analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://ak.imgfarm.com/images/nocache/vicinio/installers/v2/202980021.S29831.1/nsis/937675-S29831.1/181022154103926/msniMapsGalaxy/MapsGalaxy.291009ff407843d9be11572b61cc31f8.exe

Full analysis: https://app.any.run/tasks/d3d589dd-c5be-43ef-8c24-5a62774f3601
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 18, 2018, 15:11:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
adware
mindspark
Indicators:
MD5:

2F72D8E152AAFEC8F377A5687330D6DA

SHA1:

FD37D99FC93E4A8A026BF150FEDD02FE8C08DC3B

SHA256:

40C73C7D62D8601D36FD9E401D40401D2C332BDF7787BB43A40004CC92A60354

SSDEEP:

3:N1KfeEKCA0GEaAp3LWgOXBcVc/hVed2MdWUsSX5RUVbXfWl8eKdLdNMVQRVSTGN+:C5TLpigOXBkchMdpd4SX5RWfWKeGpNUz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • MapsGalaxy.291009ff407843d9be11572b61cc31f8[1].exe (PID: 4072)

    • Loads dropped or rewritten executable

      • MapsGalaxy.291009ff407843d9be11572b61cc31f8[1].exe (PID: 4072)

    • Downloads executable files from the Internet

      • iexplore.exe (PID: 3764)

    • MINDSPARK was detected

      • MapsGalaxy.291009ff407843d9be11572b61cc31f8[1].exe (PID: 4072)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3764)
      • MapsGalaxy.291009ff407843d9be11572b61cc31f8[1].exe (PID: 4072)
      • iexplore.exe (PID: 3488)

    • Changes the started page of IE

      • MapsGalaxy.291009ff407843d9be11572b61cc31f8[1].exe (PID: 4072)

    • Creates files in the user directory

      • MapsGalaxy.291009ff407843d9be11572b61cc31f8[1].exe (PID: 4072)

    • Creates a software uninstall entry

      • MapsGalaxy.291009ff407843d9be11572b61cc31f8[1].exe (PID: 4072)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3488)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3764)
      • iexplore.exe (PID: 3488)
      • iexplore.exe (PID: 2992)

    • Changes internet zones settings

      • iexplore.exe (PID: 3488)
      • iexplore.exe (PID: 2732)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2992)

    • Creates files in the user directory

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2332)
      • iexplore.exe (PID: 2992)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2992)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start iexplore.exe iexplore.exe #MINDSPARK mapsgalaxy.291009ff407843d9be11572b61cc31f8[1].exe iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3488"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3764"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3488 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
4072"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\MapsGalaxy.291009ff407843d9be11572b61cc31f8[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\MapsGalaxy.291009ff407843d9be11572b61cc31f8[1].exe
iexplore.exe
User:
admin
Company:
Mindspark Interactive Network, Inc.
Integrity Level:
MEDIUM
Description:
MapsGalaxy Setup
Exit code:
0
Version:
2.7.1.3000
2732"C:\Program Files\Internet Explorer\iexplore.exe" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2992"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2732 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2332C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Version:
26,0,0,131
Total events
1 202
Read events
1 042
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
1
Text files
58
Unknown types
5

