URL:

https://7pf32.r.a.d.sendibm1.com/mk/mr/sh/7xYEvjyWS1dhUVRIOYKAmu6whyoWfwa/aiKAA3DcnZho

Full analysis: https://app.any.run/tasks/768c2933-e3ca-424a-beba-46f28231802e
Verdict: Malicious activity
Analysis date: December 02, 2023, 05:29:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

DD6599640516676D7891452D958344A0

SHA1:

2929B4B2B5A3631F49FD22DFEB123368B40683E3

SHA256:

3871BC5C232BDD91F694FA8E8793E6A3ED68EACFF96ECF9048598327AFC85E33

SSDEEP:

3:N8tnELB3BftK/aWNK8vBQbKKQvHwn:2tiVBlvR4Ffwn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3964)

    • Application launched itself

      • iexplore.exe (PID: 564)

    • Checks supported languages

      • wmpnscfg.exe (PID: 3964)

    • Reads the computer name

      • wmpnscfg.exe (PID: 3964)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
564"C:\Program Files\Internet Explorer\iexplore.exe" "https://7pf32.r.a.d.sendibm1.com/mk/mr/sh/7xYEvjyWS1dhUVRIOYKAmu6whyoWfwa/aiKAA3DcnZho"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2080"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:564 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3964"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
18 754
Read events
18 677
Write events
73
Delete events
4

Modification events

(PID) Process:(564) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(564) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(564) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(564) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(564) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(564) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(564) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(564) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(564) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(564) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
30
Text files
22
Unknown types
0

Dropped files

PID
Process
Filename
Type
2080iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar6C2E.tmpbinary
MD5:9C0C641C06238516F27941AA1166D427
SHA256:4276AF3669A141A59388BC56A87F6614D9A9BDDDF560636C264219A7EB11256F
2080iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab6C2D.tmpcompressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
2080iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E10BDCBDEB8013D444EF284E872C7DCEbinary
MD5:F02ED9F4FB81A964548853094F8CFA89
SHA256:0CEB2E0AA87C9B1717D32B498DA07DD28C54BE00843061251E5F508284EFD575
2080iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:C05A4765F1EBB8FCAE4A6718BE8AA1A2
SHA256:A1D834BC698B78AFD57FA185D153080785827BA57DCB0BAE366C737E3B8F4D16
2080iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:5063CED27D591D8B7F586E9ECF939996
SHA256:6CA0A1F5620102573E0F019BED25D550949D1E026D8F9DFCFD19804F52CE5D8B
2080iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:E5925EA0049FA30DB7038E409BEDD6C1
SHA256:D99A2F8591DDCB387CA4562F36AEDB8D449FBAD51B3C62110895485D6EFB7818
2080iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab6C2B.tmpcompressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
2080iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:D126209B622EC8AD46805DCF8B1EED21
SHA256:4916A61C5318F21CB4B9F39CF34587EC1DBF80639D5A5D4CC162FB07716F198A
2080iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\aiKAA3DcnZho[1].htmhtml
MD5:48CFDC316577CF94460C85D6B5DAD3C1
SHA256:24D07B283713C88D0DD605EFA1C5B1B44692878FB12389F9C00BD638300D3A1E
2080iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:6C85C91F053591C54B8B67C6E97AB828
SHA256:652FAC630617D041D0B7DE9C997A0E9376467AE7AD69884E7F4186C841675472
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
34
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2080
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?25fa4254fbf74a53
unknown
compressed
4.66 Kb
unknown
2080
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ae379654bbbca709
unknown
compressed
4.66 Kb
unknown
2080
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?64a1a5dfd935ecb5
unknown
compressed
65.2 Kb
unknown
2080
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?a88ccd45ad45c010
unknown
compressed
65.2 Kb
unknown
2080
iexplore.exe
GET
200
23.197.120.82:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
2080
iexplore.exe
GET
200
2.16.241.15:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgSVoVk6iF7l%2BBpifKs5WEflHQ%3D%3D
unknown
binary
503 b
unknown
2080
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
binary
1.47 Kb
unknown
2080
iexplore.exe
GET
200
172.217.18.3:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
2080
iexplore.exe
GET
200
172.217.18.3:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
2080
iexplore.exe
GET
200
23.201.254.55:80
http://x2.c.lencr.org/
unknown
binary
300 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2080
iexplore.exe
1.179.112.197:443
7pf32.r.a.d.sendibm1.com
GOOGLE-CLOUD-PLATFORM
FR
unknown
2080
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
2080
iexplore.exe
23.197.120.82:80
x1.c.lencr.org
Akamai International B.V.
US
unknown
2080
iexplore.exe
2.16.241.15:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown
2080
iexplore.exe
172.217.16.202:443
fonts.googleapis.com
GOOGLE
US
whitelisted
2080
iexplore.exe
172.64.148.218:443
img-cache.net
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
7pf32.r.a.d.sendibm1.com
  • 1.179.112.197
  • 1.179.112.195
  • 1.179.112.196
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
x1.c.lencr.org
  • 23.197.120.82
whitelisted
r3.o.lencr.org
  • 2.16.241.15
  • 2.16.241.8
shared
fonts.googleapis.com
  • 172.217.16.202
whitelisted
img-cache.net
  • 172.64.148.218
  • 104.18.39.38
unknown
img.mailinblue.com
  • 104.18.38.14
  • 172.64.149.242
malicious
ocsp.digicert.com
  • 192.229.221.95
whitelisted
ocsp.pki.goog
  • 172.217.18.3
whitelisted
x2.c.lencr.org
  • 23.201.254.55
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://7pf32.r.a.d.sendibm1.com/mk/mr/sh/7xYEvjyWS1dhUVRIOYKAmu6whyoWfwa/aiKAA3DcnZho