analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

answers

Full analysis: https://app.any.run/tasks/00cc8c09-804f-4555-8b7a-9253b0cb30fe
Verdict: Malicious activity
Analysis date: February 22, 2020, 00:54:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/html
File info: HTML document, UTF-8 Unicode text, with very long lines
MD5:

5BA1D905D8F8DEC624A643B0D883F17F

SHA1:

FB6D67D374090627B23F35CCB86D55424E45BB2B

SHA256:

0BD113F9C86C51B223FFDE70AB1FD983E621F591772A9F65C263540D877F0773

SSDEEP:

384:Gw51UFSxqdVvWCDvLUKELu4VYyDpzOe/8P49ovyR8uwFYCDCkCpCnTUIwu:GwFxqL4K/M/ptuvy2PX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Update.exe (PID: 3924)
      • Update.exe (PID: 256)
      • Squirrel.exe (PID: 1780)
      • Update.exe (PID: 3680)
      • Update.exe (PID: 2432)
      • Update.exe (PID: 1116)

    • Loads dropped or rewritten executable

      • Discord.exe (PID: 872)
      • Discord.exe (PID: 2544)
      • Discord.exe (PID: 3452)
      • Discord.exe (PID: 2960)
      • Discord.exe (PID: 3420)
      • Discord.exe (PID: 1412)
      • Discord.exe (PID: 2052)
      • Discord.exe (PID: 3156)
      • Discord.exe (PID: 2780)
      • Discord.exe (PID: 3880)
      • Discord.exe (PID: 3488)
      • Discord.exe (PID: 3584)
      • Discord.exe (PID: 3720)
      • Discord.exe (PID: 3036)
      • Discord.exe (PID: 2740)
      • Discord.exe (PID: 3192)

    • Changes the autorun value in the registry

      • reg.exe (PID: 2600)

  • SUSPICIOUS

    • Starts itself from another location

      • Update.exe (PID: 3924)

    • Executable content was dropped or overwritten

      • DiscordSetup.exe (PID: 3692)
      • Update.exe (PID: 3924)
      • Discord.exe (PID: 1412)

    • Creates files in the user directory

      • Update.exe (PID: 256)
      • Discord.exe (PID: 3452)
      • Discord.exe (PID: 1412)

    • Application launched itself

      • Discord.exe (PID: 2544)
      • Discord.exe (PID: 3452)
      • Discord.exe (PID: 3156)
      • Discord.exe (PID: 1412)
      • Discord.exe (PID: 2740)

    • Uses REG.EXE to modify Windows registry

      • Discord.exe (PID: 2544)

    • Modifies the open verb of a shell class

      • reg.exe (PID: 2576)

    • Creates a software uninstall entry

      • Update.exe (PID: 3924)

    • Reads Environment values

      • Update.exe (PID: 2432)
      • Update.exe (PID: 3680)
      • Update.exe (PID: 1116)

    • Starts CMD.EXE for commands execution

      • Discord.exe (PID: 3720)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 1712)
      • iexplore.exe (PID: 2676)
      • iexplore.exe (PID: 1852)

    • Changes internet zones settings

      • iexplore.exe (PID: 2676)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2676)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2536)
      • iexplore.exe (PID: 1712)
      • iexplore.exe (PID: 3868)
      • iexplore.exe (PID: 1852)

    • Application launched itself

      • iexplore.exe (PID: 2676)
      • iexplore.exe (PID: 3868)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1712)
      • iexplore.exe (PID: 3868)
      • iexplore.exe (PID: 2536)
      • iexplore.exe (PID: 1852)
      • iexplore.exe (PID: 2676)

    • Creates files in the user directory

      • iexplore.exe (PID: 2676)
      • iexplore.exe (PID: 1712)
      • iexplore.exe (PID: 1852)

    • Reads the hosts file

      • Discord.exe (PID: 2544)
      • Discord.exe (PID: 3452)
      • Discord.exe (PID: 1412)
      • Discord.exe (PID: 2740)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 1712)
      • iexplore.exe (PID: 1852)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2536)
      • iexplore.exe (PID: 3868)
      • iexplore.exe (PID: 2676)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3868)
      • iexplore.exe (PID: 2676)
      • iexplore.exe (PID: 2536)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.htm/html | HyperText Markup Language with DOCTYPE (80.6)
.html | HyperText Markup Language (19.3)

