download:

999cape.exe

Full analysis: https://app.any.run/tasks/f78caf26-ff38-41d8-81e1-f94103629972
Verdict: Malicious activity
Analysis date: July 15, 2022, 13:14:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

DA399A65AF98380470E2479B79886297

SHA1:

4A9A97CEFB2B0A41917F7768CC35034A7718E8FB

SHA256:

309ED70D26798516585D136D8CAD8655FA9BA0C70EEDEBD9E6FA10369E4B9ED4

SSDEEP:

6144:8shsSSHqI2LtKOVVVQRxS/CCN2rhP3kj0NeY9KRzGyWJMwBRek6vfyO0aCBRYnyP:zJK+LRd8t5rhvlP+u+/kpECa+JHx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Writes to the hosts file

      • 999cape.exe (PID: 3444)

  • SUSPICIOUS

    • Reads the computer name

      • 999cape.exe (PID: 3444)

    • Starts Internet Explorer

      • 999cape.exe (PID: 3444)

    • Checks supported languages

      • 999cape.exe (PID: 3444)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 1248)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 3672)
      • iexplore.exe (PID: 1248)

    • Application launched itself

      • iexplore.exe (PID: 3672)

    • Reads the computer name

      • iexplore.exe (PID: 1248)
      • iexplore.exe (PID: 3672)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1248)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1248)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 3672)

    • Reads the hosts file

      • 999cape.exe (PID: 3444)

    • Changes internet zones settings

      • iexplore.exe (PID: 3672)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 1248)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1248)

    • Creates files in the user directory

      • iexplore.exe (PID: 1248)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1248)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

AssemblyVersion: 1.0.0.0
ProductVersion: 1.0.0.0
ProductName: 999cape
OriginalFileName: 999cape.exe
LegalTrademarks: -
LegalCopyright: Copyright © 2021
InternalName: 999cape.exe
FileVersion: 1.0.0.0
FileDescription: 999cape
CompanyName: Toffy.
Comments: -
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.0.0.0
FileVersionNumber: 1.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 4
EntryPoint: 0x42d98e
UninitializedDataSize: -
InitializedDataSize: 42496
CodeSize: 4372992
LinkerVersion: 48
PEType: PE32
TimeStamp: 2021:11:14 04:50:26+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 14-Nov-2021 03:50:26
Debug artifacts:
  • C:\Users\topik\Desktop\cape\999cape\obj\Release\999cape.pdb
Comments: -
CompanyName: Toffy.
FileDescription: 999cape
FileVersion: 1.0.0.0
InternalName: 999cape.exe
LegalCopyright: Copyright © 2021
LegalTrademarks: -
OriginalFilename: 999cape.exe
ProductName: 999cape
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 14-Nov-2021 03:50:26
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00002000
0x0042B994
0x0042BA00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
2.60371
.rsrc
0x0042E000
0x0000A260
0x0000A400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.87054
.reloc
0x0043A000
0x0000000C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.10191

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.20848
3804
UNKNOWN
UNKNOWN
RT_MANIFEST
32512
1.51664
20
UNKNOWN
UNKNOWN
RT_GROUP_ICON

Imports

mscoree.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 999cape.exe iexplore.exe no specs iexplore.exe 999cape.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
804"C:\Users\admin\AppData\Local\Temp\999cape.exe" C:\Users\admin\AppData\Local\Temp\999cape.exe—Explorer.EXE
User:
admin
Company:
Toffy.
Integrity Level:
MEDIUM
Description:
999cape
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\999cape.exe
1248"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3672 CREDAT:275457 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3444"C:\Users\admin\AppData\Local\Temp\999cape.exe" C:\Users\admin\AppData\Local\Temp\999cape.exe
Explorer.EXE
User:
admin
Company:
Toffy.
Integrity Level:
HIGH
Description:
999cape
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\999cape.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3672"C:\Program Files\Internet Explorer\iexplore.exe" https://999cape.art/C:\Program Files\Internet Explorer\iexplore.exe—999cape.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
8 545
Read events
8 452
Write events
92
Delete events
1

Modification events

(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30971980
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
182711624
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30971981
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
11
Text files
31
Unknown types
10

Dropped files

PID
Process
Filename
Type
1248iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
1248iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_B33C53C21730FCB46E04046BC9545FF3der
MD5:—
SHA256:—
1248iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\SIBSBQVU.htmhtml
MD5:—
SHA256:—
1248iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\js[1].jstext
MD5:—
SHA256:—
3444999cape.exeC:\Windows\System32\drivers\etc\hoststext
MD5:3688374325B992DEF12793500307566D
SHA256:2D6BDFB341BE3A6234B24742377F93AA7C7CFB0D9FD64EFA9282C87852E57085
1248iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:—
SHA256:—
1248iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:—
SHA256:—
1248iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAder
MD5:—
SHA256:—
1248iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_B33C53C21730FCB46E04046BC9545FF3binary
MD5:—
SHA256:—
1248iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\toastr.min[1].csstext
MD5:BC96861D9899E4E68FB2E59C363D8C60
SHA256:10D159ADB573CA535B8275F1D27DC8D60FFFD9678EE3B5F1A0F7B4BE4A77342F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
32
DNS requests
14
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1248
iexplore.exe
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
1248
iexplore.exe
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFEXqDlk0KpHEjSOBz6OhEI%3D
US
der
471 b
whitelisted
1248
iexplore.exe
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
1248
iexplore.exe
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECcV7e3Q9jc%2BEjjW9IbWOFg%3D
US
der
471 b
whitelisted
1248
iexplore.exe
GET
200
8.253.95.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ff621a16e808ba42
US
compressed
4.70 Kb
whitelisted
1248
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1248
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1248
iexplore.exe
188.114.97.3:443
999cape.art
Cloudflare Inc
US
malicious
1248
iexplore.exe
142.250.184.200:443
www.googletagmanager.com
Google Inc.
US
suspicious
1248
iexplore.exe
172.217.18.10:443
fonts.googleapis.com
Google Inc.
US
whitelisted
1248
iexplore.exe
162.159.129.233:443
discordapp.com
Cloudflare Inc
—
shared
1248
iexplore.exe
172.217.23.110:443
www.google-analytics.com
Google Inc.
US
whitelisted
1248
iexplore.exe
8.253.95.120:80
ctldl.windowsupdate.com
Global Crossing
US
suspicious
1248
iexplore.exe
104.17.24.14:443
cdnjs.cloudflare.com
Cloudflare Inc
US
suspicious
1248
iexplore.exe
142.250.185.99:80
ocsp.pki.goog
Google Inc.
US
whitelisted
1248
iexplore.exe
162.159.138.232:443
discord.com
Cloudflare Inc
—
malicious

DNS requests

Domain
IP
Reputation
999cape.art
  • 188.114.97.3
  • 188.114.96.3
malicious
ctldl.windowsupdate.com
  • 8.253.95.120
  • 8.248.133.254
  • 67.26.75.254
  • 8.253.204.120
  • 8.253.95.249
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
fonts.googleapis.com
  • 172.217.18.10
whitelisted
cdnjs.cloudflare.com
  • 104.17.24.14
  • 104.17.25.14
whitelisted
www.googletagmanager.com
  • 142.250.184.200
whitelisted
ocsp.pki.goog
  • 142.250.185.99
whitelisted
discordapp.com
  • 162.159.129.233
  • 162.159.133.233
  • 162.159.135.233
  • 162.159.130.233
  • 162.159.134.233
whitelisted
www.google-analytics.com
  • 172.217.23.110
whitelisted
discord.com
  • 162.159.138.232
  • 162.159.128.233
  • 162.159.135.232
  • 162.159.137.232
  • 162.159.136.232
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
1248
iexplore.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
1248
iexplore.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
—
—
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
1248
iexplore.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
1248
iexplore.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
1248
iexplore.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
999cape.exe