analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://ac3g33jgbo3nhutest3.rowisahosve.tk/[email protected]&sub1=u2

Full analysis: https://app.any.run/tasks/3d3453af-062a-4f81-ac3e-4ae0db6aacb2
Verdict: Malicious activity
Analysis date: June 27, 2022, 09:06:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

E100E1C760118F6F2B6F04850E466E63

SHA1:

000CF8164DCD3ADED1148609B9D34AAF91B83902

SHA256:

3401312CA5A6A653E08DD003D9F42FCEFE396D650CA62CE564496B507F280685

SSDEEP:

3:N1KfnzEuMs1FcESMCHGnRHWgQX:CvisUESMCI9WgQX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 952)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 2228)
      • iexplore.exe (PID: 952)

    • Reads the computer name

      • iexplore.exe (PID: 952)
      • iexplore.exe (PID: 2228)

    • Application launched itself

      • iexplore.exe (PID: 2228)

    • Changes internet zones settings

      • iexplore.exe (PID: 2228)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2228)
      • iexplore.exe (PID: 952)

    • Reads internet explorer settings

      • iexplore.exe (PID: 952)

    • Creates files in the user directory

      • iexplore.exe (PID: 952)
      • iexplore.exe (PID: 2228)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 952)
      • iexplore.exe (PID: 2228)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2228)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2228)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2228"C:\Program Files\Internet Explorer\iexplore.exe" "http://ac3g33jgbo3nhutest3.rowisahosve.tk/[email protected]&sub1=u2"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
952"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2228 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
13 411
Read events
13 279
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
18
Text files
40
Unknown types
14

Dropped files

PID
Process
Filename
Type
952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:B4FB73AD878426C47FAB4458D663D672
SHA256:0F92F24EA79D134A89ACA75098D26EC221FA72D5C912CDAC34B8B3B773E5C2BD
2228iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:28CC3D4B0DA8A29A9DCD6D4755C84342
SHA256:A4CA2DD1D4545838F7A9102623442BC76BDEB2185E9991A294BCB0B6456DDA0E
952iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\2U8DMY2Q.txttext
MD5:E8972E31BB8419DB0C7186998B9A34AD
SHA256:82DC76D34A8553F9E6B3C8D2E4B9CFAAEF3911BDBFB58E428A87A327059EAE9F
952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:308336E7F515478969B24C13DED11EDE
SHA256:889B832323726A9F10AD03F85562048FDCFE20C9FF6F9D37412CF477B4E92FF9
2228iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:A72DE330B3DC587248CA30FB22577862
SHA256:A56D1B2916268B7D153F984C4B3B1B5122EFA5DA21FD776D3AD9B44B3B5499FC
2228iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:B01F042B36F3432EC50ACF400550130D
SHA256:4EE6FB1EDF5AD927C38EBF6821BAB14C5212C63C5AB47BB607FBA486BC73CC8B
952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:25210289737064A5092D75E5EAB07DAD
SHA256:C95CA2603D7855957CAC73ADD2FBD7613558F3275EED7FBBF1BEBB9E4ADAB2EC
952iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabFCC6.tmpcompressed
MD5:308336E7F515478969B24C13DED11EDE
SHA256:889B832323726A9F10AD03F85562048FDCFE20C9FF6F9D37412CF477B4E92FF9
952iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\KEJEE6K0.txttext
MD5:65EEC9419FE16828EBAC8D0EC2A338C1
SHA256:97D926476F427207E9BE18C074A851AEB4ACB5A42BAC72B698931DD9FDD4F291
952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:83B3349C8CA5C5CAB6B9ECBC5D542586
SHA256:C2CD064A879744F93E29599D5145F21BA37E260947B7850FF79B7F639E5B37DD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
67
DNS requests
30
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
952
iexplore.exe
GET
302
146.190.228.148:80
http://ac3g33jgbo3nhutest3.rowisahosve.tk/[email protected]&sub1=u2
US
—
—
suspicious
952
iexplore.exe
GET
302
51.68.197.173:80
http://alexatracker.com/?r=aHR0cHM6Ly9kYXRlZXhvdGljLmNvbS9hZ0VBP3ByaWQ9e2NsaWNrX2lkfSZzdWIxPXVuc3VidTImZW1haWw9ZGV2Lm9wZXJhdGlvbnMlNDBmbGVldG1hdGljcy5jb20%3D&h=5f4d0b01f419ab01ba122492336c5b41
GB
—
—
suspicious
952
iexplore.exe
GET
200
95.140.236.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?38ac7301e7f29bac
GB
compressed
60.0 Kb
whitelisted
952
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
952
iexplore.exe
GET
200
104.89.32.83:80
http://x1.c.lencr.org/
NL
der
717 b
whitelisted
952
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
952
iexplore.exe
GET
200
2.16.241.15:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgQCVPGiL2yWNFuwwbfTrCavRA%3D%3D
unknown
der
503 b
shared
952
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCqm%2FLZVwk%2FcRLv5CtSZANu
US
der
472 b
whitelisted
2228
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
der
471 b
whitelisted
952
iexplore.exe
GET
200
104.18.20.226:80
http://ocsp2.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEHophRq39F1meVBmQbb%2F1x0%3D
US
der
1.40 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
952
iexplore.exe
146.190.228.148:80
ac3g33jgbo3nhutest3.rowisahosve.tk
—
US
suspicious
—
—
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2228
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
952
iexplore.exe
216.119.156.49:443
dateexotic.com
Hosting Services, Inc.
US
unknown
2228
iexplore.exe
2.18.212.243:80
ctldl.windowsupdate.com
Akamai International B.V.
—
unknown
952
iexplore.exe
95.140.236.0:80
ctldl.windowsupdate.com
Limelight Networks, Inc.
GB
whitelisted
2228
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
952
iexplore.exe
51.68.197.173:80
alexatracker.com
—
GB
suspicious
952
iexplore.exe
2.16.241.15:80
r3.o.lencr.org
Akamai International B.V.
—
suspicious
2228
iexplore.exe
152.199.19.161:443
r20swj13mr.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
ac3g33jgbo3nhutest3.rowisahosve.tk
  • 146.190.228.148
suspicious
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 13.107.22.200
  • 131.253.33.200
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ctldl.windowsupdate.com
  • 2.18.212.243
  • 2.18.212.211
  • 95.140.236.0
  • 178.79.242.0
whitelisted
dateexotic.com
  • 216.119.156.49
unknown
ocsp.digicert.com
  • 93.184.220.29
whitelisted
x1.c.lencr.org
  • 104.89.32.83
whitelisted
r3.o.lencr.org
  • 2.16.241.15
  • 2.16.241.8
shared
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query to a .tk domain - Likely Hostile
952
iexplore.exe
Potentially Bad Traffic
ET POLICY HTTP Request to a *.tk domain
No debug info