Malware analysis https://cegoffchade1988.blogspot.com.au/ Malicious activity

Add for printing

URL:	https://cegoffchade1988.blogspot.com.au/
Full analysis:	https://app.any.run/tasks/42250a95-c1d4-488e-8f9b-ac7a74371be4
Verdict:	Malicious activity
Analysis date:	January 18, 2019, 09:28:37
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:	EB12DD456711E3C2D7F1F4EAFB765065
SHA1:	56C9C82506A4E0AE4001DCEE8951DE0556DBA137
SHA256:	2380507EDF418CDF4AFAAEE170D52AAD7470174C187CFB72D106FB5689A8CA66
SSDEEP:	3:N8dCKDDGNEzoKlK:2AYaNKQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (68.0.3440.106)
Google Update Helper (1.3.33.17)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
Mozilla Firefox 61.0.2 (x86 en-US) (61.0.2)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
No suspicious indicators.
INFO
- Reads settings of System Certificates
  - chrome.exe (PID: 2312)
  - iexplore.exe (PID: 3464)
- Application launched itself
  - iexplore.exe (PID: 3464)
  - chrome.exe (PID: 2312)
- Creates files in the user directory
  - iexplore.exe (PID: 3464)
  - iexplore.exe (PID: 3736)
- Reads internet explorer settings
  - iexplore.exe (PID: 3736)
- Changes settings of System certificates
  - iexplore.exe (PID: 3464)
- Adds / modifies Windows certificates
  - iexplore.exe (PID: 3464)
- Reads Internet Cache Settings
  - iexplore.exe (PID: 3736)
- Changes internet zones settings
  - iexplore.exe (PID: 3464)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
3464	"C:\Program Files\Internet Explorer\iexplore.exe" -nohome	C:\Program Files\Internet Explorer\iexplore.exe		explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)
3736	"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3464 CREDAT:71937	C:\Program Files\Internet Explorer\iexplore.exe		iexplore.exe
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)
2312	"C:\Program Files\Google\Chrome\Application\chrome.exe"	C:\Program Files\Google\Chrome\Application\chrome.exe		explorer.exe
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Version: 68.0.3440.106
3228	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=68.0.3440.106 --initial-client-data=0x78,0x7c,0x80,0x74,0x84,0x6cf400b0,0x6cf400c0,0x6cf400cc	C:\Program Files\Google\Chrome\Application\chrome.exe	—	chrome.exe
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Version: 68.0.3440.106
2752	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2320 --on-initialized-event-handle=304 --parent-handle=308 /prefetch:6	C:\Program Files\Google\Chrome\Application\chrome.exe	—	chrome.exe
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Version: 68.0.3440.106
4060	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=944,2480983564651447701,8565567095361692754,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=4FA6BFA74BA88F0756F6D45190AF02F6 --mojo-platform-channel-handle=992 --ignored=" --type=renderer " /prefetch:2	C:\Program Files\Google\Chrome\Application\chrome.exe	—	chrome.exe
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Version: 68.0.3440.106
3144	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=944,2480983564651447701,8565567095361692754,131072 --enable-features=PasswordImport --service-pipe-token=524C4938B42E7865E8492A1EAC425C92 --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=524C4938B42E7865E8492A1EAC425C92 --renderer-client-id=5 --mojo-platform-channel-handle=1928 /prefetch:1	C:\Program Files\Google\Chrome\Application\chrome.exe	—	chrome.exe
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Version: 68.0.3440.106
3892	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=944,2480983564651447701,8565567095361692754,131072 --enable-features=PasswordImport --service-pipe-token=E2723E24FB0EE7FD30BA42ABED0D36CC --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=E2723E24FB0EE7FD30BA42ABED0D36CC --renderer-client-id=3 --mojo-platform-channel-handle=2064 /prefetch:1	C:\Program Files\Google\Chrome\Application\chrome.exe	—	chrome.exe
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106
3768	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=944,2480983564651447701,8565567095361692754,131072 --enable-features=PasswordImport --disable-gpu-compositing --service-pipe-token=387412987984D73704161D77D91ADF09 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=387412987984D73704161D77D91ADF09 --renderer-client-id=6 --mojo-platform-channel-handle=3116 /prefetch:1	C:\Program Files\Google\Chrome\Application\chrome.exe	—	chrome.exe
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Version: 68.0.3440.106
3352	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=944,2480983564651447701,8565567095361692754,131072 --enable-features=PasswordImport --disable-gpu-sandbox --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=7366833F81A83B02F1FA2E96F1842896 --mojo-platform-channel-handle=3872 /prefetch:2	C:\Program Files\Google\Chrome\Application\chrome.exe	—	chrome.exe
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 68.0.3440.106

