analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://survey-smiles.com

Full analysis: https://app.any.run/tasks/5b689a73-9f58-450c-9264-350d0554ea29
Verdict: Malicious activity
Analysis date: March 31, 2020, 06:12:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

33F0019CCF0A191137F5F0B04DEFBD94

SHA1:

0EA5DC9501FFD6A5FE4B30E4747244235361F0AD

SHA256:

3D7C8C83E6091907B050B21C67F5D49EFB245DCA215B3637491E58E155A084B7

SSDEEP:

3:N1KNQXTD52n:CCsn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 3892)

    • Creates files in the user directory

      • iexplore.exe (PID: 3732)
      • iexplore.exe (PID: 3892)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3732)
      • iexplore.exe (PID: 3892)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3732)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3732)
      • iexplore.exe (PID: 3892)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3892)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3892"C:\Program Files\Internet Explorer\iexplore.exe" "http://survey-smiles.com"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3732"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3892 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
11 646
Read events
1 725
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
45
Text files
23
Unknown types
26

Dropped files

PID
Process
Filename
Type
3892iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\PGXAICWX.htmhtml
MD5:6BF340E1B545124904E278F702E0B514
SHA256:6A2F0800C569852DCBA8ACD29BA914B6EC10E341ABB13EB66F74A8BB21C52FB0
3732iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\8QU1CQCK.txttext
MD5:D5F9CB389134DDC39E252271C4E674AC
SHA256:DF05BC860DFE18560AB77C0872D0351AF25C5702AFD1F56A23BEA4DD8FC4DAA9
3732iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62der
MD5:17DA722D47ECD144FC53CF1C22974A48
SHA256:0C79FEAEA93A1136EC9F02277FB24843BBE63714CD9D9217BCBF68280E3C2B4F
3732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\search-icon[1].pngimage
MD5:750928EC52C1B77AA2E72D76895D3A96
SHA256:CF2E997ED10DB7EEF3394C65EC68720FCE20C858BF202A8C83328B7C1586D87D
3732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\453HF2UZ.htmhtml
MD5:B6EE917AB39E9FDB091D4F7E071A03CB
SHA256:DA71CCA4DB0A6EE822C3DA4FBCA7AAE4CF2305E746F6C320233C2BF7E3ED2BF9
3732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\min[1].jstext
MD5:5563332AD6AF63C9C94CEF15761BE544
SHA256:4EFEC11A42893D4DF0249174CBE5AFAE24A5734F5DED35C5E84C56BF9F473EC2
3732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\1UAOJV3Wtext
MD5:32682312D17C7CBF18E73594F5570319
SHA256:E55FB1A1D731153E943B68844AF12DCCE8BFAC917C98FFDEA64C80DA0607DD47
3732iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabE5D4.tmp —
MD5:—
SHA256:—
3732iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\TarE5D5.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
40
TCP/UDP connections
48
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3732
iexplore.exe
GET
200
23.55.110.184:80
http://i4.cdn-image.com/__media__/pics/12471/arrow.png
US
image
1.04 Kb
whitelisted
3732
iexplore.exe
GET
200
23.55.110.184:80
http://i4.cdn-image.com/__media__/pics/12471/libg.png
US
image
1.07 Kb
whitelisted
3732
iexplore.exe
GET
200
23.55.110.198:80
http://i2.cdn-image.com/__media__/pics/12471/logo.png
US
image
3.86 Kb
whitelisted
3732
iexplore.exe
GET
302
95.211.219.65:80
http://survey-smiles.com/
NL
text
11 b
whitelisted
3732
iexplore.exe
GET
200
52.222.149.182:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
3732
iexplore.exe
GET
200
23.55.110.184:80
http://i4.cdn-image.com/__media__/pics/12471/bodybg.png
US
image
94.9 Kb
whitelisted
3732
iexplore.exe
GET
200
23.55.110.184:80
http://i1.cdn-image.com/__media__/pics/12471/libgh.png
US
image
1.06 Kb
whitelisted
3732
iexplore.exe
GET
200
52.222.149.103:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
3732
iexplore.exe
GET
200
52.222.149.20:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
3732
iexplore.exe
GET
200
52.222.149.103:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3892
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3732
iexplore.exe
95.211.219.65:80
survey-smiles.com
LeaseWeb Netherlands B.V.
NL
malicious
3732
iexplore.exe
23.55.110.198:80
i1.cdn-image.com
NTT America, Inc.
US
unknown
3732
iexplore.exe
54.201.63.36:443
results.searchanswers.net
Amazon.com, Inc.
US
unknown
3892
iexplore.exe
208.91.196.145:80
ww1.survey-smiles.com
Confluence Networks Inc
VG
malicious
3732
iexplore.exe
208.91.196.145:80
ww1.survey-smiles.com
Confluence Networks Inc
VG
malicious
3732
iexplore.exe
23.55.110.184:80
i1.cdn-image.com
NTT America, Inc.
US
unknown
3732
iexplore.exe
172.217.22.74:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3732
iexplore.exe
52.222.149.221:80
ocsp.sca1b.amazontrust.com
Amazon.com, Inc.
US
whitelisted
3732
iexplore.exe
52.222.149.103:80
ocsp.rootg2.amazontrust.com
Amazon.com, Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
survey-smiles.com
  • 95.211.219.65
whitelisted
ww1.survey-smiles.com
  • 208.91.196.145
malicious
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
i1.cdn-image.com
  • 23.55.110.184
  • 23.55.110.198
whitelisted
i4.cdn-image.com
  • 23.55.110.184
  • 23.55.110.198
whitelisted
i2.cdn-image.com
  • 23.55.110.198
  • 23.55.110.184
whitelisted
results.searchanswers.net
  • 54.201.63.36
  • 54.200.193.58
unknown
o.ss2.us
  • 52.222.149.20
  • 52.222.149.44
  • 52.222.149.182
  • 52.222.149.112
whitelisted
ocsp.rootg2.amazontrust.com
  • 52.222.149.103
  • 52.222.149.213
  • 52.222.149.120
  • 52.222.149.202
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://survey-smiles.com