File name:

Ursa Major.zip

Full analysis: https://app.any.run/tasks/6bf2424c-e0b0-4bed-8abc-5c0afbd0477c
Verdict: Malicious activity
Analysis date: February 03, 2024, 18:05:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

29871EE46BA50FAAAF7E7609C8329DAA

SHA1:

AAD44E6D6BEAF82DABB8FC3D503F6FB1A0773C8E

SHA256:

3FCDFDC0493E7673BA2489CE260355E6C96EA039A6D7A13170CAEF8188B1FAEB

SSDEEP:

3072:0yE61zaTwb9tdo9OA6tUxf8Njfu6iCStGkibRS7CU6Qboe0:HHzaa9tdAzxkfhiCjD0GU70

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 752)

    • Create files in the Startup directory

      • regsvr32.exe (PID: 2092)

    • Antivirus name has been found in the command line (generic signature)

      • unregmp2.exe (PID: 2040)

    • Actions looks like stealing of personal data

      • setup.exe (PID: 2408)
      • setup.exe (PID: 2448)
      • setup.exe (PID: 2692)

  • SUSPICIOUS

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 3808)
      • cmd.exe (PID: 3364)

    • Application launched itself

      • ie4uinit.exe (PID: 1956)
      • rundll32.exe (PID: 1424)
      • setup.exe (PID: 2408)
      • setup.exe (PID: 2692)

    • Starts CMD.EXE for commands execution

      • Ursa Major.exe (PID: 4092)

    • Changes internet zones settings

      • ie4uinit.exe (PID: 1956)

    • Reads the Internet Settings

      • ie4uinit.exe (PID: 1956)
      • ie4uinit.exe (PID: 2032)
      • ie4uinit.exe (PID: 2080)
      • rundll32.exe (PID: 2208)

    • Uses RUNDLL32.EXE to load library

      • ie4uinit.exe (PID: 1956)
      • rundll32.exe (PID: 1424)

    • The process executes via Task Scheduler

      • ctfmon.exe (PID: 1668)
      • sipnotify.exe (PID: 1496)

    • Reads Microsoft Outlook installation path

      • ie4uinit.exe (PID: 1956)

    • Write to the desktop.ini file (may be used to cloak folders)

      • ie4uinit.exe (PID: 1956)
      • WinMail.exe (PID: 1900)
      • regsvr32.exe (PID: 2092)

    • Changes the title of the Internet Explorer window

      • iexplore.exe (PID: 3152)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 752)

    • Manual execution by a user

      • Ursa Major.exe (PID: 4092)
      • ie4uinit.exe (PID: 1956)
      • regsvr32.exe (PID: 340)
      • WinMail.exe (PID: 1900)
      • ie4uinit.exe (PID: 2032)
      • unregmp2.exe (PID: 2040)
      • ie4uinit.exe (PID: 2080)
      • regsvr32.exe (PID: 2092)
      • setup.exe (PID: 2408)
      • IMEKLMG.EXE (PID: 2528)
      • IMEKLMG.EXE (PID: 2548)
      • rundll32.exe (PID: 2208)
      • chrmstp.exe (PID: 2220)
      • explorer.exe (PID: 2792)
      • wmpnscfg.exe (PID: 3040)
      • wmpnscfg.exe (PID: 3056)
      • iexplore.exe (PID: 3152)
      • wmpnscfg.exe (PID: 2448)

    • Checks supported languages

      • Ursa Major.exe (PID: 4092)
      • WinMail.exe (PID: 1900)
      • IMEKLMG.EXE (PID: 2548)
      • setup.exe (PID: 2408)
      • setup.exe (PID: 2416)
      • setup.exe (PID: 2448)
      • IMEKLMG.EXE (PID: 2528)
      • IMKRMIG.EXE (PID: 2560)
      • IMJPPDMG.EXE (PID: 2708)
      • wmpnscfg.exe (PID: 3040)
      • wmpnscfg.exe (PID: 3056)
      • wmpnscfg.exe (PID: 2448)
      • setup.exe (PID: 2692)
      • setup.exe (PID: 2752)

    • Reads the computer name

      • Ursa Major.exe (PID: 4092)
      • WinMail.exe (PID: 1900)
      • setup.exe (PID: 2448)
      • setup.exe (PID: 2416)
      • IMEKLMG.EXE (PID: 2528)
      • IMJPPDMG.EXE (PID: 2708)
      • wmpnscfg.exe (PID: 3056)
      • wmpnscfg.exe (PID: 3040)
      • wmpnscfg.exe (PID: 2448)
      • IMEKLMG.EXE (PID: 2548)
      • setup.exe (PID: 2752)

    • Reads the machine GUID from the registry

      • WinMail.exe (PID: 1900)

    • Creates files or folders in the user directory

      • WinMail.exe (PID: 1900)
      • unregmp2.exe (PID: 2040)
      • regsvr32.exe (PID: 2092)

    • Application launched itself

      • chrmstp.exe (PID: 2268)
      • chrmstp.exe (PID: 2220)
      • iexplore.exe (PID: 3152)
      • msedge.exe (PID: 3360)

    • Process checks whether UAC notifications are on

      • IMEKLMG.EXE (PID: 2528)
      • IMJPPDMG.EXE (PID: 2708)
      • IMEKLMG.EXE (PID: 2548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2023:05:06 18:52:22
ZipCRC: 0x1b1d7ac1
ZipCompressedSize: 60739
ZipUncompressedSize: 115712
ZipFileName: Ursa Major.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
155
Monitored processes
59
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe ursa major.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs takeown.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs sipnotify.exe no specs ctfmon.exe no specs ie4uinit.exe no specs ie4uinit.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs regsvr32.exe no specs winmail.exe no specs ie4uinit.exe no specs unregmp2.exe no specs ie4uinit.exe no specs regsvr32.exe rundll32.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs setup.exe setup.exe no specs setup.exe imeklmg.exe no specs imeklmg.exe no specs imkrmig.exe no specs imjppdmg.exe no specs imjppdmg.exe no specs explorer.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs iexplore.exe ie4uinit.exe no specs iexplore.exe ie_to_edge_stub.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs wmpnscfg.exe no specs setup.exe setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
292REG DELETE HKEY_users /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
340"C:\Windows\System32\regsvr32.exe" /s /n /i:/UserInstall C:\Windows\system32\themeui.dllC:\Windows\System32\regsvr32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
752"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Ursa Major.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1088C:\Windows\System32\rundll32 advpack.dll,LaunchINFSectionEx C:\Windows\system32\ieuinit.inf,Install,,36C:\Windows\System32\rundll32.exe—ie4uinit.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1424C:\Windows\System32\rundll32 C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /mC:\Windows\System32\rundll32.exe—ie4uinit.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1496C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1632C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0C:\Windows\System32\rundll32.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1668C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1900"C:\Program Files\Windows Mail\WinMail.exe" OCInstallUserConfigOEC:\Program Files\Windows Mail\WinMail.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Mail
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows mail\winmail.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1956"C:\Windows\System32\ie4uinit.exe" -UserConfigC:\Windows\System32\ie4uinit.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IE Per-User Initialization Utility
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ie4uinit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
38 612
Read events
25 894
Write events
397
Delete events
12 321

Modification events

(PID) Process:(752) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(752) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(292) reg.exeKey:HKEY_CURRENT_USER\AppEvents\EventLabels\.Default
Operation:delete keyName:(default)
Value:
Executable files
8
Suspicious files
160
Text files
133
Unknown types
8

