analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www.brightspeed.com/ew/business/login/?utm_source=sfmc&utm_medium=email&utm_campaign=EW_CUSTOMER_ACTIVE&utm_term=https%3a%2f%2fwww.brightspeed.com%2few%2fbusiness%2flogin%2f&utm_id=68471&sfmc_id=62855015&utm_source=sfmc_legacy&utm_term=&utm_content=15100&utm_id=556b2ec6-4d2d-4c01-8b77-9d2e0c2ac6b2&sfmc_id=62855015&sfmc_activityid=112c6918-3ba7-4449-922d-648f9718b824&utm_medium=email&utm_campaign=EW_CUSTOMER_ACTIVE

Full analysis: https://app.any.run/tasks/14ff4e90-df17-4206-8a28-80cf78e26452
Verdict: Malicious activity
Analysis date: October 04, 2022, 21:09:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

D76D5FBD4E4EDE28749EA0647900DBD0

SHA1:

C45B0D0A7DF0EA85439E0EE767FDBC4C417047FC

SHA256:

4494ADC258969F8E11D42EF2B747C4A96ADD2AB70E746843330ED3C643691C73

SSDEEP:

12:2jh/6gaQ3mgNTCAWMh9MzNGzDyYXkXLLhGUs2FXHQ3mgNTd:2j9vdCAB9PDywkb5s2gvdd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2936)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 2936)
      • iexplore.exe (PID: 3060)

    • Reads the computer name

      • iexplore.exe (PID: 3060)
      • iexplore.exe (PID: 2936)

    • Application launched itself

      • iexplore.exe (PID: 3060)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3060)
      • iexplore.exe (PID: 2936)

    • Changes internet zones settings

      • iexplore.exe (PID: 3060)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3060)
      • iexplore.exe (PID: 2936)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3060)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3060)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2936)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3060"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.brightspeed.com/ew/business/login/?utm_source=sfmc&utm_medium=email&utm_campaign=EW_CUSTOMER_ACTIVE&utm_term=https%3a%2f%2fwww.brightspeed.com%2few%2fbusiness%2flogin%2f&utm_id=68471&sfmc_id=62855015&utm_source=sfmc_legacy&utm_term=&utm_content=15100&utm_id=556b2ec6-4d2d-4c01-8b77-9d2e0c2ac6b2&sfmc_id=62855015&sfmc_activityid=112c6918-3ba7-4449-922d-648f9718b824&utm_medium=email&utm_campaign=EW_CUSTOMER_ACTIVE"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\sechost.dll
2936"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3060 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
14 902
Read events
14 781
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
18
Text files
24
Unknown types
20

