analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

answers

Full analysis: https://app.any.run/tasks/c7a89b18-0b56-45d6-ba84-96a56973f73e
Verdict: Malicious activity
Analysis date: February 22, 2020, 01:00:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/html
File info: HTML document, UTF-8 Unicode text, with very long lines
MD5:

5BA1D905D8F8DEC624A643B0D883F17F

SHA1:

FB6D67D374090627B23F35CCB86D55424E45BB2B

SHA256:

0BD113F9C86C51B223FFDE70AB1FD983E621F591772A9F65C263540D877F0773

SSDEEP:

384:Gw51UFSxqdVvWCDvLUKELu4VYyDpzOe/8P49ovyR8uwFYCDCkCpCnTUIwu:GwFxqL4K/M/ptuvy2PX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • Discord.exe (PID: 2592)
      • Discord.exe (PID: 3832)
      • Discord.exe (PID: 2512)
      • Discord.exe (PID: 2648)
      • Discord.exe (PID: 3344)
      • Discord.exe (PID: 3732)
      • Discord.exe (PID: 604)
      • Discord.exe (PID: 3920)
      • Discord.exe (PID: 2792)
      • Discord.exe (PID: 4020)
      • Discord.exe (PID: 2824)
      • Discord.exe (PID: 2696)
      • Discord.exe (PID: 2388)
      • Discord.exe (PID: 280)
      • Discord.exe (PID: 2740)
      • Discord.exe (PID: 3796)

    • Application was dropped or rewritten from another process

      • Update.exe (PID: 3012)
      • Squirrel.exe (PID: 2452)
      • Update.exe (PID: 2288)
      • Update.exe (PID: 1900)
      • Update.exe (PID: 620)
      • Update.exe (PID: 2012)

    • Changes the autorun value in the registry

      • reg.exe (PID: 3240)

  • SUSPICIOUS

    • Starts itself from another location

      • Update.exe (PID: 3012)

    • Executable content was dropped or overwritten

      • DiscordSetup.exe (PID: 3440)
      • Update.exe (PID: 3012)
      • Discord.exe (PID: 604)

    • Application launched itself

      • Discord.exe (PID: 2592)
      • Discord.exe (PID: 2512)
      • Discord.exe (PID: 3920)
      • Discord.exe (PID: 604)
      • Discord.exe (PID: 2740)

    • Creates files in the user directory

      • Update.exe (PID: 2288)
      • Discord.exe (PID: 2512)
      • Discord.exe (PID: 604)

    • Uses REG.EXE to modify Windows registry

      • Discord.exe (PID: 2592)

    • Modifies the open verb of a shell class

      • reg.exe (PID: 2432)

    • Creates a software uninstall entry

      • Update.exe (PID: 3012)

    • Reads Environment values

      • Update.exe (PID: 1900)
      • Update.exe (PID: 620)
      • Update.exe (PID: 2012)

    • Starts CMD.EXE for commands execution

      • Discord.exe (PID: 2824)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3200)
      • iexplore.exe (PID: 3756)
      • iexplore.exe (PID: 3408)
      • iexplore.exe (PID: 3552)

    • Application launched itself

      • iexplore.exe (PID: 2844)
      • iexplore.exe (PID: 3200)

    • Changes internet zones settings

      • iexplore.exe (PID: 3200)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2844)
      • iexplore.exe (PID: 3756)
      • iexplore.exe (PID: 3408)
      • iexplore.exe (PID: 3552)

    • Creates files in the user directory

      • iexplore.exe (PID: 3756)
      • iexplore.exe (PID: 3200)
      • iexplore.exe (PID: 3408)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3200)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2844)
      • iexplore.exe (PID: 3756)
      • iexplore.exe (PID: 3200)
      • Update.exe (PID: 2012)
      • iexplore.exe (PID: 3552)
      • iexplore.exe (PID: 3408)

    • Reads the hosts file

      • Discord.exe (PID: 2592)
      • Discord.exe (PID: 2512)
      • Discord.exe (PID: 604)
      • Discord.exe (PID: 2740)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 3408)
      • iexplore.exe (PID: 3552)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2844)
      • iexplore.exe (PID: 3200)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2844)
      • iexplore.exe (PID: 3200)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.htm/html | HyperText Markup Language with DOCTYPE (80.6)
.html | HyperText Markup Language (19.3)