EXIF

HTML

viewport: width=device-width, initial-scale=1
ContentType: text/html; charset=utf-8
Title: IANA — Common questions regarding abuse issues
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
79
Monitored processes
35
Malicious processes
9
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start iexplore.exe iexplore.exe iexplore.exe iexplore.exe discordsetup.exe update.exe squirrel.exe no specs discord.exe no specs update.exe no specs discord.exe no specs reg.exe reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs discord.exe discord.exe no specs discord.exe no specs update.exe discord.exe no specs update.exe discord.exe no specs discord.exe discord.exe no specs discord.exe no specs update.exe discord.exe no specs discord.exe discord.exe no specs discord.exe no specs cmd.exe no specs iexplore.exe discord.exe no specs discord.exe no specs discord.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2676"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\answers.htmC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3868"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2676 CREDAT:144385 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
1712"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2676 CREDAT:333057 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2536"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2676 CREDAT:144390 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3692"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\DiscordSetup.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\DiscordSetup.exe
iexplore.exe
User:
admin
Company:
Discord Inc.
Integrity Level:
MEDIUM
Description:
Discord - https://discordapp.com/
Exit code:
0
Version:
0.0.305
3924"C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe" --install . C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe
DiscordSetup.exe
User:
admin
Company:
GitHub
Integrity Level:
MEDIUM
Description:
Update
Exit code:
0
Version:
1.1.1.0
1780"C:\Users\admin\AppData\Local\Discord\app-0.0.305\Squirrel.exe" --updateSelf=C:\Users\admin\AppData\Local\SquirrelTemp\Update.exeC:\Users\admin\AppData\Local\Discord\app-0.0.305\Squirrel.exe—Update.exe
User:
admin
Company:
GitHub
Integrity Level:
MEDIUM
Description:
Update
Exit code:
4294967295
Version:
1.1.1.0
2544"C:\Users\admin\AppData\Local\Discord\app-0.0.305\Discord.exe" --squirrel-install 0.0.305C:\Users\admin\AppData\Local\Discord\app-0.0.305\Discord.exe—Update.exe
User:
admin
Company:
Discord Inc.
Integrity Level:
MEDIUM
Description:
Discord
Exit code:
0
Version:
0.0.305
256C:\Users\admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\admin\AppData\Local\Discord\app.icoC:\Users\admin\AppData\Local\Discord\Update.exe—Discord.exe
User:
admin
Company:
GitHub
Integrity Level:
MEDIUM
Description:
Update
Exit code:
0
Version:
1.1.1.0
872"C:\Users\admin\AppData\Local\Discord\app-0.0.305\Discord.exe" --type=gpu-process --enable-features=SharedArrayBuffer --no-sandbox --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=4259354444907474087 --mojo-platform-channel-handle=1088 /prefetch:2C:\Users\admin\AppData\Local\Discord\app-0.0.305\Discord.exe—Discord.exe
User:
admin
Company:
Discord Inc.
Integrity Level:
MEDIUM
Description:
Discord
Exit code:
0
Version:
0.0.305
Total events
16 942
Read events
3 737
Write events
0
Delete events
0

Modification events

No data
Executable files
36
Suspicious files
485
Text files
1 499
Unknown types
243

