analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://config9.com/windows/the-network-folder-specified-is-currently-mapped-using-a-different-user-name-and-password/

Full analysis: https://app.any.run/tasks/e9f7997e-7f5d-4780-b0d3-52153cb5d315
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: January 17, 2020, 21:54:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
exploit
underminer
Indicators:
MD5:

63B11F9F56BD7EA8187A9950A42FBBB3

SHA1:

09AF78523F9D2519AF442008A5FC8A445A7F811F

SHA256:

3D427E4F2A19332E51093EEF92C8ECC06ED6079AF1CC545A7D1A44C99E3E68C6

SSDEEP:

3:N8X8C43/zNA0KTsWVAGPABxPehfeCIcbS/w9IBERJBK:2MCffVAGCPcFbG/08

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to CnC server

      • rundll32.exe (PID: 2412)

    • Changes settings of System certificates

      • rundll32.exe (PID: 2412)

  • SUSPICIOUS

    • Executed via COM

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 592)

    • Creates files in the Windows directory

      • rundll32.exe (PID: 2412)

    • Connects to unusual port

      • rundll32.exe (PID: 2412)

    • Low-level read access rights to disk partition

      • rundll32.exe (PID: 2412)

    • Uses RUNDLL32.EXE to load library

      • dllhost.exe (PID: 4060)

    • Reads Internet Cache Settings

      • dllhost.exe (PID: 4060)

    • Adds / modifies Windows certificates

      • rundll32.exe (PID: 2412)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 2608)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3676)
      • iexplore.exe (PID: 2080)
      • iexplore.exe (PID: 2352)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3676)
      • iexplore.exe (PID: 2080)
      • iexplore.exe (PID: 2352)

    • Application launched itself

      • iexplore.exe (PID: 2608)

    • Creates files in the user directory

      • iexplore.exe (PID: 3676)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 592)
      • iexplore.exe (PID: 2608)
      • iexplore.exe (PID: 2080)
      • iexplore.exe (PID: 2352)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3676)
      • iexplore.exe (PID: 2608)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2608)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2608)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 3676)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
7
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs iexplore.exe dllhost.exe rundll32.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2608"C:\Program Files\Internet Explorer\iexplore.exe" "https://config9.com/windows/the-network-folder-specified-is-currently-mapped-using-a-different-user-name-and-password/"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3676"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2608 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
592C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Version:
26,0,0,131
2080"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2608 CREDAT:203009C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
4060"C:\Windows\system32\dllhost.exe"C:\Windows\system32\dllhost.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2412InetCpl.cpl,ClearMyTracksByProcess 8C:\Windows\system32\rundll32.exe
dllhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2352"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2608 CREDAT:203010C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
1 566
Read events
1 303
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
11
Text files
265
Unknown types
53

