| URL: | https://github.com/SpeedyThePaster/CFX-Bypass/releases/tag/v1.6 |
| Full analysis: | https://app.any.run/tasks/a4d6a5c1-6a43-414a-8e7b-74fea01fb63e |
| Verdict: | Malicious activity |
| Analysis date: | February 06, 2022, 21:26:14 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | C02786E3D4A56DC8DE4507C6C8641236 |
| SHA1: | 96788F8C27E87FB5EE88A7E0B2F8C97C642F1C6F |
| SHA256: | 3F0503F66FDF629B4FBD0F3B9F7D4393BD9B4FF3602C85E25FA0F3D311926FCD |
| SSDEEP: | 3:N8tEdDv3LInNRBOrqKk:2ulqnKxk |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads Microsoft Outlook installation path
- iexplore.exe (PID: 3316)
- iexplore.exe (PID: 2592)
Executable content was dropped or overwritten
- iexplore.exe (PID: 3316)
- iexplore.exe (PID: 2212)
Drops a file with a compile date too recent
- iexplore.exe (PID: 3316)
- iexplore.exe (PID: 2212)
Drops a file that was compiled in debug mode
- iexplore.exe (PID: 3316)
- iexplore.exe (PID: 2212)
Checks supported languages
- WinRAR.exe (PID: 3020)
Reads the computer name
- WinRAR.exe (PID: 3020)
Uses RUNDLL32.EXE to load library
- WinRAR.exe (PID: 3020)
INFO
Reads the computer name
- iexplore.exe (PID: 2212)
- iexplore.exe (PID: 3316)
- iexplore.exe (PID: 2592)
Checks supported languages
- iexplore.exe (PID: 2212)
- iexplore.exe (PID: 3316)
- rundll32.exe (PID: 464)
- iexplore.exe (PID: 2592)
Changes internet zones settings
- iexplore.exe (PID: 2212)
Reads settings of System Certificates
- iexplore.exe (PID: 3316)
- iexplore.exe (PID: 2212)
- iexplore.exe (PID: 2592)
Creates files in the user directory
- iexplore.exe (PID: 3316)
- iexplore.exe (PID: 2592)
Reads internet explorer settings
- iexplore.exe (PID: 3316)
- iexplore.exe (PID: 2592)
Application launched itself
- iexplore.exe (PID: 2212)
Checks Windows Trust Settings
- iexplore.exe (PID: 2212)
- iexplore.exe (PID: 3316)
- iexplore.exe (PID: 2592)
Modifies the phishing filter of IE
- iexplore.exe (PID: 2212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
41
Monitored processes
5
Malicious processes
0
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 464 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIa3020.46036\README.md | C:\Windows\system32\rundll32.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2212 | "C:\Program Files\Internet Explorer\iexplore.exe" "https://github.com/SpeedyThePaster/CFX-Bypass/releases/tag/v1.6" | C:\Program Files\Internet Explorer\iexplore.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 2592 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2212 CREDAT:2888990 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 3020 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\CFX-Bypass-1.6.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | iexplore.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 3316 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2212 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
Total events
22 205
Read events
22 028
Write events
177
Delete events
0
Modification events
| (PID) Process: | (2212) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPDaysSinceLastAutoMigration |
Value: 1 | |||
| (PID) Process: | (2212) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPLastLaunchLowDateTime |
Value: 759223056 | |||
| (PID) Process: | (2212) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPLastLaunchHighDateTime |
Value: 30940064 | |||
| (PID) Process: | (2212) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
| Operation: | write | Name: | NextCheckForUpdateLowDateTime |
Value: | |||
| (PID) Process: | (2212) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
| Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 30940064 | |||
| (PID) Process: | (2212) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (2212) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2212) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (2212) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
| (PID) Process: | (2212) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
Executable files
3
Suspicious files
14
Text files
142
Unknown types
7
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3316 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:012B768D3F2A5A3B33FFF7F8B5AD5C60 | SHA256:283D5923EBC81F52A00F8A5071E694EB6D1EA75F5721D3FC1A01A244772D5543 | |||
| 3316 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\Q04QKM4N.txt | text | |
MD5:306550D49C07B0F17D602608F9CE3713 | SHA256:63E69976EDB985222E1BE2A019EC6CE997D89572DAB6A25CA86877CA421F6C45 | |||
| 3316 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\12B578593FDE07EC53D020B1D5DEBF3B_5D74C2DB556F94499BCD6D74A36958A3 | binary | |
MD5:CDBAFA91F252B95331F70A154DCF27BF | SHA256:CC1529A117C4CB82DBFA209F00B05689EDAF7FC98A1BEAA22338786643878147 | |||
| 3316 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04 | der | |
MD5:F25EEB11E779E33A89AB394A26932062 | SHA256:AC7FABD94C7E4F98237770867757E94172F11F566E3A971ADF02957E4EABBE0B | |||
| 3316 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\MDERF9GH.txt | text | |
MD5:F68D6BF4BC04CAC1012B310C876FBEF5 | SHA256:F508B062D03A906944DE4E5F39D563315A20919787F52372B731275BB896C596 | |||
| 3316 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2A7611428D62805A3E4E5BC4103D82E4_D0FA13DADFB59BDF00C474952E166CC1 | binary | |
MD5:105DE2DDD471EFE26F5B96E65B067A79 | SHA256:4F33EA6041F5138F76B76384F5C3D3C7F3734EEEFF01AA23449B22F734DCF1F5 | |||
| 3316 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB | der | |
MD5:CD0CCEFB1B9C37F17ED864BBA7623FB7 | SHA256:2D72E8019A0B8138025E365017428BEA183BD99EAA57FA8425A838DB89D29566 | |||
| 3316 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\v1[1].htm | html | |
MD5:2F6C5245EBC44738906DF81781E093BD | SHA256:EDDE8D3D223AD9B1EEDE6349FAC06ACF22B62A8BA7E637B5596774B9F200E962 | |||
| 3316 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2A7611428D62805A3E4E5BC4103D82E4_D0FA13DADFB59BDF00C474952E166CC1 | der | |
MD5:F343F7F86F5E50B2B86B962B87F2950D | SHA256:146C8CF02DDF161BF17974F11D1A70D4D40B98BCB77AE347108F7E752A779C71 | |||
| 3316 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\12B578593FDE07EC53D020B1D5DEBF3B_5D74C2DB556F94499BCD6D74A36958A3 | der | |
MD5:F24B19C751EFF949F9DD37E6DBEAF9C3 | SHA256:891BB34744275CE2B21BD164165F86A4A86CFB27F5E5BE72256DE272EAD8B248 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
54
DNS requests
21
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3316 | iexplore.exe | GET | 200 | 23.32.238.201:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c83579eceded75d6 | US | compressed | 4.70 Kb | whitelisted |
3316 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAZnA1u7FP1jr8DWqFNO%2FhY%3D | US | der | 471 b | whitelisted |
3316 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D | US | der | 471 b | whitelisted |
2212 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D | US | der | 1.47 Kb | whitelisted |
3316 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D | US | der | 471 b | whitelisted |
3316 | iexplore.exe | GET | 200 | 23.32.238.201:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?358a1c8cd19c8c82 | US | compressed | 4.70 Kb | whitelisted |
3316 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTGMlruL6P9M9B3if1rTM7wyj%2FQKQQUUGGmoNI1xBEqII0fD6xC8M0pz0sCEAFo1XXxzocorZWo8R7xWYs%3D | US | der | 279 b | whitelisted |
2592 | iexplore.exe | GET | 301 | 92.123.194.50:80 | http://shell.windows.com/fileassoc/fileassoc.asp?Ext=md | unknown | — | — | whitelisted |
2212 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | der | 471 b | whitelisted |
3316 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTGMlruL6P9M9B3if1rTM7wyj%2FQKQQUUGGmoNI1xBEqII0fD6xC8M0pz0sCEA6L83cNktGW8Lth%2BTxBZr4%3D | US | der | 278 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2592 | iexplore.exe | 92.123.194.50:80 | shell.windows.com | Akamai International B.V. | — | unknown |
2592 | iexplore.exe | 104.89.38.104:443 | go.microsoft.com | Akamai Technologies, Inc. | NL | malicious |
2212 | iexplore.exe | 152.199.19.161:443 | iecvlist.microsoft.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
3316 | iexplore.exe | 23.32.238.201:80 | ctldl.windowsupdate.com | XO Communications | US | suspicious |
3316 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
3316 | iexplore.exe | 185.199.108.154:443 | github.githubassets.com | GitHub, Inc. | NL | suspicious |
3316 | iexplore.exe | 185.199.110.133:443 | avatars.githubusercontent.com | GitHub, Inc. | NL | malicious |
2212 | iexplore.exe | 185.199.108.154:443 | github.githubassets.com | GitHub, Inc. | NL | suspicious |
2212 | iexplore.exe | 204.79.197.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
2212 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
github.com |
| malicious |
ctldl.windowsupdate.com |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
github.githubassets.com |
| whitelisted |
avatars.githubusercontent.com |
| whitelisted |
github-cloud.s3.amazonaws.com |
| shared |
user-images.githubusercontent.com |
| whitelisted |
objects.githubusercontent.com |
| shared |