URL:

https://teams.microsoft.com/l/meetup-join/19%3ameeting_MTM0OWU1NzEtZDA2NS00NGM4LWEzNjktYTM2YjNmYmIzYTYx%40thread.v2/0?context=%7b%22Tid%22%3a%2216a4d712-85ca-455c-bba0-139c059e16e3%22%2c%22Oid%22%3a%22d19d7750-7cab-424c-9423-58673d451fe9%22%7d

Full analysis: https://app.any.run/tasks/1fc14d69-3b80-4ee3-984f-9254ef869481
Verdict: Malicious activity
Analysis date: April 27, 2022, 11:04:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

567A8DB1CC1A34807555C3E155DDD6A8

SHA1:

76910D31F2A7EA1CCA46FEF8B0FEAB57A4E43B3B

SHA256:

1C58ACB6C2211B0AC3BE54085F1AF01DCB72B09B7E7F54BD453883D99014A63D

SSDEEP:

6:2In+DEDryczK1GVrzzaIaAoXyj8A7TlS6HHfADA5XLt4H3B:2In+DEyDGVTahXC7ki/d57WHx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • iexplore.exe (PID: 2140)
      • iexplore.exe (PID: 2508)
      • TeamsSetup_s_8DA283DE68B4F61-7-0_c_w_.exe (PID: 1112)
      • Update.exe (PID: 2440)

    • Application was dropped or rewritten from another process

      • TeamsSetup_s_8DA283DE68B4F61-7-0_c_w_.exe (PID: 1112)
      • Update.exe (PID: 2440)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2140)

    • Drops a file with a compile date too recent

      • iexplore.exe (PID: 2140)
      • iexplore.exe (PID: 2508)
      • TeamsSetup_s_8DA283DE68B4F61-7-0_c_w_.exe (PID: 1112)
      • Update.exe (PID: 2440)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2140)
      • iexplore.exe (PID: 2508)
      • TeamsSetup_s_8DA283DE68B4F61-7-0_c_w_.exe (PID: 1112)
      • Update.exe (PID: 2440)

    • Checks supported languages

      • TeamsSetup_s_8DA283DE68B4F61-7-0_c_w_.exe (PID: 1112)
      • Update.exe (PID: 2440)

    • Reads Environment values

      • Update.exe (PID: 2440)

    • Reads the computer name

      • Update.exe (PID: 2440)

    • Creates files in the user directory

      • Update.exe (PID: 2440)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 2508)
      • iexplore.exe (PID: 2140)
      • WISPTIS.EXE (PID: 584)

    • Checks supported languages

      • iexplore.exe (PID: 2140)
      • iexplore.exe (PID: 2508)
      • WISPTIS.EXE (PID: 584)

    • Application launched itself

      • iexplore.exe (PID: 2508)

    • Changes internet zones settings

      • iexplore.exe (PID: 2508)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2508)
      • iexplore.exe (PID: 2140)
      • Update.exe (PID: 2440)

    • Creates files in the user directory

      • iexplore.exe (PID: 2140)
      • iexplore.exe (PID: 2508)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2140)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2508)
      • iexplore.exe (PID: 2140)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2508)

    • Reads Microsoft Office registry keys

      • Update.exe (PID: 2440)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
6
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start iexplore.exe iexplore.exe teamssetup_s_8da283de68b4f61-7-0_c_w_.exe update.exe wisptis.exe no specs wisptis.exe

Process information

PID
CMD
Path
Indicators
Parent process
2508"C:\Program Files\Internet Explorer\iexplore.exe" "https://teams.microsoft.com/l/meetup-join/19%3ameeting_MTM0OWU1NzEtZDA2NS00NGM4LWEzNjktYTM2YjNmYmIzYTYx%40thread.v2/0?context=%7b%22Tid%22%3a%2216a4d712-85ca-455c-bba0-139c059e16e3%22%2c%22Oid%22%3a%22d19d7750-7cab-424c-9423-58673d451fe9%22%7d"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2140"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2508 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1112"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\TeamsSetup_s_8DA283DE68B4F61-7-0_c_w_.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\TeamsSetup_s_8DA283DE68B4F61-7-0_c_w_.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Teams
Version:
1.5.00.9163
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\teamssetup_s_8da283de68b4f61-7-0_c_w_.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
2440"C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe" --install . --exeName=TeamsSetup_s_8DA283DE68B4F61-7-0_c_w_.exe --bootstrapperModeC:\Users\admin\AppData\Local\SquirrelTemp\Update.exe
TeamsSetup_s_8DA283DE68B4F61-7-0_c_w_.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Teams
Version:
1.10.84.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\squirreltemp\update.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3524"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;C:\Windows\SYSTEM32\WISPTIS.EXE—Update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Pen and Touch Input Component
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wisptis.exe
c:\windows\system32\ntdll.dll
584"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;C:\Windows\SYSTEM32\WISPTIS.EXE
Update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Pen and Touch Input Component
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wisptis.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
Total events
16 744
Read events
16 538
Write events
206
Delete events
0

Modification events

(PID) Process:(2508) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2508) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2508) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30956070
(PID) Process:(2508) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(2508) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30956070
(PID) Process:(2508) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2508) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2508) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2508) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2508) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
5
Suspicious files
13
Text files
32
Unknown types
4

Dropped files

PID
Process
Filename
Type
2508iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:84F30EC76B2D0B96AA96C9099DD05F72
SHA256:57C6CFB23741F63A8150CB6FF4725625985F305ADFC23478233986A7D1FEA72B
2508iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:972E0A8AAFA1DC78FE6DFA40A8D46AAB
SHA256:27D399B01A129E5C8515A259E3CC7BD8BE5D260612D82D46AA33EAFB8093BC47
2508iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:B44CF174D7F9C53CC3C04B76C4743696
SHA256:ED6726C80BAF2F49EAF29313EA5B83809698A185A7A3DF553FBB0D127C152C4B
2140iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\WVFSV2C8.txttext
MD5:C4A75774BD2707964F589BE8D2FBD217
SHA256:8EB95E741ED98515B2A3F3BDAF29E2EF0CF15AAB2BC2E0DC416326589276EFC9
2140iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\3Q33TKRO.txttext
MD5:651D23D8AA38D6F12A2109130383C17F
SHA256:E130B92E32DBB66E5E4AE23287C296C75E85796F27AFCDB2B790352EF8667E1C
2140iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\1AP1RK9N.txttext
MD5:788F9A8EAE1E1017296FDDFE02777204
SHA256:7407CC2DE90DE8632CBBF85C34DCCF0DA3DDC41A7302957336ABD41CB39A4433
2140iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\launcher.ae49134bfd3775247d16[1].jstext
MD5:F84BEDA979D064A349ADF4DA4657D8AB
SHA256:B5294D51688D7CB214570CA649220E91619CD4BDDC87B5D65A249CD34A965095
2140iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\R253RLZC.txttext
MD5:F0B287ABE869810C5CA139931BBA6E0C
SHA256:9C0394E344EE3192636E3EDCA9FEE46E16AF5548DD66F0ECA2388A69117F3062
2140iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\launcher.4f9205572e17d96695d9[1].csstext
MD5:AF627F9D43C5489F4F421531533C0716
SHA256:B78883A584664A805A6FB49D3C8EACFDDAEE51D65BBD2D5B10C561141F475DE1
2140iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442binary
MD5:5FC7A4910FBFB39292935AA00712EF32
SHA256:62D3004DC188BBD2C512BE9F2BB3E99F847DFBEDB0F81CF01A4326238FF8C2AD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
27
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2508
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2508
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
2140
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
2508
iexplore.exe
GET
200
178.79.242.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?02dafc3abb161478
DE
compressed
4.70 Kb
whitelisted
2508
iexplore.exe
GET
200
95.140.236.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?dbbbf044ac87e085
GB
compressed
4.70 Kb
whitelisted
2140
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2508
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2508
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2140
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2140
iexplore.exe
52.113.194.132:443
teams.microsoft.com
Microsoft Corporation
US
suspicious
2508
iexplore.exe
178.79.242.128:80
ctldl.windowsupdate.com
Limelight Networks, Inc.
DE
malicious
2508
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2508
iexplore.exe
96.16.143.41:443
go.microsoft.com
Akamai International B.V.
US
whitelisted
2140
iexplore.exe
52.113.195.132:443
teams.microsoft.com
Microsoft Corporation
US
suspicious
2440
Update.exe
52.113.195.132:443
teams.microsoft.com
Microsoft Corporation
US
suspicious
2440
Update.exe
23.48.23.22:443
statics.teams.cdn.office.net
TRUE INTERNET Co.,Ltd.
US
suspicious

DNS requests

Domain
IP
Reputation
teams.microsoft.com
  • 52.113.194.132
  • 52.113.195.132
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ctldl.windowsupdate.com
  • 178.79.242.128
  • 95.140.236.0
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
statics.teams.cdn.office.net
  • 52.113.195.132
  • 23.48.23.22
  • 23.48.23.9
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
go.microsoft.com
  • 96.16.143.41
whitelisted

Threats

No threats detected
Process
Message
Update.exe
Update.exe Information: 0 :
Update.exe
Starting TelemetryManager constructor
Update.exe
Update.exe Information: 0 :
Update.exe
TelemetryManagerImpl creation started
Update.exe
Update.exe Information: 0 :
Update.exe
Performance counters are disabled. Skipping creation of counters category.
Update.exe
Update.exe Information: 0 :
Update.exe
RecordBatcherTask with ID 4 started.
Update.exe
Update.exe Information: 0 :
Update.exe
DataPackageSender with UserAgent name: AST-exe-C#, version: 1.10.84.0, [Ast_Default_Source]
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://teams.microsoft.com/l/meetup-join/19%3ameeting_MTM0OWU1NzEtZDA2NS00NGM4LWEzNjktYTM2YjNmYmIzYTYx%40thread.v2/0?context=%7b%22Tid%22%3a%2216a4d712-85ca-455c-bba0-139c059e16e3%22%2c%22Oid%22%3a%22d19d7750-7cab-424c-9423-58673d451fe9%22%7d