analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| download: | europe-middle-east-africa-emea |
| Full analysis: | https://app.any.run/tasks/b1e845ea-67d1-47b4-b30b-78db14e2ee07 |
| Verdict: | Malicious activity |
| Analysis date: | October 14, 2019, 20:10:03 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | text/html |
| File info: | HTML document, UTF-8 Unicode text, with very long lines |
| MD5: | 0E031F1CB31235B3C7A0EA0772A55C04 |
| SHA1: | 4723B09900E47DBEA9FAF11BA07BF998898073BB |
| SHA256: | 219CC8485BFB02638D037CE53FDC1C0F369E3DE021D179A64F134D61012D7B22 |
| SSDEEP: | 3072:EHGEbWT/d5zG0J2cTBRArTMqXJOphsRgve81Hr0HK4kH7pqHNgdH0hHKnEHWdH2x:EHDcTBRArTMqXJOphsRgG74xqz |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
Reads Internet Cache Settings
- iexplore.exe (PID: 2504)
Application launched itself
- iexplore.exe (PID: 1556)
Creates files in the user directory
- iexplore.exe (PID: 2504)
Reads internet explorer settings
- iexplore.exe (PID: 2504)
Changes internet zones settings
- iexplore.exe (PID: 1556)
Reads settings of System Certificates
- iexplore.exe (PID: 2504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .htm/html | | | HyperText Markup Language with DOCTYPE (80.6) |
|---|---|---|
| .html | | | HyperText Markup Language (19.3) |
EXIF
HTML
| HTTPEquivCleartype: | on |
|---|---|
| viewport: | width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no |
| HandheldFriendly: | |
| MobileOptimized: | width |
| Title: | Contact Us | EMEA |
| googleSiteVerification: | 9j8qiOTQ0iAaETPkP7_yL0-dg0PDQL0qW3DPvwPlvXg |
| msvalidate01: | 9C75077AE08E824E7CC3F3A25F8D182D |
| Generator: | Drupal 7 (http://drupal.org) |
| Description: | Contact West Unified Communications Services offices in Europe, Middle East and Africa (EMEA). |
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 1556 | "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\europe-middle-east-africa-emea.htm | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 2504 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1556 CREDAT:79873 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
Total events
399
Read events
322
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
35
Unknown types
4
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1556 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 1556 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 2504 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\js_-9-t5t3cxgBM0qlyUvU_F3LDJA0oEpwRLCkDl8ZEGmw[1].js | text | |
MD5:85B1BC7E8EA1CA50330FC056EE9E6AD7 | SHA256:FBDFADE6DDDCC6004CD2A97252F53F1772C3240D28129C112C290397C6441A6C | |||
| 2504 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\api[1].js | text | |
MD5:1D1D1B8B32258E9B2CEBB65AEEEEBC77 | SHA256:1DD13A9FC794998E8574D584F6C78D737DB943AD73A80245F9AC393E9E09790B | |||
| 2504 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\js_m6OWP4akAO2_XaBn6NBtvpGm58dfmtHrQhktra90UzQ[1].js | text | |
MD5:0C07E66D3B9ADBE691725B4A0629A9D5 | SHA256:9BA3963F86A400EDBF5DA067E8D06DBE91A6E7C75F9AD1EB42192DADAF745334 | |||
| 2504 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\js_ocUCH5KDyoO03OHo8ucOMoLEPMowmCkg0mUP9EHm8pQ[1].js | text | |
MD5:1AF096AE331FD2C72D4BA55FACB9F179 | SHA256:A1C5021F9283CA83B4DCE1E8F2E70E3282C43CCA30982920D2650FF441E6F294 | |||
| 2504 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\css_nCfBclPckLay7fV70jgH9WLLinjDPQ2HFmWO3M7vOaE[1].css | text | |