Dropped files

PID
Process
Filename
Type
3488iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
3488iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3488iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFD859DA0C14E33579.TMP —
MD5:—
SHA256:—
3488iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF259FE23D543AB516.TMP —
MD5:—
SHA256:—
3488iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{4444F0C9-02D7-11E9-834A-5254004A04AF}.dat —
MD5:—
SHA256:—
2732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\favicon[1].ico —
MD5:—
SHA256:—
2732iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3764iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\MapsGalaxy.291009ff407843d9be11572b61cc31f8[1].exeexecutable
MD5:7106EE14B90B7F343B57C56C78C2B5AD
SHA256:1D96EACA65EAE9DCB5CBDD213FD9D2B7C1CD1BD4F30E8BEEE71BC23751A83EA5
2992iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\ie8[1].js —
MD5:—
SHA256:—
3488iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{4444F0CA-02D7-11E9-834A-5254004A04AF}.datbinary
MD5:1F2BE897BDC0211802BEBFC8C4B1EEBB
SHA256:A251E42C96EA05060A7D09E17C34FBA569359ED1FC64087E422F91DF8F65FF5D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
51
TCP/UDP connections
21
DNS requests
10
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4072
MapsGalaxy.291009ff407843d9be11572b61cc31f8[1].exe
GET
204
74.113.233.192:80
http://anx.mindspark.com/anx.gif?anxa=CAPDownloadProcess&anxe=Error&errorCode=-13&errorType=nsisError&errorDetails=EmptyPartnerId&platform=vicinio&anxv=2.7.1.3000&anxd=2018-10-22&coid=291009ff407843d9be11572b61cc31f8&refPartner=^UX^mni000^S29831&refSub=&anxl=en-US&anxr=-2121213396&refCobrand=UX&refCampaign=mni000&refTrack=S29831&refCountry=
US
—
—
whitelisted
4072
MapsGalaxy.291009ff407843d9be11572b61cc31f8[1].exe
GET
204
74.113.233.192:80
http://anx.mindspark.com/anx.gif?anxa=CAPDownloadProcess&anxe=InstallerInvoked&platform=vicinio&anxv=2.7.1.3000&anxd=2018-10-22&coid=291009ff407843d9be11572b61cc31f8&refPartner=^UX^mni000^S29831&refSub=&anxl=en-US&anxr=-2021363139&refCobrand=UX&refCampaign=mni000&refTrack=S29831&refCountry=
US
—
—
whitelisted
4072
MapsGalaxy.291009ff407843d9be11572b61cc31f8[1].exe
GET
204
74.113.233.192:80
http://anx.mindspark.com/anx.gif?anxa=CAPDownloadProcess&anxe=InstallerFinished&tbUID=20B5ADB8-394B-468C-BD5A-E00286DF34C6&tbVer=&platform=vicinio&anxv=2.7.1.3000&anxd=2018-10-22&coid=291009ff407843d9be11572b61cc31f8&refPartner=^UX^mni000^S29831&refSub=&anxl=en-US&anxr=2101120718&refCobrand=UX&refCampaign=mni000&refTrack=S29831&refCountry=
US
—
—
whitelisted
2992
iexplore.exe
GET
200
2.18.232.251:80
http://hp.myway.com/mapsgalaxy/ttab02/assets/1543609507806/ie8.js
unknown
html
870 b
whitelisted
2992
iexplore.exe
GET
200
2.18.232.251:80
http://ak.staticimgfarm.com/images/webtooltab/assets/logos/UX.png
unknown
image
8.17 Kb
whitelisted
2732
iexplore.exe
GET
200
2.18.232.251:80
http://ak.staticimgfarm.com/images/vicinio/chrome/spent/images/favicon/UX.ico
unknown
image
1.12 Kb
whitelisted
2992
iexplore.exe
GET
200
2.18.232.251:80
http://hp.myway.com/mapsgalaxy/ttab02/assets/1543609507806/app.js
unknown
text
124 Kb
whitelisted
2992
iexplore.exe
GET
200
2.18.232.251:80
http://hp.myway.com/mapsgalaxy/ttab02/index.html?n=784A1857&p2=^UX^mni000^S29831&ptb=20B5ADB8-394B-468C-BD5A-E00286DF34C6&coid=291009ff407843d9be11572b61cc31f8
unknown
html
4.38 Kb
whitelisted
3764
iexplore.exe
GET
200
2.18.232.251:80
http://ak.imgfarm.com/images/nocache/vicinio/installers/v2/202980021.S29831.1/nsis/937675-S29831.1/181022154103926/msniMapsGalaxy/MapsGalaxy.291009ff407843d9be11572b61cc31f8.exe
unknown
executable
374 Kb
whitelisted
2992
iexplore.exe
GET
200
2.18.232.251:80
http://ak.staticimgfarm.com/images/webtooltab/assets/searchbar/223755648.png
unknown
image
726 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2732
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3488
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
4072
MapsGalaxy.291009ff407843d9be11572b61cc31f8[1].exe
74.113.235.138:443
dp.tb.ask.com
Mindspark Interactive Network, Inc.
IE
malicious
2732
iexplore.exe
2.18.232.251:80
ak.imgfarm.com
Akamai International B.V.
—
whitelisted
3764
iexplore.exe
2.18.232.251:80
ak.imgfarm.com
Akamai International B.V.
—
whitelisted
2992
iexplore.exe
2.18.232.251:80
ak.imgfarm.com
Akamai International B.V.
—
whitelisted
4072
MapsGalaxy.291009ff407843d9be11572b61cc31f8[1].exe
74.113.233.192:80
anx.mindspark.com
Mindspark Interactive Network, Inc.
US
suspicious
2992
iexplore.exe
104.109.68.59:443
imp.admarketplace.net
Akamai International B.V.
NL
whitelisted
2992
iexplore.exe
74.113.237.38:80
weatherblink.wdgserv.com
Mindspark Interactive Network, Inc.
US
unknown
2992
iexplore.exe
74.113.233.187:80
anx.tb.ask.com
Mindspark Interactive Network, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ak.imgfarm.com
  • 2.18.232.251
whitelisted
dp.tb.ask.com
  • 74.113.235.138
whitelisted
anx.mindspark.com
  • 74.113.233.192
whitelisted
hp.myway.com
  • 2.18.232.251
whitelisted
ak.staticimgfarm.com
  • 2.18.232.251
whitelisted
imp.admarketplace.net
  • 104.109.68.59
unknown
anx.tb.ask.com
  • 74.113.233.187
whitelisted
weatherblink.wdgserv.com
  • 74.113.237.38
unknown

Threats

PID
Process
Class
Message
3764
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4072
MapsGalaxy.291009ff407843d9be11572b61cc31f8[1].exe
Misc activity
ADWARE [PTsecurity] Mindspark CAPDownloadProcess
4072
MapsGalaxy.291009ff407843d9be11572b61cc31f8[1].exe
Misc activity
ADWARE [PTsecurity] Mindspark User-Agent
4072
MapsGalaxy.291009ff407843d9be11572b61cc31f8[1].exe
Misc activity
ADWARE [PTsecurity] Mindspark CAPDownloadProcess
4072
MapsGalaxy.291009ff407843d9be11572b61cc31f8[1].exe
Misc activity
ADWARE [PTsecurity] Mindspark User-Agent
4072
MapsGalaxy.291009ff407843d9be11572b61cc31f8[1].exe
Misc activity
ADWARE [PTsecurity] Mindspark CAPDownloadProcess
4072
MapsGalaxy.291009ff407843d9be11572b61cc31f8[1].exe
Misc activity
ADWARE [PTsecurity] Mindspark User-Agent
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://ak.imgfarm.com/images/nocache/vicinio/installers/v2/202980021.S29831.1/nsis/937675-S29831.1/181022154103926/msniMapsGalaxy/MapsGalaxy.291009ff407843d9be11572b61cc31f8.exe