analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://www.zixcorp.com/info/zixmail_ZMC

Full analysis: https://app.any.run/tasks/8a9cbfbd-af78-4249-bfb3-363a9cf82123
Verdict: Malicious activity
Analysis date: January 24, 2022, 19:28:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

322F5B4F06A8F9C966ABE0AC6615441E

SHA1:

2B4140EAE2853611E6BA0C8D3E0A86DEC2CE7FEA

SHA256:

23A466A3876B6DAF220F71AC2CE36B503C97EDE44745B3FBB4B6FD26AAD5CAC1

SSDEEP:

3:N1KJS4kB25MKlJxmn:Cc4k2g

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2184)

    • Checks supported languages

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 3976)

    • Reads the computer name

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 3976)

    • Executed via COM

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 3976)

    • Creates files in the user directory

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 3976)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 2184)
      • iexplore.exe (PID: 1988)

    • Reads the computer name

      • iexplore.exe (PID: 1988)
      • iexplore.exe (PID: 2184)

    • Application launched itself

      • iexplore.exe (PID: 1988)

    • Changes internet zones settings

      • iexplore.exe (PID: 1988)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2184)
      • iexplore.exe (PID: 1988)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2184)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 1988)
      • iexplore.exe (PID: 2184)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1988)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1988)

    • Creates files in the user directory

      • iexplore.exe (PID: 2184)

    • Reads CPU info

      • iexplore.exe (PID: 2184)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe flashutil32_32_0_0_453_activex.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1988"C:\Program Files\Internet Explorer\iexplore.exe" "http://www.zixcorp.com/info/zixmail_ZMC"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2184"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1988 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
3976C:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe
Integrity Level:
MEDIUM
Description:
Adobe� Flash� Player Installer/Uninstaller 32.0 r0
Version:
32,0,0,453
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_32_0_0_453_activex.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
22 532
Read events
22 291
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
28
Text files
48
Unknown types
29

Dropped files

PID
Process
Filename
Type
2184iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D8A5A4A0441F7653C3609E0E2DE6769F_F915E31498E185C05AE6F4FD11B4AFFBder
MD5:2CBF869668D0BEE93508E73390FF1081
SHA256:03A2C003A5EED41AFDDA70A5CB4FEA9F728530549538BCEF8DD549D1296A2C82
2184iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D8A5A4A0441F7653C3609E0E2DE6769F_F915E31498E185C05AE6F4FD11B4AFFBbinary
MD5:363EA6D4EA99F647E9301A362003D7BA
SHA256:AFEDC1D764C1599439A26F1CA4E42161BF92CCF1B2944170C61FC383056D0FA8
2184iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A37B8BA80004D3266CB4D93B2052DC10_994B5C515D64A296EABD42B0A2E46349binary
MD5:279E97B1A0AF60983D5EE051A89B2E02
SHA256:51B4495444C43352C575A72E869447385125A34764049B4875AF6E3D63D5D7B5
2184iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:EC5BFE442439B2041CD39E9AA8587BDB
SHA256:C364E1F4B4E1F0875DD2A2896D382699DCFA3FF739DFDA2DC549ABDD10057FA7
2184iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:D75EECCAB959276169C9E83AB2B20472
SHA256:0B596A339D3FC52B8921062E433A53A6FC0EBBF81ED485D7E2A0F90010AA1AEB
1988iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:FC990EAA7247546FB67C18916A4CAC9B
SHA256:294F5BE9159C87842AD3173FE7CDA168C9F2010C6D428085A8AC30EF436CA993
1988iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:E3334FCE64A673F8BF9DD3B38612D3F6
SHA256:1B4023E58F086BD0C5FD0F74026C1A2B6C8F3A11C8C707F6EDEF4C581EB6B072
1988iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:2A370F3630FDAEE74BCC071EAB8DA95D
SHA256:32969D46FFA49ACC3CCEA3E08329CF48125EE4C51BB91F610D9CCC0285DF5CA3
2184iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A37B8BA80004D3266CB4D93B2052DC10_994B5C515D64A296EABD42B0A2E46349der
MD5:7A1E74268C87F4529EC420D30B8DFE48
SHA256:D164CE083C654E90F0A47B99666E351F1D72372336EBAA8C1BF701FCAA53A6DD
1988iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:111DCDB55A88510DB3C1E141A0EA1538
SHA256:022A2CD07C65A61F3419427C0D278028CC8FD3C40D593279C2035D881013973B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
83
DNS requests
30
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2184
iexplore.exe
GET
200
23.45.103.152:80
http://ocsp.entrust.net/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBTLXNCzDvBhHecWjg70iJhBW0InywQUanImetAe733nO2lR1GyNn5ASZqsCDGGh59IAAAAAUdNmpg%3D%3D
NL
der
1.55 Kb
whitelisted
2184
iexplore.exe
GET
200
23.45.105.185:80
http://x1.c.lencr.org/
NL
der
717 b
whitelisted
2184
iexplore.exe
GET
302
199.30.234.249:80
http://www.zixcorp.com/info/zixmail_ZMC
US
—
—
suspicious
2184
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
2184
iexplore.exe
GET
200
104.18.31.182:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
1988
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
1988
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2184
iexplore.exe
GET
200
8.253.95.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c11a9e5204e805b1
US
compressed
4.70 Kb
whitelisted
2184
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCrvyQ4GllugQoAAAABK4Az
US
der
472 b
whitelisted
2184
iexplore.exe
GET
200
23.45.103.152:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQnuEQcScL%2FkljKed%2BRzpzFYOq9kwQUw%2FfQtSowra8NkSFwOVTdvIlwxzoCECaLAO3HzOGwYxXYelu9XOA%3D
NL
der
1.55 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2184
iexplore.exe
199.30.234.249:80
www.zixcorp.com
Zix Corporation
US
suspicious
2184
iexplore.exe
199.30.234.249:443
www.zixcorp.com
Zix Corporation
US
suspicious
1988
iexplore.exe
8.253.95.120:80
ctldl.windowsupdate.com
Global Crossing
US
suspicious
1988
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
1988
iexplore.exe
13.107.21.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
1988
iexplore.exe
67.26.81.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
1988
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2184
iexplore.exe
23.45.103.152:80
ocsp.entrust.net
Akamai International B.V.
NL
suspicious
2184
iexplore.exe
8.253.95.120:80
ctldl.windowsupdate.com
Global Crossing
US
suspicious
2184
iexplore.exe
104.198.14.52:443
learn.zix.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.zixcorp.com
  • 199.30.234.249
suspicious
api.bing.com
  • 13.107.13.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ctldl.windowsupdate.com
  • 8.253.95.120
  • 67.26.81.254
  • 8.248.117.254
  • 8.248.143.254
  • 8.253.204.121
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
zix.com
  • 199.30.234.249
whitelisted
ocsp.entrust.net
  • 23.45.103.152
whitelisted
learn.zix.com
  • 104.198.14.52
suspicious
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

PID
Process
Class
Message
2184
iexplore.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://www.zixcorp.com/info/zixmail_ZMC