Malware analysis http://box2012.temp.domains/~chwsolut/services.html Malicious activity

Add for printing

URL:	http://box2012.temp.domains/~chwsolut/services.html
Full analysis:	https://app.any.run/tasks/0c594c04-a894-4e7f-bf5f-db4d7437de62
Verdict:	Malicious activity
Analysis date:	March 14, 2019, 20:21:40
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:	opendir
Indicators:
MD5:	99E91541D62131B85181EF730964DB06
SHA1:	8FA122A5C04B69DC23C980E642F304CA0576DF1C
SHA256:	42A1B5A13BD268ABBE8489088109A1C7B0A5E32ED267476D227435BAF352356A
SSDEEP:	3:N1KcA+KIXKS1aSWS7XAGQn:CcA+KIXx/TAGQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 120 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 60 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (68.0.3440.106)
Google Update Helper (1.3.33.17)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
Mozilla Firefox 61.0.2 (x86 en-US) (61.0.2)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
No suspicious indicators.
INFO
- Creates files in the user directory
  - FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3632)
  - iexplore.exe (PID: 3516)
- Reads Internet Cache Settings
  - iexplore.exe (PID: 3516)
- Reads internet explorer settings
  - iexplore.exe (PID: 3516)
- Application launched itself
  - iexplore.exe (PID: 2864)
- Changes internet zones settings
  - iexplore.exe (PID: 2864)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
2864	"C:\Program Files\Internet Explorer\iexplore.exe" http://box2012.temp.domains/~chwsolut/services.html	C:\Program Files\Internet Explorer\iexplore.exe		explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)
3516	"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2864 CREDAT:71937	C:\Program Files\Internet Explorer\iexplore.exe		iexplore.exe
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)
3632	C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding	C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe	—	svchost.exe
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Version: 26,0,0,131

Add for printing

Total events

449

Read events

379

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
3516	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\849-layout[1].css		text
		MD5:CEE165F8D348BE1DC2557C56434F6BBB	SHA256:EC0909A0A784320EF760F20B25998B9A2C673B8E65CB6F85CCA65FF932A5D464
3516	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\services[1].html		html
		MD5:01750AA5D6F488CA942F80D72B370174	SHA256:DA2F03D5A6505A332A5AEBBF6AC5766C044722C21BB0780316245DB44280D149
3516	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\style[1].css		text
		MD5:0D3B750FEE57E1A962495944D39755B2	SHA256:31955E986FA380B543ED7171A77AB2E2734150B1A7130C1A5537FCB5B16AE424
3516	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\jssor[1].js		text
		MD5:1397A8A69723F763949DE3A6014A85DE	SHA256:504984DF1C171AD985CA44AF299019CB992F679C7CE1CE989E3A45F177142A9F
3516	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\helper[1].js		text
		MD5:0AF11E80E33169AB815F9AB2721C3745	SHA256:F85F1CE135B6810B880273CD052B8A5CC1B4A96936A2AD9D8F0F83A8EE0B0CFA
3516	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\respond.min[1].js		html
		MD5:9CCCBCD9BC6AED2BB14DF1013E185CE3	SHA256:82069C15EDD6943DFAA59F5AC3F6ACC86FD44A28FE925E410CCDCADEC194A8BA
3516	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\wp-emoji-release.min[1].js		text
		MD5:C17B309D8AB4B4E9653876D3C35C397D	SHA256:C533B791A8EEF65604F15D20433506E1614C693EEBA9DF749E8A7677E43B466C
3516	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\bootstrap.min[1].css		text
		MD5:2F624089C65F12185E79925BC5A7FC42	SHA256:EECE6E0C65B7007AB0EB1B4998D36DAFE381449525824349128EFC3F86F4C91C
3516	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\font-awesome.min[1].css		text
		MD5:0831CBA6A670E405168B84AA20798347	SHA256:936FFCCDC35BC55221E669D0E76034AF76BA8C080C1B1149144DBBD3B5311829
3516	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\underscore.min[1].js		text
		MD5:0BD7146B45C933AD9BFE210A41CD79B1	SHA256:EDE1815B17E451C16258034BCF89A7957256C67884AEFFFEFBB97020770FDC06