Dropped files

PID
Process
Filename
Type
2676iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF7B6CAAE403F9130B.TMP —
MD5:—
SHA256:—
2676iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
1712iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\6ZEQR2R1.txt —
MD5:—
SHA256:—
1712iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\4JAHJFGH.txt —
MD5:—
SHA256:—
1712iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\WQ45PFBG.txt —
MD5:—
SHA256:—
1712iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\D6T40UBX.txt —
MD5:—
SHA256:—
1712iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\NNWGU9U4.txt —
MD5:—
SHA256:—
1712iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\FUARK0PK.txt —
MD5:—
SHA256:—
1712iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\3baa9af7[1].jstext
MD5:D5805F38EF0C0CAEF75335C76B3AB956
SHA256:AA8D1BA07437497F4A5867F87C78634C0EB19EE493DC6960C055452671997AE8
1712iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\SharedSpriteDesktop_2x_090619[1].pngimage
MD5:24D31D90FAFE1A921D1BDA84DA894642
SHA256:47A9FF55F2401A1AC3F5EEFF473CA16E3CD0D30F81F9249E9E6B02AC7F6B1F1B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
323
TCP/UDP connections
473
DNS requests
170
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1712
iexplore.exe
GET
—
13.107.5.80:80
http://api.bing.com/qsml.aspx?query=disco&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IE11SS&market=en-US
US
—
—
whitelisted
1712
iexplore.exe
GET
—
13.107.5.80:80
http://api.bing.com/qsml.aspx?query=discor&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IE11SS&market=en-US
US
—
—
whitelisted
1712
iexplore.exe
GET
—
13.107.5.80:80
http://api.bing.com/qsml.aspx?query=discord&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IE11SS&market=en-US
US
—
—
whitelisted
1712
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rs/2Z/28/cj,nj/3f1e2270/f8c6dd44.js
US
text
773 b
whitelisted
1712
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rb/5g/cj,nj/e3ca6b81/a77c5ed0.js?bu=Erkg2CCEIIcgnQWeIKAg6SCiIMsgpSDVIJUh3SC-H88ezR7BHw
US
text
5.42 Kb
whitelisted
1712
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rs/3P/p2/cj,nj/1beceeda/3baa9af7.js
US
text
425 b
whitelisted
2676
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
1712
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rb/15/cj,nj/1a10eb03/af615ab8.js?bu=DiovZHB4c21naq8BsQEvnAEv
US
text
7.65 Kb
whitelisted
1712
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/sa/simg/SharedSpriteDesktop_2x_090619.png
US
image
11.2 Kb
whitelisted
1712
iexplore.exe
POST
204
204.79.197.200:80
http://www.bing.com/fd/ls/lsp.aspx?
US
image
11.2 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1712
iexplore.exe
13.107.5.80:80
api.bing.com
Microsoft Corporation
US
whitelisted
1712
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2676
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
1712
iexplore.exe
72.21.91.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1712
iexplore.exe
40.90.137.127:443
login.live.com
Microsoft Corporation
US
unknown
1712
iexplore.exe
40.126.1.136:443
login.microsoftonline.com
Microsoft Corporation
US
unknown
1712
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
1712
iexplore.exe
162.159.134.233:443
discordapp.com
Cloudflare Inc
—
shared
1712
iexplore.exe
2.16.106.113:80
a4.bing.com
Akamai International B.V.
—
whitelisted
1712
iexplore.exe
13.107.3.254:80
8aecaa58dd00fa0bf761e82f4d2c62b9.clo.footprintdns.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
login.microsoftonline.com
  • 40.126.1.136
  • 40.126.1.138
  • 40.126.1.137
  • 40.126.1.141
  • 20.190.129.162
whitelisted
login.live.com
  • 40.90.137.127
  • 40.90.137.124
  • 40.90.137.120
whitelisted
ocsp.digicert.com
  • 72.21.91.29
whitelisted
ocsp.msocsp.com
  • 104.18.24.243
  • 104.18.25.243
whitelisted
a4.bing.com
  • 2.16.106.113
  • 2.16.106.96
whitelisted
d2de9f6f639263daf26ec8cf66682f85.clo.footprintdns.com
  • 104.211.224.23
unknown
www2.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
8aecaa58dd00fa0bf761e82f4d2c62b9.clo.footprintdns.com
  • 13.107.3.254
suspicious

Threats

PID
Process
Class
Message
1712
iexplore.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
Process
Message
DiscordSetup.exe
Start up installer:
DiscordSetup.exe
Elevated process: ?
DiscordSetup.exe
Want standard install
Discord.exe
[3488:3540:0222/005638.602:VERBOSE1:crash_service_main.cc(81)] Session start. cmdline is [--reporter-url=https://sentry.io/api/146342/minidump/?sentry_key=384ce4413de74fe0be270abe03b2b35a --application-name=Discord "--crashes-directory=C:\Users\admin\AppData\Local\Temp\Discord Crashes" --v=1]
Discord.exe
[3488:3540:0222/005638.603:VERBOSE1:crash_service.cc(147)] window handle is 00140224
Discord.exe
[3488:3540:0222/005638.603:VERBOSE1:crash_service.cc(275)] pipe name is \\.\pipe\Discord Crash Service dumps at C:\Users\admin\AppData\Local\Temp\Discord Crashes
Discord.exe
[3488:3540:0222/005638.603:VERBOSE1:crash_service.cc(279)] checkpoint is C:\Users\admin\AppData\Local\Temp\Discord Crashes\crash_checkpoint.txt server is https://sentry.io/api/146342/minidump/?sentry_key=384ce4413de74fe0be270abe03b2b35a maximum 128 reports/day reporter is electron-crash-service
Discord.exe
[3488:3540:0222/005638.603:VERBOSE1:crash_service_main.cc(95)] Ready to process crash requests
Discord.exe
[3488:2872:0222/005638.604:VERBOSE1:crash_service.cc(309)] client start. pid = 1412
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
answers