analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

scan.html

Full analysis: https://app.any.run/tasks/9449408d-e23d-4da5-819a-bfc0380aeaa8
Verdict: Malicious activity
Analysis date: November 15, 2018, 04:32:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
phishing
phish-office365
Indicators:
MIME: text/plain
File info: ASCII text, with no line terminators
MD5:

B3C543B336DE4151F0FF39D2FAE53453

SHA1:

29B53BFAD6A8D4684F403FE9374B5B8C202D00CC

SHA256:

250D3695048E356336A5A067D71BAD9A35BFBA8119029C528E87E0E6B013C2A9

SSDEEP:

3:nmNjJMzVJu+1vK3VYOfcyTK3kH7n:GMRJVSOOVTDH7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    • Reads internet explorer settings

      • iexplore.exe (PID: 1672)
      • iexplore.exe (PID: 588)
    • Changes internet zones settings

      • iexplore.exe (PID: 3688)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 588)
      • iexplore.exe (PID: 1672)
    • Application launched itself

      • iexplore.exe (PID: 3688)
      • chrome.exe (PID: 3716)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
14
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe no specs iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3688"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\scan.htmlC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
588"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3688 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exeiexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
1672"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3688 CREDAT:137473C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3716"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
68.0.3440.106
2660"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=68.0.3440.106 --initial-client-data=0x78,0x7c,0x80,0x74,0x84,0x6eb400b0,0x6eb400c0,0x6eb400ccC:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
68.0.3440.106
3852"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3720 --on-initialized-event-handle=304 --parent-handle=308 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
68.0.3440.106
3212"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=996,12610730439913717869,237175307067590326,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=71A7B8B0699F6FADC4EA5FC5F50C7858 --mojo-platform-channel-handle=1020 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Version:
68.0.3440.106
1852"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=996,12610730439913717869,237175307067590326,131072 --enable-features=PasswordImport --service-pipe-token=314F5FA2A69BC54D1A99B60D3571D2A1 --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=314F5FA2A69BC54D1A99B60D3571D2A1 --renderer-client-id=5 --mojo-platform-channel-handle=1924 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
3052"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=996,12610730439913717869,237175307067590326,131072 --enable-features=PasswordImport --service-pipe-token=2246CF123A4A0DFF7444CF112A8F473F --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=2246CF123A4A0DFF7444CF112A8F473F --renderer-client-id=3 --mojo-platform-channel-handle=2172 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
2720"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=996,12610730439913717869,237175307067590326,131072 --enable-features=PasswordImport --disable-gpu-compositing --service-pipe-token=047F302F31DD76FE9817D79F17F2C389 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=047F302F31DD76FE9817D79F17F2C389 --renderer-client-id=6 --mojo-platform-channel-handle=3548 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Version:
68.0.3440.106
Total events
1 037
Read events
903
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
54
Text files
103
Unknown types
1

Dropped files

PID
Process
Filename
Type
3688iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico
MD5:
SHA256:
3688iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
MD5:
SHA256:
3688iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF2E5C7D17E4A2BB8E.TMP
MD5:
SHA256:
3688iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFA9BB7ED5A8BEF0AE.TMP
MD5:
SHA256:
3688iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFB3B91A1DDEBF6EC9.TMP
MD5:
SHA256:
3688iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF826BEE0235C3A57C.TMP
MD5:
SHA256:
3688iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF602547579CF9D316.TMP
MD5:
SHA256:
3688iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{7046E7A7-E88F-11E8-A505-5254004AAD11}.dat
MD5:
SHA256:
3688iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{7046E7A8-E88F-11E8-A505-5254004AAD11}.datbinary
MD5:D0FE6BCCAB9F1D8341A974652A7A407A
SHA256:C3E4640B0C17E8FB65B761E3D370FF33C798DE82B29DD9073B3F70ED8CA5E216
3688iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{7046E7AB-E88F-11E8-A505-5254004AAD11}.datbinary
MD5:B2CDA99B16F189D74582902C59007207
SHA256:57E4EE6571DEB03F4C7F4272CA85B30F95A11702BDD8CB443B0681FC2F8141C0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
64
TCP/UDP connections
100
DNS requests
24
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3716
chrome.exe
GET
72.5.52.230:80
http://insights.octanner.com/stylesheets/panel/bootstrap-3.1/bootstrap.modal.only.css
US
suspicious
3716
chrome.exe
GET
72.5.52.230:80
http://insights.octanner.com/stylesheets/2013/jquery-ui-1.8.21.custom.css
US
suspicious
3716
chrome.exe
GET
72.5.52.230:80
http://insights.octanner.com/a/TakeSurvey?tt=EQyGw0e3pFw%3D&custom1=796692&custom2=Yes&custom3=Yes&custom4=Yes&custom5=Yes&custom6=Yes&custom7=Yes&custom8=Yes&custom9=Yes&custom10=Yes&custom11=Yes&custom12=Yes&custom13=Print&custom14=Other&custom15=Yes
US
suspicious
3716
chrome.exe
GET
72.5.52.230:80
http://insights.octanner.com/stylesheets/2013/porterpopup.css?version=45.3
US
suspicious
3716
chrome.exe
GET
200
72.5.52.230:80
http://insights.octanner.com/stylesheets/legacy/searchBox.css
US
text
1019 b
suspicious
3716
chrome.exe
GET
72.5.52.230:80
http://insights.octanner.com/stylesheets/v1-navy.css?version=45.3
US
suspicious
3716
chrome.exe
GET
72.5.52.230:80
http://insights.octanner.com/javascript/swfobject-2.1.js
US
suspicious
3716
chrome.exe
GET
72.5.52.230:80
http://insights.octanner.com/javascript/global.js?version=45.3
US
suspicious
3716
chrome.exe
GET
72.5.52.230:80
http://insights.octanner.com/stylesheets/takesurvey/style.css?version=45.3
US
suspicious
3716
chrome.exe
GET
72.5.52.230:80
http://insights.octanner.com/javascript/2016/jquery-ui-1.9.2.min.js
US
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3716
chrome.exe
172.217.18.3:443
www.google.de
Google Inc.
US
whitelisted
3688
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3716
chrome.exe
216.58.206.14:443
apis.google.com
Google Inc.
US
whitelisted
3716
chrome.exe
216.58.206.10:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
1672
iexplore.exe
173.212.240.29:443
kvinay.com
Contabo GmbH
DE
suspicious
3716
chrome.exe
173.212.240.29:443
kvinay.com
Contabo GmbH
DE
suspicious
3716
chrome.exe
216.58.206.3:443
www.gstatic.com
Google Inc.
US
whitelisted
3716
chrome.exe
216.58.206.13:443
accounts.google.com
Google Inc.
US
whitelisted
3716
chrome.exe
217.23.4.32:443
lancheck.net
WorldStream B.V.
NL
suspicious
3716
chrome.exe
216.58.206.4:443
www.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
kvinay.com
  • 173.212.240.29
suspicious
www.gstatic.com
  • 216.58.206.3
whitelisted
clientservices.googleapis.com
  • 216.58.206.3
whitelisted
www.google.de
  • 172.217.18.3
whitelisted
safebrowsing.googleapis.com
  • 216.58.206.10
whitelisted
accounts.google.com
  • 216.58.206.13
shared
ssl.gstatic.com
  • 216.58.206.3
whitelisted
apis.google.com
  • 216.58.206.14
whitelisted
lancheck.net
  • 217.23.4.32
  • 109.236.93.206
  • 23.111.228.220
  • 64.58.126.236
  • 64.58.121.60
  • 23.111.228.4
  • 93.190.140.94
malicious

Threats

No threats detected
No debug info