URL:

http://box2012.temp.domains/~chwsolut/services.html

Full analysis: https://app.any.run/tasks/0c594c04-a894-4e7f-bf5f-db4d7437de62
Verdict: Malicious activity
Analysis date: March 14, 2019, 20:21:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
Indicators:
MD5:

99E91541D62131B85181EF730964DB06

SHA1:

8FA122A5C04B69DC23C980E642F304CA0576DF1C

SHA256:

42A1B5A13BD268ABBE8489088109A1C7B0A5E32ED267476D227435BAF352356A

SSDEEP:

3:N1KcA+KIXKS1aSWS7XAGQn:CcA+KIXx/TAGQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Creates files in the user directory

      • iexplore.exe (PID: 3516)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3632)

    • Changes internet zones settings

      • iexplore.exe (PID: 2864)

    • Application launched itself

      • iexplore.exe (PID: 2864)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3516)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3516)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2864"C:\Program Files\Internet Explorer\iexplore.exe" http://box2012.temp.domains/~chwsolut/services.htmlC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3516"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2864 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3632C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Exit code:
0
Version:
26,0,0,131
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_26_0_0_131_activex.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
449
Read events
379
Write events
67
Delete events
3

Modification events

(PID) Process:(2864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{CFA9183B-4696-11E9-BEEC-5254004A04AF}
Value:
0
(PID) Process:(2864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(2864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
3
(PID) Process:(2864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E307030004000E00140015003800DC02
Executable files
0
Suspicious files
0
Text files
37
Unknown types
5

Dropped files

PID
Process
Filename
Type
3516iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\849-layout[1].csstext
MD5:—
SHA256:—
3516iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\style[1].csstext
MD5:—
SHA256:—
3516iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\services[1].htmlhtml
MD5:—
SHA256:—
3516iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\helper[1].jstext
MD5:0AF11E80E33169AB815F9AB2721C3745
SHA256:F85F1CE135B6810B880273CD052B8A5CC1B4A96936A2AD9D8F0F83A8EE0B0CFA
3516iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\html5shiv.min[1].jshtml
MD5:3044234175AC91F49B03FF999C592B85
SHA256:E0EAC80838C161F29E7C46D54FBC044D12CD164BAAE13255E562C6BE3AA91809
3516iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\bootstrap.min[1].csstext
MD5:2F624089C65F12185E79925BC5A7FC42
SHA256:EECE6E0C65B7007AB0EB1B4998D36DAFE381449525824349128EFC3F86F4C91C
3516iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\jquery-migrate.min[1].jstext
MD5:7121994EEC5320FBE6586463BF9651C2
SHA256:48EB8B500AE6A38617B5738D2B3FAEC481922A7782246E31D2755C034A45CD5D
3516iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\wp-emoji-release.min[1].jstext
MD5:C17B309D8AB4B4E9653876D3C35C397D
SHA256:C533B791A8EEF65604F15D20433506E1614C693EEBA9DF749E8A7677E43B466C
3516iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@temp[2].txt —
MD5:—
SHA256:—
3516iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\jquery[1].jstext
MD5:BB33093A8D4F68199C4AB6702F3976E4
SHA256:FA055F2F7C5B735DBBB71954F434AED79925BC00FF2FFBC3ECFC4A790689A723
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
47
TCP/UDP connections
12
DNS requests
5
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3516
iexplore.exe
GET
200
74.220.219.168:80
http://box2012.temp.domains/~chwsolut/wp-content/themes/dazzling/style.css?ver=5.1.1
US
text
6.96 Kb
suspicious
3516
iexplore.exe
GET
200
74.220.219.168:80
http://box2012.temp.domains/~chwsolut/wp-content/plugins/wp-google-maps/wpgmza_data.js?ver=5.1.1
US
compressed
24.4 Kb
suspicious
3516
iexplore.exe
GET
200
74.220.219.168:80
http://box2012.temp.domains/~chwsolut/services.html
US
html
7.07 Kb
suspicious
3516
iexplore.exe
GET
200
74.220.219.168:80
http://box2012.temp.domains/~chwsolut/wp-content/plugins/slider/js/jssor.js?ver=5.1.1
US
text
32.1 Kb
suspicious
3516
iexplore.exe
GET
409
74.220.219.168:80
http://box2012.temp.domains/~chwsolut/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.1.1
US
html
83 b
suspicious
3516
iexplore.exe
GET
200
74.220.219.168:80
http://box2012.temp.domains/~chwsolut/wp-includes/js/jquery/jquery.js?ver=1.12.4
US
text
38.4 Kb
suspicious
3516
iexplore.exe
GET
200
74.220.219.168:80
http://box2012.temp.domains/~chwsolut/wp-includes/css/dist/block-library/style.min.css?ver=5.1.1
US
text
5.07 Kb
suspicious
3516
iexplore.exe
GET
200
74.220.219.168:80
http://box2012.temp.domains/~chwsolut/wp-includes/js/underscore.min.js?ver=1.8.3
US
text
6.29 Kb
suspicious
3516
iexplore.exe
GET
200
74.220.219.168:80
http://box2012.temp.domains/~chwsolut/wp-includes/js/wp-emoji-release.min.js?ver=5.1.1
US
text
4.79 Kb
suspicious
3516
iexplore.exe
GET
200
74.220.219.168:80
http://box2012.temp.domains/~chwsolut/wp-content/themes/dazzling/inc/js/html5shiv.min.js
US
html
1.34 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3516
iexplore.exe
74.220.219.168:80
box2012.temp.domains
Unified Layer
US
suspicious
2864
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3516
iexplore.exe
2.16.186.83:80
a.vimeocdn.com
Akamai International B.V.
—
whitelisted
3516
iexplore.exe
172.217.18.174:80
www.google-analytics.com
Google Inc.
US
whitelisted
2864
iexplore.exe
74.220.219.168:80
box2012.temp.domains
Unified Layer
US
suspicious

DNS requests

Domain
IP
Reputation
box2012.temp.domains
  • 74.220.219.168
suspicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
a.vimeocdn.com
  • 2.16.186.83
  • 2.16.186.49
whitelisted
www.google-analytics.com
  • 172.217.18.174
whitelisted
chwsolutions.com
  • 74.220.219.168
suspicious

Threats

PID
Process
Class
Message
3516
iexplore.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
3516
iexplore.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
3516
iexplore.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://box2012.temp.domains/~chwsolut/services.html