URL:

http://bapps.net.global.prod.fastly.net/files/apps/face-mobile/?i=118778

Full analysis: https://app.any.run/tasks/9c9a7839-e8a7-4bca-81c6-a2aab652adf5
Verdict: Malicious activity
Analysis date: January 30, 2024, 21:03:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

7195B9A72595F40DF94274B6DF0B8599

SHA1:

4B9D5301C4A9E3267A950C090A62EE0E574559E0

SHA256:

1828241809676A0C93F94CF1108430BECAE807BAA150C9132F7C656B28F3B8EF

SSDEEP:

3:N1Kc8iBa0O6XQK8bYY8JvaM5an:CcbQ0OluJo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
268"C:\Program Files\Internet Explorer\iexplore.exe" "http://bapps.net.global.prod.fastly.net/files/apps/face-mobile/?i=118778"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3468"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:268 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
13 582
Read events
13 503
Write events
73
Delete events
6

Modification events

(PID) Process:(268) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(268) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(268) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(268) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(268) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(268) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(268) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(268) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(268) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(268) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
12
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
3468iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\jquery-1.9.1.min[1].jstext
MD5:397754BA49E9E0CF4E7C190DA78DDA05
SHA256:C12F6098E641AACA96C60215800F18F5671039AECF812217FAB3C0D152F6ADB4
3468iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\gg[1].pngimage
MD5:F0C1EDE11E7ECE89D2D65D02E3F79301
SHA256:41B5F73FB6E48E6F46905D852A8807BC9613C4FBC281D41D6A6E266F4C4EDBB7
3468iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:8FEBADA1AD56833E9F72ADD7D4D9444D
SHA256:B02EF00F524395D55AB974A153166EF241485E906C4B7945BF152D2A6EB455D2
3468iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:F310E773651E66F2B018A7C8F3C5E69B
SHA256:9B97A7AC986576B9AE17C200E639AA3FFF8736892FED15A11C4FC89E006298F0
268iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
3468iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:5745427863C133FFBEE9DC2CF749F47C
SHA256:F8D800DB8262F26FE40F52630BBA31F8EB4DD539BF340AEDE349374C4137C24C
268iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:1A510F2F7741E35ECC097C2EC95BC582
SHA256:CB17DCEE72C9437D911849BF754E0740541492400218C5F258660E4DD029A707
268iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
268iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:C223880A5B2CBC6A0F7C3CDFF0437989
SHA256:879B5B7415EBAE3618A2375A3231A0528B642D48B7A46D77221BB85A541990FA
3468iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:AC89A852C2AAA3D389B2D2DD312AD367
SHA256:0B720E19270C672F9B6E0EC40B468AC49376807DE08A814573FE038779534F45
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
23
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3468
iexplore.exe
GET
200
151.101.0.249:80
http://bapps.net.global.prod.fastly.net/files/apps/face-mobile/?i=118778
unknown
html
1.47 Kb
unknown
3468
iexplore.exe
GET
200
151.101.0.249:80
http://bapps.net.global.prod.fastly.net/files/apps/face-mobile/nicepage.css
unknown
text
104 Kb
unknown
3468
iexplore.exe
GET
200
151.101.0.249:80
http://bapps.net.global.prod.fastly.net/files/apps/face-mobile/page1.css
unknown
text
259 b
unknown
3468
iexplore.exe
GET
200
151.101.0.249:80
http://bapps.net.global.prod.fastly.net/files/apps/face-mobile/images/gg.png
unknown
image
156 Kb
unknown
3468
iexplore.exe
GET
200
151.101.0.249:80
http://bapps.net.global.prod.fastly.net/files/apps/face-mobile/jquery-1.9.1.min.js
unknown
text
32.0 Kb
unknown
3468
iexplore.exe
GET
304
23.32.238.59:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5d86ac995d96f820
unknown
—
—
unknown
3468
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
3468
iexplore.exe
GET
304
23.32.238.59:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7c6c1f20e25e896c
unknown
—
—
unknown
3468
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
3468
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGbSiPAo8Qj1CbnbR%2FpRjKM%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
3468
iexplore.exe
151.101.0.249:80
bapps.net.global.prod.fastly.net
FASTLY
US
malicious
3468
iexplore.exe
172.217.18.10:443
fonts.googleapis.com
GOOGLE
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3468
iexplore.exe
23.32.238.59:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3468
iexplore.exe
142.250.185.163:80
ocsp.pki.goog
GOOGLE
US
whitelisted
268
iexplore.exe
151.101.0.249:80
bapps.net.global.prod.fastly.net
FASTLY
US
malicious
268
iexplore.exe
104.126.37.160:443
www.bing.com
Akamai International B.V.
DE
unknown
268
iexplore.exe
23.32.238.59:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
bapps.net.global.prod.fastly.net
  • 151.101.0.249
  • 151.101.64.249
  • 151.101.128.249
  • 151.101.192.249
unknown
fonts.googleapis.com
  • 172.217.18.10
whitelisted
ctldl.windowsupdate.com
  • 23.32.238.59
  • 23.32.238.67
  • 2.19.198.208
  • 2.19.198.81
  • 23.32.238.18
  • 173.222.108.226
  • 173.222.108.210
whitelisted
ocsp.pki.goog
  • 142.250.185.163
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.160
  • 104.126.37.137
  • 104.126.37.162
  • 104.126.37.170
  • 104.126.37.163
  • 104.126.37.176
  • 104.126.37.161
  • 104.126.37.139
  • 104.126.37.136
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://bapps.net.global.prod.fastly.net/files/apps/face-mobile/?i=118778