URL:

http://mirknig.su

Full analysis: https://app.any.run/tasks/e9e0459e-ce85-4a66-8a1b-b439cbdc5e28
Verdict: Malicious activity
Analysis date: September 21, 2018, 08:50:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

827967F1C379C6D393A71250C8267823

SHA1:

62592825EBD291F7D61E7BEDA7AA0F342885B5D0

SHA256:

4FD2F5F5D8B1C8AFE16AC74048F1DC68A2290993C1A9CA5B5399F66C667CBF4A

SSDEEP:

3:N1KTl:Cp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 3520)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3824)

    • Creates files in the user directory

      • iexplore.exe (PID: 3520)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2932)
      • iexplore.exe (PID: 3824)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3824)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 3824)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2932C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Exit code:
0
Version:
26,0,0,131
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_26_0_0_131_activex.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3520"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3824"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3520 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
626
Read events
442
Write events
182
Delete events
2

Modification events

(PID) Process:(3520) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3520) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3520) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3520) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(3520) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3520) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005F000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3520) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{748D7F9F-BD7B-11E8-BFAB-5254004AAD11}
Value:
0
(PID) Process:(3520) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(3520) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
2
(PID) Process:(3520) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E207090005001500080032003A00C001
Executable files
0
Suspicious files
0
Text files
143
Unknown types
6

Dropped files

PID
Process
Filename
Type
3520iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\favicon[1].ico —
MD5:—
SHA256:—
3520iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3824iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\mirknig_su[1].txt —
MD5:—
SHA256:—
3824iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\style[1].csstext
MD5:—
SHA256:—
3824iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\default[1].jstext
MD5:—
SHA256:—
3824iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\mirknig_su[1].htmhtml
MD5:—
SHA256:—
3824iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\1_1[1].gifimage
MD5:07859021603454CD658B044B7E024E75
SHA256:—
3824iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\index[2].phptext
MD5:3A3B161960B064F83E873AE435DD1751
SHA256:5C8CF229AFAF1BC1DC61CB3FA044D7735F376CD6C7293FBADB65241B170CA0C6
3824iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\1470069146_d6dade8b5268[1].jpgimage
MD5:—
SHA256:—
3824iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\spacer[1].gifimage
MD5:325472601571F31E1BF00674C368D335
SHA256:B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
131
TCP/UDP connections
32
DNS requests
13
Threats
89

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3824
iexplore.exe
GET
200
185.43.220.22:80
http://mirknig.su/engine/skins/default.js
LT
text
2.69 Kb
whitelisted
3824
iexplore.exe
GET
200
88.99.165.109:80
http://ddnk.advertur.ru/v1/s/loader.js
DE
text
54.7 Kb
malicious
3824
iexplore.exe
GET
200
185.43.220.22:80
http://mirknig.su/templates/mirknig/images/block/navigation.gif
LT
image
424 b
whitelisted
3824
iexplore.exe
GET
200
185.43.220.22:80
http://mirknig.su/templates/mirknig/images/spacer.gif
LT
image
43 b
whitelisted
3824
iexplore.exe
GET
200
185.43.220.22:80
http://mirknig.su/templates/mirknig/images/newl.gif
LT
image
3.60 Kb
whitelisted
3824
iexplore.exe
GET
200
185.43.220.22:80
http://mirknig.su/templates/mirknig/images/block/favorites.png
LT
image
766 b
whitelisted
3824
iexplore.exe
GET
200
185.43.220.22:80
http://mirknig.su/templates/mirknig/images/block/online.gif
LT
image
623 b
whitelisted
3824
iexplore.exe
GET
200
185.43.220.22:80
http://mirknig.su/templates/mirknig/images/3_1.gif
LT
image
196 b
whitelisted
3824
iexplore.exe
GET
200
185.43.220.22:80
http://mirknig.su/templates/mirknig/images/8_1.gif
LT
image
196 b
whitelisted
3824
iexplore.exe
GET
200
185.43.220.22:80
http://mirknig.su/templates/mirknig/images/9_1.gif
LT
image
197 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3824
iexplore.exe
88.99.165.109:80
ddnk.advertur.ru
Hetzner Online GmbH
DE
suspicious
3824
iexplore.exe
144.76.175.135:80
am15.net
Hetzner Online GmbH
DE
unknown
3520
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3824
iexplore.exe
185.43.220.22:80
mirknig.su
WIBO Baltic UAB
LT
suspicious
3824
iexplore.exe
5.9.22.60:80
context-art.ru
Hetzner Online GmbH
DE
unknown
3824
iexplore.exe
92.223.124.254:80
jsc.marketgid.com
G-Core Labs S.A.
DE
suspicious
3824
iexplore.exe
77.88.21.119:443
mc.yandex.ru
YANDEX LLC
RU
whitelisted
3824
iexplore.exe
104.31.95.126:80
mbzl-pro.xyz
Cloudflare Inc
US
shared
3824
iexplore.exe
195.201.194.159:80
sync.dmp.otm-r.com
Awanti Ltd.
RU
unknown
3824
iexplore.exe
78.155.222.210:80
sync2.audtd.com
OOO Network of data-centers Selectel
RU
unknown

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
mirknig.su
  • 185.43.220.22
whitelisted
ddnk.advertur.ru
  • 88.99.165.109
  • 195.201.163.155
malicious
jsc.marketgid.com
  • 92.223.124.254
whitelisted
mc.yandex.ru
  • 77.88.21.119
  • 93.158.134.119
  • 87.250.251.119
  • 87.250.250.119
whitelisted
am15.net
  • 144.76.175.135
  • 148.251.11.44
  • 148.251.47.213
  • 213.239.208.163
  • 5.9.12.131
  • 5.9.118.207
  • 136.243.22.228
  • 144.76.154.167
whitelisted
mbzl-pro.xyz
  • 104.31.95.126
  • 104.31.94.126
unknown
context-art.ru
  • 5.9.22.60
unknown
sync2.audtd.com
  • 78.155.222.210
  • 78.155.222.212
  • 78.155.222.215
  • 78.155.222.213
  • 78.155.222.211
whitelisted
sync.teamrtb.net
  • 136.243.102.236
  • 148.251.136.163
unknown

Threats

PID
Process
Class
Message
3824
iexplore.exe
A Network Trojan was detected
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
3824
iexplore.exe
A Network Trojan was detected
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
3824
iexplore.exe
A Network Trojan was detected
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
3824
iexplore.exe
A Network Trojan was detected
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
3824
iexplore.exe
A Network Trojan was detected
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
3824
iexplore.exe
A Network Trojan was detected
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
3824
iexplore.exe
A Network Trojan was detected
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
3824
iexplore.exe
A Network Trojan was detected
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
3824
iexplore.exe
A Network Trojan was detected
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
3824
iexplore.exe
A Network Trojan was detected
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://mirknig.su