URL:

http://www.swanseacomputerservices.com/8UxRSIWRUf

Full analysis: https://app.any.run/tasks/7c75326e-cc33-4d2b-8d4a-c49c9fc23405
Verdict: Malicious activity
Analysis date: December 18, 2018, 13:36:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

2E201B1EE807D24D46599FB4CCBD6A52

SHA1:

60094F43CB3FA4D61A358CA457AD6AD730F20DD4

SHA256:

2B3AED19CF5373AD603D86C95C3EAE1544B1186354BE3CFB61AC7B4B76877998

SSDEEP:

3:N1KJS4YKcXDHKd2m:Cc4niKd2m

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 2944)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3072)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3072)

    • Application launched itself

      • iexplore.exe (PID: 2944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
31
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2944"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3072"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2944 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
341
Read events
296
Write events
45
Delete events
0

Modification events

(PID) Process:(2944) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2944) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2944) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2944) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2944) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2944) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2944) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{F9BC602B-02C9-11E9-91D7-5254004A04AF}
Value:
0
(PID) Process:(2944) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(2944) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
3
(PID) Process:(2944) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E2070C00020012000D0024003400E203
Executable files
0
Suspicious files
0
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
2944iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\favicon[1].ico —
MD5:—
SHA256:—
2944iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2944iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\favicon[2].pngimage
MD5:9FB559A691078558E77D6848202F6541
SHA256:6D8A01DC7647BC218D003B58FE04049E24A9359900B7E0CEBAE76EDF85B8B914
3072iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\404mid[1].gifimage
MD5:DC8055F43FBB4A4B6DFB298EC35188F2
SHA256:B857737891B84293B3DF526B48CE3D54FDCC5789C250EADFF9DD38E3C2C68CAF
3072iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\f[1].pngimage
MD5:48AB4A603B81E4FEED659BF03483C419
SHA256:0ED026C4829F5BB704EA921A525D9E60BE74C072444E16AF21CB3CF90439E335
3072iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\simple-expand.min[1].jstext
MD5:42CB9467FD660B25209863C072E69342
SHA256:7989430E3C85121CAA76C6DA31AA38D43EF139062E2C3BD4F4350B62FE90D4D4
3072iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\jquery-1.9.1[1].jstext
MD5:08C235D357750C657AC1DB7D1CF656A9
SHA256:7BD80D06C01C0340C1B9159B9B4A197DB882CA18CBAC8E9B9AA025E68F998D40
3072iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\404top_w[1].jpgimage
MD5:DE6ECBBB2471827D90BF32C47A0CBC45
SHA256:5CAE6C33F0F9D4449CE8539A60E7D40EBA2DDC75979FC26284854A29C36D08CB
3072iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\404bottom[1].gifimage
MD5:54EB288427ACF79ED320EFD4916FE0B7
SHA256:70E4A5F9F7D98C1564B17ECC69196FED4F74FE5AFB2C61B4FB7045DD3309DC4F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
6
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3072
iexplore.exe
GET
—
192.185.153.254:80
http://www.swanseacomputerservices.com/cgi-sys/js/simple-expand.min.js
US
—
—
malicious
3072
iexplore.exe
GET
403
192.185.153.254:80
http://www.swanseacomputerservices.com/8UxRSIWRUf/
US
html
5.21 Kb
malicious
3072
iexplore.exe
GET
200
192.185.153.254:80
http://www.swanseacomputerservices.com/cgi-sys/images/404bottom.gif
US
image
537 b
malicious
3072
iexplore.exe
GET
200
192.185.153.254:80
http://www.swanseacomputerservices.com/cgi-sys/images/f.png
US
image
17.8 Kb
malicious
3072
iexplore.exe
GET
200
192.185.153.254:80
http://www.swanseacomputerservices.com/cgi-sys/images/404top_w.jpg
US
image
4.23 Kb
malicious
—
—
GET
200
192.185.153.254:80
http://www.swanseacomputerservices.com/cgi-sys/images/404mid.gif
US
image
120 b
malicious
3072
iexplore.exe
GET
200
192.185.153.254:80
http://www.swanseacomputerservices.com/cgi-sys/js/simple-expand.min.js
US
text
1.13 Kb
malicious
3072
iexplore.exe
GET
200
205.185.208.52:80
http://code.jquery.com/jquery-1.9.1.js
US
text
94.9 Kb
whitelisted
3072
iexplore.exe
GET
301
192.185.153.254:80
http://www.swanseacomputerservices.com/8UxRSIWRUf
US
html
339 b
malicious
2944
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2944
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3072
iexplore.exe
192.185.153.254:80
www.swanseacomputerservices.com
CyrusOne LLC
US
malicious
3072
iexplore.exe
205.185.208.52:80
code.jquery.com
Highwinds Network Group, Inc.
US
unknown
—
—
192.185.153.254:80
www.swanseacomputerservices.com
CyrusOne LLC
US
malicious

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.swanseacomputerservices.com
  • 192.185.153.254
malicious
code.jquery.com
  • 205.185.208.52
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://www.swanseacomputerservices.com/8UxRSIWRUf