analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://headlightrevolution.com/cart.php

Full analysis: https://app.any.run/tasks/275f0eb8-9c07-4ff3-8af6-9cd3d43c3ad4
Verdict: Malicious activity
Analysis date: March 31, 2020, 08:57:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

23742ABE1F494CBB87753735E6EFDAF7

SHA1:

71B32B9D08188CC7CEF40EC3DE9600FAEFC501A3

SHA256:

170A32A95D15BB2B2ABDD64758D25A06D45DBE417F23ACE047DCFDF070534082

SSDEEP:

3:N88VRSUdIdEBhNV:28nId8NV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2668)
      • iexplore.exe (PID: 3376)

    • Changes internet zones settings

      • iexplore.exe (PID: 3376)

    • Application launched itself

      • iexplore.exe (PID: 3376)

    • Creates files in the user directory

      • iexplore.exe (PID: 2668)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2668)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3376)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3376)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3376)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3376"C:\Program Files\Internet Explorer\iexplore.exe" "https://headlightrevolution.com/cart.php"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2668"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3376 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
5 962
Read events
615
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
92
Text files
129
Unknown types
58

Dropped files

PID
Process
Filename
Type
2668iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab7A1A.tmp —
MD5:—
SHA256:—
2668iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar7A1B.tmp —
MD5:—
SHA256:—
2668iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\I62BBKP0.txt —
MD5:—
SHA256:—
2668iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4344B8AF97AF3A423D9EE52899963CDE_78849AF2BCA6F2FB97DE2940460ADC6Abinary
MD5:0F1065AC3B033DD107FBFE5B1FC92843
SHA256:8A0618C3959A0CC1E181AC597B7B89B15993C237792880E1A5AF417313E66A27
2668iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_74167E25E5476CCA2A5946AAA61BF9E1binary
MD5:BBF87A37FB25CBBA85BECE5DAECA3458
SHA256:DCE02E684D2404141741E1D91E4194F7A4CAF264D985CBEF92804295084569BF
2668iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4344B8AF97AF3A423D9EE52899963CDE_78849AF2BCA6F2FB97DE2940460ADC6Ader
MD5:BA634773F64FF271E7366E4930BD3068
SHA256:C43C3E7160AEA4E752E4717948C99617CC2493BCB888AD97FED08C3C5FE97F00
2668iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_9487BC0D4381A7CDEB9A8CC43F66D27Cbinary
MD5:B8D1FD2B4DEF237EE43BD2B860EB8F74
SHA256:36FAF877AC255F826BFBD7618DD1A69EF44CFF356C0A31F7F2CE002F95CC2D5A
2668iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\cart[1].htmhtml
MD5:B23013751E83644EE7A04E94556AB74E
SHA256:AF8C167EA02DE770529C82E6545789116B83C1020885D36BDDBB59EC90CCE51F
2668iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_9487BC0D4381A7CDEB9A8CC43F66D27Cder
MD5:63311A320518E4CA5045931F3E6ADE16
SHA256:23B7BECCB98DAF194EF0EE6709E93CAC4632C1214F6478FCFA2A547515237D83
2668iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5ABder
MD5:485769451751B235AA005A439A241DC2
SHA256:D3CB3B2B263F929797CFEDAD54A2CA134639D586CD43E26A1D3934E9D5FFC177
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
38
TCP/UDP connections
122
DNS requests
43
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2668
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D
US
der
471 b
whitelisted
2668
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
2668
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
2668
iexplore.exe
GET
200
93.184.220.29:80
http://status.geotrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR3enuod9bxDxzpICGW%2B2sabjf17QQUkFj%2FsJx1qFFUd7Ht8qNDFjiebMUCEAez3RP7hyTB6WlLwXG2xOk%3D
US
der
471 b
whitelisted
2668
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
2668
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2Fz5hY5qj0aEmX0H4s05bY%3D
US
der
1.47 Kb
whitelisted
2668
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2Fz5hY5qj0aEmX0H4s05bY%3D
US
der
1.47 Kb
whitelisted
2668
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
2668
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
2668
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2668
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2668
iexplore.exe
35.186.228.254:443
headlightrevolution.com
Google Inc.
US
unknown
2668
iexplore.exe
2.21.36.136:443
cdn11.bigcommerce.com
GTT Communications Inc.
FR
unknown
2668
iexplore.exe
54.241.86.195:443
uschat3.contivio.com
Amazon.com, Inc.
US
unknown
—
—
104.22.51.245:443
www.powr.io
Cloudflare Inc
US
suspicious
2668
iexplore.exe
216.58.206.8:443
www.googletagmanager.com
Google Inc.
US
whitelisted
—
—
172.217.22.52:443
acp-magento.appspot.com
Google Inc.
US
whitelisted
2668
iexplore.exe
172.217.22.52:443
acp-magento.appspot.com
Google Inc.
US
whitelisted
2668
iexplore.exe
13.225.87.166:443
d3ryumxhbd2uw7.cloudfront.net
—
US
unknown

DNS requests

Domain
IP
Reputation
headlightrevolution.com
  • 35.186.228.254
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
status.geotrust.com
  • 93.184.220.29
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
cdn11.bigcommerce.com
  • 2.21.36.136
whitelisted
www.googletagmanager.com
  • 216.58.206.8
whitelisted
www.powr.io
  • 104.22.51.245
  • 104.22.50.245
shared
uschat3.contivio.com
  • 54.241.86.195
unknown
acp-magento.appspot.com
  • 172.217.22.52
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://headlightrevolution.com/cart.php