analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| URL: | http://www.pfarreleonhard.at |
| Full analysis: | https://app.any.run/tasks/0dfa3424-5bee-4533-969a-3a07f40cd1a7 |
| Verdict: | Malicious activity |
| Analysis date: | March 14, 2019, 09:00:15 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | 3F01983DB6C9AE3E65A8213FC945E528 |
| SHA1: | 791896EE9D364B9E0958DAF1E6CFD90F138D95E7 |
| SHA256: | 4AC7D83F694C1BF47B8C4A9256BA7D1D0045FB4070D2018965083836B4B9D7A6 |
| SSDEEP: | 3:N1KJS4qHsAfL4:Cc4JoL4 |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
Reads internet explorer settings
- iexplore.exe (PID: 3712)
Creates files in the user directory
- iexplore.exe (PID: 3264)
- FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2592)
- iexplore.exe (PID: 3712)
Reads Internet Cache Settings
- iexplore.exe (PID: 3712)
Application launched itself
- iexplore.exe (PID: 3264)
Reads settings of System Certificates
- iexplore.exe (PID: 3712)
Changes internet zones settings
- iexplore.exe (PID: 3264)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
32
Monitored processes
3
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 3264 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 3712 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3264 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 2592 | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe | — | svchost.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Version: 26,0,0,131 | ||||
Total events
413
Read events
362
Write events
51
Delete events
0
Modification events
| (PID) Process: | (3264) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
| (PID) Process: | (3264) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (3264) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (3264) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones |
| Operation: | write | Name: | SecuritySafe |
Value: 1 | |||
| (PID) Process: | (3264) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (3264) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000 | |||
| (PID) Process: | (3264) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active |
| Operation: | write | Name: | {9BCEE469-4637-11E9-AA93-5254004A04AF} |
Value: 0 | |||
| (PID) Process: | (3264) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
| Operation: | write | Name: | Type |
Value: 4 | |||
| (PID) Process: | (3264) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
| Operation: | write | Name: | Count |
Value: 3 | |||
| (PID) Process: | (3264) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
| Operation: | write | Name: | Time |
Value: E307030004000E00090000001B00CB03 | |||
Executable files
0
Suspicious files
0
Text files
89
Unknown types
3
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3264 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 3264 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 3712 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\mootools-core[1].js | text | |
MD5:A2DAE4F1B5C1C2947956D2BAE8426DD4 | SHA256:97E6D159666D4C218C732D77D7CFEA6F40097DDFF357CF8B3153521EFCE7F8CC | |||
| 3712 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\template[1].css | text | |
MD5:06FCF3758AF0627A2F558E8615159B51 | SHA256:EE06C0197972452EBB24FAE731425453860D71BF3A0502AB908D198BF4B76CF4 | |||
| 3712 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\sfhover-ie[1].js | text | |
MD5:8FD3A357627B586A19FCB0D0EBF2D6E9 | SHA256:E7B84E6C5A8822CAEE3BD952D5ECDE7BBB9E385387A3A94F926FCE6FBC774F3B | |||
| 3712 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\jquery.min[1].js | text | |
MD5:F1E4F84E79DCFB4554241A9F8B8D2A48 | SHA256:F97667EF208E359AF1E7548539B77F1B7ADC6B46A25E68B89EC6335FDECBD722 | |||
| 3712 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\mega-tm_ul[1].css | text | |
MD5:AB86D86C8D5FB0C1619A01CB2EE5D39D | SHA256:0D1F1D2DBFC21FD59D4B051135C9065C0C9CE8448D4EA99CDC788BD5B73717C5 | |||
| 3712 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\nsb-opac[1].css | text | |
MD5:E7934D90015364BFA3BA9FB138581C0E | SHA256:33033A7B75E12B328AA6F8E7C7B1F2971EFB1F8283BC6F0BE74ABA0EC2601CBF | |||
