analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Siriciuos Protector.rar

Full analysis: https://app.any.run/tasks/6c7d921d-73b6-4187-8e96-d7788b321702
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: August 04, 2024, 22:21:23
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
telegram
sheetrat
rat
ip-check
wmi-base64
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

8E4F4810E653B7C6ABEAE16033F0BCE3

SHA1:

050A873F90AD985408062660B8BB522D96BE9D22

SHA256:

0B676772A37C09B439E13F94851BB77C02CEFA2732C622FDC56B5328186887A6

SSDEEP:

98304:6mMrqjKTz/zF6jgo3uS7rTYBSZzsWSekSHVMzNJrTMPkSS7wzlkvBrk7JmU1PSYS:zis8wo8IRZqgjV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • SHEETRAT has been detected (YARA)

      • Siriciuos Protectorcrck.exe (PID: 1964)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Siriciuos Protectorcrck.exe (PID: 1964)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 6480)

    • Reads the BIOS version

      • Siriciuos Protectorcrck.exe (PID: 1964)

    • The process checks if it is being run in the virtual environment

      • Siriciuos Protectorcrck.exe (PID: 1964)

    • Read disk information to detect sandboxing environments

      • Siriciuos Protectorcrck.exe (PID: 1964)

    • There is functionality for capture public ip (YARA)

      • Siriciuos Protectorcrck.exe (PID: 1964)

    • There is functionality for taking screenshot (YARA)

      • Siriciuos Protectorcrck.exe (PID: 1964)

  • INFO

    • Checks supported languages

      • Siriciuos Protectorcrck.exe (PID: 1964)
      • identity_helper.exe (PID: 7800)

    • Reads Microsoft Office registry keys

      • Siriciuos Protectorcrck.exe (PID: 1964)
      • msedge.exe (PID: 4160)

    • Reads the computer name

      • Siriciuos Protectorcrck.exe (PID: 1964)
      • identity_helper.exe (PID: 7800)

    • Reads the machine GUID from the registry

      • Siriciuos Protectorcrck.exe (PID: 1964)

    • Manual execution by a user

      • Siriciuos Protectorcrck.exe (PID: 1964)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6480)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 6480)

    • Application launched itself

      • msedge.exe (PID: 4160)

    • Attempting to use instant messaging service

      • msedge.exe (PID: 2508)

    • Reads Environment values

      • identity_helper.exe (PID: 7800)

    • Found Base64 encoded reference to WMI classes (YARA)

      • Siriciuos Protectorcrck.exe (PID: 1964)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
173
Monitored processes
43
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs #SHEETRAT siriciuos protectorcrck.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6480"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Siriciuos Protector.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
188C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1964"C:\Users\admin\Desktop\Siriciuos Protector\Siriciuos Protectorcrck.exe" C:\Users\admin\Desktop\Siriciuos Protector\Siriciuos Protectorcrck.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Siriciuos Protector
Version:
5.0.0.0
Modules
Images
c:\users\admin\desktop\siriciuos protector\siriciuos protectorcrck.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4160"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/privreversingC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Siriciuos Protectorcrck.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
4692"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x31c,0x320,0x324,0x24c,0x32c,0x7fffce435fd8,0x7fffce435fe4,0x7fffce435ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3908"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2332 --field-trial-handle=2336,i,12012918345813891128,6341329900184066153,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2508"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2512 --field-trial-handle=2336,i,12012918345813891128,6341329900184066153,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2336"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2536 --field-trial-handle=2336,i,12012918345813891128,6341329900184066153,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
6212"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3352 --field-trial-handle=2336,i,12012918345813891128,6341329900184066153,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6392"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3688 --field-trial-handle=2336,i,12012918345813891128,6341329900184066153,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
18 287
Read events
18 189
Write events
95
Delete events
3

Modification events

(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Siriciuos Protector.rar
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6480) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(1964) Siriciuos Protectorcrck.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
Executable files
13
Suspicious files
81
Text files
83
Unknown types
0

