URL:

https://anonfiles.com/veZfff8eu9/Cindy_Botnet_rar

Full analysis: https://app.any.run/tasks/3be4a68c-c71a-49cf-a4b2-595af8d257b1
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: July 24, 2021, 19:09:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
njrat
bladabindi
Indicators:
MD5:

0BF8BC8AD0AB8336A5A9B5E356B81BFF

SHA1:

E0A938D57D4CF95BD121393F4A68475971E76393

SHA256:

39A42FF65B5571352C242792F3F04AEC855CAB9E6349322E7D8094AF3AE29998

SSDEEP:

3:N8M2Iaf3vkLDO:2M2dyi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Cindy Botnet.exe (PID: 760)
      • IGFXEM MODULE.EXE (PID: 540)
      • SVCHOST.EXE (PID: 1836)
      • Explorer.exe (PID: 4072)
      • SYSTEM.EXE (PID: 3108)
      • WSSAPX.EXE (PID: 3436)
      • DLLHOST.EXE (PID: 2692)
      • System32.exe (PID: 2324)
      • Print Service.exe (PID: 2228)
      • 12376w8q09dq.exe (PID: 2996)

    • Drops executable file immediately after starts

      • Cindy Botnet.exe (PID: 760)
      • WSSAPX.EXE (PID: 3436)
      • SVCHOST.EXE (PID: 1836)
      • Explorer.exe (PID: 4072)

    • Uses Task Scheduler to run other applications

      • IGFXEM MODULE.EXE (PID: 540)
      • Print Service.exe (PID: 2228)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2116)
      • schtasks.exe (PID: 1412)
      • schtasks.exe (PID: 2424)
      • schtasks.exe (PID: 2744)

    • Changes the autorun value in the registry

      • WSSAPX.EXE (PID: 3436)
      • Explorer.exe (PID: 4072)
      • DLLHOST.EXE (PID: 2692)
      • SYSTEM.EXE (PID: 3108)
      • Print Service.exe (PID: 2228)

    • NANOCORE was detected

      • WSSAPX.EXE (PID: 3436)

    • NJRAT was detected

      • Explorer.exe (PID: 4072)

    • Writes to a start menu file

      • Explorer.exe (PID: 4072)
      • Print Service.exe (PID: 2228)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2436)

    • Reads the computer name

      • WinRAR.exe (PID: 1764)
      • Cindy Botnet.exe (PID: 760)
      • DLLHOST.EXE (PID: 2692)
      • SVCHOST.EXE (PID: 1836)
      • SYSTEM.EXE (PID: 3108)
      • IGFXEM MODULE.EXE (PID: 540)
      • WSSAPX.EXE (PID: 3436)
      • Explorer.exe (PID: 4072)
      • System32.exe (PID: 2324)
      • Print Service.exe (PID: 2228)
      • 12376w8q09dq.exe (PID: 2996)

    • Checks supported languages

      • WinRAR.exe (PID: 1764)
      • Cindy Botnet.exe (PID: 760)
      • DLLHOST.EXE (PID: 2692)
      • IGFXEM MODULE.EXE (PID: 540)
      • WSSAPX.EXE (PID: 3436)
      • SYSTEM.EXE (PID: 3108)
      • SVCHOST.EXE (PID: 1836)
      • Explorer.exe (PID: 4072)
      • cmd.exe (PID: 3984)
      • System32.exe (PID: 2324)
      • Print Service.exe (PID: 2228)
      • 12376w8q09dq.exe (PID: 2996)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 1764)

    • Executable content was dropped or overwritten

      • Cindy Botnet.exe (PID: 760)
      • WinRAR.exe (PID: 1764)
      • WSSAPX.EXE (PID: 3436)
      • SVCHOST.EXE (PID: 1836)
      • Explorer.exe (PID: 4072)
      • SYSTEM.EXE (PID: 3108)
      • DLLHOST.EXE (PID: 2692)
      • IGFXEM MODULE.EXE (PID: 540)
      • Print Service.exe (PID: 2228)

    • Creates executable files which already exist in Windows

      • Cindy Botnet.exe (PID: 760)