EXIF

HTML

Title: IANA — Common questions regarding abuse issues
ContentType: text/html; charset=utf-8
viewport: width=device-width, initial-scale=1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
82
Monitored processes
35
Malicious processes
8
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start iexplore.exe iexplore.exe iexplore.exe discordsetup.exe update.exe squirrel.exe no specs discord.exe no specs update.exe no specs discord.exe no specs reg.exe reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs discord.exe discord.exe no specs discord.exe no specs update.exe discord.exe no specs iexplore.exe discord.exe no specs discord.exe discord.exe no specs discord.exe no specs update.exe discord.exe no specs discord.exe discord.exe no specs discord.exe no specs update.exe cmd.exe no specs iexplore.exe discord.exe no specs discord.exe no specs discord.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3200"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\answers.htmC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2844"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3200 CREDAT:144385 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3756"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3200 CREDAT:333057 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3440"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\DiscordSetup.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\DiscordSetup.exe
iexplore.exe
User:
admin
Company:
Discord Inc.
Integrity Level:
MEDIUM
Description:
Discord - https://discordapp.com/
Exit code:
0
Version:
0.0.305
3012"C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe" --install . C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe
DiscordSetup.exe
User:
admin
Company:
GitHub
Integrity Level:
MEDIUM
Description:
Update
Exit code:
0
Version:
1.1.1.0
2452"C:\Users\admin\AppData\Local\Discord\app-0.0.305\Squirrel.exe" --updateSelf=C:\Users\admin\AppData\Local\SquirrelTemp\Update.exeC:\Users\admin\AppData\Local\Discord\app-0.0.305\Squirrel.exe—Update.exe
User:
admin
Company:
GitHub
Integrity Level:
MEDIUM
Description:
Update
Exit code:
4294967295
Version:
1.1.1.0
2592"C:\Users\admin\AppData\Local\Discord\app-0.0.305\Discord.exe" --squirrel-install 0.0.305C:\Users\admin\AppData\Local\Discord\app-0.0.305\Discord.exe—Update.exe
User:
admin
Company:
Discord Inc.
Integrity Level:
MEDIUM
Description:
Discord
Exit code:
0
Version:
0.0.305
2288C:\Users\admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\admin\AppData\Local\Discord\app.icoC:\Users\admin\AppData\Local\Discord\Update.exe—Discord.exe
User:
admin
Company:
GitHub
Integrity Level:
MEDIUM
Description:
Update
Exit code:
0
Version:
1.1.1.0
3832"C:\Users\admin\AppData\Local\Discord\app-0.0.305\Discord.exe" --type=gpu-process --enable-features=SharedArrayBuffer --no-sandbox --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=3382102711336408495 --mojo-platform-channel-handle=1076 /prefetch:2C:\Users\admin\AppData\Local\Discord\app-0.0.305\Discord.exe—Discord.exe
User:
admin
Company:
Discord Inc.
Integrity Level:
MEDIUM
Description:
Discord
Exit code:
0
Version:
0.0.305
3240C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d C:\Users\admin\AppData\Local\Discord\app-0.0.305\Discord.exe /fC:\Windows\System32\reg.exe
Discord.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
13 497
Read events
3 671
Write events
0
Delete events
0

Modification events

No data
Executable files
36
Suspicious files
98
Text files
1 079
Unknown types
43

