analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www.unknowncheats.me/forum/downloads.php?do=file&id=31827&act=down&actionhash=1609554361-d0b1d65cf25f2898459cffd2737d8a04f2b3bcf1

Full analysis: https://app.any.run/tasks/49a8dbd6-43d9-44c4-b53d-96e6ca3980eb
Verdict: Malicious activity
Analysis date: January 02, 2021, 02:42:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

782E39C8389D2A0ABF2092552D2136D2

SHA1:

4521FFF4C8F3A405D513F49B178DF67C2F10BBF9

SHA256:

505E821F1810C7FEA0C0D106FBA75ADCF7773A565D409EA5AA5614478C0DE2EF

SSDEEP:

3:N8DSLRLJLw/t6L0DF9WUVx/YGqY38RUV0lodlvhlywTI:2OLtFeDF9x1r/8mRdZhNTI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1672)
      • iexplore.exe (PID: 1456)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1672)

    • Creates files in the user directory

      • iexplore.exe (PID: 1456)
      • iexplore.exe (PID: 1672)

    • Application launched itself

      • iexplore.exe (PID: 1672)

    • Changes internet zones settings

      • iexplore.exe (PID: 1672)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 1672)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1456)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1672"C:\Program Files\Internet Explorer\iexplore.exe" https://www.unknowncheats.me/forum/downloads.php?do=file&id=31827&act=down&actionhash=1609554361-d0b1d65cf25f2898459cffd2737d8a04f2b3bcf1C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
1456"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1672 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Total events
526
Read events
441
Write events
82
Delete events
3

Modification events

(PID) Process:(1672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
349465964
(PID) Process:(1672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30859441
(PID) Process:(1672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A5000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(1672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
0
Suspicious files
14
Text files
42
Unknown types
6

Dropped files

PID
Process
Filename
Type
1456iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar3661.tmp —
MD5:—
SHA256:—
1456iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\D495X4LO.txt —
MD5:—
SHA256:—
1456iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:6565CC87BF70549F3AE3531D4CDA98DF
SHA256:D8F9BBF6A49F555033D9D15B4E5B4D1F3E11F66CB38D4E4A7778D03BE26964DB
1456iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\DmoXG1OXbwhoBIMRpR3F8WTgDY4[1].jstext
MD5:24C04EF633E7AB93B3A1EA74BD28663D
SHA256:BBD57C5FC37FD6FE8C431E632EC57839BDDEDC17E80844B2F53519CD423BA8F3
1456iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\F7AUI3PZ.txttext
MD5:501D1CEFABAC7B079703E9DAA17F212E
SHA256:49D6A913547D42B48AB63343A2A82596FB50088EC421D799A429F23EA9E6E623
1456iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:BFF50A982CB4DF177E4C7F4EDB57D7D9
SHA256:02ACF0FAAC792EA778F5B95D42D8C215B1E3338622FB62CF4B135A0364F946AB
1456iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\X3PWIF8E.txttext
MD5:67DED16372264B6F169DDD530EBF434A
SHA256:B308C8A4434050AEE371CC76A3DA8831D09B55F2F72F63D9F584005FA46A961D
1456iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\yahoo-dom-event[1].jstext
MD5:6284C4FE82825F3069A9CA5599A56492
SHA256:210415B78A14AE0EA35A1128937BCBF750649CAFAA4D26DD4B20ABF9125F76C6
1456iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\prettify[1].csstext
MD5:FF0E971619A2F6D0ADE9DE1B6965F61F
SHA256:EEAF7ADD3EAC1012EC3EE5FC79379C7FEB1EC7F20A86322C5393A434670A531A
1456iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\vbulletin_menu[1].jstext
MD5:9C61250D03EE4D10900B1313989525A4
SHA256:183F9A7C5FFB8321D9BA11E68C274F4060D0C9EFC87275402A94C41BA5F59A04
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
20
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1456
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
1456
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
1672
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
1672
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
1672
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
1672
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1456
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1672
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
—
—
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
1672
iexplore.exe
104.26.12.251:443
www.unknowncheats.me
Cloudflare Inc
US
unknown
1456
iexplore.exe
104.18.46.203:443
cdn.adligature.com
Cloudflare Inc
US
shared
1672
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1456
iexplore.exe
104.26.12.251:443
www.unknowncheats.me
Cloudflare Inc
US
unknown

DNS requests

Domain
IP
Reputation
www.unknowncheats.me
  • 104.26.12.251
  • 172.67.73.40
  • 104.26.13.251
unknown
ocsp.digicert.com
  • 93.184.220.29
whitelisted
cdn.adligature.com
  • 104.18.46.203
  • 172.67.152.93
  • 104.18.47.203
malicious
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.unknowncheats.me/forum/downloads.php?do=file&id=31827&act=down&actionhash=1609554361-d0b1d65cf25f2898459cffd2737d8a04f2b3bcf1