Dropped files

PID
Process
Filename
Type
1900WinMail.exeC:\Windows\TEMP\admin.bmpimage
MD5:343FA15C150A516B20CC9F787CFD530E
SHA256:D632E9DBACDCD8F6B86BA011ED6B23F961D104869654CAA764216EA57A916524
1900WinMail.exeC:\Users\admin\Contacts\admin (1).contactxml
MD5:C1272AF922A20998F98805830E6CF074
SHA256:598E127E237672EA682E257537BC32D22FCFE47ACE1712A15C4DECA75261DEDA
1956ie4uinit.exeC:\Windows\TEMP\RGI24DE.tmptext
MD5:31CB7778F65DF8D02353E6C7B2B2CFFC
SHA256:647A8C7F316EF325F73C2037E8883854F9287584904C977C81D1662DB6471A58
1956ie4uinit.exeC:\Windows\TEMP\RGI250F.tmptext
MD5:31CB7778F65DF8D02353E6C7B2B2CFFC
SHA256:647A8C7F316EF325F73C2037E8883854F9287584904C977C81D1662DB6471A58
1956ie4uinit.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\brndlog.baktext
MD5:E9E473C9777B0C24D50EE8C972A78FE2
SHA256:90BE32975E76E679B01FF719148DF508CBBE2D7F2C47D93201F33A31994B4174
1956ie4uinit.exeC:\Windows\TEMP\RGI256E.tmptext
MD5:87BA1D52A05A8D4343356EB0C6279DE2
SHA256:564A351DB0AB9249751ECF3F5D03049A43BEB0F8F3B95A5B8AAE9A9F7D0C17FB
1956ie4uinit.exeC:\Users\admin\Favorites\Links\desktop.initext
MD5:3C106F431417240DA12FD827323B7724
SHA256:E469ED17B4B54595B335DC51817A52B81FCF13AAD7B7B994626F84EC097C5D57
1956ie4uinit.exeC:\Windows\TEMP\www26F5.tmpbinary
MD5:873C8643CBBFB8FF63731BC25AC9B18C
SHA256:C4AD21379C11DA7943C605EADB22F6FC6F54B49783466F8C1F3AD371EB167466
1956ie4uinit.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin9728060290\msapplication.xmlxml
MD5:4057DC3819C2F00164C416BA0C19FD6D
SHA256:E7892793F676B3C21071529D5967FB75C4746BCD8A595EB464BAE3C5BB8411D2
1956ie4uinit.exeC:\Users\admin\Favorites\Links\Web Slice Gallery.urltext
MD5:1E7E5E93C2A5AADAF932F93D25C57F3E
SHA256:8B94D04FECE582E4182E8E73F46FB86EB8E965C69C526C42805ABB9E43641E35
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
32
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3152
iexplore.exe
GET
200
184.24.77.207:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f5058ef4554a5e5c
unknown
compressed
4.66 Kb
unknown
3152
iexplore.exe
GET
200
184.24.77.207:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6abadbe2aa656a5c
unknown
compressed
4.66 Kb
unknown
3248
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
binary
471 b
unknown
3248
iexplore.exe
GET
200
184.24.77.207:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a055bf949f709bf8
unknown
compressed
4.66 Kb
unknown
3248
iexplore.exe
GET
200
184.24.77.207:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8f2c92b493bcf6fb
unknown
compressed
4.66 Kb
unknown
3248
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
binary
471 b
unknown
3152
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
3152
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEA6Nvl6mEObLtWnHNvbXAEs%3D
unknown
binary
312 b
unknown
3152
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1096
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3152
iexplore.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
unknown
3248
iexplore.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
unknown
3152
iexplore.exe
184.24.77.207:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3248
iexplore.exe
184.24.77.207:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3248
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3152
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 23.35.238.131
whitelisted
ctldl.windowsupdate.com
  • 184.24.77.207
  • 184.24.77.191
  • 184.24.77.176
  • 184.24.77.174
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
query.prod.cms.rt.microsoft.com
  • 23.197.138.118
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
www.bing.com
  • 92.123.104.40
  • 92.123.104.59
  • 92.123.104.47
  • 92.123.104.49
  • 92.123.104.44
  • 92.123.104.60
  • 92.123.104.61
  • 92.123.104.51
  • 92.123.104.52
whitelisted
self.events.data.microsoft.com
  • 20.42.65.85
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Ursa Major.zip