Malware analysis http://141.8.225.31 Malicious activity

Add for printing

URL:	http://141.8.225.31
Full analysis:	https://app.any.run/tasks/266404ad-c2b7-460f-ae4c-e1c4e2fade54
Verdict:	Malicious activity
Analysis date:	September 11, 2019, 01:33:05
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:	331FEAF9BA49A986907EDE7857E98EF6
SHA1:	2FDA2A85B3C4B20830045CB9EEAEF978BC722079
SHA256:	4E237E4013D4F999B80EB7469799CB83806F8B592CE735AA7B6355AF6F9ED353
SSDEEP:	3:N1Kpura:CYra

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (75.0.3770.100)
Google Update Helper (1.3.34.7)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.7.2 (4.7.03062)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702 (14.21.27702.2)
Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702 (14.21.27702)
Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702 (14.21.27702)
Mozilla Firefox 68.0.1 (x86 en-US) (68.0.1)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
Update for Microsoft .NET Framework 4.7.2 (KB4087364) (1)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB4019990
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
No suspicious indicators.
INFO
- Application launched itself
  - iexplore.exe (PID: 3528)
- Reads Internet Cache Settings
  - iexplore.exe (PID: 3988)
- Reads internet explorer settings
  - iexplore.exe (PID: 3988)
- Changes internet zones settings
  - iexplore.exe (PID: 3528)
- Creates files in the user directory
  - iexplore.exe (PID: 3988)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Parent process
3528	"C:\Program Files\Internet Explorer\iexplore.exe" "http://141.8.225.31"	C:\Program Files\Internet Explorer\iexplore.exe	explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)
3988	"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3528 CREDAT:71937	C:\Program Files\Internet Explorer\iexplore.exe	iexplore.exe
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)

Add for printing

Total events

382

Read events

321

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
3528	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico		—
		MD5:—	SHA256:—
3528	iexplore.exe	C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico		—
		MD5:—	SHA256:—
3988	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\QOLU4G3X\fwdservice_com[1].txt		—
		MD5:—	SHA256:—
3988	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\QOLU4G3X\ww8_fwdservice_com[1].htm		—
		MD5:—	SHA256:—
3988	iexplore.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt		text
		MD5:59B66168EFE5E3C58A989F2B00F5585C	SHA256:A977B485AD51B11E4704EBEA178C0914CBBBAB6484139B2E02DF22FDD3C8E9A2
3988	iexplore.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@fwdservice[1].txt		text
		MD5:A09FDCA94D39B9CE0D7D3C32D2B0A5A6	SHA256:88EE8CB809D8CAAB3870CAB92BE3BD0E5794DEA29D632CB92EF5D00E46D4B856
3988	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat		dat
		MD5:9091DDC9F3CD8F32B93229158E4ACEDC	SHA256:A8C1996C1347FB3862D945E7C1751795C4B5252141E03DA875E211FFC9553719
3988	iexplore.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.dat		dat
		MD5:359BDC8A8F4DB313557C25DA8248F2F3	SHA256:84D402908191F67AD2F0B57A91CA872F54CBC9766A20D290EE9DAE08E333721D
3988	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\QOLU4G3X\ww8_fwdservice_com[2].htm		html
		MD5:85E6D378CE5AC2C6B41D95739E75B734	SHA256:C4E40CA5644A25562E5F763F7FCA8B2018722BC3E76FF340BCF3DF8875E6406A
3988	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019091120190912\index.dat		dat
		MD5:2356B6E2730E1A84D4D37957C282CCF5	SHA256:DAAB62C03BE846C982B87A9A3B820DDB4DE60FF39ACFE49098CB5BE2C66E8E80

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
3988	iexplore.exe	GET	302	141.8.225.31:80	http://141.8.225.31/	CH	—	—	malicious
3988	iexplore.exe	GET	200	141.8.224.25:80	http://fwdservice.com/?ga=ZSKaPLVj8pSEPSqR5yYF32P%2BQkg%2BYeN6DcPMPc%2FlFQA0z4i25Ir4Ys3kExlRohw5TU6DT4NBOs5MhrjuEa28pMLBSWp7xAPMji0CKxfavO0tMxx%2FOgotAh8dUX9UhGhN5Ai%2BWZKWXS4F7Uy86KEu7g6vPHZgG2XohsC8qyxVSSE%3D&gerf=3bFVDiWPG8qd0xdkz%2BZI0m4Nkq8f%2BdlJzhbMLsBQ0uU%3D&guro=heXpXLbXQSqyDjqaKP4CziFG%2BR9VbQUTMwGRB18oOIvaIb2BAnG9CojdVmuGez4F&	CH	html	419 b	malicious
3988	iexplore.exe	GET	200	141.8.224.25:80	http://fwdservice.com/	CH	html	1.06 Kb	malicious
3528	iexplore.exe	GET	200	204.79.197.200:80	http://www.bing.com/favicon.ico	US	image	237 b	whitelisted
3988	iexplore.exe	GET	200	35.186.238.101:80	http://ww8.fwdservice.com/	US	html	800 b	whitelisted
3988	iexplore.exe	GET	200	35.186.238.101:80	http://ww8.fwdservice.com/	US	html	800 b	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
3528	iexplore.exe	204.79.197.200:80	www.bing.com	Microsoft Corporation	US	whitelisted
3988	iexplore.exe	172.217.16.132:443	www.google.com	Google Inc.	US	whitelisted
3988	iexplore.exe	35.186.238.101:80	ww8.fwdservice.com	Google Inc.	US	whitelisted
3988	iexplore.exe	141.8.224.25:80	fwdservice.com	Confluence Networks Inc	CH	malicious
3988	iexplore.exe	141.8.225.31:80	—	Confluence Networks Inc	CH	malicious
3988	iexplore.exe	143.204.208.129:443	d1hi41nc56pmug.cloudfront.net	—	US	unknown

DNS requests

Domain	IP	Reputation
fwdservice.com	141.8.224.25	malicious
www.bing.com	204.79.197.200 13.107.21.200	whitelisted
d3ujb2t8x8alxd.cloudfront.net	—	whitelisted
ww8.fwdservice.com	35.186.238.101	whitelisted
www.google.com	172.217.16.132	whitelisted
d1hi41nc56pmug.cloudfront.net	143.204.208.129 143.204.208.108 143.204.208.147 143.204.208.175	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

http://141.8.225.31

331FEAF9BA49A986907EDE7857E98EF6

2FDA2A85B3C4B20830045CB9EEAEF978BC722079

4E237E4013D4F999B80EB7469799CB83806F8B592CE735AA7B6355AF6F9ED353

3:N1Kpura:CYra

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

INFO

Application launched itself

Reads Internet Cache Settings

Reads internet explorer settings

Changes internet zones settings

Creates files in the user directory

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings