URL:

https://outlookdiagnostics.azureedge.net/sarafiles/Microsoft.Sara.Prod.application?usergroup=Prod&Ring=Prod&symptomid=2a490a7b-b194-4354-b134-8af569395d05

Full analysis: https://app.any.run/tasks/b65f11b6-a544-4f9d-a9de-086985efed18
Verdict: Malicious activity
Analysis date: November 14, 2023, 14:45:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
SHA1:

5E35BC3097C5EDBD135756872B1FDFB2F763D176

SHA256:

387421E4FAA485E91517FAD369363D8E6991215CD7D877E84FBA0FEE910BA8D9

SSDEEP:

3:N8ZRMC/FCAjWXq0Kg+trEBRVMMQbeOvOKOBJNxA+0lqQDq:2bNCAUqvlWzieeO/NxtrQG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads settings of System Certificates

      • dfsvc.exe (PID: 3580)

    • Reads the Internet Settings

      • dfsvc.exe (PID: 3580)

    • Checks Windows Trust Settings

      • dfsvc.exe (PID: 3580)

    • Reads Internet Explorer settings

      • dfsvc.exe (PID: 3580)

  • INFO

    • Reads the machine GUID from the registry

      • dfsvc.exe (PID: 3580)
      • wmpnscfg.exe (PID: 3748)

    • Reads the computer name

      • dfsvc.exe (PID: 3580)
      • wmpnscfg.exe (PID: 3748)

    • Checks supported languages

      • dfsvc.exe (PID: 3580)
      • wmpnscfg.exe (PID: 3748)

    • Application launched itself

      • iexplore.exe (PID: 3208)

    • Creates files or folders in the user directory

      • dfsvc.exe (PID: 3580)

    • Reads Environment values

      • dfsvc.exe (PID: 3580)

    • Checks proxy server information

      • dfsvc.exe (PID: 3580)

    • Create files in a temporary directory

      • dfsvc.exe (PID: 3580)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3748)

    • Process checks are UAC notifies on

      • dfsvc.exe (PID: 3580)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
5
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe no specs iexplore.exe dfsvc.exe no specs dfsvc.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3208"C:\Program Files\Internet Explorer\iexplore.exe" "https://outlookdiagnostics.azureedge.net/sarafiles/Microsoft.Sara.Prod.application?usergroup=Prod&Ring=Prod&symptomid=2a490a7b-b194-4354-b134-8af569395d05"C:\Program Files\Internet Explorer\iexplore.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3276"C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
ClickOnce
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\dfsvc.exe
c:\windows\system32\ntdll.dll
3432"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3208 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3580"C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
ClickOnce
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\dfsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3748"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
Total events
13 814
Read events
13 739
Write events
71
Delete events
4

Modification events

(PID) Process:(3208) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3208) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3208) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3208) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3208) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3208) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3208) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3208) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3208) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3208) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
12
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
3432iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:7A8242CCC0C8A55281A4E6185B84DCA9
SHA256:3AC5D2DA9E3E7CB0C5E9A82FE5C3FAF79B7FB703CA3E366AF4665DA54F4CFB7E
3432iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
3208iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{77069597-82FC-11EE-A826-12A9866C77DE}.datbinary
MD5:B4DB7B7D0FC142AE4776D79257D9C2DB
SHA256:21C9A262DFE8E3D561E48F18CA12E200F8B67F7AEB22FFB4C0DBEFB69D1B036A
3432iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:249F9E3B3C074A98D2BF13547FC6226B
SHA256:340DBB9A7D9C03E23AC78FF668DDA6C0F383A18E0009B79F029BB756DC27257E
3208iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF50923BC889E941B2.TMPbinary
MD5:09CF911C7A932BB0D2EA488902989BF7
SHA256:134F26A712BEBB201B057F5A28A7C572DD5FF944B32912DC808434750C88418D
3208iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{77069599-82FC-11EE-A826-12A9866C77DE}.datbinary
MD5:748017921F2541324F1AD542D6020BD6
SHA256:B0A8A8D035DD5A2BDCC9D3D34123802E0DEAB0CF09B422BBE12908FC540050F6
3432iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:80365737D831AA050168DFB7213F7395
SHA256:393EEE3AEEC54276BCCEE202EAD5FCA82E09CB7422FBE9E52638434E2864CD16
3432iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\Microsoft.Sara.Prod[1].applicationxml
MD5:E40A2906E73AC5D64A776D58415DA397
SHA256:B2A7AC0684FA49C20BE616318A94F1A3102A4ACDE45E61DB775E392E7D05C05C
3208iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFA45923819CC441A7.TMPbinary
MD5:BFC7BBE033E94FFF1760BA4F03ED8AB6
SHA256:D56D471A107C2814F5682C1991DD1C46529B21396A1871A34D4B10F2DCF02D53
3580dfsvc.exeC:\Users\admin\AppData\Local\Temp\CabC0EE.tmpcompressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
10
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3580
dfsvc.exe
GET
—
23.35.229.160:80
http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt
unknown
—
—
unknown
3432
iexplore.exe
GET
200
95.140.236.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5f0e922e4b9c4d0d
unknown
compressed
4.66 Kb
unknown
3432
iexplore.exe
GET
200
95.140.236.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1380efddd71b9ea9
unknown
compressed
4.66 Kb
unknown
3432
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
3580
dfsvc.exe
GET
200
95.101.54.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?807b9ab83e15559c
unknown
compressed
61.6 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3432
iexplore.exe
95.140.236.128:80
ctldl.windowsupdate.com
LLNW
US
unknown
3432
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3580
dfsvc.exe
152.199.19.160:443
—
EDGECAST
US
whitelisted
3580
dfsvc.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3580
dfsvc.exe
95.101.54.128:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 95.140.236.128
  • 95.140.236.0
  • 95.101.54.128
  • 95.101.54.105
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted

Threats

No threats detected
Process
Message
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://outlookdiagnostics.azureedge.net/sarafiles/Microsoft.Sara.Prod.application?usergroup=Prod&Ring=Prod&symptomid=2a490a7b-b194-4354-b134-8af569395d05