File name:

http://xemhang.vn/Website/iexplore.exe

Full analysis: https://app.any.run/tasks/8f65e730-5c6e-42fc-b510-46e7a46652e4
Verdict: Malicious activity
Analysis date: October 05, 2022, 07:07:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F54C429A5A0B2BA6922417A181C89856

SHA1:

5EB52117D4F01C7CCDE053D780242959686DA355

SHA256:

47C20159BAB515DD809169D8339892BAC10FA8EDE4781FC1CD8B76978DBC3D47

SSDEEP:

1572864:xYmpnWwFRqWuRAqd4iiN+e6eu18GIw5LDwJy59oG7:xYmpnRFcPAqOiiWeu18G7wo59f7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 1284)
      • cmd.exe (PID: 2832)
      • unpro.exe (PID: 2236)

    • Application was dropped or rewritten from another process

      • screen.exe (PID: 2896)
      • screen.exe (PID: 1568)
      • RuntimeBroker.exe (PID: 2840)
      • RuntimeBroker.exe (PID: 3284)
      • RuntimeBroker.exe (PID: 3520)
      • RuntimeBroker.exe (PID: 3296)
      • RuntimeBroker.exe (PID: 1464)
      • unpro.exe (PID: 2108)
      • RuntimeBroker.exe (PID: 3936)
      • unpro.exe (PID: 2236)
      • RuntimeBroker.exe (PID: 3396)
      • screen.exe (PID: 2568)
      • IntelSvc.exe (PID: 708)
      • IntelSvc.exe (PID: 3632)
      • screen.exe (PID: 3692)
      • IntelSvc.exe (PID: 2192)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 2832)
      • cmd.exe (PID: 3956)

    • Creates a writable file the system directory

      • cmd.exe (PID: 2832)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3960)
      • schtasks.exe (PID: 3504)
      • schtasks.exe (PID: 2108)
      • schtasks.exe (PID: 2180)
      • schtasks.exe (PID: 4000)
      • schtasks.exe (PID: 1264)
      • schtasks.exe (PID: 3712)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 2832)

  • SUSPICIOUS

    • Drops a file that was compiled in debug mode

      • iexplore.exe (PID: 1284)
      • cmd.exe (PID: 2832)
      • unpro.exe (PID: 2236)

    • Drops a file with too old compile date

      • iexplore.exe (PID: 1284)
      • cmd.exe (PID: 2832)
      • unpro.exe (PID: 2236)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 1284)
      • cmd.exe (PID: 2832)
      • unpro.exe (PID: 2236)

    • Starts CMD.EXE for commands execution

      • iexplore.exe (PID: 1284)
      • cmd.exe (PID: 2032)
      • screen.exe (PID: 1568)
      • cmd.exe (PID: 2832)
      • cmd.exe (PID: 3956)
      • RuntimeBroker.exe (PID: 3396)

    • Reads Internet Settings

      • iexplore.exe (PID: 1284)
      • screen.exe (PID: 2896)
      • screen.exe (PID: 2568)
      • screen.exe (PID: 3692)
      • IntelSvc.exe (PID: 708)

    • Application launched itself

      • cmd.exe (PID: 2032)
      • screen.exe (PID: 2896)
      • cmd.exe (PID: 2832)
      • cmd.exe (PID: 3956)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2832)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 2832)

    • Creates files in the Windows directory

      • cmd.exe (PID: 2832)

    • Creates or modifies Windows services

      • reg.exe (PID: 1972)
      • reg.exe (PID: 2184)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 2832)
      • cmd.exe (PID: 3956)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 2832)

    • Creates a directory in Program Files

      • unpro.exe (PID: 2236)

    • Executes as Windows Service

      • RuntimeBroker.exe (PID: 3396)
      • IntelSvc.exe (PID: 2192)

    • Reads the machine GUID from the registry

      • IntelSvc.exe (PID: 708)

    • Executed via COM

      • DllHost.exe (PID: 2592)

    • Checks Windows Trust Settings

      • IntelSvc.exe (PID: 708)

    • Reads security settings of Internet Explorer

      • IntelSvc.exe (PID: 708)

    • Starts CHOICE.EXE to create a delay

      • cmd.exe (PID: 2832)

    • Reads settings of System Certificates

      • IntelSvc.exe (PID: 708)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 1284)
      • screen.exe (PID: 2896)
      • screen.exe (PID: 1568)
      • RuntimeBroker.exe (PID: 2840)
      • RuntimeBroker.exe (PID: 3284)
      • RuntimeBroker.exe (PID: 3296)
      • RuntimeBroker.exe (PID: 3520)
      • RuntimeBroker.exe (PID: 1464)
      • RuntimeBroker.exe (PID: 3936)
      • unpro.exe (PID: 2108)
      • unpro.exe (PID: 2236)
      • RuntimeBroker.exe (PID: 3396)
      • screen.exe (PID: 2568)
      • IntelSvc.exe (PID: 708)
      • screen.exe (PID: 3692)
      • IntelSvc.exe (PID: 3632)
      • IntelSvc.exe (PID: 2192)

