analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www.fematestanswers.com/

Full analysis: https://app.any.run/tasks/54556973-ce25-4dce-830d-3d7e4fb94cfa
Verdict: Malicious activity
Analysis date: January 24, 2022, 19:20:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

2514BAB473A4992E3A573C1DA0263F48

SHA1:

5DDD9C1CC6A7330546ABFF2DFC37C3FAE4243CA8

SHA256:

1AA4AAA869C0645311EB047D2FA64228DD9971B3634C0A0B773CB508FF3351A7

SSDEEP:

3:N8DSLc5mWiiStn:2OLc5kR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3256)
      • iexplore.exe (PID: 3704)
      • iexplore.exe (PID: 2632)

    • Checks supported languages

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 1592)

    • Creates files in the user directory

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 1592)

    • Executed via COM

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 1592)

    • Reads the computer name

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 1592)

  • INFO

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1988)
      • iexplore.exe (PID: 3704)
      • iexplore.exe (PID: 3256)
      • iexplore.exe (PID: 2632)

    • Checks supported languages

      • iexplore.exe (PID: 3704)
      • iexplore.exe (PID: 1988)
      • iexplore.exe (PID: 3256)
      • iexplore.exe (PID: 2632)

    • Reads the computer name

      • iexplore.exe (PID: 3256)
      • iexplore.exe (PID: 3704)
      • iexplore.exe (PID: 1988)
      • iexplore.exe (PID: 2632)

    • Changes internet zones settings

      • iexplore.exe (PID: 1988)

    • Application launched itself

      • iexplore.exe (PID: 1988)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3704)
      • iexplore.exe (PID: 3256)
      • iexplore.exe (PID: 2632)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 1988)
      • iexplore.exe (PID: 3256)
      • iexplore.exe (PID: 2632)
      • iexplore.exe (PID: 3704)

    • Creates files in the user directory

      • iexplore.exe (PID: 3256)
      • iexplore.exe (PID: 2632)
      • iexplore.exe (PID: 1988)
      • iexplore.exe (PID: 3704)

    • Reads CPU info

      • iexplore.exe (PID: 3256)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1988)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1988)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 3256)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
5
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iexplore.exe flashutil32_32_0_0_453_activex.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1988"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.fematestanswers.com/"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3704"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1988 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3256"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1988 CREDAT:1578259 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
1592C:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe
Integrity Level:
MEDIUM
Description:
Adobe� Flash� Player Installer/Uninstaller 32.0 r0
Exit code:
0
Version:
32,0,0,453
2632"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1988 CREDAT:3609882 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Total events
66 649
Read events
65 871
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
117
Text files
735
Unknown types
158

Dropped files

PID
Process
Filename
Type
3704iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:494A7483CEAF488A79CB45418E88ECCD
SHA256:9A65904F97742B3D8844EFAFCE7D9E9DA7C1B96A8FDE541E718768AE68293D50
1988iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:FC990EAA7247546FB67C18916A4CAC9B
SHA256:294F5BE9159C87842AD3173FE7CDA168C9F2010C6D428085A8AC30EF436CA993
3704iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:532E98C1713B2E83EA206D56C25972F0
SHA256:ED9B2E6163C116AFD00F0A11801D0FB273CAAB5387C0C2948895384D88E2F56C
3704iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\post-2515[1].csstext
MD5:C984BA9AA3036E4CEFFF1C9C0FA58429
SHA256:09F7CACC6549307ED992364A79E5619FC2258527836D054509AB8995948F02BD
3704iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\chap-semantic-ui[1].csstext
MD5:517C4B151DB34271B0FFD3B3ED3AE02E
SHA256:871C62E50C1335C20A8E3EF2F30D82C8A274B16482FD33B478B8D8E72BEB5E1F
3704iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\post-2612[1].csstext
MD5:3F0C94DC5922836AB39F1B670F9C3AB8
SHA256:9A9D15A004061A648158C2FF230F2DDCB3146FE9342ED7DE15897822A449556E
3704iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\JBRLR9CF.htmhtml
MD5:11889216546070B7E1B969D9EF6E0992
SHA256:2010A5DD960B895E454A6EBD9611F30EBA42182B64AFDD45524C9DB9EC13952E
3704iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\chap-titan-framework-chap-1-css[1].csstext
MD5:2937283BED518F168289F95B907D35BC
SHA256:5152A79CC3A92F0A7C3BD8BFBDFD216185FA1486E4A84F406FEA2D9233393009
1988iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:137A27C73FCF84FD93765DB25F1855F3
SHA256:D707F4ABA8181D3FD3AAF28E704ED4AC8525B7DE19E6926BAA9BA11C76BDCA14
1988iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:F1D3379B9CA34F6A0499F22ADDA6002C
SHA256:19219B772645FB562D92A469CB46093F3554B4451B1A5AFB1D44895E0F825E9B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
105
TCP/UDP connections
637
DNS requests
192
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3704
iexplore.exe
GET
200
216.58.212.163:80
http://crl.pki.goog/gsr1/gsr1.crl
US
der
1.61 Kb
whitelisted
3256
iexplore.exe
GET
200
104.18.20.226:80
http://ocsp2.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEHophRq39F1meVBmQbb%2F1x0%3D
US
der
1.40 Kb
whitelisted
3704
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBp41H%2BM47%2F6CgAAAAErghs%3D
US
der
471 b
whitelisted
1988
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3704
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC2PrP09fGo%2BgoAAAABK3x6
US
der
472 b
whitelisted
3704
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEEFKxQHtEPcBCgAAAAErfHU%3D
US
der
471 b
whitelisted
3256
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
3704
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEH4wYrandiOsCgAAAAErgCs%3D
US
der
471 b
whitelisted
3704
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC04WHG3wyS9QoAAAABK3x8
US
der
472 b
whitelisted
3704
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF%2FRvGeR%2FuhJCgAAAAErgC8%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3704
iexplore.exe
142.250.181.226:443
securepubads.g.doubleclick.net
Google Inc.
US
whitelisted
—
—
142.250.185.163:80
ocsp.pki.goog
Google Inc.
US
whitelisted
1988
iexplore.exe
131.253.33.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
1988
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1988
iexplore.exe
95.140.236.0:80
ctldl.windowsupdate.com
Limelight Networks, Inc.
GB
whitelisted
3704
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3704
iexplore.exe
104.16.95.65:443
static.cloudflareinsights.com
Cloudflare Inc
US
shared
3704
iexplore.exe
104.21.33.116:443
www.fematestanswers.com
Cloudflare Inc
US
unknown
3704
iexplore.exe
95.140.236.0:80
ctldl.windowsupdate.com
Limelight Networks, Inc.
GB
whitelisted
3704
iexplore.exe
142.250.185.163:80
ocsp.pki.goog
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.fematestanswers.com
  • 104.21.33.116
  • 172.67.162.84
unknown
ctldl.windowsupdate.com
  • 95.140.236.0
  • 209.197.3.8
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 131.253.33.200
  • 13.107.22.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
securepubads.g.doubleclick.net
  • 142.250.181.226
whitelisted
static.cloudflareinsights.com
  • 104.16.95.65
  • 104.16.94.65
whitelisted
ocsp.pki.goog
  • 142.250.185.163
  • 142.250.186.67
whitelisted
crl.pki.goog
  • 216.58.212.163
  • 142.250.181.227
whitelisted
www.googletagmanager.com
  • 142.250.186.136
whitelisted

Threats

PID
Process
Class
Message
3256
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
—
—
Potentially Bad Traffic
ET DNS Query for .to TLD
3256
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.fematestanswers.com/