analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://headlightrevolution.com/cart.php

Full analysis: https://app.any.run/tasks/9896d87a-3f87-452e-8032-98e5ecd53f2e
Verdict: Malicious activity
Analysis date: March 31, 2020, 11:36:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

23742ABE1F494CBB87753735E6EFDAF7

SHA1:

71B32B9D08188CC7CEF40EC3DE9600FAEFC501A3

SHA256:

170A32A95D15BB2B2ABDD64758D25A06D45DBE417F23ACE047DCFDF070534082

SSDEEP:

3:N88VRSUdIdEBhNV:28nId8NV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 2804)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2804)
      • iexplore.exe (PID: 2664)
    • Application launched itself

      • iexplore.exe (PID: 2804)
    • Reads internet explorer settings

      • iexplore.exe (PID: 2664)
    • Creates files in the user directory

      • iexplore.exe (PID: 2804)
      • iexplore.exe (PID: 2664)
    • Reads settings of System Certificates

      • iexplore.exe (PID: 2804)
    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2804)
    • Changes settings of System certificates

      • iexplore.exe (PID: 2804)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2804"C:\Program Files\Internet Explorer\iexplore.exe" "https://headlightrevolution.com/cart.php"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2664"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2804 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Total events
6 415
Read events
445
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
129
Text files
554
Unknown types
96

Dropped files

PID
Process
Filename
Type
2664iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab7AA7.tmp
MD5:
SHA256:
2664iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar7AA8.tmp
MD5:
SHA256:
2664iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\WQ37RWQU.txt
MD5:
SHA256:
2664iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\17KZOABL.txttext
MD5:7ACFE92E2313B18516AA9A5092B03D14
SHA256:825ACEF19A93B5AEE411DF1666DE3552802391E781560DCEF70D0DFEC3FC6C44
2664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_9487BC0D4381A7CDEB9A8CC43F66D27Cder
MD5:63311A320518E4CA5045931F3E6ADE16
SHA256:23B7BECCB98DAF194EF0EE6709E93CAC4632C1214F6478FCFA2A547515237D83
2664iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\contivio-chat[1].jstext
MD5:1BED3D3F5A6C00684DFD39C6BB2BC45F
SHA256:7989A1A96A62CC7AD5F84FD40F4E293C16EDAB75CF1F8EA4E00773FA9364349D
2664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5ABbinary
MD5:C71FEA1287113D33C7F4C1D0718A2B6F
SHA256:1A5D7432247ACBFCC822EB77BA164269256B8B23AA956E394DEF2ADED85303E1
2664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4344B8AF97AF3A423D9EE52899963CDE_78849AF2BCA6F2FB97DE2940460ADC6Ader
MD5:BA634773F64FF271E7366E4930BD3068
SHA256:C43C3E7160AEA4E752E4717948C99617CC2493BCB888AD97FED08C3C5FE97F00
2664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_74167E25E5476CCA2A5946AAA61BF9E1binary
MD5:BF0F851612D8D3E948D0AEA96287AFD7
SHA256:32C848EDE682B7141A9F365E7D02CA9C778289B00942BCB5ACBB5962FCDBEDD8
2664iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\banner-cat[1].jpgimage
MD5:A693798254348534B8E37CCD0E247532
SHA256:011A333C6C39E4B451365583E8888D9322EEDBF8D3087510C783CDAA20B42A43
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
63
TCP/UDP connections
182
DNS requests
55
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2664
iexplore.exe
GET
200
93.184.220.29:80
http://status.geotrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR3enuod9bxDxzpICGW%2B2sabjf17QQUkFj%2FsJx1qFFUd7Ht8qNDFjiebMUCEAez3RP7hyTB6WlLwXG2xOk%3D
US
der
471 b
whitelisted
2664
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2Fz5hY5qj0aEmX0H4s05bY%3D
US
der
1.47 Kb
whitelisted
2664
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEBPqKHBb9OztDDZjCYBhQzY%3D
US
der
471 b
whitelisted
2664
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
2664
iexplore.exe
GET
200
172.217.22.35:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
2664
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEBPqKHBb9OztDDZjCYBhQzY%3D
US
der
471 b
whitelisted
2664
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D
US
der
471 b
whitelisted
2664
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
2664
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2Fz5hY5qj0aEmX0H4s05bY%3D
US
der
1.47 Kb
whitelisted
2664
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2664
iexplore.exe
35.186.228.254:443
Google Inc.
US
unknown
2664
iexplore.exe
54.241.86.195:443
uschat3.contivio.com
Amazon.com, Inc.
US
unknown
2664
iexplore.exe
23.210.248.160:443
cdn11.bigcommerce.com
Akamai International B.V.
NL
whitelisted
2664
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2664
iexplore.exe
172.217.16.136:443
www.googletagmanager.com
Google Inc.
US
suspicious
2664
iexplore.exe
104.22.51.245:443
www.powr.io
Cloudflare Inc
US
suspicious
2664
iexplore.exe
172.217.23.116:443
acp-magento.appspot.com
Google Inc.
US
malicious
2664
iexplore.exe
143.204.207.113:443
js.adsrvr.org
US
unknown
2664
iexplore.exe
23.55.110.211:80
ocsp.trustwave.com
NTT America, Inc.
US
suspicious
2804
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
headlightrevolution.com
  • 172.217.22.38
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
status.geotrust.com
  • 93.184.220.29
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
cdn11.bigcommerce.com
  • 23.210.248.160
whitelisted
www.googletagmanager.com
  • 172.217.16.136
whitelisted
www.powr.io
  • 104.22.51.245
  • 104.22.50.245
shared
uschat3.contivio.com
  • 54.241.86.195
unknown
acp-magento.appspot.com
  • 172.217.23.116
whitelisted

Threats

No threats detected
No debug info