    • Creates a file in a temporary directory

      • iexplore.exe (PID: 1284)

    • Process checks are UAC notifies on

      • iexplore.exe (PID: 1284)

    • Process checks LSA protection

      • iexplore.exe (PID: 1284)
      • screen.exe (PID: 2896)
      • screen.exe (PID: 2568)
      • screen.exe (PID: 3692)
      • IntelSvc.exe (PID: 708)
      • IntelSvc.exe (PID: 3632)
      • IntelSvc.exe (PID: 2192)

    • Reads the computer name

      • iexplore.exe (PID: 1284)
      • screen.exe (PID: 2896)
      • RuntimeBroker.exe (PID: 2840)
      • RuntimeBroker.exe (PID: 3284)
      • RuntimeBroker.exe (PID: 3296)
      • RuntimeBroker.exe (PID: 3520)
      • RuntimeBroker.exe (PID: 3936)
      • RuntimeBroker.exe (PID: 1464)
      • RuntimeBroker.exe (PID: 3396)
      • screen.exe (PID: 2568)
      • IntelSvc.exe (PID: 708)
      • screen.exe (PID: 3692)
      • IntelSvc.exe (PID: 3632)
      • IntelSvc.exe (PID: 2192)

    • Creates files in the program directory

      • cmd.exe (PID: 2032)
      • cmd.exe (PID: 2832)
      • cmd.exe (PID: 3956)
      • unpro.exe (PID: 2236)
      • IntelSvc.exe (PID: 708)

    • Reads the machine GUID from the registry

      • WMIC.exe (PID: 3364)
      • taskkill.exe (PID: 2316)
      • taskkill.exe (PID: 4012)
      • taskkill.exe (PID: 652)
      • WMIC.exe (PID: 3312)
      • WMIC.exe (PID: 3796)
      • WMIC.exe (PID: 2264)
      • taskkill.exe (PID: 3836)
      • taskkill.exe (PID: 3172)
      • taskkill.exe (PID: 1996)
      • taskkill.exe (PID: 1368)
      • DllHost.exe (PID: 2592)

    • Process checks computer location settings

      • IntelSvc.exe (PID: 708)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (83.4)
.exe | Win32 Executable (generic) (8.7)
.exe | Generic Win/DOS Executable (3.8)
.exe | DOS Executable Generic (3.8)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 1992-Jun-19 22:22:17
Detected languages:
  • English - United States

DOS Header

e_magic: MZ
e_cblp: 80
e_cp: 2
e_crlc: -
e_cparhdr: 4
e_minalloc: 15
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: 26
e_oemid: -
e_oeminfo: -
e_lfanew: 256

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 8
TimeDateStamp: 1992-Jun-19 22:22:17
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_BYTES_REVERSED_HI
  • IMAGE_FILE_BYTES_REVERSED_LO
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
CODE
4096
77892
78336
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.43594
DATA
86016
1548
2048
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.51863
BSS
90112
3237
0
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata
94208
2640
3072
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.26186
.tls
98304
12
0
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata
102400
24
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
0.204488
.reloc
106496
6328
6656
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
6.52837
.rsrc
114688
52999344
52999680
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
7.87114

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.96797
1384
Latin 1 / Western European
English - United States
RT_ICON
2
6.2503
2216
Latin 1 / Western European
English - United States
RT_ICON
3
7.90976
708670
Latin 1 / Western European
UNKNOWN
RT_RCDATA
4
4.9657
392704
Latin 1 / Western European
UNKNOWN
RT_RCDATA
5
7.75028
45568
Latin 1 / Western European
UNKNOWN
RT_RCDATA
6
6.09357
1072593
Latin 1 / Western European
UNKNOWN
RT_RCDATA
7
6.45762
5128016
Latin 1 / Western European
UNKNOWN
RT_RCDATA
8
6.17976
167936
Latin 1 / Western European
UNKNOWN
RT_RCDATA
9
7.68694
181772
Latin 1 / Western European
UNKNOWN
RT_RCDATA
10
7.99858
41853697
Latin 1 / Western European
UNKNOWN
RT_RCDATA

