analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

index.html

Full analysis: https://app.any.run/tasks/3e1388b4-a9a5-4aec-8d33-fbe27a6f1a0e
Verdict: Malicious activity
Analysis date: January 23, 2019, 05:14:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/html
File info: HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
MD5:

A31C803A4A5E2BBF702052800FFDE391

SHA1:

46C9562AEBDAA33B263FFB9F759F87962546E129

SHA256:

55E82097F0BD67397484CAA3D061DDDC38058A84638C10F36FFB9DF80DDC5A14

SSDEEP:

6144:ph71hIOiOmxxb7TI+uw2LPmYikbVMIKy1NFoM72rdA7yJUpx+Qz9KmlTUtGJiJs3:pmLIDaw/CtrUMtQu+TOWjNwxQTQbGj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads the Task Scheduler COM API

      • CCleaner.exe (PID: 2988)
      • CCleaner.exe (PID: 3760)

    • Runs app for hidden code execution

      • cmd.exe (PID: 3164)

    • Uses SVCHOST.EXE for hidden code execution

      • cmd.exe (PID: 3164)

    • Changes the autorun value in the registry

      • CCleaner.exe (PID: 3760)

    • Actions looks like stealing of personal data

      • CCleaner.exe (PID: 3760)
      • CCleaner.exe (PID: 3040)

  • SUSPICIOUS

    • Creates files in the user directory

      • filezilla.exe (PID: 2504)
      • CCleaner.exe (PID: 3040)

    • Reads internet explorer settings

      • CCleaner.exe (PID: 3040)
      • CCleaner.exe (PID: 3760)

    • Application launched itself

      • CCleaner.exe (PID: 3040)
      • cmd.exe (PID: 3164)

    • Low-level read access rights to disk partition

      • CCleaner.exe (PID: 3040)

    • Reads the cookies of Google Chrome

      • CCleaner.exe (PID: 3040)

    • Reads the cookies of Mozilla Firefox

      • CCleaner.exe (PID: 3040)

    • Starts application with an unusual extension

      • cmd.exe (PID: 3164)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 3164)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 3004)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 3300)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3828)
      • WINWORD.EXE (PID: 2036)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2036)
      • iexplore.exe (PID: 3300)
      • WINWORD.EXE (PID: 3828)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3300)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3004)
      • iexplore.exe (PID: 3300)
      • CCleaner.exe (PID: 3040)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3004)
      • iexplore.exe (PID: 3300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.aiml | Artificial Intelligence Markup Language (48.3)
.htm/html | HyperText Markup Language with DOCTYPE (41.6)
.html | HyperText Markup Language (9.9)

EXIF

HTML

oathGuceConsentHost: guce.yahoo.com
referrer: unsafe-url
themeColor: #400090
formatDetection: telephone=no
Keywords: Yahoo, Yahoo Startseite, yahoo startseite, Yahoo Suche, Yahoo Mail, Yahoo Messenger, Yahoo Spiele, Nachrichten, Finanzen, Sport, Unterhaltung
Description: Nachrichten, E-Mails und die Suche sind nur der Anfang. Jeden Tag gibt es mehr zu entdecken. Finden Sie genau das, was Sie suchen.
HTTPEquivXUACompatible: chrome=1
ContentType: text/html; charset=utf-8
HTTPEquivXDnsPrefetchControl: on
Title: Yahoo
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
97
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe cmd.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs ping.exe no specs svchost.exe no specs svchost.exe no specs nslookup.exe nslookup.exe winword.exe no specs winword.exe no specs filezilla.exe no specs ccleaner.exe no specs ccleaner.exe ccleaner.exe svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs tree.com no specs tree.com no specs tree.com no specs cmd.exe no specs tree.com no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3004"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\index.htmlC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3300"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3004 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3164"C:\Windows\system32\cmd.exe" C:\Windows\system32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3228C:\Windows\System32\svchost.exe -k bdxC:\Windows\System32\svchost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3780C:\Windows\System32\svchost.exe -kC:\Windows\System32\svchost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1208C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2696C:\Windows\System32\svchost.exe -hC:\Windows\System32\svchost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3552ping C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2304svchostC:\Windows\system32\svchost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2752svchost -hC:\Windows\system32\svchost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
2 863
Read events
2 464
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
7
Text files
55
Unknown types
19