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
3516	iexplore.exe	GET	200	74.220.219.168:80	http://box2012.temp.domains/~chwsolut/wp-includes/css/dist/block-library/style.min.css?ver=5.1.1	US	text	5.07 Kb	suspicious
3516	iexplore.exe	GET	200	74.220.219.168:80	http://box2012.temp.domains/~chwsolut/wp-content/themes/dazzling/inc/css/bootstrap.min.css?ver=5.1.1	US	text	24.4 Kb	suspicious
3516	iexplore.exe	GET	200	74.220.219.168:80	http://box2012.temp.domains/~chwsolut/wp-content/plugins/slider/js/jssor.js?ver=5.1.1	US	text	32.1 Kb	suspicious
3516	iexplore.exe	GET	200	74.220.219.168:80	http://box2012.temp.domains/~chwsolut/wp-content/uploads/bb-plugin/cache/849-layout.css?ver=1e5128d0462f9a847fa4408c45729b21	US	text	6.10 Kb	suspicious
3516	iexplore.exe	GET	200	74.220.219.168:80	http://box2012.temp.domains/~chwsolut/wp-content/plugins/slider/js/helper.js?ver=5.1.1	US	text	2.17 Kb	suspicious
3516	iexplore.exe	GET	200	74.220.219.168:80	http://box2012.temp.domains/~chwsolut/wp-content/themes/dazzling/style.css?ver=5.1.1	US	text	6.96 Kb	suspicious
3516	iexplore.exe	GET	200	74.220.219.168:80	http://box2012.temp.domains/~chwsolut/wp-content/themes/dazzling/inc/css/font-awesome.min.css?ver=5.1.1	US	text	6.69 Kb	suspicious
3516	iexplore.exe	GET	200	2.16.186.83:80	http://a.vimeocdn.com/js/froogaloop2.min.js?ver=5.1.1	unknown	text	735 b	whitelisted
3516	iexplore.exe	GET	200	74.220.219.168:80	http://box2012.temp.domains/~chwsolut/services.html	US	html	7.07 Kb	suspicious
3516	iexplore.exe	GET	200	74.220.219.168:80	http://box2012.temp.domains/~chwsolut/wp-includes/js/wp-emoji-release.min.js?ver=5.1.1	US	text	4.79 Kb	suspicious

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
3516	iexplore.exe	172.217.18.174:80	www.google-analytics.com	Google Inc.	US	whitelisted
2864	iexplore.exe	74.220.219.168:80	box2012.temp.domains	Unified Layer	US	suspicious
3516	iexplore.exe	2.16.186.83:80	a.vimeocdn.com	Akamai International B.V.	—	whitelisted
2864	iexplore.exe	204.79.197.200:80	www.bing.com	Microsoft Corporation	US	whitelisted
3516	iexplore.exe	74.220.219.168:80	box2012.temp.domains	Unified Layer	US	suspicious

DNS requests

Domain	IP	Reputation
box2012.temp.domains	74.220.219.168	suspicious
www.bing.com	204.79.197.200 13.107.21.200	whitelisted
a.vimeocdn.com	2.16.186.83 2.16.186.49	whitelisted
www.google-analytics.com	172.217.18.174	whitelisted
chwsolutions.com	74.220.219.168	suspicious

Threats

PID	Process	Class	Message
3516	iexplore.exe	Generic Protocol Command Decode	SURICATA STREAM excessive retransmissions
3516	iexplore.exe	Generic Protocol Command Decode	SURICATA STREAM excessive retransmissions
3516	iexplore.exe	Generic Protocol Command Decode	SURICATA STREAM excessive retransmissions

Add for printing

No debug info

General Info

http://box2012.temp.domains/~chwsolut/services.html

99E91541D62131B85181EF730964DB06

8FA122A5C04B69DC23C980E642F304CA0576DF1C

42A1B5A13BD268ABBE8489088109A1C7B0A5E32ED267476D227435BAF352356A

3:N1KcA+KIXKS1aSWS7XAGQn:CcA+KIXx/TAGQ

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

INFO

Creates files in the user directory

Reads Internet Cache Settings

Reads internet explorer settings

Application launched itself

Changes internet zones settings

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings