analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

index.html

Full analysis: https://app.any.run/tasks/1846eee5-ef1c-4a4b-b7d3-b92186f97bd2
Verdict: Malicious activity
Analysis date: February 21, 2020, 23:55:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/html
File info: HTML document, UTF-8 Unicode text, with very long lines
MD5:

CF8B30771E395A6D9BD51EB388ABA44D

SHA1:

6926F0B70C6F5CDBC38FDBEAE587085DE84C1371

SHA256:

235A461A4DB29EB5FA298F44F8195376AF32B034F8CB03E98A49A00F517D6C90

SSDEEP:

6144:MA5eZ6dw8WNt/iOhPcWpdQa4dqJ/eqaJo45w:H5eZNNtv2qJ+5w

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 2864)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3924)
      • chrome.exe (PID: 2864)

    • Manual execution by user

      • chrome.exe (PID: 2864)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3924)

    • Changes internet zones settings

      • iexplore.exe (PID: 3924)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2944)

    • Reads the hosts file

      • chrome.exe (PID: 2864)
      • chrome.exe (PID: 2708)

    • Reads settings of System Certificates

      • chrome.exe (PID: 2708)
      • iexplore.exe (PID: 2944)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2944)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.aiml | Artificial Intelligence Markup Language (48.3)
.htm/html | HyperText Markup Language with DOCTYPE (41.6)
.html | HyperText Markup Language (9.9)

EXIF

HTML

HTTPEquivXUACompatible: IE=edge
Title: Yahoo
HTTPEquivXDnsPrefetchControl: on
ContentType: text/html; charset=utf-8
viewport: width=device-width, initial-scale=1.0
msapplicationNavbuttonColor: red
msapplicationTileColor: #ffffff
msapplicationTileImage: https://s.yimg.com/cv/apiv2/social/images/yahoo_default_logo.png
applicationName: Yahoo
msapplicationTapHighlight: no
fullScreen: yes
browsermode: application
nightmode: disable
layoutmode: fitscreen
imagemode: force
Description: News, email and search are just the beginning. Discover more every day. Find your yodel.
Keywords: yahoo, yahoo home page, yahoo homepage, yahoo search, yahoo mail, yahoo messenger, yahoo games, news, finance, sport, entertainment
formatDetection: telephone=no
themeColor: #400090
referrer: unsafe-url
oathGuceConsentHost: guce.yahoo.com
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
72
Monitored processes
36
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3924"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\index.htmlC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2944"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3924 CREDAT:144385 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2864"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3492"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6ebaa9d0,0x6ebaa9e0,0x6ebaa9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2608"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=1520 --on-initialized-event-handle=324 --parent-handle=328 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3988"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1000,7273398566510923877,17763040525713715282,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=9454728916492468828 --mojo-platform-channel-handle=1020 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2708"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1000,7273398566510923877,17763040525713715282,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=15399153414131613295 --mojo-platform-channel-handle=1616 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
308"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1000,7273398566510923877,17763040525713715282,131072 --enable-features=PasswordImport --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=14121556739902761417 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2208 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3900"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1000,7273398566510923877,17763040525713715282,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=6774271100197795534 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2496 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3672"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1000,7273398566510923877,17763040525713715282,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=17499576059233377874 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2568 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
4 274
Read events
1 694
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
26
Text files
268
Unknown types
6