Dropped files

PID
Process
Filename
Type
3676iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OLF13TVK\the-network-folder-specified-is-currently-mapped-using-a-different-user-name-and-password[1].txt —
MD5:—
SHA256:—
3676iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:AA2018DD49C5F2E8A8E3B7D67F388986
SHA256:BD2E00D09F76992948E7F5E49483E4F7951DDEE1E9F5B7E24E18BBDB15AAC668
3676iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9D3NS720\css[1].txttext
MD5:167EBF8D1AF5A34FFD9CB866A42D7B82
SHA256:189F57D1337B6176E5A6ED8B8C407C843FA9F2F7178EC2DD721760CD75AD41DC
3676iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OLF13TVK\style[1].csstext
MD5:8297716D5F5C7C54C31512E99BD45904
SHA256:38C3E242A46909A4A20B28499BD5E45BE52DB6B5E725F85A2619AC5602296737
3676iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:76211BCA4837095210627EBDEC4DFC07
SHA256:AED895297B6C4B219D84EDED2CA6577509DD6E15E5AF16D6B96A23E81E2EC1D4
3676iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OLF13TVK\the-network-folder-specified-is-currently-mapped-using-a-different-user-name-and-password[1].htmhtml
MD5:2E91627E628FA90307E9B84CA0AE9C85
SHA256:87A8A2C9A47642E678E936DF45B9876A75E6E70AB60E5C5D62B06810D539998F
3676iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\AWOX0H6H\blocks[1].csstext
MD5:D17984F34089EE268849436DAB80B693
SHA256:2B682EAFDBB1105C7E0292965160ED0E2A446A30AC0D49049297F29E8C48A278
3676iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\AWOX0H6H\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
3676iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9D3NS720\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
3676iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\AWOX0H6H\style.min[1].csstext
MD5:9EEDDC51B0B4A2580A959042D50F826E
SHA256:D9662B4B9BA6C2C3691CE0ACD4572E027366EB97D6070550A13429262BB0037F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
301
DNS requests
63
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3676
iexplore.exe
GET
200
185.17.186.1:80
http://edublogg.com/ad?cachebust=MHRuSGY2aW9zNmlmcWFhYXJ0SGloSmx2aG52Q29NYUt3ckRHdkt1dDBzdkMydEo1aEdhSGl1Zmx2SFN1N3NaMTZ1L0s3b1ROMGxTQW9vZGxwS204ZE8zcTAzWGw1dEdtb1pySmRYZGtjNTIxNUxDc3pxekhscUtwdk11UTNjWmxrcHQvZDhiYnI1YlA1Y2QxeCsyL3lKamV5SFJlWm5PZDNOeXZsczZ1eUlyTHFiN3VrZEhTVTN1cWM1eks2c2VLditMZWlzam4xY2g3bGNoMWxXWnlkOG5keDRyQ3M4ZVh4NnkveUpTYXlHVnpxWFIzdGVpeHFacXR2bWlsdlpiWHQ5VG5obXRqWFdpZW9acHdwckt3Y2FtZjJkaUlsckJYWm10TG5OM2d6S2F5cTY5NnE2dXBySHlWc1ZOZ2FsNWpsdG5UZjYyc3FIU2lxNTZtZ1pPclVWNVlscWpWNHR4LzJLekFzTXpSd3FtV21OT05rV1YzclpiaXlLaXk0dTYzNHV5VnA0eUtxMmRUWkd1VzROMlFvOW1vM2JMZm5xSzZ2c3JybDVOWFYzbmoyTks1bytyaXM1ZXN0dFZ3bUwxVVpXdFZXS0tteFdlb3ZyRjFxdkdwcEhIWTdWNWZaMXhzb3FtYmM2V3lvTGJuMjluWWlMWEljVlNuaG5DOTM5MnI0ZWJiYUtTL3BLSjdrSjVUWnBXVW9PRFIxNnZYNXQ5b3BidWJ3WjZ1dmt4bVlGVllvN0tPbWQ3bzNyTHA3SnZDbjVDdlQxOVhXSFdieE5XcjJkL290NWVydHFoNWxaNVVjRjE0ZjdPemxXZW92S1Z4d0w3RW40Nnh5MHhnWUZWaHBhQ2FkS3lmcllXZHA3NjVuNUM4YllCZFdHR2xucFp5ckt5emFLVzdtNktacXMxTWNYNTNYcU9lazNDb3FyRjFxNTZqdG5heTNvV1hrMUIyMWQ3WHArZWx5b2FkcjU2a2NKaTdURnlBYW9la25wT0ZtcTI4YnFESHRjaC9rNmxtVTJSZVdlWFp4MytucnF4NA%3D%3D&u=2425
