analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://trustaltus.com

Full analysis: https://app.any.run/tasks/94bbb4b8-a3b0-46b1-b0b4-8c471da3bb37
Verdict: Malicious activity
Analysis date: August 12, 2022, 17:16:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

065951092DBCD395C6DF71FB051BFB9D

SHA1:

3CA23833CABA16764DC76FE02315A189DCE8AD38

SHA256:

56725C0EE5931989E1533F005278ECC96709CCA88DC99B549652AAE2A7068785

SSDEEP:

3:N8fDq2qIn:2brqIn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3004)
  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 2984)
      • iexplore.exe (PID: 3004)
    • Reads settings of System Certificates

      • iexplore.exe (PID: 2984)
      • iexplore.exe (PID: 3004)
    • Reads the computer name

      • iexplore.exe (PID: 3004)
      • iexplore.exe (PID: 2984)
    • Changes internet zones settings

      • iexplore.exe (PID: 2984)
    • Application launched itself

      • iexplore.exe (PID: 2984)
    • Reads internet explorer settings

      • iexplore.exe (PID: 3004)
    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3004)
      • iexplore.exe (PID: 2984)
    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 2984)
    • Changes settings of System certificates

      • iexplore.exe (PID: 2984)
    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2984"C:\Program Files\Internet Explorer\iexplore.exe" "https://trustaltus.com"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3004"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2984 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
18 085
Read events
17 919
Write events
164
Delete events
2

Modification events

(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30977647
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30977647
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2984) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
37
Text files
115
Unknown types
55

Dropped files

PID
Process
Filename
Type
3004iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\1LZFTLRF.htmhtml
MD5:1620D3ECE332EF6FFD83C7E95F281BBD
SHA256:209E1E66B7A6AD6A034412DA6DD8E0020D662F554FF77D9D8223ADF929BF56E3
3004iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2Dbinary
MD5:5D2831416651FD571FBFAFA9A1FCB396
SHA256:5185CD86AF3A4B7305AF2FF4D50A1376ADA70D339A71EE054B68EA4E5BA27200
3004iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771binary
MD5:2689C87B478C0B2B9FED7A3A944A9280
SHA256:B9F4F6DEB05F6BA570CE6C5514403A3026685E519FD775108AF77C439D561086
3004iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771der
MD5:EAE315910DF7E04D7386FEB6E156E0C3
SHA256:2AE573190FA210FFD635047D18EC4D54993772FCC00F8D24A191D9542B58DACD
3004iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FD00DF04BB919AD1F8FA90EEF74E93CC_FB0B008EDAB6820FF4DF815D187D3623der
MD5:C84E08681793A943D54B9D193C943583
SHA256:E8B040AE64813691274CDDA9C45289D9E45C543D6C20A6F68881F219EAD22A40
2984iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:992B6BA9D956543E161AED7EA138E588
SHA256:8F131F7EE0F83437672691CE23A34A0ECA3A0EB59A8CED4C21A36579C558C43F
3004iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\1-large-screen[1].csstext
MD5:E2673ABBA9A79BD6311753DEA6562AA2
SHA256:9A76ED995EE9BD086512173AD1B0402A5E1A8899327F5B15F0ED6B54B0AB07D4
3004iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2Dder
MD5:731961DEA42A253E0D50F88E7C104352
SHA256:BDEF2FB73CC39298479BC53D1B3EE1BE54B0E940A7F3150E85031F9B1FA61324
3004iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FD00DF04BB919AD1F8FA90EEF74E93CC_FB0B008EDAB6820FF4DF815D187D3623binary
MD5:26DE4F3C4F6F25D7B2BAEF1AABA8A222
SHA256:B63972DD1F6FC4E633F72AA49F95F7C2D31242C02D177B94A471C29B2EECC624
3004iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\formidableforms[1].csstext
MD5:0A7533A2143CDC2DFD4C3C511D3DAD0A
SHA256:723EDC75AFC98A8154ACBD43B85DFE2325CFE49DBAE8D314DCAEF8D748B415DA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
129
DNS requests
52
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3004
iexplore.exe
GET
200
172.64.155.188:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
2.18 Kb
whitelisted
3004
iexplore.exe
GET
200
18.66.92.225:80
http://s.ss2.us/r.crl
US
der
434 b
whitelisted
3004
iexplore.exe
GET
200
172.64.155.188:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
1.42 Kb
whitelisted
3004
iexplore.exe
GET
200
104.18.32.68:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEDMvHGUB1PdXbZ%2F3dPyGnto%3D
US
der
471 b
whitelisted
3004
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
3004
iexplore.exe
GET
200
192.124.249.36:80
http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D
US
der
1.66 Kb
whitelisted
3004
iexplore.exe
GET
200
192.124.249.36:80
http://ocsp.godaddy.com//MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCFy84iEV47ME
US
der
1.74 Kb
whitelisted
2984
iexplore.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/Omniroot2025.crl
US
der
7.78 Kb
whitelisted
3004
iexplore.exe
GET
200
192.124.249.36:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
US
der
1.69 Kb
whitelisted
3004
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC7KoDMFPzdvBICsqCGvR0X
US
der
472 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2984
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2984
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
3004
iexplore.exe
192.124.249.36:80
ocsp.godaddy.com
Sucuri
US
suspicious
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3004
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
3004
iexplore.exe
18.206.102.206:443
trustaltus.com
US
unknown
2984
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
18.206.102.206:443
trustaltus.com
US
unknown
142.250.185.202:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3004
iexplore.exe
209.128.119.150:443
stats.sa-as.com
Bay Area Internet Solutions
US
unknown

DNS requests

Domain
IP
Reputation
trustaltus.com
  • 18.206.102.206
unknown
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ocsp.godaddy.com
  • 192.124.249.36
  • 192.124.249.22
  • 192.124.249.41
  • 192.124.249.24
  • 192.124.249.23
whitelisted
www.trustaltus.com
  • 18.206.102.206
unknown
www.googletagmanager.com
  • 142.250.186.72
whitelisted
fonts.googleapis.com
  • 142.250.185.202
whitelisted
cdn.leadmanagerfx.com
  • 13.224.189.5
  • 13.224.189.125
  • 13.224.189.37
  • 13.224.189.111
whitelisted

Threats

PID
Process
Class
Message
Potentially Bad Traffic
ET DNS Query for .to TLD
Potentially Bad Traffic
ET DNS Query for .to TLD
Potentially Bad Traffic
ET DNS Query for .to TLD
No debug info