analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://dell1.ug/dhf58457ywuhifghpenelop3/Ai74ywouig/get.php?pid=9D21DEA2F9EA5AFC93634DAFF1A5107F&first=true

Full analysis: https://app.any.run/tasks/afc44dfd-0e39-4af5-9bd8-e7bfe4f1cbe0
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: September 18, 2019, 22:35:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
opendir
Indicators:
MD5:

83153BFCC36296A4ED42BF7B3272A996

SHA1:

5FA0BD63F8434F21599C1996EC506FCF775CD9FD

SHA256:

51DA7BC576185A07EB7095416944C251E614E0BA42EA376126A077732B260248

SSDEEP:

3:N1KaAJ1CKHUsNMSq/boR23tw2Yme+8naKjYLMv:Ca5eNMSq/8R2K/b+8nLjY4v

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2884)

    • Creates files in the user directory

      • iexplore.exe (PID: 3224)
      • iexplore.exe (PID: 2884)

    • Changes internet zones settings

      • iexplore.exe (PID: 2884)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3224)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3224)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2884"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3224"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2884 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
343
Read events
282
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
6
Unknown types
4

Dropped files

PID
Process
Filename
Type
2884iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
2884iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3224iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\A7W5SG8P\get[1].php —
MD5:—
SHA256:—
3224iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BE0VVHEL\get[1].htmtext
MD5:CBCC3E0E7CECE4C5C4352F6BAC9941A5
SHA256:47776EFBB5D5DA84AAB5082FF3F3693FD57A249A4551F0D63AEE6B49AADAE47B
2884iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019091820190919\index.datdat
MD5:808372AD79977EC92892D79BF0C293D7
SHA256:68035F9C4B8829B9C4D76B06697BA59BDF8D4D1EF57C4180F179E5F488A37D4E
3224iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:4310F48BF670C4D9F0B9D9B262F4E14B
SHA256:52A84F70222B4D954E77CFDF9485BE98126EC911CC9F36D94D6EA90E0919B74D
3224iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:3008791942DCF45FA13B696B7736397A
SHA256:5F9808DFD9EB664F8F51E83FD789687BA9F85050118F55061DB43A9293E79CA2
3224iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019091820190919\index.datdat
MD5:3600A7A9C6081C332DAE24D4C7373590
SHA256:54C16F5E8F0953A4AA0D1E656149F9EC8C0D221330DCFEFAB555B1B19492658B
3224iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\A7W5SG8P\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
2884iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\favicon[1].pngimage
MD5:9FB559A691078558E77D6848202F6541
SHA256:6D8A01DC7647BC218D003B58FE04049E24A9359900B7E0CEBAE76EDF85B8B914
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3224
iexplore.exe
GET
200
8.208.13.6:80
http://dell1.ug/dhf58457ywuhifghpenelop3/Ai74ywouig/get.php?pid=9D21DEA2F9EA5AFC93634DAFF1A5107F&first=true
US
text
559 b
malicious
2884
iexplore.exe
GET
404
8.208.13.6:80
http://dell1.ug/favicon.ico
US
html
209 b
malicious
2884
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2884
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3224
iexplore.exe
8.208.13.6:80
dell1.ug
Level 3 Communications, Inc.
US
malicious
2884
iexplore.exe
8.208.13.6:80
dell1.ug
Level 3 Communications, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
dell1.ug
  • 8.208.13.6
malicious

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://dell1.ug/dhf58457ywuhifghpenelop3/Ai74ywouig/get.php?pid=9D21DEA2F9EA5AFC93634DAFF1A5107F&first=true