MD5:DD270B2598068E3C7524CCA1B9F10809 | SHA256:9C27C17253DC90B6B2EDF57BD23807F562CB8A78C33D0D8716658EDCCEEF39A1 | |||
| 2504 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\css_Bb2UQwhX0P7AS13cRxramAccdjVZ8_JWvk9HT8Xn7AI[1].css | text | |
MD5:29CCFA1D4ADE50EE51BB2A8593138DFD | SHA256:05BD94430857D0FEC04B5DDC471ADA98071C763559F3F256BE4F474FC5E7EC02 | |||
| 2504 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\css_9YJ6Kpp9ROwGz_vqBpCBgk30a5INlGiLJS9IjquK13k[1].css | text | |
MD5:ACE98A8118358C69B4C0F90D17C68C5B | SHA256:F5827A2A9A7D44EC06CFFBEA069081824DF46B920D94688B252F488EAB8AD779 | |||
| 2504 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\fontello[1].eot | eot | |
MD5:4475DF1C28DE3C31FC8E57004CCE1E76 | SHA256:5F47746B217E1BAB94E2B03C8D70AA1654C34FA7E192622AC9536F2C480CE757 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
29
DNS requests
9
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2504 | iexplore.exe | OPTIONS | 400 | 172.217.21.232:80 | http://www.googletagmanager.com/ | US | html | 1.52 Kb | whitelisted |
2504 | iexplore.exe | OPTIONS | 400 | 172.217.21.232:80 | http://www.googletagmanager.com/ | US | html | 1.52 Kb | whitelisted |
2504 | iexplore.exe | OPTIONS | 400 | 172.217.21.232:80 | http://www.googletagmanager.com/ | US | html | 1.52 Kb | whitelisted |
2504 | iexplore.exe | OPTIONS | 400 | 172.217.21.232:80 | http://www.googletagmanager.com/ | US | html | 1.52 Kb | whitelisted |
2504 | iexplore.exe | OPTIONS | 400 | 172.217.21.232:80 | http://www.googletagmanager.com/ | US | html | 1.52 Kb | whitelisted |
2504 | iexplore.exe | OPTIONS | 400 | 172.217.21.232:80 | http://www.googletagmanager.com/ | US | html | 1.52 Kb | whitelisted |
2504 | iexplore.exe | OPTIONS | 400 | 172.217.21.232:80 | http://www.googletagmanager.com/ | US | html | 1.52 Kb | whitelisted |
2504 | iexplore.exe | OPTIONS | 400 | 172.217.21.232:80 | http://www.googletagmanager.com/ | US | html | 1.52 Kb | whitelisted |
1556 | iexplore.exe | GET | 200 | 13.107.21.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
2504 | iexplore.exe | OPTIONS | 400 | 172.217.21.232:80 | http://www.googletagmanager.com/ | US | html | 1.52 Kb | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1556 | iexplore.exe | 13.107.21.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2504 | iexplore.exe | 172.217.23.163:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
2504 | iexplore.exe | 172.217.18.170:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
2504 | iexplore.exe | 172.217.23.106:443 | maps.googleapis.com | Google Inc. | US | whitelisted |
2504 | iexplore.exe | 216.58.207.68:443 | www.google.com | Google Inc. | US | whitelisted |
4 | System | 172.217.21.232:445 | www.googletagmanager.com | Google Inc. | US | whitelisted |
2504 | iexplore.exe | 104.20.38.125:443 | www.westuc.com | Cloudflare Inc | US | shared |
2504 | iexplore.exe | 104.20.39.125:443 | www.westuc.com | Cloudflare Inc | US | shared |
2504 | iexplore.exe | 136.147.110.2:443 | c.la4-c2-dfw.salesforceliveagent.com | Salesforce.com, Inc. | US | unknown |
2504 | iexplore.exe | 172.217.21.232:80 | www.googletagmanager.com | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.bing.com |
| whitelisted |
www.westuc.com |
| unknown |
fonts.googleapis.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
www.google.com |
| whitelisted |
maps.googleapis.com |
| whitelisted |
www.googletagmanager.com |
| whitelisted |
c.la4-c2-dfw.salesforceliveagent.com |
| whitelisted |
Threats
10 ETPRO signatures available at the full report