analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://cloudflare-ipfs.com/ipfs/QmZcSgNpUR55HpAVJcYnn382aUgfYsuEvgVCZFqCc9sWCa/

Full analysis: https://app.any.run/tasks/eef7ec19-4e67-4bd2-95d8-49d6efa8cb49
Verdict: Malicious activity
Analysis date: October 04, 2022, 23:15:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

5DD0616C79C941B6FF674CD2E15FDC43

SHA1:

07862B4C2F531F7C1118BB2AE30C397DBBD5B969

SHA256:

254BB91B88318E9AB7147C5FC393FFE3388ACA9838C2B379BA77E58093803E92

SSDEEP:

3:N8ULBDSKKMH+QEG8eVEz5CzIomGcsjn:2U7HvEgNzIoxcQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3112)

    • Uses RUNDLL32.EXE to load library

      • iexplore.exe (PID: 3148)

    • Starts Internet Explorer

      • rundll32.exe (PID: 2024)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 3148)
      • iexplore.exe (PID: 3112)
      • rundll32.exe (PID: 2024)
      • iexplore.exe (PID: 2432)

    • Checks supported languages

      • iexplore.exe (PID: 3112)
      • iexplore.exe (PID: 3148)
      • rundll32.exe (PID: 2024)
      • iexplore.exe (PID: 2432)

    • Changes internet zones settings

      • iexplore.exe (PID: 3148)

    • Application launched itself

      • iexplore.exe (PID: 3148)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3112)
      • iexplore.exe (PID: 3148)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3148)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3112)
      • iexplore.exe (PID: 3148)

    • Creates files in the user directory

      • iexplore.exe (PID: 3112)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 3148)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3112)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 3112)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
4
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe rundll32.exe no specs iexplore.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3148"C:\Program Files\Internet Explorer\iexplore.exe" "https://cloudflare-ipfs.com/ipfs/QmZcSgNpUR55HpAVJcYnn382aUgfYsuEvgVCZFqCc9sWCa/"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3112"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3148 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2024"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\QmZcSgNpUR55HpAVJcYnn382aUgfYsuEvgVCZFqCc9sWCa.jsonC:\Windows\system32\rundll32.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2432"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?LinkId=57426&Ext=jsonC:\Program Files\Internet Explorer\iexplore.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
11 215
Read events
11 084
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
11
Text files
118
Unknown types
5

Dropped files

PID
Process
Filename
Type
3148iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{68B292A1-443A-11ED-8BE5-12A9866C77DE}.datbinary
MD5:1A3BC9AFAD5E8BC46AA2CDBED63B2969
SHA256:7325FAE0571B413AA653103E6C9271C578D6D2782AC6BED94F2EF2DBF8D813AE
3112iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:14A969AC8E1B08D575AA8255BA3ED0E6
SHA256:BB4C1A256216BA742C9A60075C77425DEA4D27610AAA1CBA016C8664593F1DF2
3112iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\F29XLZ5A.txttext
MD5:2648BB8C9DCD95E0A6C18F43EF92FE8A
SHA256:5A45777E92042E982F17F49F0D0035BB40FBB5C1247A4C610894016AAA9CACC6
3112iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\Q3BSZ727.txttext
MD5:7091AE8795CFEF7744B4918729EE7E32
SHA256:079BD47FEC44F00BA9FEB54F34BAB1EB3AD1F521FA2A4FB4E9CC9D8C4CCEA978
3112iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\SFWYA9LA.txttext
MD5:E96930E8679F8085C6C13D6122DCFF89
SHA256:D7E4F2FD1380F0AA5C28D741D8FFADF6D151C686FA511150C31932AEB6EBE92C
3112iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442binary
MD5:25AA8510032B6D006FCD1BD16B331A9D
SHA256:B0A1B981FF9CD212D2D20332A74DE4F7CD15AE565A64302D827F0D229071FA8A
3148iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF27563F66EB3B1762.TMPgmc
MD5:3CD26C98241F0524A3092AB3086B0FF2
SHA256:D9F612073B3032C03C1389621E100D42A5F95FCF42BF89B9F785FEFC42191A9C
3112iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:87AAD071DDAAAD8ADB70E4DABCC1A750
SHA256:2D558A3FE733F9893095B3758FF661E7B48DB7D8D725D7AC9EDBFFABC65D1613
3112iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:6AA004EA38D8BAFFDAD771D3C4F2D24D
SHA256:6C57EC9C626D2836D9CA5C30D48C04F8FB56D0F59BC963836AE12CECB0FDEAB9
3112iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:2E46E0D3FB9F9AEA6D52F02DAA5AAD75
SHA256:9F6739FE8CA0DBD3D26B6A12DBBC42FC296BB11F44469E368A74485DFDF48478
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
23
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3112
iexplore.exe
GET
301
2.16.106.81:80
http://shell.windows.com/fileassoc/fileassoc.asp?Ext=json
unknown
—
—
whitelisted
3112
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
3112
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
3112
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3112
iexplore.exe
GET
200
95.140.236.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?861fc0ecea823d74
GB
compressed
4.70 Kb
whitelisted
3112
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3112
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
3148
iexplore.exe
13.107.21.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3112
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
2.16.106.81:80
shell.windows.com
Akamai International B.V.
DE
whitelisted
3112
iexplore.exe
184.31.86.154:443
go.microsoft.com
AKAMAI-AS
DE
malicious
3112
iexplore.exe
95.140.236.0:80
ctldl.windowsupdate.com
LLNW
US
whitelisted
3112
iexplore.exe
104.17.96.13:443
cloudflare-ipfs.com
CLOUDFLARENET
—
suspicious
3112
iexplore.exe
40.126.32.68:443
login.microsoftonline.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
suspicious
3112
iexplore.exe
40.126.32.76:443
login.microsoftonline.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
cloudflare-ipfs.com
  • 104.17.96.13
  • 104.17.64.14
suspicious
ctldl.windowsupdate.com
  • 95.140.236.0
  • 95.140.236.128
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
go.microsoft.com
  • 184.31.86.154
whitelisted
shell.windows.com
  • 2.16.106.81
  • 2.16.106.73
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
login.microsoftonline.com
  • 40.126.32.76
  • 20.190.160.14
  • 40.126.32.133
  • 20.190.160.22
  • 20.190.160.17
  • 40.126.32.140
  • 20.190.160.20
  • 40.126.32.68
whitelisted
login.live.com
  • 40.126.32.68
  • 40.126.32.76
  • 40.126.32.138
  • 20.190.160.17
  • 40.126.32.133
  • 40.126.32.134
  • 20.190.160.20
  • 40.126.32.136
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://cloudflare-ipfs.com/ipfs/QmZcSgNpUR55HpAVJcYnn382aUgfYsuEvgVCZFqCc9sWCa/