analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www.uol.com.br

Full analysis: https://app.any.run/tasks/50dad285-4b23-4b30-8e8e-40a2ae16fc75
Verdict: Malicious activity
Analysis date: January 25, 2022, 03:25:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

CE26F7A8B516B538F8A715B07AFE2220

SHA1:

FEE6D2F5114AD7653B6FFD33CF84CA079BBCE99D

SHA256:

14F10343EE062F625A247862F05739CCC94269828C7BD3978A887775C5B1A108

SSDEEP:

3:N8DSLjS:2OLjS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3884)
      • iexplore.exe (PID: 3368)
  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 3368)
      • iexplore.exe (PID: 3884)
    • Reads settings of System Certificates

      • iexplore.exe (PID: 3884)
      • iexplore.exe (PID: 3368)
    • Reads the computer name

      • iexplore.exe (PID: 3368)
      • iexplore.exe (PID: 3884)
    • Changes internet zones settings

      • iexplore.exe (PID: 3368)
    • Application launched itself

      • iexplore.exe (PID: 3368)
    • Reads internet explorer settings

      • iexplore.exe (PID: 3884)
    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3368)
      • iexplore.exe (PID: 3884)
    • Creates files in the user directory

      • iexplore.exe (PID: 3884)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3368"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.uol.com.br"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\version.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernelbase.dll
3884"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3368 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
28 876
Read events
28 670
Write events
206
Delete events
0

Modification events

(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
792627296
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30937499
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30937499
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
53
Text files
201
Unknown types
59

Dropped files

PID
Process
Filename
Type
3884iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62binary
MD5:BE33BB0664A229669A36878AE71DA3C5
SHA256:1CD63AA06C1CCD3876CF9005FFCDDD74B2821E1D9FD9DE65F116D6145600DAD0
3368iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:FC990EAA7247546FB67C18916A4CAC9B
SHA256:294F5BE9159C87842AD3173FE7CDA168C9F2010C6D428085A8AC30EF436CA993
3884iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4Fbinary
MD5:A07F4F5F7314B617E825B775589E626E
SHA256:C096573E7DB72F0C60C73D194422DE728576C07532AF5724470007752E7CD3AB
3884iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894der
MD5:E9953511B806D96C85112D07C44DE02A
SHA256:86008864D275A5005CDEE88B0DF9E38009AB1F28E731673403DDCD89078A381B
3884iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894binary
MD5:04FEE32D29EF5ED31E96CAC6F6F27CA7
SHA256:C5EECE3C21AF2A5DD360FFAE900955F423ACE2135FA542362A2EC17E343B66F2
3884iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4Fder
MD5:CC0C289EA7D427477ACE1B0A0DB02D54
SHA256:A7A7E062E466C1F51B146C74B9C252AF0BCAC6D9DE256E85384A972BA13BE432
3884iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:8DB6695280F8E25E79AACE166DB12902
SHA256:178CC4FE9ED766AF0A7974E6D5060ACF0491D80A0A59547FE49168FE9E9B68A3
3884iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\hotjar-569021[1].jstext
MD5:82D6B0B6ADA53762DD91ACE6AD10EDFC
SHA256:33600299998B37E5A4BCA10191DCB0722D61C0411F33FD5ABDA0969DE179E97F
3884iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:10F16068D4E1DA6F9AD26982BB93A9F1
SHA256:66B610CE97729F986839DD06691489D10E33464A632F3D4E4159F47EBEDD8818
3884iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\2V18EII9.htmhtml
MD5:929C9A6080A5D8F44D854844412672AF
SHA256:1AAFAEC6669F1070F22CF7B6464915AE586C519EF7F7E50A1162D58731B27A61
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
47
TCP/UDP connections
175
DNS requests
86
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3884
iexplore.exe
GET
216.58.214.3:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
whitelisted
3884
iexplore.exe
GET
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR0tOcjGcdlkhVARHvHzj6Qwhh26wQUpI3lvnx55HAjbS4pNK0jWNz1MX8CEAZZkD0SHMopLkoyGXicisQ%3D
US
whitelisted
3884
iexplore.exe
GET
200
104.18.31.182:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
3884
iexplore.exe
GET
200
216.58.214.3:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEEFKxQHtEPcBCgAAAAErfHU%3D
US
der
471 b
whitelisted
3884
iexplore.exe
GET
200
216.58.214.3:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
3884
iexplore.exe
GET
200
93.184.220.29:80
http://status.rapidssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRhhZrQET0hvbSHUJmNfBKqR%2FiT7wQUU8oXWfxrwAMhLxqu5KqoHIJW2nUCEAu0P0rbaDh5wb7AZVN3nXU%3D
US
der
471 b
shared
3884
iexplore.exe
GET
200
104.18.30.182:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
3884
iexplore.exe
GET
200
65.9.84.150:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
3884
iexplore.exe
GET
200
18.66.242.45:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D
US
der
1.39 Kb
shared
3884
iexplore.exe
GET
200
18.66.242.81:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3368
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3368
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3884
iexplore.exe
65.9.84.150:80
ocsp.rootg2.amazontrust.com
AT&T Services, Inc.
US
whitelisted
3884
iexplore.exe
8.253.208.113:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
unknown
3884
iexplore.exe
178.79.208.1:80
ctldl.windowsupdate.com
Limelight Networks, Inc.
IT
suspicious
3884
iexplore.exe
65.9.82.11:443
www.uol.com.br
AT&T Services, Inc.
US
unknown
3884
iexplore.exe
18.66.242.45:80
ocsp.rootca1.amazontrust.com
Massachusetts Institute of Technology
US
whitelisted
3884
iexplore.exe
18.66.242.81:80
o.ss2.us
Massachusetts Institute of Technology
US
suspicious
3884
iexplore.exe
142.251.36.2:443
securepubads.g.doubleclick.net
Google Inc.
US
unknown
3884
iexplore.exe
104.18.31.182:80
ocsp.comodoca.com
Cloudflare Inc
US
unknown

DNS requests

Domain
IP
Reputation
www.uol.com.br
  • 108.157.4.18
  • 108.157.4.110
  • 108.157.4.95
  • 108.157.4.28
  • 65.9.82.11
  • 65.9.82.89
  • 65.9.82.100
  • 65.9.82.61
whitelisted
ctldl.windowsupdate.com
  • 8.253.208.113
  • 67.26.109.254
  • 8.238.21.254
  • 8.247.210.254
  • 8.247.211.126
  • 178.79.208.1
  • 67.26.111.254
  • 8.248.1.254
  • 67.26.105.254
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
o.ss2.us
  • 18.66.242.81
  • 18.66.242.228
  • 18.66.242.188
  • 18.66.242.94
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ocsp.rootg2.amazontrust.com
  • 65.9.84.150
  • 65.9.84.213
  • 65.9.84.140
  • 65.9.84.191
whitelisted
ocsp.rootca1.amazontrust.com
  • 18.66.242.45
  • 18.66.242.62
  • 18.66.242.155
  • 18.66.242.58
shared
ping.chartbeat.net
  • 52.205.152.61
  • 54.165.118.4
  • 34.238.149.180
  • 23.22.200.199
  • 23.22.20.106
  • 23.21.122.84
  • 3.232.21.183
  • 54.198.123.195
whitelisted
mab.chartbeat.com
  • 151.101.2.202
  • 151.101.194.202
  • 151.101.66.202
  • 151.101.130.202
whitelisted

Threats

No threats detected
No debug info