NL
—
757 b
suspicious
3676
iexplore.exe
GET
200
185.17.186.1:80
http://edublogg.com/ad?cachebust=MHRuSGY2V29xbk9pcXFtcGNjamxpcEdkWXBTNHdwT2x2Y2V3ait1eXBOYWkzTzU2aG9oWmxjZm4ySnVucys2UHBQSG16c1dlNFhwaGhKV1ZvcVNjbTZmeTZweWs3TjNWZmJ1dWNZSjdWNEhhdGRlUDM5T3NrTVdwb01DZnFxNXZnb1NRZ2JUSms0N0p3L0dSN003a3c1L0lxVzZYWTVDTTZ0T1Rqc25lNXBLMnl1bkRuOG5rZTNKM1Y0S3p5dDJtdmNUaXA3blAzdG1mbGFsdnFJZWNnTFMxMEthOXg3T1F4czZqdzUrdXJuQnlkNTZBMnJIYmtNYWZyWWVYckxTYXJ0SG9qNU52Vm11bG5wUjVvNnV5ZWFDd2x0MnZvcXBZWkdwZVdkbmQwNnZadDZ0NHFiS2lyWU9XcTFKaVlsdG1sdG5UZjYyc3FIU2lxNTZtZ1pPclVWNVlscWpWNHR4LzJzSEV1ZGU4NU9lc3ZkT05WS1NLbWEzWTE3Ymw3WjkyczU2aXVuQ1h2NFNlbjFLVTFKN0dzZUtmcklubDN1THFzSXFyWjZHYWxLcWU0TXV5bXEzQXBKZXN0S2VDbnFsR1lHaUhXS08wbW5TdDhyTnptT3prc1h5YXNGcGdhMTFrb3FLSnRlcmM0NmV2eWIvRWNkcmFYbnVobjV6YzNNUm5wOEN1Y2FLa2xhYUR5T2lPbnBPWm5OTGN5R2VvdktXUXhjSzFuNE9UcVVaaGRGQ0syZDdIc2V6dHBaSEdwS2FpZklxc1kxbUdsNXpVMWRHMm1xekFkNkNwbGFlTmtNeHRjWFZYV0tPeWpuRER2ODV1dGNYQ24zMlRxVTlqWWx4bHA1V1doS0NveUlqR3BMUEFuWkNzVDJOZ1dHT25vcHhucUx5bGNjQyt4SitPc2N0TVlXQlZZYU9nbW5TdW42MkZuY2JWMkxUR3BHU1RvSm1ZNHB1emhhQ3dxSE9YckxLZmViTytkV0pnVlhhVm82VnRvOGkvbDZhbm9MbHdsN0pIbzV1SmNLS2tsWGM9&u=2425
NL
—
757 b
suspicious
3676
iexplore.exe
GET
200
185.17.186.1:80
http://edublogg.com/ad?cachebust=MHRuSGY2aW9zNmlmcWFhYXJ0SGloSmx2aG52Q29NYUt3ckRHdkt1dDBzdkMydEo1aEdhSGl1Zmx2SFN1N3NaMTZ1L0s3b1ROMGxTQW9vZGxwS204ZE8zcTAzWGw1dEdtb1pySmRYZGtjNTIxNUxDc3pxekhscUtwdk11UjB0SjFmSjUwZDdIcXI1Ykw1TWV0M2UzS3VKemR4blJmbkhTS3Z0dXZtY2J5eUszVzVyN2hrZExJZUlObGM2eks2c2VLditMZWlzam4xY2g3bGNkbGQ2bHlkOVBkeDRyQ3M4ZVh4NnkveUpTYXlHVnpxWFIzeWVld2s1cXR2bWlsdlpiWHQ5VG5obXRqWFdpZW9acHdwckt3Y2FtZjJkaUlsckJYWm10TG5OM2d6S2F5cTY5NnE2dXBySHlWc1ZkaFpGeHFsdG5UZjYyc3FIU2lxNTZtZ1pPclVWNVlscWpWNHR4LzJlZlF2TldydHQ2bHVPMllpSXB2b05USGxLNmI3TitwcitIazZMdllubFJ2VjFkNWxhS3BwZVhucDZUV3A5UGp1SXFyWjZHWGw2blZsWldJNk9McHVxRHAyT1J3bUwrQ1UyVnBacWVwazJlbnNOeG9wYjJqcEh2ZHExWmVXSmlucmFHWWVhNnNzM3VqcWFtYXZ0cmJpcEp2ZFlMQWx0aWpzc2ZwdmR2bDNOVndsNzlWWEdKUVdLS294ckhpNnR1MzI5dmMyWENZdTB4N2hXNTRtNmlSY3BxdHZHN0o0dDdZdXR6c1RIeUdVR21lb1loMXQ2WE90ZHZkMWVLL2lxdG5ZbUJWV0tPeWpwWEJ2YjExbDZ5eW4zbXp2blZaZFhHRm02S1JjcU92cW5xa3NKV25qWkNuYjNPR1VIYTh3bzUxbzYrb2RxS3dvcTF3bUx0TVhJQnFoNXV6cjVTZ3JhaHpvS3lncTMyZW5sUndYWEtZMU5uRWJiamY2TGZYNjV2RWpwQ3ZUMTVYV0hXYm5yR0h5YTZvYzdXZW83WjJrOGRtZ21aVFk3V1ZsWHViNytPbnI2dWtwb0E9&u=2425
NL
—
764 b
suspicious
3676
iexplore.exe
GET
200
2.20.188.10:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
unknown
compressed
57.4 Kb
whitelisted
2080
iexplore.exe
