| download: | index.html |
| Full analysis: | https://app.any.run/tasks/b842072d-2dfb-49ff-84f4-01ff1b835224 |
| Verdict: | No threats detected |
| Analysis date: | June 01, 2019, 01:40:31 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | text/html |
| File info: | HTML document, ASCII text |
| MD5: | C2BCF87CA95D60EC1E91CC53F0959822 |
| SHA1: | 004D642C64FEBD709BAF4ABBE776620562DF4D96 |
| SHA256: | 11790A6F4C4FB2D4B29F6A0481738197CAD3E6B5F4178CC10A4F547AB6BE72C7 |
| SSDEEP: | 48:47mvUkHVNqsOVNq3L+83iF4rSQ05fJ6vB:7qZqpSSJ |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executed via COM
- FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3512)
INFO
Application launched itself
- iexplore.exe (PID: 2468)
Changes internet zones settings
- iexplore.exe (PID: 2468)
Changes settings of System certificates
- iexplore.exe (PID: 2468)
Reads internet explorer settings
- iexplore.exe (PID: 1664)
- iexplore.exe (PID: 1240)
Adds / modifies Windows certificates
- iexplore.exe (PID: 2468)
Creates files in the user directory
- iexplore.exe (PID: 1664)
- FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3512)
Reads Internet Cache Settings
- iexplore.exe (PID: 2468)
- iexplore.exe (PID: 1664)
Reads settings of System Certificates
- iexplore.exe (PID: 2468)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
EXIF
HTML
| ContentType: | text/html; charset=UTF-8 |
|---|---|
| CacheControl: | no-cache |
| Refresh: | 1;URL='https://a.vfgtb.com/efa9bdbb-1afa-47b6-823c-9d64897c2ebc?subID1=oops-you&affiliateID=44543&source=102d11414ce77e1bccca3e8e73554d&subID2=94804' |
| Title: | Redirecting |
Total processes
36
Monitored processes
4
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1240 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2468 CREDAT:79873 | C:\Program Files\Internet Explorer\iexplore.exe | — | iexplore.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1664 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2468 CREDAT:203009 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2468 | "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\index.html | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3512 | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe | — | svchost.exe | |||||||||||
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Exit code: 0 Version: 26,0,0,131 Modules
| |||||||||||||||
Total events
649
Read events
523
Write events
119
Delete events
7
Modification events
| (PID) Process: | (2468) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
| (PID) Process: | (2468) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2468) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (2468) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones |
| Operation: | write | Name: | SecuritySafe |
Value: 1 | |||
| (PID) Process: | (1240) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore |
| Operation: | write | Name: | Type |
Value: 3 | |||
| (PID) Process: | (1240) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore |
| Operation: | write | Name: | Count |
Value: 1 | |||
| (PID) Process: | (1240) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore |
| Operation: | write | Name: | Time |
Value: E307060006000100010028003B00B503 | |||
| (PID) Process: | (1240) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore |
| Operation: | write | Name: | LoadTime |
Value: 30 | |||
| (PID) Process: | (1240) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore |
| Operation: | write | Name: | Type |
Value: 3 | |||
| (PID) Process: | (1240) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore |
| Operation: | write | Name: | Count |
Value: 1 | |||
Executable files
0
Suspicious files
6
Text files
89
Unknown types
12
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2468 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 2468 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 1664 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@t.hrtyi[1].txt | — | |
MD5:— | SHA256:— | |||
| 2468 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF576C23F87556ADE6.TMP | — | |
MD5:— | SHA256:— | |||
| 1664 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@a.vfgtb[1].txt | — | |
MD5:— | SHA256:— | |||
| 1664 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@a.vfghc[1].txt | — | |
MD5:— | SHA256:— | |||
| 1664 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@t.irtyf[1].txt | — | |
MD5:— | SHA256:— | |||
| 1664 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:— | SHA256:— | |||
| 1664 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Cab5953.tmp | — | |
MD5:— | SHA256:— | |||
| 1664 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Tar5954.tmp | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
33
DNS requests
22
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1664 | iexplore.exe | GET | 302 | 52.48.235.139:80 | http://localflirtbuddies.com/?group_id=3217&subid=102831f1ae4909353332be9897f0c0&keyword=44543 | IE | — | — | whitelisted |
1664 | iexplore.exe | GET | 302 | 64.140.168.227:80 | http://oops-you.com/ | US | html | 593 b | unknown |
1664 | iexplore.exe | GET | 200 | 205.185.216.42:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | US | compressed | 56.2 Kb | whitelisted |
2468 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
1664 | iexplore.exe | GET | 302 | 35.159.5.116:80 | http://a.vfghc.com/51529c26-6644-42d1-9bdf-4ea187479509?subID1=oops-you&affiliateID=44543&source=102f2fffa8e50578076b590fc7fe06&subID2=94804 | DE | — | — | suspicious |
1664 | iexplore.exe | GET | 200 | 54.230.14.131:80 | http://x.ss2.us/x.cer | US | der | 1.27 Kb | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 52.209.7.210:443 | optimiser.tmtrck.com | Amazon.com, Inc. | IE | unknown |
1664 | iexplore.exe | 66.254.122.102:443 | content.localflirtbuddies.com | Reflected Networks, Inc. | US | suspicious |
— | — | 216.58.207.72:443 | www.googletagmanager.com | Google Inc. | US | whitelisted |
4 | System | 205.185.216.10:445 | ckstatic.com | Highwinds Network Group, Inc. | US | whitelisted |
2468 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
— | — | 205.185.216.10:137 | ckstatic.com | Highwinds Network Group, Inc. | US | whitelisted |
1664 | iexplore.exe | 64.140.168.227:80 | oops-you.com | WebNX, Inc. | US | unknown |
1664 | iexplore.exe | 107.178.242.109:443 | t.hrtyi.com | Google Inc. | US | whitelisted |
1664 | iexplore.exe | 205.185.216.10:443 | ckstatic.com | Highwinds Network Group, Inc. | US | whitelisted |
2468 | iexplore.exe | 107.178.242.109:443 | t.hrtyi.com | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
ckstatic.com |
| suspicious |
www.bing.com |
| whitelisted |
oops-you.com |
| unknown |
t.hrtyi.com |
| suspicious |
a.vfgtb.com |
| suspicious |
a.vfghc.com |
| suspicious |
t.irtyf.com |
| suspicious |
profile.adultcrush.com |
| unknown |
x.ss2.us |
| whitelisted |
www.download.windowsupdate.com |
| whitelisted |