| 3712 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\mootools-more[1].js | text | |
MD5:3101E339B82FF560B2341ED5EB53A1EA | SHA256:01AEE3A291B4142D561F88A9F592A8EB286C26932B006AA8F53AD7699B39C707 | |||
| 3712 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\core[1].js | text | |
MD5:F0F867D965D63951DC5D06B73400EDD8 | SHA256:31790EED66D0747EE7D3DEEA3CE02BBF23CCF98B170BE573F90C0847CE3F5E5A | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
80
TCP/UDP connections
83
DNS requests
11
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3712 | iexplore.exe | GET | 200 | 81.19.145.91:80 | http://www.pfarreleonhard.at/plugins/system/jcemediabox/themes/squeeze/css/style.css?version=114 | AT | text | 7.03 Kb | suspicious |
3712 | iexplore.exe | GET | 200 | 81.19.145.91:80 | http://www.pfarreleonhard.at/components/com_jevents/views/default/assets/css/modstyle.css | AT | text | 3.93 Kb | suspicious |
3712 | iexplore.exe | GET | 200 | 81.19.145.91:80 | http://www.pfarreleonhard.at/modules/mod_nice_social_bookmark/css/nsb-opac.css | AT | text | 164 b | suspicious |
3712 | iexplore.exe | GET | — | 81.19.145.91:80 | http://www.pfarreleonhard.at/media/system/js/core.js | AT | — | — | suspicious |
3712 | iexplore.exe | GET | 200 | 81.19.145.91:80 | http://www.pfarreleonhard.at/media/system/js/mootools-core.js | AT | text | 94.8 Kb | suspicious |
3712 | iexplore.exe | GET | — | 81.19.145.91:80 | http://www.pfarreleonhard.at/plugins/system/jcemediabox/js/jcemediabox.js?version=114 | AT | — | — | suspicious |
3712 | iexplore.exe | GET | 200 | 81.19.145.91:80 | http://www.pfarreleonhard.at/media/system/js/mootools-more.js | AT | text | 233 Kb | suspicious |
3712 | iexplore.exe | GET | 200 | 81.19.145.91:80 | http://www.pfarreleonhard.at/modules/mod_roknavmenu/themes/fusion/css/fusion.css | AT | text | 5.92 Kb | suspicious |
3712 | iexplore.exe | GET | 200 | 81.19.145.91:80 | http://www.pfarreleonhard.at/ | AT | html | 53.6 Kb | suspicious |
3712 | iexplore.exe | GET | 200 | 81.19.145.91:80 | http://www.pfarreleonhard.at//components/com_gcalendar/libraries/jquery/jquery.min.js | AT | text | 91.3 Kb | suspicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3264 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3712 | iexplore.exe | 74.125.140.82:80 | html5shim.googlecode.com | Google Inc. | US | whitelisted |
3712 | iexplore.exe | 81.19.145.91:80 | www.pfarreleonhard.at | World4You Internet Services GmbH | AT | suspicious |
3712 | iexplore.exe | 81.4.122.193:80 | track.positiverefreshment.org | RouteLabel V.O.F. | NL | malicious |
3712 | iexplore.exe | 172.217.18.174:443 | apis.google.com | Google Inc. | US | whitelisted |
3712 | iexplore.exe | 188.241.39.12:443 | analytics.clickstat360.com | Hydra Communications Ltd | GB | unknown |
3712 | iexplore.exe | 216.58.207.67:443 | ssl.gstatic.com | Google Inc. | US | whitelisted |
3712 | iexplore.exe | 172.217.18.100:443 | www.google.com | Google Inc. | US | whitelisted |
3712 | iexplore.exe | 172.217.168.205:443 | accounts.google.com | Google Inc. | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.bing.com |
| whitelisted |
www.pfarreleonhard.at |
| unknown |
html5shim.googlecode.com |
| whitelisted |
track.positiverefreshment.org |
| unknown |
apis.google.com |
| whitelisted |
accounts.google.com |
| shared |
www.google.com |
| whitelisted |
ssl.gstatic.com |
| whitelisted |
analytics.clickstat360.com |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3712 | iexplore.exe | Generic Protocol Command Decode | SURICATA STREAM excessive retransmissions |
3712 | iexplore.exe | Generic Protocol Command Decode | SURICATA STREAM excessive retransmissions |
3712 | iexplore.exe | Generic Protocol Command Decode | SURICATA STREAM excessive retransmissions |
3712 | iexplore.exe | Generic Protocol Command Decode | SURICATA STREAM excessive retransmissions |
3712 | iexplore.exe | Generic Protocol Command Decode | SURICATA STREAM excessive retransmissions |
3712 | iexplore.exe | Generic Protocol Command Decode | SURICATA STREAM excessive retransmissions |
3712 | iexplore.exe | Generic Protocol Command Decode | SURICATA STREAM excessive retransmissions |