analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

index.html

Full analysis: https://app.any.run/tasks/5bd7f5ba-8f70-45de-957f-bdfd5982adaf
Verdict: Malicious activity
Analysis date: October 19, 2020, 22:05:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/html
File info: HTML document, UTF-8 Unicode text, with very long lines, with CRLF, CR, LF line terminators
MD5:

204A393A8A0A5772695322C5A8CC2EE9

SHA1:

6A9F7220A32A9BE2D76DC72400397271D511DCF4

SHA256:

3D81F166AFF9EDB67D869FC1654426040BBD611176B8055BE5AEFA712B3AF645

SSDEEP:

1536:GGn9RP/mqyL0Guw8NS7A1DgTBtshpip/lpTp5MpQpPjpDpQ0pGpowpCp+Pp9epFI:99ZNGSSTBGSxAFSN8tH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2748)
      • chrome.exe (PID: 4088)
      • iexplore.exe (PID: 2392)
      • iexplore.exe (PID: 2928)

    • Changes internet zones settings

      • iexplore.exe (PID: 2928)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2748)
      • iexplore.exe (PID: 2928)
      • iexplore.exe (PID: 2392)
      • chrome.exe (PID: 4088)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2748)
      • iexplore.exe (PID: 2392)
      • iexplore.exe (PID: 2508)

    • Application launched itself

      • iexplore.exe (PID: 2928)
      • chrome.exe (PID: 3368)
      • iexplore.exe (PID: 2392)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2928)
      • iexplore.exe (PID: 3332)

    • Manual execution by user

      • chrome.exe (PID: 3368)

    • Reads the hosts file

      • chrome.exe (PID: 4088)
      • chrome.exe (PID: 3368)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2748)
      • iexplore.exe (PID: 2928)
      • iexplore.exe (PID: 2392)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 2392)

    • Creates files in the user directory

      • iexplore.exe (PID: 2928)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

EXIF

HTML

googleSiteVerification: A49bhnB6wYzAswGpdpw3SLInKPtMPPhqtb6GHqC82iU
Title: Lights2you - Australian Lighting Store | Light Fixtures | Light Shop
HTTPEquivXUACompatible: IE=edge
formatDetection: telephone=no
viewport: width=device-width, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no
Robots: INDEX,FOLLOW
Keywords: LED Lights, Home Lighting, Ceiling Lighting, Outdoor Lighting, Ceiling Fans, Outdoor Fans, Lamps, LED Lighting, LED Downlights, Garden Lights
Description: Lights2you is a premier Australian lighting store, offering lighting products and supplies. Visit our light shop in Sydney or call us on 02 8811 1688 today.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
97
Monitored processes
57
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs iexplore.exe iexplore.exe no specs iexplore.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2928"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\index.htmlC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2748"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2928 CREDAT:144385 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
3489660927
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3368"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
2632"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6f09a9d0,0x6f09a9e0,0x6f09a9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
1116"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3712 --on-initialized-event-handle=324 --parent-handle=328 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3568"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1000,12483522643274396442,15934269757241423428,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=18388690358456465740 --mojo-platform-channel-handle=1012 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
4088"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1000,12483522643274396442,15934269757241423428,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=730334791876813448 --mojo-platform-channel-handle=1600 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3044"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1000,12483522643274396442,15934269757241423428,131072 --enable-features=PasswordImport --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=12117900830597320697 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2260 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
3776"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1000,12483522643274396442,15934269757241423428,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=2439777532337154065 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2528 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
3020"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1000,12483522643274396442,15934269757241423428,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=10481449740807854801 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2536 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Total events
6 005
Read events
5 694
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
715
Text files
601
Unknown types
46

Dropped files

PID
Process
Filename
Type
2928iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2748iexplore.exeC:\Users\admin\AppData\Local\Temp\Cab6B51.tmp —
MD5:—
SHA256:—
2748iexplore.exeC:\Users\admin\AppData\Local\Temp\Tar6B52.tmp —
MD5:—
SHA256:—
2748iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288Bbinary
MD5:A4581EC57C151E02697AA3096C44D8CF
SHA256:649A4F531942678DD519E51A3EC9E074B5E3C6F42CEA4B9BFA2AB0DE70012562
2748iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619binary
MD5:BEE277C8F3F92BF9F24016F797A4FCDF
SHA256:EC8CEF273271E5AE31C805B20A708B615913000DCC1365EDE15F9EB5936125B5
2748iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_1E16160C9EC2FB955631E32D246F2C56der
MD5:109DB896473F50C6AF1FF3A3459663E4
SHA256:5828EE2761A87B4FB00BD5196FFA8248C4B70FD929F4F9501F06D996F6CD9193
2748iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619der
MD5:F015601AD339528FD173B9D3B2988E2C
SHA256:D86428471E16F63A5185B1BCC3E376D687548A45AB9C8B0E1257A7853C343562
2748iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CC197601BE0898B7B0FCC91FA15D8A69_82315E7977AD1FD70B1072657822BA2Dbinary
MD5:CB93A4A59E4822F0C0A9DE34740AD0AC
SHA256:79C533EC6317E327AF703E17354549F5189577884A1E58698B8EC895563F5295
2748iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CC197601BE0898B7B0FCC91FA15D8A69_82315E7977AD1FD70B1072657822BA2Dder
MD5:5D877137C4A36DB5D804EC38669DD55C
SHA256:2A7CA945E48DE3022BD9DC31D8740405370A6F5DCEA7547F76B427FB422D87C2
2748iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:F686805FEA39BF9741D66C0661A8E1F1
SHA256:EDCD357EFF84C40CE730B7407CBB7081016376A37D86E0A88344FFF5C9BD89A3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
214
DNS requests
162
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2748
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D
US
der
471 b
whitelisted
2748
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
2392
iexplore.exe
GET
200
172.217.22.35:80
http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCECiWpPQxRDpPAgAAAAB8NWE%3D
US
der
471 b
whitelisted
2392
iexplore.exe
GET
200
172.217.22.35:80
http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEB3oRgfjsJWUCAAAAABbLrQ%3D
US
der
471 b
whitelisted
2748
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEAnMvWCoypOZemHr2vSm8u4%3D
US
der
278 b
whitelisted
2748
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
2748
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEAnMvWCoypOZemHr2vSm8u4%3D
US
der
278 b
whitelisted
4088
chrome.exe
GET
301
104.18.33.32:80
http://www.lights2you.com.au/
US
html
238 b
whitelisted
2748
iexplore.exe
GET
200
172.217.22.35:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCOUTy4wn8XWggAAAAAWy8I
US
der
472 b
whitelisted
2748
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEAnMvWCoypOZemHr2vSm8u4%3D
US
der
278 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2748
iexplore.exe
216.58.207.42:443
fonts.googleapis.com
Google Inc.
US
whitelisted
2748
iexplore.exe
172.67.216.115:443
www.lights2you.com.au
—
US
unknown
2748
iexplore.exe
104.108.59.211:443
www.eway.com.au
Akamai Technologies, Inc.
NL
unknown
4
System
172.217.16.162:139
www.googleadservices.com
Google Inc.
US
whitelisted
4
System
172.217.16.162:445
www.googleadservices.com
Google Inc.
US
whitelisted
2748
iexplore.exe
104.17.113.181:443
static.afterpay.com
Cloudflare Inc
US
shared
2748
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
4088
chrome.exe
172.217.22.3:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2748
iexplore.exe
172.217.22.35:80
ocsp.pki.goog
Google Inc.
US
whitelisted
2928
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
www.lights2you.com.au
  • 172.67.216.115
  • 104.18.32.32
  • 104.18.33.32
unknown
fonts.googleapis.com
  • 216.58.207.42
whitelisted
www.eway.com.au
  • 104.108.59.211
unknown
static.afterpay.com
  • 104.17.113.181
  • 104.17.114.181
suspicious
www.googleadservices.com
  • 172.217.16.162
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ocsp.pki.goog
  • 172.217.22.35
whitelisted
googleads.g.doubleclick.net
  • 142.250.74.194
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .world TLD
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
index.html