analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://headlightrevolution.com/cart.php

Full analysis: https://app.any.run/tasks/97173ccc-a88f-47da-ab6a-a4469fa72d33
Verdict: Malicious activity
Analysis date: March 31, 2020, 08:49:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

23742ABE1F494CBB87753735E6EFDAF7

SHA1:

71B32B9D08188CC7CEF40EC3DE9600FAEFC501A3

SHA256:

170A32A95D15BB2B2ABDD64758D25A06D45DBE417F23ACE047DCFDF070534082

SSDEEP:

3:N88VRSUdIdEBhNV:28nId8NV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3144)
      • iexplore.exe (PID: 3436)

    • Changes internet zones settings

      • iexplore.exe (PID: 3144)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3436)

    • Creates files in the user directory

      • iexplore.exe (PID: 3436)
      • iexplore.exe (PID: 3144)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3436)
      • iexplore.exe (PID: 3144)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3144)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3144)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3144"C:\Program Files\Internet Explorer\iexplore.exe" "https://headlightrevolution.com/cart.php"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3436"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3144 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
6 344
Read events
822
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
112
Text files
175
Unknown types
71

Dropped files

PID
Process
Filename
Type
3436iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab7085.tmp —
MD5:—
SHA256:—
3436iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar7086.tmp —
MD5:—
SHA256:—
3436iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\WQ37RWQU.txt —
MD5:—
SHA256:—
3436iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\17KZOABL.txttext
MD5:4636F341979DAABC8CC79E63A42CA734
SHA256:AB86EBDC7BA0D664EE05B18B4D3E687D2CEC7E4B44D150BDC63555A00B3AA69C
3436iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\cart[1].htmhtml
MD5:F3951779B67B2945D6C77B00E17AEE0B
SHA256:6D541C054C6DB5A275D2CD13D64C705DB23F55AE422CA7B46A4800121797C4DD
3436iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_9487BC0D4381A7CDEB9A8CC43F66D27Cder
MD5:63311A320518E4CA5045931F3E6ADE16
SHA256:23B7BECCB98DAF194EF0EE6709E93CAC4632C1214F6478FCFA2A547515237D83
3436iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_9487BC0D4381A7CDEB9A8CC43F66D27Cbinary
MD5:29DD04FB2C808899F51A0A7263A6BE75
SHA256:A124E7A1054B0FBC02D498BE80A12C91C509CBDB3CD56794C76DF5B2E5D25E87
3436iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4344B8AF97AF3A423D9EE52899963CDE_78849AF2BCA6F2FB97DE2940460ADC6Abinary
MD5:CD4D844B3A86AB5A733E78D9987F5072
SHA256:1F39F04254FD618AE56FF54D2B062471C5ABC3CFDE0CE120255E428683657475
3436iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4344B8AF97AF3A423D9EE52899963CDE_78849AF2BCA6F2FB97DE2940460ADC6Ader
MD5:BA634773F64FF271E7366E4930BD3068
SHA256:C43C3E7160AEA4E752E4717948C99617CC2493BCB888AD97FED08C3C5FE97F00
3436iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\contivio-chat[1].jstext
MD5:1BED3D3F5A6C00684DFD39C6BB2BC45F
SHA256:7989A1A96A62CC7AD5F84FD40F4E293C16EDAB75CF1F8EA4E00773FA9364349D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
62
TCP/UDP connections
109
DNS requests
45
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3436
iexplore.exe
GET
200
93.184.220.29:80
http://status.geotrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR3enuod9bxDxzpICGW%2B2sabjf17QQUkFj%2FsJx1qFFUd7Ht8qNDFjiebMUCEAez3RP7hyTB6WlLwXG2xOk%3D
US
der
471 b
whitelisted
3436
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D
US
der
471 b
whitelisted
3436
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
3436
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D
US
der
471 b
whitelisted
3436
iexplore.exe
GET
304
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
1.47 Kb
whitelisted
3436
iexplore.exe
GET
200
172.217.21.227:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
3436
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
3436
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2Fz5hY5qj0aEmX0H4s05bY%3D
US
der
1.47 Kb
whitelisted
3436
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
3436
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3436
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3436
iexplore.exe
35.186.228.254:443
headlightrevolution.com
Google Inc.
US
unknown
3436
iexplore.exe
216.58.206.8:443
www.googletagmanager.com
Google Inc.
US
whitelisted
3436
iexplore.exe
54.241.86.195:443
uschat3.contivio.com
Amazon.com, Inc.
US
unknown
3436
iexplore.exe
23.210.248.160:443
cdn11.bigcommerce.com
Akamai International B.V.
NL
whitelisted
3436
iexplore.exe
104.22.51.245:443
www.powr.io
Cloudflare Inc
US
suspicious
—
—
13.225.87.20:443
d3ryumxhbd2uw7.cloudfront.net
—
US
suspicious
3436
iexplore.exe
23.8.10.113:443
chimpstatic.com
Akamai International B.V.
NL
unknown
3436
iexplore.exe
172.217.22.52:443
acp-magento.appspot.com
Google Inc.
US
whitelisted
3436
iexplore.exe
13.225.87.20:443
d3ryumxhbd2uw7.cloudfront.net
—
US
suspicious

DNS requests

Domain
IP
Reputation
headlightrevolution.com
  • 35.186.228.254
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
status.geotrust.com
  • 93.184.220.29
whitelisted
cdn11.bigcommerce.com
  • 23.210.248.160
whitelisted
www.googletagmanager.com
  • 216.58.206.8
whitelisted
www.powr.io
  • 104.22.51.245
  • 104.22.50.245
shared
uschat3.contivio.com
  • 54.241.86.195
unknown
acp-magento.appspot.com
  • 172.217.22.52
whitelisted
js.adsrvr.org
  • 143.204.94.29
whitelisted
chimpstatic.com
  • 23.8.10.113
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://headlightrevolution.com/cart.php