| download: | t78sw |
| Full analysis: | https://app.any.run/tasks/6afa772e-9a07-4230-ad48-8dc730ae687d |
| Verdict: | No threats detected |
| Analysis date: | November 26, 2018, 17:05:01 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | text/html |
| File info: | HTML document, UTF-8 Unicode text, with very long lines |
| MD5: | E54F21ED5739B6A9D13021C5A78E3A6D |
| SHA1: | 31EBE596A6DB87C267CA11229B3F91E713A792B0 |
| SHA256: | 2058B3B9B3E2560603ABF14CEB2E3CDA19F71ED8E18D922943E64A4F967491DE |
| SSDEEP: | 1536:BZyUv/6VzBqo6Ngv/b/15NWUw0fJR+aPbOg/MnbEwGvMF/b4jt837JFi8ltWvJga:BZd7AD15NmGvUimi/H61/feLtrbj |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
Changes internet zones settings
- iexplore.exe (PID: 2956)
Application launched itself
- iexplore.exe (PID: 2956)
Adds / modifies Windows certificates
- iexplore.exe (PID: 3352)
- iexplore.exe (PID: 2956)
Reads settings of System Certificates
- iexplore.exe (PID: 3352)
- iexplore.exe (PID: 2956)
Creates files in the user directory
- iexplore.exe (PID: 3352)
- iexplore.exe (PID: 3540)
Changes settings of System certificates
- iexplore.exe (PID: 3352)
- iexplore.exe (PID: 2956)
Reads Internet Cache Settings
- iexplore.exe (PID: 3352)
- iexplore.exe (PID: 3540)
Reads internet explorer settings
- iexplore.exe (PID: 3352)
- iexplore.exe (PID: 3540)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .htm/html | | | HyperText Markup Language with DOCTYPE (80.6) |
|---|---|---|
| .html | | | HyperText Markup Language (19.3) |
Total processes
34
Monitored processes
3
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2956 | "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\t78sw.htm | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3352 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2956 CREDAT:79873 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3540 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2956 CREDAT:203009 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
655
Read events
547
Write events
103
Delete events
5
Modification events
| (PID) Process: | (2956) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
| (PID) Process: | (2956) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2956) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (2956) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones |
| Operation: | write | Name: | SecuritySafe |
Value: 1 | |||
| (PID) Process: | (2956) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (2956) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2956) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active |
| Operation: | write | Name: | {72D25D91-F19D-11E8-834A-5254004A04AF} |
Value: 0 | |||
| (PID) Process: | (3352) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore |
| Operation: | write | Name: | Type |
Value: 3 | |||
| (PID) Process: | (3352) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore |
| Operation: | write | Name: | Count |
Value: 3 | |||
| (PID) Process: | (3352) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore |
| Operation: | write | Name: | Time |
Value: E2070B0001001A00110005001200BF03 | |||
Executable files
0
Suspicious files
1
Text files
198
Unknown types
6
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2956 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 2956 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 3352 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\cb851d15708e4c908c009025c3f8bc061b5829c7[1].jpg | image | |
MD5:— | SHA256:— | |||
| 3352 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\12ce9754dc511b77f892c37233b298639a76c329[1].jpg | image | |
MD5:— | SHA256:— | |||
| 3352 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\076ff9d962cb273ccfbd6c786168af33484a98ed[1].jpg | image | |
MD5:— | SHA256:— | |||
| 3352 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\bc09e60048894d2299cb66ae3a7d348b942f34fa[1].jpg | image | |
MD5:— | SHA256:— | |||
| 3352 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\8cf502904a54ffe40f2f50f913fc0bcac6144914[1].jpg | image | |
MD5:— | SHA256:— | |||
| 3352 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2YPIJ90\3a87dc1f72cd88cc566c38bfd7b91a83dbfa830f[1].jpg | image | |
MD5:— | SHA256:— | |||
| 3352 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\93ba6ec34202dace94fe1be68783d7050cfdc18f[1].jpg | image | |
MD5:— | SHA256:— | |||
| 3352 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\13964792b1feb3b0f8dd369c885983d5358eb77c[1].jpg | image | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
31
DNS requests
6
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3540 | iexplore.exe | GET | — | 195.201.83.247:80 | http://www.jeunefemmes.com/assets/html.css | RU | — | — | unknown |
3540 | iexplore.exe | GET | 302 | 195.201.83.247:80 | http://www.joliteens.com/free/free_gal.php?id=51&aux1=80&url=http://www.jeunefemmes.com/classique/ | RU | — | — | unknown |
3540 | iexplore.exe | GET | 200 | 195.201.83.247:80 | http://www.jeunefemmes.com/met-png-round/rot140.php | RU | image | 27.3 Kb | unknown |
3540 | iexplore.exe | GET | 200 | 195.201.83.247:80 | http://www.jeunefemmes.com/classique/preview/met-art_5804.jpg | RU | image | 4.61 Kb | unknown |
3540 | iexplore.exe | GET | 200 | 195.201.83.247:80 | http://www.jeunefemmes.com/classique/preview/met-art_5805.jpg | RU | image | 4.63 Kb | unknown |
3540 | iexplore.exe | GET | 200 | 195.201.83.247:80 | http://www.jeunefemmes.com/assets/html.css | RU | text | 1.39 Kb | unknown |
3540 | iexplore.exe | GET | 200 | 195.201.83.247:80 | http://www.jeunefemmes.com/classique/preview/met-art_5792.jpg | RU | image | 6.21 Kb | unknown |
3540 | iexplore.exe | GET | 200 | 195.201.83.247:80 | http://www.jeunefemmes.com/classique/preview/met-art_5810.jpg | RU | image | 4.20 Kb | unknown |
3540 | iexplore.exe | GET | 200 | 195.201.83.247:80 | http://www.jeunefemmes.com/classique/preview/met-art_6000.jpg | RU | image | 4.77 Kb | unknown |
3540 | iexplore.exe | GET | 200 | 195.201.83.247:80 | http://www.jeunefemmes.com/classique/ | RU | html | 2.28 Kb | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3352 | iexplore.exe | 51.15.97.128:443 | archive.is | Online S.a.s. | FR | unknown |
2956 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3540 | iexplore.exe | 51.15.97.128:443 | archive.is | Online S.a.s. | FR | unknown |
3540 | iexplore.exe | 195.201.83.247:80 | www.joliteens.com | Awanti Ltd. | RU | unknown |
2956 | iexplore.exe | 195.201.83.247:80 | www.joliteens.com | Awanti Ltd. | RU | unknown |
2956 | iexplore.exe | 51.15.97.128:443 | archive.is | Online S.a.s. | FR | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
archive.is |
| suspicious |
www.bing.com |
| whitelisted |
95.211.188.11.nl.scw74.94345838.pixel.archive.is |
| unknown |
www.joliteens.com |
| unknown |
www.jeunefemmes.com |
| unknown |
www.jeunelle.com |
| unknown |