analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://gist.github.com/WitherOrNot/8ead32aede204b601f624ce7415a3289

Full analysis: https://app.any.run/tasks/311efe4c-dc35-4362-98c3-97285c9dc0e8
Verdict: Malicious activity
Analysis date: January 24, 2022, 22:14:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

085290318B8F951DFEECD6A59165A86D

SHA1:

EF474516CA8502F96C911CAB86847586E8248047

SHA256:

0D5B6DEEEDFE97DD2827F621144E2EDF2492E38273DBE42F245480566AAA9CF0

SSDEEP:

3:N8tMCMEdpNUXpBTTBnRWOn:21ME7i/Trhn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts CertUtil for decode files

      • cmd.exe (PID: 2572)
      • cmd.exe (PID: 2716)
      • cmd.exe (PID: 2896)

    • Application was dropped or rewritten from another process

      • installer.exe (PID: 2164)
      • installer.exe (PID: 3568)
      • installer.exe (PID: 1304)
      • installer.exe (PID: 3692)
      • installer.exe (PID: 3556)
      • installer.exe (PID: 2224)
      • installer.exe (PID: 3500)
      • installer.exe (PID: 3480)
      • installer.exe (PID: 4016)
      • installer.exe (PID: 956)
      • installer.exe (PID: 3148)
      • installer.exe (PID: 120)
      • installer.exe (PID: 3584)
      • installer.exe (PID: 3640)
      • installer.exe (PID: 1384)

    • Drops executable file immediately after starts

      • certutil.exe (PID: 2752)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3448)

    • Reads the computer name

      • WinRAR.exe (PID: 2764)
      • cmd.exe (PID: 2572)
      • cmd.exe (PID: 2716)
      • installer.exe (PID: 2224)
      • installer.exe (PID: 3148)
      • cmd.exe (PID: 2896)

    • Checks supported languages

      • cmd.exe (PID: 2572)
      • WinRAR.exe (PID: 2764)
      • installer.exe (PID: 1304)
      • cmd.exe (PID: 2716)
      • installer.exe (PID: 2224)
      • installer.exe (PID: 4016)
      • installer.exe (PID: 956)
      • installer.exe (PID: 3500)
      • installer.exe (PID: 120)
      • installer.exe (PID: 3148)
      • installer.exe (PID: 3480)
      • cmd.exe (PID: 2896)
      • installer.exe (PID: 1384)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 2764)

    • Executable content was dropped or overwritten

      • certutil.exe (PID: 2752)

    • Application launched itself

      • installer.exe (PID: 2224)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 3596)
      • iexplore.exe (PID: 3448)
      • certutil.exe (PID: 2752)
      • certutil.exe (PID: 2736)
      • certutil.exe (PID: 4052)

    • Checks supported languages

      • iexplore.exe (PID: 3596)
      • iexplore.exe (PID: 3448)
      • certutil.exe (PID: 2752)
      • certutil.exe (PID: 2736)
      • notepad.exe (PID: 2528)
      • certutil.exe (PID: 4052)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3448)
      • iexplore.exe (PID: 3596)

    • Application launched itself

      • iexplore.exe (PID: 3596)

    • Changes internet zones settings

      • iexplore.exe (PID: 3596)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3596)
      • iexplore.exe (PID: 3448)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3448)

    • Creates files in the user directory

      • iexplore.exe (PID: 3448)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3596)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
72
Monitored processes
25
Malicious processes
4
Suspicious processes
6

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe no specs cmd.exe no specs certutil.exe installer.exe no specs installer.exe no specs installer.exe cmd.exe no specs certutil.exe no specs installer.exe no specs installer.exe no specs installer.exe installer.exe no specs installer.exe no specs installer.exe no specs installer.exe no specs installer.exe no specs installer.exe no specs notepad.exe no specs cmd.exe no specs certutil.exe no specs installer.exe no specs installer.exe no specs installer.exe

Process information

PID
CMD
Path
Indicators
Parent process
3596"C:\Program Files\Internet Explorer\iexplore.exe" "https://gist.github.com/WitherOrNot/8ead32aede204b601f624ce7415a3289"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3448"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3596 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2764"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\8ead32aede204b601f624ce7415a3289-23af3482cef09738b5bcebdfa0572cd020bf9e90.zip"C:\Program Files\WinRAR\WinRAR.exe—iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2572C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$DIa2764.17614\memz.bat" "C:\Windows\system32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
2752certutil -decode c installer.exeC:\Windows\system32\certutil.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CertUtil.exe
Exit code:
0
Version:
6.1.7601.18151 (win7sp1_gdr.130512-1533)
Modules
Images
c:\windows\system32\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\certcli.dll
c:\windows\system32\atl.dll
2164installer.exe C:\Users\admin\Desktop\installer.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\installer.exe
c:\windows\system32\ntdll.dll
3692"C:\Users\admin\Desktop\installer.exe" C:\Users\admin\Desktop\installer.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\installer.exe
c:\windows\system32\ntdll.dll
1304"C:\Users\admin\Desktop\installer.exe" C:\Users\admin\Desktop\installer.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
2716C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$DIa2764.18476\memz.bat" "C:\Windows\system32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2736certutil -decode c installer.exeC:\Windows\system32\certutil.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CertUtil.exe
Exit code:
2147942480
Version:
6.1.7601.18151 (win7sp1_gdr.130512-1533)
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
Total events
15 870
Read events
15 656
Write events
214
Delete events
0