Dropped files

PID
Process
Filename
Type
6480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6480.41062\Siriciuos Protector\Guna.UI2.dllexecutable
MD5:F2152FE97A30C659A305AEA511CDDADD
SHA256:85679D122DD4CC738FD8B4DE3929CA42C1169AC6CD7618323DCA382E206D751A
6480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6480.41062\Siriciuos Protector\Icons\telegram channel.txttext
MD5:4FFFF471D9B44057E1C39473C5F939B4
SHA256:9008E2D8C8DC3B318B04C248E4405E0E1CA3BA5F41CBF5DB7071386BFE866DE1
6480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6480.41062\Siriciuos Protector\Siriciuos Protector-embed.pdbbinary
MD5:2CE8B7F7106FC9ED22E5AA8FB23CEFB6
SHA256:54F0CEE069F3F682335229BC6B4BE722C9AC1333CF5247D1DDB5F84FAE4D8FC6
6480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6480.41062\Siriciuos Protector\Siriciuos Protector.exe.configxml
MD5:BF7EA66AFB114C9C3A6EC06B8A6D5812
SHA256:D1D931D549429C624638972F7C1D8E885E22713826D3C5C836982BA0E4BCF722
6480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6480.41062\Siriciuos Protector\IconExtractor.dllexecutable
MD5:640D8FFA779C6DD5252A262E440C66C0
SHA256:440912D85D2F98BB4F508AB82847067C18E1E15BE0D8ECDCFF0CC19327527FC2
6480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6480.41062\Siriciuos Protector\Icons\icon (5).icoimage
MD5:9DBDD6972E129D31568661A89C81D8F9
SHA256:45C85BDAAF0E0C30678D8D77E2585871EA6D1298EE0D30037745BACEA6338484
6480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6480.41062\Siriciuos Protector\Siriciuos Protector.configxml
MD5:31AA4A5DAA3448567FD71E02090C8164
SHA256:5CC2011509324FB19B9E4977CCD5956007F70ADD23F87D4B41C53ED13CCC8F02
6480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6480.41062\Siriciuos Protector\Icons\icon (8).icoimage
MD5:AF1739A9B1A1BF72E7072AD9551C6EEA
SHA256:A65CBBDC2CA671A9EDD7EDAC0C6737B3B116E357727E003E5FDEFF163C6C21AB
6480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6480.41062\Siriciuos Protector\Icons\Stub.vbtext
MD5:A38B90C3B9C00937224D9C28116A7BF4
SHA256:A5328CB8F71DFE613D96D84C3132D151A54D9232C51D154F6D215EACFB9A896B
6480WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6480.41062\Siriciuos Protector\Icons\icon (10).icoimage
MD5:AD1740CB3317527AA1ACAE6E7440311E
SHA256:7A97547954AAAD629B0563CC78BCA75E3339E8408B70DA2ED67FA73B4935D878
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
67
DNS requests
57
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8128
svchost.exe
HEAD
200
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0b8df384-7776-4d34-92b7-bfc968353145?P1=1723182532&P2=404&P3=2&P4=Abf0xGmdpDfOspwjMPQrbJe%2bNG%2bD1pEFuXWPpzznAsOWS1o94hNm8Z5qfNucNh58Zi2pd305IuZ3tmvn8u0kmg%3d%3d
unknown
—
—
unknown
8128
svchost.exe
GET
206
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/369e8e41-5ce3-4eb8-9826-427d58ae27b0?P1=1723182532&P2=404&P3=2&P4=gXZMG2mweBQ34HMGnUJPbuTBRgxd0u3tYBWm1ucBnpPGcZoT1hg37yAOt1G02h%2fQW5F7lK1lm7E0qqYR%2fSFl1w%3d%3d
unknown
—
—
unknown
8128
svchost.exe
GET
206
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9a2e7003-81ba-4c4b-8085-4e4c3d107325?P1=1723361699&P2=404&P3=2&P4=CDoLmE5p%2bi7ptHMRSC8s6PLO0Z3vStHWHdfp6Q%2f%2fzsjY5A%2bJghQNcfLml%2bB8%2bRibyt%2fNLMaCEv3wjC1djMtefA%3d%3d
unknown
—
—
unknown
8128
svchost.exe
GET
206
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0b8df384-7776-4d34-92b7-bfc968353145?P1=1723182532&P2=404&P3=2&P4=Abf0xGmdpDfOspwjMPQrbJe%2bNG%2bD1pEFuXWPpzznAsOWS1o94hNm8Z5qfNucNh58Zi2pd305IuZ3tmvn8u0kmg%3d%3d
unknown
—
—
unknown
4920
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
unknown
6816
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
8128
svchost.exe
HEAD
200
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/138c8f92-04c4-4a90-889e-e5bcd7ecdef9?P1=1723401319&P2=404&P3=2&P4=YOhxpJq62QqZ9EKp9k7MIXCCnjNeBouSbs%2f9B4gtTZAgubMYTaoIuhGN1irf%2bYltIe0NHSwXg8igvH43MplWbg%3d%3d
unknown
—
—
unknown
8128
svchost.exe
HEAD
200
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/369e8e41-5ce3-4eb8-9826-427d58ae27b0?P1=1723182532&P2=404&P3=2&P4=gXZMG2mweBQ34HMGnUJPbuTBRgxd0u3tYBWm1ucBnpPGcZoT1hg37yAOt1G02h%2fQW5F7lK1lm7E0qqYR%2fSFl1w%3d%3d
unknown
—
—
unknown
8128
svchost.exe
GET
206
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0b8df384-7776-4d34-92b7-bfc968353145?P1=1723182532&P2=404&P3=2&P4=Abf0xGmdpDfOspwjMPQrbJe%2bNG%2bD1pEFuXWPpzznAsOWS1o94hNm8Z5qfNucNh58Zi2pd305IuZ3tmvn8u0kmg%3d%3d
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4056
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1248
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
5336
SearchApp.exe
2.23.209.187:443
www.bing.com
Akamai International B.V.
GB
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4920
svchost.exe
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.206
whitelisted
www.bing.com
  • 2.23.209.187
  • 2.23.209.179
  • 2.23.209.189
  • 2.23.209.182
  • 2.23.209.149
  • 2.23.209.140
  • 2.23.209.185
  • 2.23.209.133
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.159.68
  • 40.126.31.69
  • 20.190.159.64
  • 20.190.159.4
  • 40.126.31.67
  • 40.126.31.73
  • 20.190.159.0
  • 20.190.159.2
whitelisted
th.bing.com
  • 2.23.209.140
  • 2.23.209.185
  • 2.23.209.179
  • 2.23.209.182
  • 2.23.209.187
  • 2.23.209.189
  • 2.23.209.149
  • 2.23.209.133
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

PID
Process
Class
Message
2508
msedge.exe
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Siriciuos Protector.rar