analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://metaladdicts.com/

Full analysis: https://app.any.run/tasks/e1b3d25b-9399-4ee7-a8c6-3c0699859bf4
Verdict: Malicious activity
Analysis date: April 01, 2023, 11:29:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

C15F2B12609A9C78E96C6F8CCF4B8101

SHA1:

BEA3D696315BA16B1035803C9C7175A072C772F4

SHA256:

2B3C7F5C8A981679E9D38D877794B344A3F4BAC99078DD0670ED9329BDD4C848

SSDEEP:

3:N8SJEXRmn:2SJJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2688)
    • Create files in a temporary directory

      • iexplore.exe (PID: 3220)
      • iexplore.exe (PID: 2688)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2688"C:\Program Files\Internet Explorer\iexplore.exe" "https://metaladdicts.com/"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\version.dll
3220"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2688 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\rpcrt4.dll
Total events
41 970
Read events
41 778
Write events
192
Delete events
0

Modification events

(PID) Process:(2688) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2688) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2688) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2688) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2688) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2688) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2688) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2688) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2688) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2688) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
44
Text files
130
Unknown types
32

Dropped files

PID
Process
Filename
Type
3220iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:E86F8B0B18F253DC3E4E938DB0E9AB7B
SHA256:8CF814B77F9DE5D81D72CD2A384441AFDC2542436F628CA7168DFD226A09DAE4
3220iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\QUC0EWML.txttext
MD5:58FDA4300C320111B82524D129A79CCC
SHA256:72E0109BE17F3632A5A6C5312AA18A35570F0E8FBD9917A68ACF11B09167DCB2
3220iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZABZ0NOM.txttext
MD5:B05D9AD4350696D46C8C29989EDFD065
SHA256:1363E3420963780C20E0F52C6D7FE910DEC5AFE504763516AD66A7D039EA8D55
3220iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\F9VG3U4C.txttext
MD5:01F5EB19AE3AF41804FB21AA295F2E57
SHA256:B651B330D8E2E57129B0E1CDA42858F2C9766A4837EA9AE20795594278BCDE8A
3220iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:B9C2FFF9A567EF52BEE8F7622E9722FA
SHA256:412224665E1628A33016C1A44D4E9785348AB9BB9E10DC50519A6491597F3715
3220iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\5SE7NHM2.txttext
MD5:30D09E9C3927884631201A4185478B48
SHA256:8047312AEE9972392387C80E2FDB3082739F7B201A35CC77F8071F12CA62F009
3220iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\058132Y8.txttext
MD5:D6AC4FD7DC057008702BF5B453A3D9FD
SHA256:C01DDE25FBD158E26B19B2724DDC1E194B32D1782DFC73A32B9164361A6AA4E4
3220iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\VN2BGKLA.txttext
MD5:446C8273B39F2E7FF27429FFE2B5BED1
SHA256:289BB5E761C69517C9557420A496A8E62D83972BDAB3FCBF4CC297C30F321356
3220iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\WP8T4UYN.txttext
MD5:9BA1C64E8A8D7F08314833062A86626A
SHA256:F5E91175ACCAC0354E2851310B8064B389511347B73E70FAA7C8E5838F92149D
3220iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\0CDAKYFR.txttext
MD5:B55E9E9F0A4552E2CD7FDFCF6D1596B9
SHA256:4407BF7D47D41F73F230AA902D9B5AF554C06A007EDA9C465E467EA1E5494C98
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
73
DNS requests
32
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3220
iexplore.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQD%2FB2zZ7cy1JAocIdUzcD8Q
US
der
472 b
whitelisted
3220
iexplore.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
3220
iexplore.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGpqxJbBk7c3CvIUCwl%2FKLk%3D
US
der
471 b
whitelisted
3220
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?13ce3007c369d28c
US
compressed
61.1 Kb
whitelisted
3220
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
3220
iexplore.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
3220
iexplore.exe
GET
200
108.138.2.107:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
2688
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3220
iexplore.exe
GET
200
52.222.250.185:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D
US
der
1.39 Kb
shared
GET
200
52.222.226.205:80
http://ocsp.r2m02.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAlZZhunD5UwxkVR4PVOmws%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3220
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3220
iexplore.exe
142.250.185.66:443
pagead2.googlesyndication.com
GOOGLE
US
whitelisted
3220
iexplore.exe
172.64.202.5:443
ezodn.com
CLOUDFLARENET
US
unknown
3220
iexplore.exe
142.250.185.136:443
www.googletagmanager.com
GOOGLE
US
suspicious
3220
iexplore.exe
104.21.28.48:443
privacy.gatekeeperconsent.com
CLOUDFLARENET
unknown
3220
iexplore.exe
172.67.144.62:443
privacy.gatekeeperconsent.com
CLOUDFLARENET
US
unknown
3220
iexplore.exe
172.67.206.12:443
metaladdicts.com
CLOUDFLARENET
US
unknown
3220
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
3220
iexplore.exe
108.138.7.87:443
sf.ezoiccdn.com
AMAZON-02
US
unknown
2688
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
metaladdicts.com
  • 172.67.206.12
  • 104.21.69.71
unknown
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
privacy.gatekeeperconsent.com
  • 172.67.144.62
  • 104.21.28.48
unknown
sf.ezoiccdn.com
  • 108.138.7.87
  • 108.138.7.82
  • 108.138.7.2
  • 108.138.7.127
suspicious
pagead2.googlesyndication.com
  • 142.250.185.66
whitelisted
www.googletagmanager.com
  • 142.250.185.136
whitelisted
ezodn.com
  • 172.64.202.5
  • 172.64.203.5
whitelisted
the.gatekeeperconsent.com
  • 104.21.28.48
  • 172.67.144.62
unknown
go.ezodn.com
  • 172.64.202.5
  • 172.64.203.5
whitelisted

Threats

PID
Process
Class
Message
Potentially Bad Traffic
ET INFO Commonly Abused Content Delivery Network Domain in DNS Lookup (btloader .com)
3220
iexplore.exe
Potentially Bad Traffic
ET INFO Observed Abused Content Delivery Network Domain (btloader .com in TLS SNI)
3220
iexplore.exe
Potentially Bad Traffic
ET INFO Observed Abused Content Delivery Network Domain (btloader .com in TLS SNI)
No debug info