Add for printing

Total events

581

Read events

468

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

Text files

127

Unknown types

Dropped files

PID	Process	Filename		Type
3464	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico		—
		MD5:—	SHA256:—
3464	iexplore.exe	C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico		—
		MD5:—	SHA256:—
3736	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\cegoffchade1988_blogspot_com[1].txt		—
		MD5:—	SHA256:—
3736	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\cegoffchade1988_blogspot_com[1].htm		html
		MD5:5D5C81510F4B553B291068F804FC0E0C	SHA256:677FBB567E5B8A41F310468663F6022EAEDAE93940218998E380F9F72666F7FB
3736	iexplore.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@juntre[1].txt		text
		MD5:0784CA9D4D379C44C27476CA74B3734D	SHA256:2E3B7DF5177C7F3BC9CB2DBF4F5F07D56B6891065C6DBCC58D5110CD126D1DB5
3736	iexplore.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@gg[1].txt		text
		MD5:035B34EF759129DE884ECDCB8EA25883	SHA256:95D316E1B0548E3ACABEABCCEE8489A30E82F40C195B7E4A06C25A2374F7CAF4
3736	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\timer[1].js		text
		MD5:2919284BD8399B8C7FB6B6E4B1C1EC0F	SHA256:16455DB20C83E961765F27565F0903B3EA19CFBD6809884DFDF1CD3BE0DDCAE3
3736	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\211300122-widgets[1].js		text
		MD5:12926C0E6033D425F424771F4BBE3A7C	SHA256:4DC814BE3C423A930D46F18AD50F1F3DB9B57F4F657DC7ED7C9D1F825F7A9E89
3736	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\2006463801-indie_compiled[1].js		text
		MD5:FFD740A6B6DB5D3FC3B390A5E83933C0	SHA256:DC1F3B45AA62A17334B662F99F67A34E386F52C133EFCD5E99A86754A317A27D
3736	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\clipboard.min[1].js		text
		MD5:D3A8DB521C9136A5362B14525E20B459	SHA256:A00D3CABD4A8DBDBD2E992E238D11EC889FB3CC7751D9BC271F063A17EC8BF7D

