File name:

Capture.PNG

Full analysis: https://app.any.run/tasks/61877b59-e315-4637-abe7-143e8f229790
Verdict: Malicious activity
Analysis date: January 10, 2025, 20:34:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
qrcode
phishing
phish-url
mamba
43
MIME: image/png
File info: PNG image data, 948 x 479, 8-bit/color RGBA, non-interlaced
MD5:

94047FBBC1FA5AB15837FBA585B64812

SHA1:

FD607E827B9FAF22421E3B0C168CC72A16E9CF25

SHA256:

0C107102E33E1E55874B34A3B19DEFCFF14AA4CDBA92E599DFFA7A367F067DC2

SSDEEP:

3072:ug4+6L0GI4TLUVQ2LSiaEvaWx3FwEbJcbLEiMJr2RwvEk+k:ug4tCKoVVLS0vtx3FwgJcbLOJSR4N

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Suspicious URL found

      • explorer.exe (PID: 6148)
    • QR code contains URL with email

      • explorer.exe (PID: 6148)
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 6148)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.png | Portable Network Graphics (100)

EXIF

Composite

Megapixels: 0.454
ImageSize: 948x479

PNG

PixelUnits: meters
PixelsPerUnitY: 3779
PixelsPerUnitX: 3779
Gamma: 2.2
SRGBRendering: Perceptual
Interlace: Noninterlaced
Filter: Adaptive
Compression: Deflate/Inflate
ColorType: RGB with Alpha
BitDepth: 8
ImageHeight: 479
ImageWidth: 948
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start explorer.exe no specs explorer.exe no specs msedge.exe

Process information

PID
CMD
Path
Indicators
Parent process
6148"C:\Windows\explorer.exe" "https://htbilisim.com/m/?c3Y9bzM2NV8xX3NwJnJhbmQ9V2tVNWFuWT0mdWlkPVVTRVIwNjAxMjAyNVUwMzAxMDYzOQ==N0123N#[email protected]"C:\Windows\explorer.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\twinapi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
6344C:\WINDOWS\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
6632"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2584 --field-trial-handle=2432,i,5294958257231485215,1453246571413011409,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Total events
131
Read events
131
Write events
0
Delete events
0

Modification events

No data
Executable files
25
Suspicious files
30
Text files
19
Unknown types
0

Dropped files

PID
Process
Filename
Type
6632msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reportsini
MD5:D751713988987E9331980363E24189CE
SHA256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
6632msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6e8f354d-9c9f-4e37-9972-ee372eac6cf2.tmpini
MD5:D751713988987E9331980363E24189CE
SHA256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
6632msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF1365d2.TMPini
MD5:D751713988987E9331980363E24189CE
SHA256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
6632msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00025dimage
MD5:54BAE8FD03E88339FD15443DF63FE098
SHA256:EA931B34A8611C2FA7194F3329F46759DD18D60FCB59E157D203FF1C845445F3
6632msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00025ftext
MD5:259A0AF98559C142A56D398E7922C5D8
SHA256:CE1F580E31FA18412D11C859F2172AFC13EF07BB2BBDB654E626AD94EBB4E207
6632msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00025bimage
MD5:46E5A58F1866AE3C7D8A35AA3C7EE45F
SHA256:E906B20BD1028C6AEA3F81C736AF90F0C253E7DD581BC35C650DE8562A75A973
6632msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\65e8cebe-d48a-4be0-80e4-913da27c3d41.tmpini
MD5:D751713988987E9331980363E24189CE
SHA256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
6632msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF135e7f.TMPini
MD5:D751713988987E9331980363E24189CE
SHA256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
6632msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionariesbinary
MD5:20D4B8FA017A12A108C87F540836E250
SHA256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
6632msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a7fe6b26-fe8b-436d-9155-46555c1d6c2d.tmpbinary
MD5:20D4B8FA017A12A108C87F540836E250
SHA256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
101
DNS requests
105
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3488
RUXIMICS.exe
GET
200
104.107.161.181:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
200
104.107.161.181:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
GET
200
104.107.161.181:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
200
2.21.245.134:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
200
2.21.245.134:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
3488
RUXIMICS.exe
GET
200
2.21.245.134:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3488
RUXIMICS.exe
4.231.128.59:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
whitelisted
2.21.133.179:443
www.bing.com
Akamai International B.V.
DE
whitelisted
2.21.245.134:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
3488
RUXIMICS.exe
2.21.245.134:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
104.107.161.181:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3488
RUXIMICS.exe
104.107.161.181:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
4.231.128.59:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
192.168.100.255:138
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
www.bing.com
  • 2.21.133.179
whitelisted
crl.microsoft.com
  • 2.21.245.134
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.microsoft.com
  • 104.107.161.181
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
htbilisim.com
  • 213.238.180.143
unknown
edge.microsoft.com
  • 204.79.197.239
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.44
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted

Threats

PID
Process
Class
Message
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Suspected Mamba2FA`s Phishing-Kit domain by CrossDomain (htbilisim .com)
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Suspected Mamba2FA`s Phishing-Kit domain by CrossDomain (htbilisim .com)
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Suspected Mamba2FA`s Phishing-Kit domain by CrossDomain (htbilisim .com)
No debug info