.108:80
http://update.microsoft.com/images/0UKhvMtxYzp4Lv_2Bw_2FSU/sLxOqHuURj/czHGqKe22RMWkmslc/Nsn7Pmr6IvbX/NWF0BVbXj8d/dUwCLIVBkJvRna/ZbA1a_2BE4u_2Fij5931Z/Fa0r3MRI_2BaP1PR/F7na1uXRiA_2B2y/R1JQKqBDQ_2Fv_2FZX/QoOK3_2Bx7/n.avi
unknown
—
—
whitelisted
1312
iexplore.exe
GET
404
49.13.77.253:80
http://hlilaf44erick.xyz/images/SPRb6fEfvipxm6CEUxiZH3D/WbnJU_2Fty/HaaLt5Zr68dNLcz_2/FIpx7h0DO9qP/JYMEwAz3YZE/PN8a7enhZeY_2B/1IrOJpXyTD9HOghjEPO7_/2Bu8GtW1_2F0usKS/h7XtCiVkd_2F4KC/aDS1q9XeJx1FIn5qjn0fL/k0.avi
unknown
—
—
malicious
3156
iexplore.exe
GET
404
49.13.77.253:80
http://redyth57k4.top/images/UGGf_2Fus_2FC/MtBhokDs/NqaMM4S_2FZOM_2FMKb78AS/zRjhXyYF_2/FLDmbsdum_2FdrXRU/jWwdv5p3bFj1/aXGCnak9OAa/VZDWyPleUhcitk/DjLQyFqYuX3RP9FTmOmdG/62rjRvMWCaeAjStc/32bnsHm78YCEnGh/b0KeRTEAJ4D/hcz0SLjbI/EST.avi
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1512
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5260
iexplore.exe
20.76.201.171:80
microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
20.198.162.78:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
6544
svchost.exe
20.190.160.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
  • 51.104.136.2
whitelisted
google.com
  • 142.250.184.238
whitelisted
microsoft.com
  • 20.76.201.171
  • 20.231.239.246
  • 20.112.250.133
  • 20.70.246.20
  • 20.236.44.162
whitelisted
client.wns.windows.com
  • 20.198.162.78
whitelisted
login.live.com
  • 20.190.160.67
  • 20.190.160.20
  • 40.126.32.72
  • 20.190.160.132
  • 40.126.32.138
  • 20.190.160.65
  • 20.190.160.4
  • 40.126.32.134
whitelisted
arc.msn.com
  • 20.223.36.55
  • 20.199.58.43
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
  • 2603:1030:7::106
whitelisted
198.187.3.20.in-addr.arpa
  • —
unknown
6.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown

Threats

PID
Process
Class
Message
5260
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5260
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
3620
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
6564
iexplore.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
6564
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
6564
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5332
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5332
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
3364
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2019-07-08-Ursnif-binary-retrieved-by-Word-macro.exe