URL:

http://gleanerjm.com/__media__/js/netsoltrademark.php?d=batmanapollo.ru

Full analysis: https://app.any.run/tasks/f53119e9-9765-441d-ac40-b0960785ce1e
Verdict: Malicious activity
Analysis date: November 07, 2023, 17:09:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
SHA1:

685839C4E4855636A6F25C40FB50DC004F892D9D

SHA256:

55FCC61453479DF05DEEAD26EDBEADCBCB5C4AAEC03E5B3233564B22DF1F8AEA

SSDEEP:

3:N1KZJhtLdh9vZKLvSC2ebwI3hLA:CfLdZXKLA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3428)

    • Checks supported languages

      • wmpnscfg.exe (PID: 3488)

    • Reads the computer name

      • wmpnscfg.exe (PID: 3488)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3488)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3488)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3216"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3428 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3428"C:\Program Files\Internet Explorer\iexplore.exe" "http://gleanerjm.com/__media__/js/netsoltrademark.php?d=batmanapollo.ru"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3488"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
Total events
8 984
Read events
8 921
Write events
57
Delete events
6

Modification events

(PID) Process:(3428) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3428) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3428) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3428) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3428) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3428) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3428) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3428) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3428) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3428) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
10
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3428iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
3428iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF53730A3B3B883FDC.TMPbinary
MD5:4CE51088106780C07EA2EAD9490E8568
SHA256:7FB7E7DD5A97DF87F14CCBC08F8A516B2FA04A8D25877EBFE9CB3DD592589958
3428iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF27FF978CD6C2BAAD.TMPbinary
MD5:5C8532696810380EC2BEE4CD29B7599A
SHA256:97E9B6CCF6DAE3942C8EF9B00E726AEDC8786CF50BFBA9984FABA34301693104
3428iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF62E9E4818CE5C534.TMPbinary
MD5:79C07576AFF3DD15547B59304541F433
SHA256:3D1BA78FD2995EC3DE42F3666D36F49387127504D72D01859CA247F937313A36
3428iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{5EA6A52D-7D90-11EE-A826-12A9866C77DE}.datbinary
MD5:3F5EE6423F7D0FC065706F97600DF87B
SHA256:6DC9F93DA89E5D0073D38598417188E16892591B1D2B35A45C1E29673A25CF17
3216iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\netsol-logo[1].jpgimage
MD5:438A8373A21AF25780C0EF33EACC1D4D
SHA256:FF6EF3CD45017888F330134649C649B1E2820037A004B80921CBAC834248BEC8
3428iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
3428iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:1488327F7C3662E09C021C527C313A7E
SHA256:5F05FDF1EE69A39C5EED5868652E7C165E867E6B8A79CF7188740E62BEDA72CC
3428iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Abinary
MD5:5EE3D532B7CDC453FB44720C7E4B3D84
SHA256:9CBA956B07DC3D0CD8D462581518C24E33EDFBA2D82F8EA8D152CA476534FA55
3428iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Abinary
MD5:77630F6071CD272CD33B1BD3554CA6C9
SHA256:906F08316DC970BE94D76FB97A0F6E87BC8C68F1B2386296AE2EFE2472C4F869
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
14
DNS requests
45
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3428
iexplore.exe
GET
200
8.238.206.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?884fc2e8cfe94039
unknown
compressed
4.66 Kb
—
3428
iexplore.exe
GET
200
8.238.206.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?803fe1dbe68dd6c5
unknown
compressed
4.66 Kb
—
3216
iexplore.exe
GET
200
208.91.196.253:80
http://nine.cdn-image.com/__media__/pics/451/netsol-logo.jpg
unknown
image
909 b
—
3428
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
der
312 b
—
3428
iexplore.exe
GET
404
208.91.197.127:80
http://gleanerjm.com/favicon.ico
unknown
text
10 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
3216
iexplore.exe
208.91.196.253:80
nine.cdn-image.com
CONFLUENCE-NETWORK-INC
VG
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
unknown
868
svchost.exe
95.101.148.135:80
—
Akamai International B.V.
NL
unknown
3428
iexplore.exe
104.126.37.131:443
www.bing.com
Akamai International B.V.
DE
unknown
3428
iexplore.exe
8.238.206.126:80
ctldl.windowsupdate.com
LEVEL3
US
unknown
3428
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
unknown
3428
iexplore.exe
208.91.197.127:80
—
CONFLUENCE-NETWORK-INC
VG
unknown
868
svchost.exe
184.30.20.134:80
armmf.adobe.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
nine.cdn-image.com
  • 208.91.196.253
unknown
api.bing.com
  • 13.107.5.80
unknown
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
  • 104.126.37.131
  • 104.126.37.128
  • 104.126.37.160
  • 104.126.37.145
  • 104.126.37.139
  • 104.126.37.130
  • 104.126.37.152
  • 104.126.37.129
  • 104.126.37.186
unknown
ctldl.windowsupdate.com
  • 8.238.206.126
  • 8.238.189.126
  • 8.248.149.254
  • 8.238.190.126
  • 8.253.207.120
unknown
ocsp.digicert.com
  • 192.229.221.95
unknown
armmf.adobe.com
  • 184.30.20.134
unknown
r20swj13mr.microsoft.com
  • 152.199.19.161
unknown
iecvlist.microsoft.com
  • —
unknown
dns.msftncsi.com
  • 131.107.255.255
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://gleanerjm.com/__media__/js/netsoltrademark.php?d=batmanapollo.ru