URL: | https://anonfiles.com/P5ec9fs9yb/s4_Yahoo_Checker_rar |
Full analysis: | https://app.any.run/tasks/af48cfa0-4376-4ca2-a4f3-d7722bf13acf |
Verdict: | Malicious activity |
Analysis date: | June 27, 2022, 09:56:40 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | 8BCF126D81938AF6B9C7AE33DED2F568 |
SHA1: | 1D0FDC5CDE01424567933E57EA150FD4EBCEA349 |
SHA256: | 21272ED66F94B396B99B25D441FAC44896406D5ECC72ED37F019E0C831FF222A |
SSDEEP: | 3:N8M2brHNR68EYKNEc:2M2brHm8Eqc |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2568 | "C:\Program Files\Internet Explorer\iexplore.exe" "https://anonfiles.com/P5ec9fs9yb/s4_Yahoo_Checker_rar" | C:\Program Files\Internet Explorer\iexplore.exe | Explorer.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
2864 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2568 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
2572 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\s4 Yahoo Checker.rar" | C:\Program Files\WinRAR\WinRAR.exe | iexplore.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 | ||||
3000 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\system32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Version: 7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211) | ||||
1092 | "C:\Users\admin\Desktop\s4 Yahoo Checker\S4 Yahoo Checker.exe" | C:\Users\admin\Desktop\s4 Yahoo Checker\S4 Yahoo Checker.exe | — | Explorer.EXE |
User: admin Integrity Level: MEDIUM Description: Launcher Exit code: 0 Version: 1.0.0.0 | ||||
2660 | "C:\Users\admin\Desktop\s4 Yahoo Checker\LIB\Launcher.exe" | C:\Users\admin\Desktop\s4 Yahoo Checker\LIB\Launcher.exe | S4 Yahoo Checker.exe | |
User: admin Integrity Level: HIGH Description: Launcher Exit code: 0 Version: 1.0.0.0 | ||||
2356 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\ | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | Launcher.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 1 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) | ||||
2736 | "C:\Users\admin\Desktop\s4 Yahoo Checker\LIB\ldm.exe" | C:\Users\admin\Desktop\s4 Yahoo Checker\LIB\ldm.exe | S4 Yahoo Checker.exe | |
User: admin Company: S4 Integrity Level: HIGH Description: S4 Version: 1.0.0.0 | ||||
840 | "C:\Windows\IMF\Windows Services.exe" {Arguments If Needed} | C:\Windows\IMF\Windows Services.exe | — | Launcher.exe |
User: admin Integrity Level: HIGH Description: Windows Services Version: 1.0.0.0 | ||||
2592 | "C:\Windows\IMF\Secure System Shell.exe" | C:\Windows\IMF\Secure System Shell.exe | — | Windows Services.exe |
User: admin Integrity Level: HIGH Description: Secure System Shell Version: 1.0.0.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2568 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63 | der | |
MD5:28CC3D4B0DA8A29A9DCD6D4755C84342 | SHA256:A4CA2DD1D4545838F7A9102623442BC76BDEB2185E9991A294BCB0B6456DDA0E | |||
2864 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 | binary | |
MD5:36ECACCA57C4B6A7B4659E365CB6866B | SHA256:BDA9DE77805BEC90B90423967EF83D4D028446417986A76A2BE423445229B733 | |||
2864 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:E7028E2149582565244AAB03846A2460 | SHA256:530EE890479D9449A1E1C4EEB430C65F3842501A47EFDC1E3E4787A1EADA2B66 | |||
2864 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\s4_Yahoo_Checker_rar[1].htm | html | |
MD5:CDC2C8A076827C35F2F4B56275A0B28F | SHA256:284DE6F6316978006F18D305CD407C172F186F258254EB9D8354D033E781F467 | |||
2864 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Cab618F.tmp | compressed | |
MD5:308336E7F515478969B24C13DED11EDE | SHA256:889B832323726A9F10AD03F85562048FDCFE20C9FF6F9D37412CF477B4E92FF9 | |||
2864 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Tar6190.tmp | cat | |
MD5:2D8A5090656DE9FB55DD0F3BA20F9299 | SHA256:44AE1E61A4E6305C15AAA52FD1B29DDB060E69233703CBA611F5E781D766442E | |||
2864 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 | compressed | |
MD5:308336E7F515478969B24C13DED11EDE | SHA256:889B832323726A9F10AD03F85562048FDCFE20C9FF6F9D37412CF477B4E92FF9 | |||
2568 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63 | binary | |
MD5:725F2C9D1F837BDFD318B82002BF280F | SHA256:B5D9E2D666AC633925EEEA48CD218383B708256ED4DE39D00940BCDA354D7285 | |||
2864 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\app[1].js | text | |
MD5:F0626F7951F77EC730D1B3A53C291016 | SHA256:6DC4208F5C103390AFBA664C79F9B0474E7439276DC71AEF460B02D5A6C4949D | |||
2568 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\favicon[2].ico | image | |
MD5:DA597791BE3B6E732F0BC8B20E38EE62 | SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2568 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D | US | der | 1.47 Kb | whitelisted |
2864 | iexplore.exe | GET | 200 | 184.24.77.67:80 | http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgMKkbL8LAFVsPfjhHUkFjxBXA%3D%3D | US | der | 503 b | shared |
2864 | iexplore.exe | GET | 200 | 188.114.99.173:80 | http://ocsp2.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEHophRq39F1meVBmQbb%2F1x0%3D | US | der | 1.40 Kb | whitelisted |
2864 | iexplore.exe | GET | 200 | 93.184.221.240:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?9bd51c455daa7161 | US | compressed | 60.0 Kb | whitelisted |
2864 | iexplore.exe | GET | 200 | 18.66.137.173:80 | http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D | US | der | 1.70 Kb | whitelisted |
2864 | iexplore.exe | GET | 200 | 93.184.221.240:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f1e602415c584d2e | US | compressed | 4.70 Kb | whitelisted |
2864 | iexplore.exe | GET | 200 | 18.66.242.155:80 | http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D | US | der | 1.51 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2864 | iexplore.exe | 184.24.77.67:80 | r3.o.lencr.org | Time Warner Cable Internet LLC | US | unknown |
2568 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2864 | iexplore.exe | 96.16.145.230:80 | x1.c.lencr.org | Akamai Technologies, Inc. | US | suspicious |
2864 | iexplore.exe | 45.154.253.152:443 | anonfiles.com | — | — | suspicious |
2568 | iexplore.exe | 131.253.33.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
2864 | iexplore.exe | 93.184.221.240:80 | ctldl.windowsupdate.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2864 | iexplore.exe | 151.101.2.217:443 | vjs.zencdn.net | Fastly | US | suspicious |
2864 | iexplore.exe | 143.204.101.138:443 | djv99sxoqpv11.cloudfront.net | — | US | unknown |
2864 | iexplore.exe | 188.114.99.173:80 | ocsp2.globalsign.com | Cloudflare Inc | US | unknown |
2864 | iexplore.exe | 195.96.151.42:443 | cdn-148.anonfiles.com | Archway S.r.l | IQ | suspicious |
Domain | IP | Reputation |
---|---|---|
anonfiles.com |
| shared |
ctldl.windowsupdate.com |
| whitelisted |
x1.c.lencr.org |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
r3.o.lencr.org |
| shared |
vjs.zencdn.net |
| whitelisted |
djv99sxoqpv11.cloudfront.net |
| shared |
ocsp2.globalsign.com |
| whitelisted |