Modification events

(PID) Process:(3596) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3596) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3596) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30937455
(PID) Process:(3596) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3596) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30937455
(PID) Process:(3596) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3596) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3596) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3596) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3596) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
1
Suspicious files
13
Text files
29
Unknown types
5

Dropped files

PID
Process
Filename
Type
3448iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\light-764b98156fab6bcc984addf8d9ee6924[1].csstext
MD5:5AEA45CDC1C70BB203DF458BAECB4F45
SHA256:6F2CDD415F1D8FE4F9ED028A39CD920D5B86B7C9CEBB6AE76B70874179712348
3448iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2659C1A560AB92C9C29D4B2B25815AE8binary
MD5:BCFA160A54985DEF50D7ABD05D52C7D3
SHA256:74E7AEFAAFC59242DCC51D47F83F52FE616B7E6AF68779C280FBD127BDA04EFE
3596iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:FC990EAA7247546FB67C18916A4CAC9B
SHA256:294F5BE9159C87842AD3173FE7CDA168C9F2010C6D428085A8AC30EF436CA993
3448iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\26913821[1].jpgimage
MD5:6D5E53DF0FD88DCB896126392A068880
SHA256:D395E3887F55381DC81E3C5AC93191856B7366F611E59B01F80BD51CDCABC26D
3448iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:64C143B6BBFF348D99C351ACD311B4A6
SHA256:AA293E7E934B672FDC242299BC902B9268566ACB8A7840D907B4613C8E9768C8
3448iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\Y4EOIYBP.txttext
MD5:942BB904F2632EC449FBE52294991BEF
SHA256:33729FDBBEEFC1F095035F815529A4AED1688D25FC639FC6486A9D04FFFDEB88
3448iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\12B578593FDE07EC53D020B1D5DEBF3B_980AA3B36C864217D922EB19C07A691Abinary
MD5:7B15A12DC2BC8C37889EA26D638C00DE
SHA256:1E5B4C1D5A0EC22430B40936307ADEBC3E578E0A768CF63F4DB53E802C98DF5B
3448iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\behaviors-f5bfa4f3481e4a49c608cf8690c4df42[1].csstext
MD5:AF6CBA91A56F4F9371114396CD7A3FAA
SHA256:D0E38FE05AABD8E68D6D48CD19EEE4B2EED07F90B54363120A0341481FAAEE10
3448iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\8ead32aede204b601f624ce7415a3289[1].htmhtml
MD5:AB07E2B3D5A3B3703479FBDC8B25CE92
SHA256:038AABD2F1C5B0217BCB72E2E7477B06DA4B706A4685CA3BAAD451E471D053C6
3448iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04der
MD5:D28ABD46CE7943753EAE1C30E1657908
SHA256:9BA4774C75879EF9898314740B8AD3BDA009ECB3A3E2B1EA1F0DC579E11193D3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
33
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3448
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTGMlruL6P9M9B3if1rTM7wyj%2FQKQQUUGGmoNI1xBEqII0fD6xC8M0pz0sCEAFo1XXxzocorZWo8R7xWYs%3D
US
der
278 b
whitelisted
3448
iexplore.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl
US
der
592 b
whitelisted
3596
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3448
iexplore.exe
GET
—
67.27.233.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c6b966393682f9ed
US
—
—
whitelisted
3596
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3448
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
3448
iexplore.exe
GET
200
8.253.207.121:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5b810eac8f0d199b
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3448
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3596
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
—
—
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3448
iexplore.exe
185.199.111.133:443
avatars.githubusercontent.com
GitHub, Inc.
NL
suspicious
3448
iexplore.exe
8.253.207.121:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
3596
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3448
iexplore.exe
185.199.111.154:443
github.githubassets.com
GitHub, Inc.
NL
suspicious
3448
iexplore.exe
140.82.121.3:443
gist.github.com
—
US
suspicious
3596
iexplore.exe
185.199.111.154:443
github.githubassets.com
GitHub, Inc.
NL
suspicious
3596
iexplore.exe
152.199.19.161:443
r20swj13mr.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
gist.github.com
  • 140.82.121.3
suspicious
ctldl.windowsupdate.com
  • 8.253.207.121
  • 67.27.233.254
  • 67.27.159.254
  • 67.27.233.126
  • 67.27.235.126
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
crl3.digicert.com
  • 93.184.220.29
whitelisted
github.githubassets.com
  • 185.199.111.154
  • 185.199.110.154
  • 185.199.109.154
  • 185.199.108.154
whitelisted
avatars.githubusercontent.com
  • 185.199.111.133
  • 185.199.110.133
  • 185.199.109.133
  • 185.199.108.133
whitelisted
github-cloud.s3.amazonaws.com
  • 52.217.164.113
shared
user-images.githubusercontent.com
  • 185.199.111.133
  • 185.199.110.133
  • 185.199.109.133
  • 185.199.108.133
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://gist.github.com/WitherOrNot/8ead32aede204b601f624ce7415a3289