analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://safelandtitle603750568.wordpress.com/new-document/

Full analysis: https://app.any.run/tasks/55e851f7-8cc5-427f-8d41-6baa9bbec5bb
Verdict: Malicious activity
Analysis date: January 24, 2022, 18:42:38
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
phishing
Indicators:
MD5:

58D9B0146A76A27DDC74134E9E1B8BC7

SHA1:

19C2D1637815989EEADFD1174C92025FA91BF684

SHA256:

36F552D24DED5F85B4F4774EF4D69E8BCE4E2B27EA826ABA9ED8857D4652E140

SSDEEP:

3:N8JFnc2DZcKXP838SIuRK:2TVdcKXfSps

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2720)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 2720)
      • iexplore.exe (PID: 3268)

    • Checks supported languages

      • iexplore.exe (PID: 3268)
      • iexplore.exe (PID: 2720)

    • Changes internet zones settings

      • iexplore.exe (PID: 3268)

    • Application launched itself

      • iexplore.exe (PID: 3268)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3268)
      • iexplore.exe (PID: 2720)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2720)
      • iexplore.exe (PID: 3268)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2720)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3268)

    • Creates files in the user directory

      • iexplore.exe (PID: 3268)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3268"C:\Program Files\Internet Explorer\iexplore.exe" "https://safelandtitle603750568.wordpress.com/new-document/"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2720"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3268 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
17 624
Read events
17 479
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
25
Text files
53
Unknown types
17

Dropped files

PID
Process
Filename
Type
2720iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\_static[3].csstext
MD5:2D071345EF353C9201F4F300B87773AB
SHA256:9F23205EEBC76292E60AF16B711F297F65D97D11F9D4150AC078DE9A46C9D092
2720iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3538626A1FCCCA43C7E18F220BDD9B02binary
MD5:1C318BD1FF5C051EDA570B66D697A01E
SHA256:D1CDFF9019D762E8AB0469892C55D1DE8259BB6ADD93FBA72F72BFCEDABD7536
3268iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:FC990EAA7247546FB67C18916A4CAC9B
SHA256:294F5BE9159C87842AD3173FE7CDA168C9F2010C6D428085A8AC30EF436CA993
2720iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Eder
MD5:49639B4124119DFEB7616D8DD50F9BB7
SHA256:7F935C9D0A9BD17558459D5A6387B61452011BEA4589AD94A6F2435540A373B5
2720iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\_static[1].csstext
MD5:BB244F74E93CF87909DF5F44C0F734DA
SHA256:0A91EEB8FB88D2677CB5B5A4C580045297D664D6AEEC7DD9C4FFD08ECEE45EB1
3268iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
2720iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:6AD260AD3A77E525727E68255389023B
SHA256:8236F5AF02033C02E6C8556EF62D08A632B3BE4519536757B08DAD8933F89C12
2720iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:291BDF6E122DB5052C2BD9994C159833
SHA256:F6409357FBDDBF5867920640E01BBED1321ECB7F6CA92B514D30CAD09AAB6D1D
2720iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3538626A1FCCCA43C7E18F220BDD9B02der
MD5:6F548F022FDB7B7C9E69D9C2AE913A5A
SHA256:2607A4ABCAC2C515C92606732494C4C4003A1A7B021B5FE4846C05AB533C67A6
3268iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:EA9797996D7AA2B79FCCADF7BB48E6B4
SHA256:FCCE578B71266BD19B33062951D0BA4F4105E3B15C520D65140ACC78B5E30EC8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
84
DNS requests
41
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2720
iexplore.exe
GET
200
18.66.242.58:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
2720
iexplore.exe
GET
200
142.250.186.67:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
2720
iexplore.exe
GET
200
104.18.30.182:80
http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl
US
der
978 b
whitelisted
2720
iexplore.exe
GET
200
18.66.188.222:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
2720
iexplore.exe
GET
200
104.18.31.182:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
2720
iexplore.exe
GET
200
142.250.186.67:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
3268
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2720
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
2720
iexplore.exe
GET
200
142.250.186.67:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCrvyQ4GllugQoAAAABK4Az
US
der
472 b
whitelisted
2720
iexplore.exe
GET
200
104.89.32.83:80
http://x1.c.lencr.org/
NL
der
717 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2720
iexplore.exe
192.0.77.32:443
s2.wp.com
Automattic, Inc
US
suspicious
2720
iexplore.exe
192.0.78.12:443
safelandtitle603750568.wordpress.com
Automattic, Inc
US
malicious
2720
iexplore.exe
192.0.78.13:443
safelandtitle603750568.wordpress.com
Automattic, Inc
US
malicious
2720
iexplore.exe
23.32.238.201:80
ctldl.windowsupdate.com
XO Communications
US
suspicious
2720
iexplore.exe
104.18.30.182:80
ocsp.comodoca.com
Cloudflare Inc
US
suspicious
2720
iexplore.exe
104.18.31.182:80
ocsp.comodoca.com
Cloudflare Inc
US
unknown
2720
iexplore.exe
142.250.184.234:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3268
iexplore.exe
131.253.33.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3268
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2720
iexplore.exe
192.0.73.2:443
0.gravatar.com
Automattic, Inc
US
whitelisted

DNS requests

Domain
IP
Reputation
safelandtitle603750568.wordpress.com
  • 192.0.78.12
  • 192.0.78.13
suspicious
ctldl.windowsupdate.com
  • 23.32.238.201
  • 23.32.238.208
  • 23.32.238.178
  • 95.140.236.128
  • 95.140.236.0
whitelisted
api.bing.com
  • 13.107.13.80
whitelisted
www.bing.com
  • 131.253.33.200
  • 13.107.22.200
whitelisted
ocsp.comodoca.com
  • 104.18.31.182
  • 104.18.30.182
whitelisted
ocsp.usertrust.com
  • 104.18.31.182
  • 104.18.30.182
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
crl.usertrust.com
  • 104.18.30.182
  • 104.18.31.182
whitelisted
s2.wp.com
  • 192.0.77.32
whitelisted
s0.wp.com
  • 192.0.77.32
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Suspicious Glitch Hosted DNS Request - Possible Phishing Landing
2720
iexplore.exe
Misc activity
ET INFO Suspicious Glitch Hosted TLS SNI Request - Possible Phishing Landing
2720
iexplore.exe
Misc activity
ET INFO Suspicious Glitch Hosted TLS SNI Request - Possible Phishing Landing
3268
iexplore.exe
Misc activity
ET INFO Suspicious Glitch Hosted TLS SNI Request - Possible Phishing Landing
3268
iexplore.exe
Misc activity
ET INFO Suspicious Glitch Hosted TLS SNI Request - Possible Phishing Landing
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://safelandtitle603750568.wordpress.com/new-document/