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

126

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
3736	iexplore.exe	GET	302	104.31.95.206:80	http://vip.juntre.club/tracker?offer_id=2164&aff_id=225&pl=401:100&cb=1&gl=off	US	—	—	suspicious
3736	iexplore.exe	GET	301	104.27.202.93:80	http://gg.gg/cwtna	US	—	—	shared
3736	iexplore.exe	GET	200	104.31.94.206:80	http://prl.juntre.club/prelands/401/images/asseenin.jpg	US	image	17.2 Kb	suspicious
3736	iexplore.exe	GET	404	104.31.94.206:80	http://prl.juntre.club/prelands/401/cnnmoney-icons.eot%3F%22)%20format(%22embedded-opentype%22),%20url(%22../fonts/cnnmoney-icons.woff%22)%20format(%22woff	US	html	258 b	suspicious
3736	iexplore.exe	GET	200	104.31.94.206:80	http://prl.juntre.club/prelands/401/js/timer.js	US	text	32.0 Kb	suspicious
3736	iexplore.exe	GET	200	104.31.94.206:80	http://prl.juntre.club/prelands/401/images/zz1.jpg	US	image	90.0 Kb	suspicious
3736	iexplore.exe	GET	200	104.31.94.206:80	http://prl.juntre.club/prelands/401/css/style2.css	US	text	3.40 Kb	suspicious
3736	iexplore.exe	GET	200	104.31.94.206:80	http://prl.juntre.club/prelands/401/js/timer2.js	US	text	9.61 Kb	suspicious
3736	iexplore.exe	GET	200	104.31.94.206:80	http://prl.juntre.club/prelands/401/css/style.css	US	text	8.96 Kb	suspicious
3736	iexplore.exe	GET	200	104.31.94.206:80	http://prl.juntre.club/?pl=401.1cd8162ecbbf19232619c2e01db1fffc&n=aHR0cDovL2VuLmJpdGNvaW4tc29mdC52aXAuanVudHJlLmNsdWIvP3Nlc3Npb249ZDRmNTY5NWIyYzdjNGVjZGE2NDU0YThjYWIzMWE4YTEmYWZmX2lkPTIyNSZjYj0xJmZwcD0xJmJwPTE=	US	html	13.6 Kb	suspicious

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
3464	iexplore.exe	204.79.197.200:80	www.bing.com	Microsoft Corporation	US	whitelisted
3736	iexplore.exe	216.58.205.227:443	www.gstatic.com	Google Inc.	US	whitelisted
3736	iexplore.exe	172.217.22.35:443	fonts.gstatic.com	Google Inc.	US	whitelisted
3736	iexplore.exe	216.58.210.1:443	cegoffchade1988.blogspot.com.au	Google Inc.	US	whitelisted
3736	iexplore.exe	172.217.22.105:443	resources.blogblog.com	Google Inc.	US	whitelisted
3736	iexplore.exe	172.217.23.161:443	themes.googleusercontent.com	Google Inc.	US	whitelisted
3464	iexplore.exe	216.58.210.1:443	cegoffchade1988.blogspot.com.au	Google Inc.	US	whitelisted
3736	iexplore.exe	104.31.95.206:80	vip.juntre.club	Cloudflare Inc	US	shared
3736	iexplore.exe	104.31.94.206:80	vip.juntre.club	Cloudflare Inc	US	shared
3736	iexplore.exe	104.27.202.93:80	gg.gg	Cloudflare Inc	US	shared

DNS requests

Domain	IP	Reputation
www.bing.com	204.79.197.200 13.107.21.200	whitelisted
cegoffchade1988.blogspot.com.au	216.58.210.1	whitelisted
cegoffchade1988.blogspot.com	216.58.210.1	whitelisted
www.gstatic.com	216.58.205.227	whitelisted
resources.blogblog.com	172.217.22.105	whitelisted
www.blogger.com	172.217.22.105	shared
fonts.gstatic.com	172.217.22.35	whitelisted
themes.googleusercontent.com	172.217.23.161	whitelisted
gg.gg	104.27.202.93 104.27.201.93	shared
vip.juntre.club	104.31.95.206 104.31.94.206	suspicious

Threats

No threats detected

Add for printing

No debug info

General Info

https://cegoffchade1988.blogspot.com.au/

EB12DD456711E3C2D7F1F4EAFB765065

56C9C82506A4E0AE4001DCEE8951DE0556DBA137

2380507EDF418CDF4AFAAEE170D52AAD7470174C187CFB72D106FB5689A8CA66

3:N8dCKDDGNEzoKlK:2AYaNKQ

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

INFO

Reads settings of System Certificates

Application launched itself

Creates files in the user directory

Reads internet explorer settings

Changes settings of System certificates

Adds / modifies Windows certificates

Reads Internet Cache Settings

Changes internet zones settings

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings