analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://www.afiyacenter.com/mNjUlyHHjzfP7MjID/vqgFghjUHCnMaI/

Full analysis: https://app.any.run/tasks/93ef4812-b447-4667-b8e7-ec9e02311cb8
Verdict: Malicious activity
Analysis date: June 19, 2019, 16:31:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

D46035A23AA09CA70E936AD743EBFC76

SHA1:

235C3D6C3DE3015B9340608552248476A4947C60

SHA256:

1D78EEC8E33EB90E3903D6C48AC44365F682D2E1540B54A2308506DEC4EA2B7F

SSDEEP:

3:N1KJS4xLOGKm3tP5LHCNIt8oFK:Cc4xLOk/LHCyt5w

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Executed via COM

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 996)
    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 1916)
  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 3172)
    • Reads internet explorer settings

      • iexplore.exe (PID: 2672)
    • Application launched itself

      • iexplore.exe (PID: 3172)
      • chrome.exe (PID: 1916)
    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 2672)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2672)
    • Creates files in the user directory

      • iexplore.exe (PID: 2672)
      • iexplore.exe (PID: 3172)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 996)
    • Manual execution by user

      • chrome.exe (PID: 1916)
    • Reads settings of System Certificates

      • chrome.exe (PID: 1916)
      • iexplore.exe (PID: 2672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
72
Monitored processes
39
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3172"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2672"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3172 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
3221225547
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
996C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exesvchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Version:
26,0,0,131
1916"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
3221225547
Version:
73.0.3683.75
3372"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=73.0.3683.75 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6f5e0f18,0x6f5e0f28,0x6f5e0f34C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
2896"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=544 --on-initialized-event-handle=308 --parent-handle=312 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
3192"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=964,15495639994422557233,17980465426009013049,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwAAAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=11780592205651006071 --mojo-platform-channel-handle=960 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
3008"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=964,15495639994422557233,17980465426009013049,131072 --enable-features=PasswordImport --service-pipe-token=466397283990426492 --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=466397283990426492 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2024 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
2852"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=964,15495639994422557233,17980465426009013049,131072 --enable-features=PasswordImport --service-pipe-token=8380724827126286536 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=8380724827126286536 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2168 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
2972"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=964,15495639994422557233,17980465426009013049,131072 --enable-features=PasswordImport --service-pipe-token=10777218520550000533 --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=10777218520550000533 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2100 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
Total events
1 129
Read events
946
Write events
175
Delete events
8

Modification events

(PID) Process:(3172) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3172) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3172) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3172) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(3172) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3172) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000071000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3172) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{C6A5EA0B-92AF-11E9-A09E-5254004A04AF}
Value:
0
(PID) Process:(3172) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(3172) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
1
(PID) Process:(3172) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E3070600030013001000200007005C02
Executable files
0
Suspicious files
161
Text files
299
Unknown types
33

Dropped files

PID
Process
Filename
Type
3172iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico
MD5:
SHA256:
3172iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
MD5:
SHA256:
2672iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LI82YMJV\vqgFghjUHCnMaI[1].txt
MD5:
SHA256:
2672iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LI82YMJV\b[1].txt
MD5:
SHA256:
2672iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LI82YMJV\vqgFghjUHCnMaI[1].htmhtml
MD5:B3CD404816FE7CE126C714C5E0FCAD82
SHA256:DE8B747854EF5C2D7949257224732329D69F04B87628C63F534316C207EFD013
2672iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LI82YMJV\b[1].htmhtml
MD5:51E9D04EA052D612545DEDB1531E395C
SHA256:B02A02CCF239B2102C782BEA7AEAB0D8D14D90EFD8F5EA55776829B19216D8BE
3172iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019061920190620\index.datdat
MD5:5ADED08573607D12B3289762EA8BA5CB
SHA256:241EED6F9E1429E0664E5CAE2D08F31DE1165894EEF2C802BBCF333FE17FC959
2672iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VXBQPGHI\implement-r[1].jstext
MD5:C9590D94F46084CC8D806D426E81E9DD
SHA256:6C90579BFB9A9CC27C6C8C1493347BA730DA2CBB322D13477F3D4191F19991AB
2672iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:F2D31BDE8FCE3141E159BB78E5140537
SHA256:09F9C4F42A3BFD4144879EBB6F79238036D545E1570068B3A252C114253C7EE1
2672iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019061920190620\index.datdat
MD5:064EA7BDFB2AA0C525E1D49DF46531F6
SHA256:417174BEEBB164AF7A7417F158AD8BCEE6A41605D684068FC1ABB21E9F7A40B2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
76
TCP/UDP connections
91
DNS requests
59
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3172
iexplore.exe
GET
200
76.164.197.18:80
http://www.afiyacenter.com/favicon.ico
US
unknown
2672
iexplore.exe
GET
302
159.203.183.115:80
http://searchbygem.com/ec.php?k=1518&kc=3733766&ks=0&kf=0&pc=1803&t1=shinin9&t2=0&t3=&t4=&u=&u2=
US
unknown
2672
iexplore.exe
GET
200
159.203.183.115:80
http://globalsearchtoday.com/b/?k=1518&pc=33082980&ct=31&b_tt=c_1518_8237&st=House%20Cleaning%20Service&kc=3733766&t2=0&t3=&uuid=7a332731-785a-48e3-a116-461e28ee8dac&ltid0=80988&odata=US9xNGdBenFRa285RnZ3SG9vdDlmd3BvUVlZNCt3azU
US
html
7.62 Kb
unknown
2672
iexplore.exe
GET
200
76.164.197.18:80
http://www.afiyacenter.com/mNjUlyHHjzfP7MjID/vqgFghjUHCnMaI/
US
html
536 b
unknown
2672
iexplore.exe
GET
200
159.203.183.115:80
http://globalsearchtoday.com/abp/px.gif?ch=1&rn=2.1016275706081253
US
image
43 b
unknown
2672
iexplore.exe
GET
200
35.190.36.172:80
http://cdn.fqtag.com/1.18.277-c283d97/pixel.js
US
text
20.3 Kb
whitelisted
3172
iexplore.exe
GET
200
76.164.197.18:80
http://www.afiyacenter.com/favicon.ico
US
unknown
2672
iexplore.exe
GET
200
35.190.72.161:80
http://fqtag.com/js/implement-r.js?org=LimCvrn1Q4n9E64AH1nz&p=1803&a=366072&cmp=0&rt=click&sl=1
US
text
907 b
whitelisted
2672
iexplore.exe
GET
200
159.203.183.115:80
http://globalsearchtoday.com/b/?k=1518&pc=33082980&ct=31&b_tt=c_1518_8237&st=House%20Cleaning%20Service&kc=3733766&t2=0&t3=&uuid=be7f02c5-32f9-4236-85f6-7394347f864f&odata=US9xNGdBenFRa285RnZ3SG9vdDlmd3BvUVlZNCt3azU
US
html
6.79 Kb
unknown
2672
iexplore.exe
GET
302
159.203.183.115:80
http://searchbygem.com/ec.php?k=1518&kc=3733766&ks=0&kf=0&pc=1803&t1=shinin9&t2=0&t3=&t4=&u=&u2=
US
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3172
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3172
iexplore.exe
76.164.197.18:80
www.afiyacenter.com
Versaweb, LLC
US
unknown
2672
iexplore.exe
172.217.22.14:443
www.google-analytics.com
Google Inc.
US
whitelisted
2672
iexplore.exe
172.217.18.163:443
fonts.gstatic.com
Google Inc.
US
whitelisted
2672
iexplore.exe
216.58.205.234:443
fonts.googleapis.com
Google Inc.
US
whitelisted
2672
iexplore.exe
35.190.36.172:80
cdn.fqtag.com
Google Inc.
US
whitelisted
2672
iexplore.exe
172.217.23.170:443
fonts.googleapis.com
Google Inc.
US
whitelisted
2672
iexplore.exe
35.190.72.161:80
fqtag.com
Google Inc.
US
whitelisted
2672
iexplore.exe
209.197.3.15:443
stackpath.bootstrapcdn.com
Highwinds Network Group, Inc.
US
whitelisted
2672
iexplore.exe
159.203.183.115:80
searchbygem.com
Digital Ocean, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.afiyacenter.com
  • 76.164.197.18
unknown
searchbygem.com
  • 159.203.183.115
unknown
globalsearchtoday.com
  • 159.203.183.115
unknown
stackpath.bootstrapcdn.com
  • 209.197.3.15
whitelisted
fqtag.com
  • 35.190.72.161
unknown
use.fontawesome.com
  • 23.111.9.35
whitelisted
fonts.googleapis.com
  • 172.217.23.170
  • 216.58.205.234
whitelisted
ajax.googleapis.com
  • 216.58.205.234
  • 172.217.21.234
  • 172.217.22.10
  • 172.217.23.138
  • 216.58.206.10
  • 216.58.207.42
  • 172.217.16.170
  • 216.58.208.42
  • 172.217.16.138
  • 172.217.22.106
  • 172.217.16.202
  • 172.217.18.106
  • 172.217.21.202
whitelisted
www.google-analytics.com
  • 172.217.22.14
  • 172.217.18.174
whitelisted

Threats

No threats detected
No debug info