Dropped files

PID
Process
Filename
Type
3924iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF3F706D53834D4FDF.TMP —
MD5:—
SHA256:—
3924iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFC41E657ADC721A97.TMP —
MD5:—
SHA256:—
3924iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3924iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF88AE9A130D5E0A41.TMP —
MD5:—
SHA256:—
3924iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{9ED2BD33-5505-11EA-972D-5254004A04AF}.dat —
MD5:—
SHA256:—
3924iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF8676F2B2453D2666.TMP —
MD5:—
SHA256:—
3924iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{9ED2BD31-5505-11EA-972D-5254004A04AF}.dat —
MD5:—
SHA256:—
2864chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5E506DF3-B30.pma —
MD5:—
SHA256:—
2864chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000028.dbtmp —
MD5:—
SHA256:—
2864chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\bfdf8058-2f9d-40ba-990b-2ea47b22a2e4.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
55
DNS requests
32
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2708
chrome.exe
GET
302
103.224.182.239:80
http://westrenunion.com/
AU
—
—
malicious
2708
chrome.exe
GET
302
103.224.182.239:80
http://westrenunion.com/
AU
—
—
malicious
2708
chrome.exe
GET
200
91.195.240.96:80
http://ww1.westrenunion.com/
DE
html
21.2 Kb
unknown
2708
chrome.exe
GET
302
172.217.23.110:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
html
515 b
whitelisted
2708
chrome.exe
GET
200
91.195.240.96:80
http://ww1.westrenunion.com/
DE
html
21.3 Kb
unknown
2708
chrome.exe
GET
200
91.195.240.96:80
http://ww1.westrenunion.com/search/portal.php?l=OAllZjYxZDJkMTAzYTdmNDM5MWZjZjQxM2U5MDZhZDUwZAkJMzAJMAkJMzEzOTU1MjM0CXdlc3RyZW51bmlvbgkyMDQzCQkyMAkyNQkxNTgyMzI5MzM3CTAJTgkwCTEJMAkxMjA1CTc5OTA4NTAyCTg1LjIwNi4xNjYuODIJMA%3D%3D
DE
text
1.20 Kb
unknown
2708
chrome.exe
GET
200
91.195.240.96:80
http://ww1.westrenunion.com/search/tsc.php?200=MzEzOTU1MjM0&21=ODUuMjA2LjE2Ni44Mg==&681=MTU4MjMyOTM0MjY0ZGUyYWZhY2U0MjZhZGQ3ZmIwZDgxMDk2OWQyMDU0&crc=dcb16e8acfa5b1e95a6e94a2ca7f66a8c0938257&cv=1
DE
compressed
21.3 Kb
unknown
2708
chrome.exe
GET
200
91.195.240.96:80
http://ww1.westrenunion.wucq5server.westrenunion.com/
DE
html
21.3 Kb
unknown
2708
chrome.exe
GET
200
91.195.240.96:80
http://ww1.westrenunion.wucq5server.westrenunion.com/search/tsc.php?200=MzEzOTU1MjM0&21=ODUuMjA2LjE2Ni44Mg==&681=MTU4MjMyOTM0N2MzOTI3MzU1MmIxOTk0ZTk4YjQ2MWFhZGM2ZjRkYjBm&crc=1494589e2e35cd24501c7c7aefbebde4e601e408&cv=1
DE
—
—
unknown
2708
chrome.exe
GET
200
87.245.200.147:80
http://r8---sn-gxuog0-n8vl.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx?cms_redirect=yes&mip=85.206.166.82&mm=28&mn=sn-gxuog0-n8vl&ms=nvh&mt=1582328836&mv=u&mvi=7&pl=23&shardbypass=yes
RU
crx
293 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3924
iexplore.exe
13.107.21.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2944
iexplore.exe
152.199.21.71:443
us.y.atwola.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
unknown
2944
iexplore.exe
87.248.118.22:443
s.yimg.com
Yahoo! UK Services Limited
GB
shared
2944
iexplore.exe
104.111.214.103:443
sb.scorecardresearch.com
Akamai International B.V.
NL
whitelisted
2708
chrome.exe
172.217.16.195:443
www.google.com.ua
Google Inc.
US
whitelisted
2708
chrome.exe
172.217.16.142:443
clients2.google.com
Google Inc.
US
whitelisted
2708
chrome.exe
172.217.22.99:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2708
chrome.exe
172.217.23.109:443
accounts.google.com
Google Inc.
US
suspicious
2708
chrome.exe
172.217.16.138:443
fonts.googleapis.com
Google Inc.
US
whitelisted
2708
chrome.exe
172.217.23.110:80
redirector.gvt1.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
s.yimg.com
  • 87.248.118.22
  • 87.248.118.23
shared
us.y.atwola.com
  • 152.199.21.71
whitelisted
sb.scorecardresearch.com
  • 104.111.214.103
shared
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
clientservices.googleapis.com
  • 172.217.22.99
whitelisted
accounts.google.com
  • 172.217.23.109
shared
www.google.com.ua
  • 172.217.16.195
whitelisted
clients2.google.com
  • 172.217.16.142
whitelisted
fonts.googleapis.com
  • 172.217.16.138
whitelisted

Threats

PID
Process
Class
Message
2708
chrome.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
2708
chrome.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
index.html