GET
303
18.214.175.230:80
http://ps.popcash.net/ad/ad?p=220739&w=520804&t=668e6e61b77dc2aa&r=&vw=0&vh=0
US
html
54 b
shared
2412
rundll32.exe
GET
200
2.16.186.11:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
unknown
der
1.37 Kb
whitelisted
2412
rundll32.exe
GET
200
2.19.43.67:80
http://cert.int-x3.letsencrypt.org/
unknown
der
1.15 Kb
whitelisted
2080
iexplore.exe
GET
200
18.214.175.230:80
http://ps.popcash.net/go/220739/520804
US
html
272 b
shared
2080
iexplore.exe
GET
301
104.26.3.188:80
http://popcash.net/world/go/220739/520804
US
html
162 b
whitelisted
3676
iexplore.exe
GET
200
104.28.24.119:80
http://babetube.icu/1.php
US
html
304 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3676
iexplore.exe
172.217.16.170:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3676
iexplore.exe
172.217.23.99:443
fonts.gstatic.com
Google Inc.
US
whitelisted
2608
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3676
iexplore.exe
104.18.56.22:443
cpm-ad.com
Cloudflare Inc
US
shared
3676
iexplore.exe
104.19.130.80:443
jsc.adskeeper.co.uk
Cloudflare Inc
US
unknown
3676
iexplore.exe
45.76.1.139:443
config9.com
Choopa, LLC
US
unknown
3676
iexplore.exe
172.217.21.202:443
ajax.googleapis.com
Google Inc.
US
whitelisted
3676
iexplore.exe
104.17.64.4:443
cdnjs.cloudflare.com
Cloudflare Inc
US
unknown
3676
iexplore.exe
172.217.18.174:443
www.google-analytics.com
Google Inc.
US
whitelisted
3676
iexplore.exe
172.217.23.162:443
pagead2.googlesyndication.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
config9.com
  • 45.76.1.139
unknown
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
fonts.googleapis.com
  • 172.217.16.170
whitelisted
fonts.gstatic.com
  • 172.217.23.99
whitelisted
jsc.adskeeper.co.uk
  • 104.19.130.80
  • 104.19.131.80
  • 104.19.133.80
  • 104.19.134.80
  • 104.19.132.80
whitelisted
cpm-ad.com
  • 104.18.56.22
  • 104.18.57.22
suspicious
ajax.googleapis.com
  • 172.217.21.202
whitelisted
cdnjs.cloudflare.com
  • 104.17.64.4
  • 104.17.65.4
whitelisted
www.googletagmanager.com
  • 172.217.21.200
whitelisted
adz2you.net
  • 104.31.81.149
  • 104.31.80.149
malicious

Threats

PID
Process
Class
Message
2412
rundll32.exe
A Network Trojan was detected
MALWARE [PTsecurity] Encrypted Hidden Bee binary payload
2412
rundll32.exe
A Network Trojan was detected
MALWARE [PTsecurity] Encrypted Hidden Bee binary payload
—
—
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .icu Domain
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .world TLD
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .world TLD
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .world TLD
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://config9.com/windows/the-network-folder-specified-is-currently-mapped-using-a-different-user-name-and-password/