Imports

advapi32.dll
kernel32.dll
kernel32.dll (#2)
kernel32.dll (#3)
kernel32.dll (#4)
oleaut32.dll
oleaut32.dll (#2)
user32.dll
user32.dll (#2)
winmm.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
249
Monitored processes
208
Malicious processes
12
Suspicious processes
8

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start runas.exe no specs iexplore.exe cmd.exe no specs find.exe no specs reg.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs screen.exe no specs screen.exe no specs timeout.exe no specs cmd.exe wmic.exe no specs taskkill.exe no specs taskkill.exe no specs schtasks.exe no specs net.exe no specs net1.exe no specs sc.exe no specs timeout.exe no specs cmd.exe no specs whoami.exe no specs cmd.exe no specs findstr.exe no specs timeout.exe no specs cmd.exe no specs findstr.exe no specs attrib.exe no specs attrib.exe no specs schtasks.exe no specs timeout.exe no specs schtasks.exe no specs schtasks.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs attrib.exe no specs runtimebroker.exe no specs runtimebroker.exe no specs runtimebroker.exe no specs runtimebroker.exe no specs runtimebroker.exe no specs runtimebroker.exe no specs reg.exe no specs reg.exe no specs unpro.exe no specs unpro.exe attrib.exe no specs attrib.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs sc.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs runtimebroker.exe no specs cmd.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs cmd.exe no specs schtasks.exe no specs schtasks.exe no specs attrib.exe no specs net.exe no specs net1.exe no specs sc.exe no specs net.exe no specs net1.exe no specs sc.exe no specs net.exe no specs net1.exe no specs wmic.exe no specs sc.exe no specs wmic.exe no specs wmic.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs net.exe no specs net1.exe no specs sc.exe no specs net.exe no specs net1.exe no specs sc.exe no specs net.exe no specs net1.exe no specs sc.exe no specs net.exe no specs net1.exe no specs sc.exe no specs net.exe no specs net1.exe no specs sc.exe no specs net1.exe no specs net.exe no specs sc.exe no specs net.exe no specs net1.exe no specs sc.exe no specs net.exe no specs net1.exe no specs sc.exe no specs net.exe no specs net1.exe no specs sc.exe no specs net.exe no specs net1.exe no specs sc.exe no specs net.exe no specs net1.exe no specs sc.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs timeout.exe no specs screen.exe no specs intelsvc.exe timeout.exe no specs screen.exe no specs intelsvc.exe timeout.exe no specs intelsvc.exe DllHost.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs sc.exe no specs choice.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124attrib +h +r +s "C:\SysWOW64\Systemfont.exe" C:\Windows\system32\attrib.exe—cmd.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
124C:\Windows\system32\net1 stop "DNSEvent"C:\Windows\system32\net1.exe—net.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
180C:\Windows\system32\net1 stop "Event System"C:\Windows\system32\net1.exe—net.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
300C:\Windows\system32\net1 stop "ServiceNetwork"C:\Windows\system32\net1.exe—net.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
300C:\Windows\system32\net1 stop "Interactive Services Detection"C:\Windows\system32\net1.exe—net.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\net1.exe
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
312attrib -h -r -s "C:\ProgramData\screen.exe" C:\Windows\system32\attrib.exe—cmd.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
312Sc delete "AeroAdmin"C:\Windows\system32\sc.exe—cmd.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
320attrib +h +r +s "C:\ProgramData\RuntimeBroker.exe" C:\Windows\system32\attrib.exe—cmd.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
328reg.exe ADD "HKLM\System\CurrentControlSet\Services\App System\Parameters" /v AppThrottle /t REG_DWORD /d 256000 /fC:\Windows\system32\reg.exe—cmd.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
340reg.exe ADD "HKLM\System\CurrentControlSet\Services\LocalService\Parameters" /v AppThrottle /t REG_DWORD /d 256000 /fC:\Windows\system32\reg.exe—cmd.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
7 186
Read events
7 082
Write events
100
Delete events
4

Modification events

(PID) Process:(1284) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:delete valueName:ProxyByPass
Value:
0
(PID) Process:(1284) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:delete valueName:IntranetName
Value:
0
(PID) Process:(1284) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1284) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2896) screen.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2896) screen.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3036) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
Operation:writeName:C:\Windows\SysWOW64\RuntimeBroker.exe
Value:
~ RUNASADMIN
(PID) Process:(1936) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
Operation:writeName:C:\ProgramData\RuntimeBroker.exe
Value:
~ RUNASADMIN
(PID) Process:(3180) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
Operation:writeName:C:\Windows\SysWOW64\screen.exe
Value:
~ RUNASADMIN
(PID) Process:(3296) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
Operation:writeName:C:\ProgramData\screen.exe
Value:
~ RUNASADMIN
Executable files
87
Suspicious files
30
Text files
65
Unknown types
17

