Malware analysis index.html Malicious activity | ANY.RUN

Add for printing

download:	index.html
Full analysis:	https://app.any.run/tasks/3c343953-a50b-466c-89d7-213c1e1147e1
Verdict:	Malicious activity
Analysis date:	May 24, 2019, 15:37:42
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME:	text/html
File info:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
MD5:	322B0AD0CB87E925DEC4BF498ED552FE
SHA1:	3AC3F3E729FC7142ED5ED1171536A85BE3514E50
SHA256:	2A950D87574DBC1086A60B9051827E8FA1016401DFE0CD5E5787217A692E309A
SSDEEP:	3072:sP8wM8IAjjdtFjxwqL6yj2L0PYoQgj7lZQ6WQhAdWI5lS5EyurlE5:YBtFjxwqL6yjYoQgj7vQG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 120 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 60 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (73.0.3683.75)
Google Update Helper (1.3.33.23)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
Mozilla Firefox 65.0.2 (x86 en-US) (65.0.2)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
No suspicious indicators.
INFO
- Application launched itself
  - iexplore.exe (PID: 712)
- Reads internet explorer settings
  - iexplore.exe (PID: 1032)
- Creates files in the user directory
  - iexplore.exe (PID: 1032)
- Changes internet zones settings
  - iexplore.exe (PID: 712)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.htm/html	\|	HyperText Markup Language with DOCTYPE (80.6)
.html	\|	HyperText Markup Language (19.3)

EXIF

HTML

Generator:	WordPress 5.0.4
Title:	My Blog – My WordPress Blog
viewport:	width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Parent process
712	"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\index.html	C:\Program Files\Internet Explorer\iexplore.exe	explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)
1032	"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:712 CREDAT:79873	C:\Program Files\Internet Explorer\iexplore.exe	iexplore.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)

Add for printing

Total events

330

Read events

277

Write events

Delete events

Modification events


(PID) Process:	(712) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:	write	Name:	CompatibilityFlags
Value: 0
(PID) Process:	(712) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 0
(PID) Process:	(712) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 1
(PID) Process:	(712) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:	write	Name:	SecuritySafe
Value: 1
(PID) Process:	(712) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:	write	Name:	ProxyEnable
Value: 0
(PID) Process:	(712) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:	write	Name:	SavedLegacySettings
Value: 4600000071000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:	(712) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:	write	Name:	{EA621D4B-7E39-11E9-A370-5254004A04AF}
Value: 0
(PID) Process:	(712) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:	write	Name:	Type
Value: 4
(PID) Process:	(712) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:	write	Name:	Count
Value: 1
(PID) Process:	(712) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:	write	Name:	Time
Value: E3070500050018000F00260003002D03

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
712	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico		—
		MD5:—	SHA256:—
712	iexplore.exe	C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico		—
		MD5:—	SHA256:—
1032	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\css[1].txt		text
		MD5:831B6A7A3EB9D63929D80AE320FE832F	SHA256:9098A0A4D0CE7E53C78B91CD75E8E61E6852C867A3194157900D2D7730A04FCA
1032	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\bootstrap[1].css		text
		MD5:6968BF9DBDFEA8451E1311518069615C	SHA256:7B3209DE0352220D1FE25D9626EE27A098BB6C59C681DC3E16B6E4BCCFCD8A8C
1032	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\bootstrap-theme[1].css		text
		MD5:7ADF000D3AA22608A3BAED5A696B0B90	SHA256:2017FDBD83D1DDE39CE557DAB634D595339B699F0E0510F7E1786F3712F619BA
1032	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\colorpicker[1].css		text
		MD5:CC9213B7044CE209F819A32F61CD76F5	SHA256:CAD87591B3045C4A882961E2BF07B6EF001EB2D07004E9CE7C6884AEA1A379EC
1032	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\blog_shortcode[1].css		text
		MD5:D83F0D7F9487D535C3070E1DE55CC83E	SHA256:BB8B7D191E267972D1938A7D73E0B791F35255D13AC875DBA5819B2986AA3D57
1032	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\widget[1].css		text
		MD5:AB4A680BD1C1375F08894DBC81030D92	SHA256:25A2B4F2BDB81E4CAC709EF25C837C63F7C0F581D3A424C495459499E2DE3703
1032	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\css[2].txt		text
		MD5:3F0EFA84FFA4EAD6E91383EB2CB3CEA1	SHA256:0C1DCFFFA27D91DD6DD09A5C0AA270EDE53C493EB1F5E4ADD0631BE265BA864A
1032	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\style[1].css		text
		MD5:26A175C4F946660FD2CAE555C873FDED	SHA256:5DB8DE67C41998DE7A43867BE619B69F61DB4FCE049D309FEA2DF64DE647BA02