Dropped files

PID
Process
Filename
Type
3004iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\favicon[1].ico —
MD5:—
SHA256:—
3004iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3300iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2YPIJ90\sda_advance_0.0.39[1].csstext
MD5:3DA862EA71B06DDFEA6974CEC12E484F
SHA256:0A4A06617D0F695110B7583EEDFC6D02C811789F758D478040E8B6D12C9525DA
3300iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\yglyphs[1].eoteot
MD5:430F2CB7F3B2B01E8A0FF27FD883F5A1
SHA256:8C83E68BEA7A6FC8B2E696DD5F0107837375B8BF6B536645C03E05D95A28571F
3300iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\styles-ltr[1].csstext
MD5:1AD164954ADC1530309C2C4FA0E1FEA9
SHA256:BF6470BE437AA10CC19F7E433F355ED8C962914A961780EAA6AD46EA59B97406
3300iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\advance_0.0.26[1].csstext
MD5:78965BF87C7464FD77B1CDE6620EECD9
SHA256:E732721FD4F3DF512C903E20709B4F48F2A0DA5A135286F83911F25F116B2A95
3300iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2YPIJ90\yglyphs-legacy_0.0.29[1].csstext
MD5:FEA1B3F449C8DE4E6AD28FC439976648
SHA256:8986CE1C5001F7AEEC6203851EC850874A158268F11CDC59E04DC56E86D9DBD1
3300iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\font_rc4_0.0.91[1].csstext
MD5:C45EDC1345620CAABA9C35594F085196
SHA256:8C9134E768A60DB1E0570E7709B960F18EBF4F1577E7B907DAEEFFF8BB5F35FD
3300iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2YPIJ90\SemiBold[1].eoteot
MD5:8AC3B02B7BFC128D5DC8EF4DF48AB3B4
SHA256:2FBB97FEE914826C65508059B20D78FFA28F0971550BC074AE69DD1A56214260
3300iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\advance_base_rc4_0.0.91[1].csstext
MD5:FED5969E59CCE3D2D712A3A4C229D08C
SHA256:C3A38D789DC540C78CC300EE7280FD8DD981BA55FB567F42FD2CC16E824BD012
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
21
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3040
CCleaner.exe
GET
301
151.101.0.64:80
http://www.piriform.com/auto?a=0&p=cc&v=5.35.6210&l=1033&lk=&mk=IJR6-W5SV-5KYR-QBZD-6BY4-RN5Z-WAV9-RVK2-VJCA&o=6.1W3&au=1&mx=97B7721C4994E2556FF6A439510F665DB45337A341A47E15F4997584423BF714&gu=00000000-0000-4000-8000-d6f7f2be5127
US
—
—
whitelisted
3004
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3004
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3040
CCleaner.exe
151.101.0.64:80
www.piriform.com
Fastly
US
whitelisted
3040
CCleaner.exe
151.101.0.64:443
www.piriform.com
Fastly
US
whitelisted
3300
iexplore.exe
104.111.214.103:443
sb.scorecardresearch.com
Akamai International B.V.
NL
whitelisted
3300
iexplore.exe
87.248.114.12:443
s.yimg.com
Yahoo! UK Services Limited
GB
shared
3040
CCleaner.exe
151.101.2.202:443
www.ccleaner.com
Fastly
US
suspicious
3004
iexplore.exe
212.82.100.137:443
de.search.yahoo.com
Yahoo! UK Services Limited
CH
shared

DNS requests

Domain
IP
Reputation
s.yimg.com
  • 87.248.114.12
  • 87.248.114.11
shared
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
beap-bc.yahoo.com
  • 87.248.114.12
  • 87.248.114.11
whitelisted
sb.scorecardresearch.com
  • 104.111.214.103
shared
de.search.yahoo.com
  • 212.82.100.137
whitelisted
www.piriform.com
  • 151.101.0.64
  • 151.101.64.64
  • 151.101.128.64
  • 151.101.192.64
whitelisted
www.ccleaner.com
  • 151.101.2.202
  • 151.101.66.202
  • 151.101.130.202
  • 151.101.194.202
whitelisted

Threats

PID
Process
Class
Message
3040
CCleaner.exe
A Network Trojan was detected
SC MINER Miner Possible Bitcoin Miner Windows
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
index.html