Dropped files

PID
Process
Filename
Type
1284iexplore.exeC:\Users\ADMINI~1\AppData\Local\Temp\palemoon.zip —
MD5:—
SHA256:—
1284iexplore.exeC:\Users\ADMINI~1\AppData\Local\Temp\netserver.exeexecutable
MD5:483421FB3DA24E88AE3B3337967CF4A4
SHA256:FAB3AB7FD5D49194EEAF4D88B487F4FA7E2388B81999031367521457AAD0A65B
2832cmd.exeC:\Program Files\palemoon.zip —
MD5:—
SHA256:—
1284iexplore.exeC:\Users\ADMINI~1\AppData\Local\Temp\RuntimeBroker.exeexecutable
MD5:AC27DE51896A5BA2FD0DDA9B7955A201
SHA256:35D3F6C87CC33F2FDA5B594A6990D8D14E085E313564127A9C0606CEDB398F93
1284iexplore.exeC:\Users\ADMINI~1\AppData\Local\Temp\cmdow.exeexecutable
MD5:DDD12566B99343B96609AFA2524ECEC3
SHA256:767B877E735C425BF05C34683356ABFDE4070B092F17A4741EA5AC490611F3DE
1284iexplore.exeC:\Users\ADMINI~1\AppData\Local\Temp\IntelSvc.exeexecutable
MD5:A7CDE18F991E97037A7899B7669E2548
SHA256:8B9F1FA5F941C7F46B65BF8929CA80D132435151E1DCB3A5DE7693B70B254467
1284iexplore.exeC:\Users\ADMINI~1\AppData\Local\Temp\Systemfont.exeexecutable
MD5:3C47D45F09948B8E6FDB5F96523BC60B
SHA256:86BB64D0A8D548445E17D4EDEF0A0E5F97D019F3AF524FC9CD625294916C973D
1284iexplore.exeC:\Users\ADMINI~1\AppData\Local\Temp\Moonchild Productions.zipcompressed
MD5:2D11BC1E77499859AE1CBAA7FBA43B8B
SHA256:5497246DE1822EAECE5657DEC9ABBD30FE730154F7BAF0DDE8B92F08543303CA
2832cmd.exeC:\ProgramData\MicrosoftEdgeTaskMachineWS.xmlxml
MD5:—
SHA256:—
2832cmd.exeC:\Windows\System32\MicrosoftEdgeTaskMachineWS.xmlxml
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
4
DNS requests
4
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
708
IntelSvc.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
708
IntelSvc.exe
GET
200
8.248.131.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5fce982482aa552d
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
708
IntelSvc.exe
37.48.87.53:5665
auth11.aeroadmin.com
LeaseWeb Netherlands B.V.
NL
suspicious
708
IntelSvc.exe
188.114.97.3:443
ulm.aeroadmin.com
CLOUDFLARENET
NL
malicious
708
IntelSvc.exe
8.248.131.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
708
IntelSvc.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted

DNS requests

Domain
IP
Reputation
auth11.aeroadmin.com
  • 37.48.87.53
malicious
ulm.aeroadmin.com
  • 188.114.97.3
  • 188.114.96.3
malicious
ctldl.windowsupdate.com
  • 8.248.131.254
  • 8.248.115.254
  • 8.253.204.249
  • 8.241.11.126
  • 8.248.147.254
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

PID
Process
Class
Message
708
IntelSvc.exe
Generic Protocol Command Decode
SURICATA Applayer Wrong direction first Data
Process
Message
IntelSvc.exe
Info: % 1106] mode: 0
IntelSvc.exe
Info: % 1123] Start
IntelSvc.exe
Info: % 1135] Environment language: "en"
IntelSvc.exe
Info: % 1138] Launch parameters: admin: 1, boot_mode: 0, mode: 0, restart: ""C:\Windows\Temp\IntelSvc.exe" a ", selected: 0, service: 0, as sessid: 1, is running updated: 0
IntelSvc.exe
Error: % 1274] registering tray window class
IntelSvc.exe
Info: % 1306] Running with no UI
IntelSvc.exe
Info: % 54] Adapter best: 1, name: "{4040CF00-1B3E-486A-B407-FA14C56B6FC0}", status: 1
IntelSvc.exe
Info: % 54] Adapter best: 0, name: "{E29AC6C2-7037-11DE-816D-806E6F6E6963}", status: 1
IntelSvc.exe
Info: % 274] Connecting to ip: "37.48.87.53", port: "5665"
IntelSvc.exe
Info: % 262] TCP connection established with socket: 632
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://xemhang.vn/Website/iexplore.exe