Dropped files

PID
Process
Filename
Type
3200iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3756iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\1S965QKO.txt —
MD5:—
SHA256:—
3756iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\YXVGUWSS.txt —
MD5:—
SHA256:—
3756iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\1GGROQ6I.txt —
MD5:—
SHA256:—
3756iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\I1SGHVL0.txt —
MD5:—
SHA256:—
3756iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\YNFN3F8O.txt —
MD5:—
SHA256:—
3756iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\EF344GE5.txt —
MD5:—
SHA256:—
3756iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\SharedSpriteDesktop_2x_090619[1].pngimage
MD5:24D31D90FAFE1A921D1BDA84DA894642
SHA256:47A9FF55F2401A1AC3F5EEFF473CA16E3CD0D30F81F9249E9E6B02AC7F6B1F1B
3756iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\a77c5ed0[1].jstext
MD5:7E7883B569182478D56A6FB1A1A63E3D
SHA256:957198FC98947B366440E2D6A335B1BE45BBFE2A24E1AA5EC11E5D48D546C05F
3200iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\imagestore\f7ruq93\imagestore.datbinary
MD5:2B0C98EF3CB68FA430D67F526B7194FC
SHA256:EA74AA7E690B567391CBB6BB315ED4FE0F902C43CC6BDA2B20E02C39609651C6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
116
TCP/UDP connections
145
DNS requests
59
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3756
iexplore.exe
GET
—
13.107.5.80:80
http://api.bing.com/qsml.aspx?query=discor&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IE11SS&market=en-US
US
—
—
whitelisted
3756
iexplore.exe
GET
—
13.107.5.80:80
http://api.bing.com/qsml.aspx?query=disco&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IE11SS&market=en-US
US
—
—
whitelisted
3756
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rs/47/A/cj,nj/64cc4a49/e70a8ff8.js
US
text
354 b
whitelisted
3200
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
3756
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/search?q=discord&src=IE-TopResult&FORM=IE11TR&conversationid=
US
html
37.6 Kb
whitelisted
3756
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rb/5g/cj,nj/e3ca6b81/a77c5ed0.js?bu=Erkg2CCEIIcgnQWeIKAg6SCiIMsgpSDVIJUh3SC-H88ezR7BHw
US
text
5.42 Kb
whitelisted
3756
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rb/15/cj,nj/1a10eb03/af615ab8.js?bu=DiovZHB4c21naq8BsQEvnAEv
US
text
7.65 Kb
whitelisted
3756
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rs/2Z/2g/cj,nj/4c7364c5/40e1b425.js
US
text
816 b
whitelisted
3756
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rs/2Z/2M/cj,nj/93002ee5/ce33b6aa.js
US
text
177 b
whitelisted
3756
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rs/2Z/28/cj,nj/3f1e2270/f8c6dd44.js
US
text
773 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3200
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3756
iexplore.exe
13.107.5.80:80
api.bing.com
Microsoft Corporation
US
whitelisted
3756
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3756
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3756
iexplore.exe
40.126.1.138:443
login.microsoftonline.com
Microsoft Corporation
US
unknown
3756
iexplore.exe
40.90.137.126:443
login.live.com
Microsoft Corporation
US
unknown
3756
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3756
iexplore.exe
104.18.25.243:80
ocsp.msocsp.com
Cloudflare Inc
US
shared
3756
iexplore.exe
162.159.129.233:443
discordapp.com
Cloudflare Inc
—
shared
3756
iexplore.exe
216.58.208.42:443
fonts.googleapis.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
login.microsoftonline.com
  • 40.126.1.138
  • 20.190.129.162
  • 40.126.1.137
  • 40.126.1.141
  • 40.126.1.136
whitelisted
login.live.com
  • 40.90.137.126
  • 40.90.23.247
  • 40.90.137.120
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ocsp.msocsp.com
  • 104.18.25.243
  • 104.18.24.243
whitelisted
www2.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
a4.bing.com
  • 2.16.106.113
  • 2.16.106.96
whitelisted
discordapp.com
  • 162.159.129.233
  • 162.159.135.233
  • 162.159.134.233
  • 162.159.130.233
  • 162.159.133.233
whitelisted
ocsp.trust-provider.com
  • 151.139.128.14
whitelisted

Threats

PID
Process
Class
Message
3756
iexplore.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
Process
Message
DiscordSetup.exe
Start up installer:
DiscordSetup.exe
Elevated process: ?
DiscordSetup.exe
Want standard install
Discord.exe
[280:676:0222/010228.947:VERBOSE1:crash_service_main.cc(81)] Session start. cmdline is [--reporter-url=https://sentry.io/api/146342/minidump/?sentry_key=384ce4413de74fe0be270abe03b2b35a --application-name=Discord "--crashes-directory=C:\Users\admin\AppData\Local\Temp\Discord Crashes" --v=1]
Discord.exe
[280:676:0222/010228.948:VERBOSE1:crash_service.cc(147)] window handle is 000602AE
Discord.exe
[280:676:0222/010228.948:VERBOSE1:crash_service.cc(275)] pipe name is \\.\pipe\Discord Crash Service dumps at C:\Users\admin\AppData\Local\Temp\Discord Crashes
Discord.exe
[280:676:0222/010228.948:VERBOSE1:crash_service.cc(279)] checkpoint is C:\Users\admin\AppData\Local\Temp\Discord Crashes\crash_checkpoint.txt server is https://sentry.io/api/146342/minidump/?sentry_key=384ce4413de74fe0be270abe03b2b35a maximum 128 reports/day reporter is electron-crash-service
Discord.exe
[280:676:0222/010228.948:VERBOSE1:crash_service_main.cc(95)] Ready to process crash requests
Discord.exe
[280:2628:0222/010228.949:VERBOSE1:crash_service.cc(309)] client start. pid = 604
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
answers