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1032	iexplore.exe	GET	—	45.252.248.20:80	http://phongphan.cf/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.1.1	VN	—	—	malicious
1032	iexplore.exe	GET	—	45.252.248.20:80	http://phongphan.cf/wp-includes/css/dist/block-library/style.min.css?ver=5.0.4	VN	—	—	malicious
1032	iexplore.exe	GET	—	45.252.248.20:80	http://phongphan.cf/wp-content/themes/wp_general/js/html5.js	VN	—	—	malicious
1032	iexplore.exe	GET	—	45.252.248.20:80	http://phongphan.cf/wp-content/plugins/projects-by-woothemes/assets/css/woo-projects-handheld.css?ver=1.5.0	VN	—	—	malicious
1032	iexplore.exe	GET	—	45.252.248.20:80	http://phongphan.cf/wp-content/plugins/wd-plugin/assests/css/wd-pp.style.css?ver=5.0.4	VN	—	—	malicious
1032	iexplore.exe	GET	—	45.252.248.20:80	http://phongphan.cf/wp-content/plugins/wd_shortcode/css/shop_shortcode.css?ver=5.0.4	VN	—	—	malicious
1032	iexplore.exe	GET	200	216.58.207.74:80	http://fonts.googleapis.com/css?family=Archivo+Narrow&ver=5.0.4	US	text	176 b	whitelisted
1032	iexplore.exe	GET	200	216.58.207.74:80	http://fonts.googleapis.com/css?family=Poppins%3A400%2C300%2C500%2C600%2C700&ver=5.0.4	US	text	158 b	whitelisted
1032	iexplore.exe	GET	200	216.58.207.74:80	http://fonts.googleapis.com/css?family=Archivo+Narrow%3A400%2C700&ver=5.0.4	US	text	176 b	whitelisted
1032	iexplore.exe	GET	200	216.58.207.74:80	http://fonts.googleapis.com/css?family=Istok+Web&ver=5.0.4	US	text	165 b	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
712	iexplore.exe	204.79.197.200:80	www.bing.com	Microsoft Corporation	US	whitelisted
1032	iexplore.exe	104.25.123.99:80	code.ionicframework.com	Cloudflare Inc	US	shared
1032	iexplore.exe	45.252.248.20:80	phongphan.cf	AZDIGI Corporation	VN	malicious
1032	iexplore.exe	216.58.207.74:80	fonts.googleapis.com	Google Inc.	US	whitelisted
4	System	209.197.3.15:139	maxcdn.bootstrapcdn.com	Highwinds Network Group, Inc.	US	whitelisted
4	System	209.197.3.15:445	maxcdn.bootstrapcdn.com	Highwinds Network Group, Inc.	US	whitelisted

DNS requests

Domain	IP	Reputation
maxcdn.bootstrapcdn.com	209.197.3.15	whitelisted
phongphan.cf	45.252.248.20	malicious
www.bing.com	204.79.197.200 13.107.21.200	whitelisted
fonts.googleapis.com	216.58.207.74	whitelisted
code.ionicframework.com	104.25.123.99 104.25.124.99	whitelisted

Threats

PID	Process	Class	Message
—	—	Potentially Bad Traffic	ET INFO DNS Query for Suspicious .cf Domain

Add for printing

No debug info

General Info

index.html

322B0AD0CB87E925DEC4BF498ED552FE

3AC3F3E729FC7142ED5ED1171536A85BE3514E50

2A950D87574DBC1086A60B9051827E8FA1016401DFE0CD5E5787217A692E309A

3072:sP8wM8IAjjdtFjxwqL6yj2L0PYoQgj7lZQ6WQhAdWI5lS5EyurlE5:YBtFjxwqL6yjYoQgj7vQG

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

INFO

Application launched itself

Reads internet explorer settings

Creates files in the user directory

Changes internet zones settings

Malware configuration

Static information

TRiD

EXIF

HTML

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings