analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://lthge-zcglf.maillist-manage.com/click.zc?m=1&mrd=1e03161021bc91ed&od=3z735b07acf9ddfbe69b4660294b02ea06e05241bb7fd085ad1330565e23380377&linkDgs=1e0316102198595d&repDgs=1e03161021c47e74

Full analysis: https://app.any.run/tasks/328e029b-73db-4fa1-b0b1-8cea16e58b58
Verdict: Malicious activity
Analysis date: October 05, 2022, 00:55:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

F0B5B7E45203D4D00D5D8700DF9C52BB

SHA1:

C3BDD5023CF6A286B715E9E7ED72A950AD623D4E

SHA256:

3F18B703969C831C26A3AC6D4204DB8E16213C0C21796E689C1FD1EA85DD1278

SSDEEP:

3:N8R8VZIlJVuVULGGGJM1fad6K82HGcLaU4vADch9hVM6OB09wJf2c8LwUWYU72GQ:2wOCULgJM1fad692HLWU4v73QC98f2lP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3444)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 3444)
      • iexplore.exe (PID: 472)

    • Reads the computer name

      • iexplore.exe (PID: 472)
      • iexplore.exe (PID: 3444)

    • Changes internet zones settings

      • iexplore.exe (PID: 472)

    • Application launched itself

      • iexplore.exe (PID: 472)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 472)
      • iexplore.exe (PID: 3444)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 472)
      • iexplore.exe (PID: 3444)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3444)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
472"C:\Program Files\Internet Explorer\iexplore.exe" "https://lthge-zcglf.maillist-manage.com/click.zc?m=1&mrd=1e03161021bc91ed&od=3z735b07acf9ddfbe69b4660294b02ea06e05241bb7fd085ad1330565e23380377&linkDgs=1e0316102198595d&repDgs=1e03161021c47e74"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3444"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:472 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
13 495
Read events
13 384
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
13
Text files
15
Unknown types
10

Dropped files

PID
Process
Filename
Type
3444iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabB825.tmpcompressed
MD5:D15AAA7C9BE910A9898260767E2490E1
SHA256:F8EBAAF487CBA0C81A17C8CD680BDD2DD8E90D2114ECC54844CFFC0CC647848E
3444iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4459712200BC8AE39D623E181C3AFDAAbinary
MD5:73BAD57530C40BC90B14F0F2205B9B73
SHA256:98AEC96F1A7CC6B3DA1D39A7DF7FBEC688BA99C7968A9B3341FD202B7BCF1208
3444iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:B00CB31D8B05364C7BA47602DFC15221
SHA256:B9FD505560A82C5FE89AC1FE87376217A49F914369D9BECD70DB66857BB3AAAD
3444iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\TarB826.tmpcat
MD5:C75C82DE5128C3E55D72A4FF9C73F5E4
SHA256:379E2F7218F036D70E2C474BF6A09364C5623C1C5F8D5A1A16F1B9B1EC243B55
3444iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4459712200BC8AE39D623E181C3AFDAAder
MD5:C0C284CC957B1C8FAFD630059F2FEA5C
SHA256:D3AE4C49DDC2BA6ABC852A7B817B1A393F2C97506E909B56A6EE949360194254
3444iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\O7ZIC373.htmhtml
MD5:695932FF47CFFB610982F797F39DA876
SHA256:D43F455A45F2154A99BA894A402971E9D283E5B860525E2C5320F0087FEC847F
3444iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:D15AAA7C9BE910A9898260767E2490E1
SHA256:F8EBAAF487CBA0C81A17C8CD680BDD2DD8E90D2114ECC54844CFFC0CC647848E
3444iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:32501FA5B316E6D5339A4F40420A7A2F
SHA256:FA9C1A98ED1CB0D7D7C2F083B63B1E3A9975632631F3B24FBFD54566F7950DB2
472iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442binary
MD5:EF707CF0346A889FA4A5BD5C8313DAE8
SHA256:EBCDFAF2ED6942E116B5208F915DE785FC96D44D6B74BF72ECF205714D2EF470
3444iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:E63D24552136ECCB1DC2281A919AA1C6
SHA256:EE7FEB87B5447DB82A687AA57806A517141440362F3FE6E2F92B680BEA479697
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
35
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3444
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?ad3a8252b74bf600
US
compressed
60.9 Kb
whitelisted
3444
iexplore.exe
GET
200
195.138.255.17:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgN1akjE036nmQcjgxJjJeping%3D%3D
DE
der
503 b
shared
3444
iexplore.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/DigiCertGlobalRootCA.crl
US
der
631 b
whitelisted
472
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
3444
iexplore.exe
GET
200
151.101.2.133:80
http://ocsp2.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEHueQfY9sYqur%2B17E2BPFJI%3D
US
der
1.40 Kb
whitelisted
3444
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
3444
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3b23d5856c057568
US
compressed
4.70 Kb
whitelisted
3444
iexplore.exe
GET
200
96.16.145.230:80
http://x1.c.lencr.org/
US
der
717 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
472
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
472
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
3444
iexplore.exe
136.143.190.68:443
lthge-zcglf.maillist-manage.com
ZOHO-AS
US
suspicious
3444
iexplore.exe
96.16.145.230:80
x1.c.lencr.org
AKAMAI-AS
DE
suspicious
3444
iexplore.exe
195.138.255.17:80
r3.o.lencr.org
AS33891 Netzbetrieb GmbH
DE
whitelisted
3444
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
—
—
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
472
iexplore.exe
151.101.2.133:443
cdn.myportfolio.com
FASTLY
US
malicious
3444
iexplore.exe
151.101.2.133:443
cdn.myportfolio.com
FASTLY
US
malicious
3444
iexplore.exe
151.101.192.119:443
crestmortgageloan.com
FASTLY
US
malicious

DNS requests

Domain
IP
Reputation
lthge-zcglf.maillist-manage.com
  • 136.143.190.68
suspicious
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
x1.c.lencr.org
  • 96.16.145.230
whitelisted
r3.o.lencr.org
  • 195.138.255.17
  • 195.138.255.18
shared
ocsp.digicert.com
  • 93.184.220.29
whitelisted
crestmortgageloan.com
  • 151.101.192.119
malicious
cdn.myportfolio.com
  • 151.101.2.133
  • 151.101.66.133
  • 151.101.130.133
  • 151.101.194.133
whitelisted
use.typekit.net
  • 184.24.77.156
  • 184.24.77.144
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://lthge-zcglf.maillist-manage.com/click.zc?m=1&mrd=1e03161021bc91ed&od=3z735b07acf9ddfbe69b4660294b02ea06e05241bb7fd085ad1330565e23380377&linkDgs=1e0316102198595d&repDgs=1e03161021c47e74