Dropped files

PID
Process
Filename
Type
3060iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442der
MD5:B8BDA0B382A7D056A4241B388338B778
SHA256:7BAA967F6686CCE471826B20FFA5CB7FEB4BF3C5C0BF43F51F08E84EB5850DD2
2936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4344B8AF97AF3A423D9EE52899963CDE_9233AADADBB3ECAEDE5C54637A6F4B63der
MD5:50208EDFCAD49D58341AC1D6411C077F
SHA256:E3EB9BDD00369BA7CF2ACC6017B98D997DC10C5336FC8560A977C43524DAD4E7
2936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_9487BC0D4381A7CDEB9A8CC43F66D27Cder
MD5:54523297893C9B65209BD97F2A77B0E9
SHA256:37B5A041615209AA1731D6784CAA21C4089783E47190D9702ECE1215A97F9D34
2936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Eder
MD5:B6F52795B677B4E2AD47736FFE3704A5
SHA256:C8AFF1F15506340E6ABD76C8A8382E9CAEBA4FA8E8483254CF7AB9D22C2A57FE
3060iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442binary
MD5:DCBCE4B04786A8953180098485091CC5
SHA256:DB40041DF81B089696EB8AFA2FB9D00B42B8C7EA09B085861020E99CEEFCB676
3060iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
2936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C11083FD8BAD269CF864618FA59583AC_602F32DDE626148E879AB208D2040C80der
MD5:FCF46D5AFEAA7576A37298CB9F296020
SHA256:FFEA5AAFB35B87D0DDA54708702622FF9F1E2402252A17856EBFD0E59DD2A478
2936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_9487BC0D4381A7CDEB9A8CC43F66D27Cbinary
MD5:C0C3CF70974AB66BE03AD18399C30577
SHA256:4B131E43F78F4E9445C085F0A325F859CBF852FC397945B158876B832C4163F1
2936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4344B8AF97AF3A423D9EE52899963CDE_9233AADADBB3ECAEDE5C54637A6F4B63binary
MD5:6C59BD55A46D40DACC26006B9F195777
SHA256:ED6E405FD8E4DEE2D202BAA5C090CED99FA99422A8890C23D2E9A6D5959B19C3
3060iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:D70ED5CE678F8E1DBA1126CE9B50ED0D
SHA256:CB610D5B4C3CCEDC651250C596AA029C1EF565B027A54AC151D20C2FDEE804D4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
56
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3060
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
2936
iexplore.exe
GET
200
93.184.220.29:80
http://status.geotrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR3enuod9bxDxzpICGW%2B2sabjf17QQUkFj%2FsJx1qFFUd7Ht8qNDFjiebMUCEAhoirddYwxO5Eic6W2UgLc%3D
US
der
471 b
whitelisted
2936
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D
US
der
471 b
whitelisted
2936
iexplore.exe
GET
200
104.18.32.68:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
1.42 Kb
whitelisted
2936
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAwIlmU1uUKpc1Jl5Pl1QLw%3D
US
der
471 b
whitelisted
2936
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTubeiRal9hlMRbT70r8I4mClph2gQUEsmImy%2FJRHp9EvHfQANCmJLHJNYCEAroWGGh2VkXaIyIdkMNcLU%3D
US
der
471 b
whitelisted
3060
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2936
iexplore.exe
GET
200
172.64.155.188:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
2.18 Kb
whitelisted
2936
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAj%2BKCZ79LYV9Ua8QXjnzLM%3D
US
der
471 b
whitelisted
2936
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAhflMAthXvozBT%2FU%2B2iPio%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3060
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3060
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
2936
iexplore.exe
207.120.33.204:443
www.brightspeed.com
LEVEL3
US
unknown
3060
iexplore.exe
8.248.139.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
2936
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
2936
iexplore.exe
67.27.159.254:80
ctldl.windowsupdate.com
LEVEL3
US
malicious
2936
iexplore.exe
8.248.137.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
2936
iexplore.exe
69.16.175.42:443
code.jquery.com
STACKPATH-CDN
US
malicious
3060
iexplore.exe
13.107.21.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
104.18.32.68:80
ocsp.comodoca.com
CLOUDFLARENET
—
suspicious

DNS requests

Domain
IP
Reputation
www.brightspeed.com
  • 207.120.33.204
  • 207.120.33.205
  • 207.120.33.169
  • 207.120.33.171
  • 207.120.33.170
  • 207.120.33.196
  • 207.120.33.199
  • 207.120.33.195
unknown
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ctldl.windowsupdate.com
  • 8.248.137.254
  • 67.27.159.254
  • 8.248.139.254
  • 8.241.78.254
  • 8.238.190.126
  • 8.241.123.126
  • 8.238.29.254
  • 8.248.115.254
  • 8.248.141.254
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
status.geotrust.com
  • 93.184.220.29
whitelisted
lib.lumen.com
  • 143.204.215.92
  • 143.204.215.56
  • 143.204.215.100
  • 143.204.215.105
malicious
code.jquery.com
  • 69.16.175.42
  • 69.16.175.10
whitelisted
controlcenter.brightspeed.com
  • 155.70.49.14
unknown
ocsp.comodoca.com
  • 104.18.32.68
  • 172.64.155.188
whitelisted

Threats

PID
Process
Class
Message
2936
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2936
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.brightspeed.com/ew/business/login/?utm_source=sfmc&utm_medium=email&utm_campaign=EW_CUSTOMER_ACTIVE&utm_term=https%3a%2f%2fwww.brightspeed.com%2few%2fbusiness%2flogin%2f&utm_id=68471&sfmc_id=62855015&utm_source=sfmc_legacy&utm_term=&utm_content=15100&utm_id=556b2ec6-4d2d-4c01-8b77-9d2e0c2ac6b2&sfmc_id=62855015&sfmc_activityid=112c6918-3ba7-4449-922d-648f9718b824&utm_medium=email&utm_campaign=EW_CUSTOMER_ACTIVE