    • Drops a file with a compile date too recent

      • Cindy Botnet.exe (PID: 760)
      • SVCHOST.EXE (PID: 1836)
      • Explorer.exe (PID: 4072)
      • SYSTEM.EXE (PID: 3108)
      • IGFXEM MODULE.EXE (PID: 540)
      • Print Service.exe (PID: 2228)

    • Creates files in the user directory

      • WSSAPX.EXE (PID: 3436)
      • Explorer.exe (PID: 4072)
      • DLLHOST.EXE (PID: 2692)
      • Print Service.exe (PID: 2228)

    • Reads Environment values

      • WSSAPX.EXE (PID: 3436)
      • netsh.exe (PID: 2296)
      • System32.exe (PID: 2324)
      • Print Service.exe (PID: 2228)

    • Starts itself from another location

      • SVCHOST.EXE (PID: 1836)
      • SYSTEM.EXE (PID: 3108)
      • IGFXEM MODULE.EXE (PID: 540)

    • Uses NETSH.EXE for network configuration

      • Explorer.exe (PID: 4072)

    • Starts CMD.EXE for commands execution

      • DLLHOST.EXE (PID: 2692)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 2056)
      • iexplore.exe (PID: 2436)
      • schtasks.exe (PID: 2116)
      • schtasks.exe (PID: 1412)
      • netsh.exe (PID: 2296)
      • schtasks.exe (PID: 2424)
      • schtasks.exe (PID: 2744)

    • Checks supported languages

      • iexplore.exe (PID: 2436)
      • iexplore.exe (PID: 2056)
      • schtasks.exe (PID: 2116)
      • schtasks.exe (PID: 1412)
      • netsh.exe (PID: 2296)
      • timeout.exe (PID: 3136)
      • schtasks.exe (PID: 2424)
      • schtasks.exe (PID: 2744)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2056)
      • iexplore.exe (PID: 2436)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2056)
      • iexplore.exe (PID: 2436)
      • System32.exe (PID: 2324)

    • Changes internet zones settings

      • iexplore.exe (PID: 2056)

    • Application launched itself

      • iexplore.exe (PID: 2056)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2436)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
61
Monitored processes
20
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe winrar.exe cindy botnet.exe dllhost.exe igfxem module.exe svchost.exe system.exe #NANOCORE wssapx.exe schtasks.exe no specs schtasks.exe no specs #NJRAT explorer.exe netsh.exe no specs cmd.exe no specs timeout.exe no specs system32.exe print service.exe schtasks.exe no specs schtasks.exe no specs 12376w8q09dq.exe

Process information

PID
CMD
Path
Indicators
Parent process
540"C:\Users\admin\AppData\Local\Temp\IGFXEM MODULE.EXE" C:\Users\admin\AppData\Local\Temp\IGFXEM MODULE.EXE
Cindy Botnet.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\igfxem module.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
760"C:\Users\admin\AppData\Local\Temp\Rar$EXa1764.44149\Cindy Botnet\Cindy Botnet.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1764.44149\Cindy Botnet\Cindy Botnet.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1764.44149\cindy botnet\cindy botnet.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1412schtasks /create /tn NYAN /tr "C:\Users\admin\AppData\Local\Temp\IGFXEM MODULE.EXE" /sc minute /mo 1C:\Windows\system32\schtasks.exe—IGFXEM MODULE.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1764"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Cindy Botnet.rar"C:\Program Files\WinRAR\WinRAR.exe
iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
1836"C:\Users\admin\AppData\Local\Temp\SVCHOST.EXE" C:\Users\admin\AppData\Local\Temp\SVCHOST.EXE
Cindy Botnet.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2056"C:\Program Files\Internet Explorer\iexplore.exe" "https://anonfiles.com/veZfff8eu9/Cindy_Botnet_rar"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2116schtasks /Delete /tn NYAN /FC:\Windows\system32\schtasks.exe—IGFXEM MODULE.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
2228"C:\Users\admin\AppData\Local\Temp\Print Service.exe" C:\Users\admin\AppData\Local\Temp\Print Service.exe
IGFXEM MODULE.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\print service.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2296netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\ Explorer.exe" " Explorer.exe" ENABLEC:\Windows\system32\netsh.exe— Explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\gdi32.dll
2324"C:\Users\admin\AppData\Local\Temp\System32\System32.exe" C:\Users\admin\AppData\Local\Temp\System32\System32.exe
SYSTEM.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\system32\system32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
27 029
Read events
26 683
Write events
346
Delete events
0

Modification events

(PID) Process:(2056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30900415
(PID) Process:(2056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(2056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30900415
(PID) Process:(2056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
21
Suspicious files
17
Text files
75
Unknown types
9

Dropped files

PID
Process
Filename
Type
2436iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:—
SHA256:—
2436iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:—
SHA256:—
2436iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\Cindy_Botnet_rar[1].htmhtml
MD5:—
SHA256:—
2436iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\anonfiles[1].csstext
MD5:—
SHA256:—
2436iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
2436iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\app[1].jstext
MD5:—
SHA256:—
2436iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
2436iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\us[1].pngimage
MD5:AE506A6C014BFEB8D8CBFDFBE94C14C9
SHA256:BC6DD978E70894C8A0148E6806F4FDE9566EE59349ADB03C02A61A3B2E25B6F1
2436iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62der
MD5:—
SHA256:—
2436iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_ACB084F1532E23E916946A083A45F6BFbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
37
DNS requests
23
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2436
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
2436
iexplore.exe
GET
200
13.32.23.204:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D
US
der
1.39 Kb
shared
2436
iexplore.exe
GET
200
23.55.163.57:80
http://crl.identrust.com/DSTROOTCAX3CRL.crl
US
der
1.16 Kb
whitelisted
2436
iexplore.exe
GET
200
104.18.20.226:80
http://ocsp2.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEHgDGCDPAjbzpoUYuu%2B39wE%3D
US
der
1.40 Kb
whitelisted
2056
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
2436
iexplore.exe
GET
200
13.32.23.204:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
2436
iexplore.exe
GET
200
13.32.23.215:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
2436
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?deaccb68ce407946
US
compressed
4.70 Kb
whitelisted
2436
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b87f606e250673d8
US
compressed
4.70 Kb
whitelisted
—
—
GET
200
104.117.200.9:80
http://x1.c.lencr.org/
US
der
717 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2436
iexplore.exe
172.67.211.127:443
anonfiles.com
—
US
unknown
2436
iexplore.exe
151.101.2.217:443
vjs.zencdn.net
Fastly
US
suspicious
2436
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2436
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2436
iexplore.exe
104.18.20.226:80
ocsp2.globalsign.com
Cloudflare Inc
US
shared
2436
iexplore.exe
65.9.58.79:443
djv99sxoqpv11.cloudfront.net
AT&T Services, Inc.
US
suspicious
2436
iexplore.exe
13.32.23.204:80
ocsp.rootg2.amazontrust.com
Amazon.com, Inc.
US
whitelisted
2056
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2436
iexplore.exe
185.157.161.137:443
cdn-105.anonfiles.com
Obenetwork AB
SE
suspicious
2056
iexplore.exe
172.67.211.127:443
anonfiles.com
—
US
unknown

DNS requests

Domain
IP
Reputation
anonfiles.com
  • 172.67.211.127
  • 104.21.77.203
shared
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
vjs.zencdn.net
  • 151.101.2.217
  • 151.101.66.217
  • 151.101.130.217
  • 151.101.194.217
whitelisted
djv99sxoqpv11.cloudfront.net
  • 65.9.58.79
  • 65.9.58.37
  • 65.9.58.213
  • 65.9.58.163
shared
ocsp2.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted
o.ss2.us
  • 13.32.23.215
  • 13.32.23.96
  • 13.32.23.104
  • 13.32.23.16
whitelisted
ocsp.rootg2.amazontrust.com
  • 13.32.23.204
  • 13.32.23.69
  • 13.32.23.206
  • 13.32.23.89
whitelisted
ocsp.rootca1.amazontrust.com
  • 13.32.23.204
  • 13.32.23.206
  • 13.32.23.69
  • 13.32.23.89
shared
api.bing.com
  • 13.107.5.80
whitelisted

Threats

PID
Process
Class
Message
3436
WSSAPX.EXE
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
3436
WSSAPX.EXE
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
3436
WSSAPX.EXE
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
3436
WSSAPX.EXE
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
3436
WSSAPX.EXE
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://anonfiles.com/veZfff8eu9/Cindy_Botnet_rar