analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://bit.ly/UptimeMaintenance15-16August

Full analysis: https://app.any.run/tasks/c889ec90-47e9-4523-a62c-a6ba4979006b
Verdict: Malicious activity
Analysis date: June 27, 2022, 07:15:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

81B9282BD93552325DF9E1DE7210015B

SHA1:

4B7C098F555219E7FECBAD7406F7C75FC00A604A

SHA256:

567726F17FAB7C08D607390A14885BBBCF1251F234DA3BD9B8331B8D2E28711A

SSDEEP:

3:N8kwMIAoEb5AJI/XN:25MIAoEb5P/XN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2984)

  • INFO

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2220)
      • iexplore.exe (PID: 2984)
      • AcroRd32.exe (PID: 3812)
      • RdrCEF.exe (PID: 3460)

    • Checks supported languages

      • iexplore.exe (PID: 2220)
      • iexplore.exe (PID: 2984)
      • AcroRd32.exe (PID: 3820)
      • AcroRd32.exe (PID: 3812)
      • RdrCEF.exe (PID: 3460)
      • RdrCEF.exe (PID: 1864)
      • RdrCEF.exe (PID: 680)
      • RdrCEF.exe (PID: 2228)
      • RdrCEF.exe (PID: 2348)
      • RdrCEF.exe (PID: 3252)
      • RdrCEF.exe (PID: 2960)

    • Reads the computer name

      • iexplore.exe (PID: 2220)
      • iexplore.exe (PID: 2984)
      • AcroRd32.exe (PID: 3820)
      • AcroRd32.exe (PID: 3812)
      • RdrCEF.exe (PID: 3460)

    • Application launched itself

      • iexplore.exe (PID: 2220)
      • AcroRd32.exe (PID: 3812)
      • RdrCEF.exe (PID: 3460)

    • Changes internet zones settings

      • iexplore.exe (PID: 2220)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2220)
      • iexplore.exe (PID: 2984)
      • AcroRd32.exe (PID: 3812)

    • Reads CPU info

      • AcroRd32.exe (PID: 3820)

    • Creates files in the user directory

      • iexplore.exe (PID: 2984)

    • Searches for installed software

      • AcroRd32.exe (PID: 3820)
      • AcroRd32.exe (PID: 3812)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2984)

    • Reads the hosts file

      • RdrCEF.exe (PID: 3460)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
12
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe acrord32.exe no specs acrord32.exe no specs acrord32.exe no specs rdrcef.exe rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2220"C:\Program Files\Internet Explorer\iexplore.exe" "https://bit.ly/UptimeMaintenance15-16August"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2984"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2220 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3740"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" /o /eo /l /b /id 2984C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—iexplore.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Exit code:
0
Version:
20.13.20064.405839
3812"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" /o /eo /l /b /id 2984C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—iexplore.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Version:
20.13.20064.405839
3820"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer /o /eo /l /b /id 2984C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Version:
20.13.20064.405839
3460"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Version:
20.13.20064.405839
1864"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1184,1743163323286751308,11865622991855627666,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=17376947952145457557 --renderer-client-id=2 --mojo-platform-channel-handle=1192 --allow-no-sandbox-job /prefetch:1C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Version:
20.13.20064.405839
2960"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1184,1743163323286751308,11865622991855627666,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=14841500332066962152 --mojo-platform-channel-handle=1212 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
1
Version:
20.13.20064.405839
680"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1184,1743163323286751308,11865622991855627666,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=11302591911589449404 --mojo-platform-channel-handle=1388 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
1
Version:
20.13.20064.405839
3252"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1184,1743163323286751308,11865622991855627666,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=14454289754837596855 --mojo-platform-channel-handle=1492 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
1
Version:
20.13.20064.405839
Total events
20 209
Read events
20 082
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
102
Text files
5
Unknown types
7

Dropped files

PID
Process
Filename
Type
2984iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DE5046D52438F8F4BA2FE2F770A8AA96_CB8BCCF3100ED9DE1F94E9DE5BE7F170der
MD5:28064956C745783A45E9D41D14CADAA6
SHA256:9D0FC19D6E90E516F98489065C9F99ADE9BE56783D251153AC63534CD47E7100
2984iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4D1ED785E3365DE6C966A82E99CCE8EA_BE51B43F9F95B8E556690D4EA2757FD1der
MD5:2D1B0661D29247F50E74F9F7ECF0C4CF
SHA256:23EC09A69E52CE7EDAF472C0DD094CA84CB13F444CAAD5C3907C421FCCC78A65
2984iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B4BE6C3F16209E128EF59D5F2CA77D2binary
MD5:3AE6AE2684055B5059C22546A95B075B
SHA256:68AEF41CCC9CFED0C878E1F14C6C653B2C27141C86DB34F3EC43F49795DEE635
2220iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:2232627DB4A5E856F3BC0D3E5B8D9D9E
SHA256:040579DA7AD446E376B233B9AC1E558476FA9842623D4EF73C8498C4B451A0C6
2984iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\UptimeMaintenance15-16August[1].htmhtml
MD5:1F7B4D369FE092BEF9387019189806DB
SHA256:D93059D033F9744D43FAC7D2E1BB46C8394649EAF77B626E30691AD63C0D0C27
2984iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\MPJDO2YH.txttext
MD5:D78305FDABB5173EB2C00EBE1D77A36B
SHA256:DCF4ED3E0227753475A1908EDBDA6EDC1191B06151ACD6F564FB95F731DC3C87
2984iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771binary
MD5:3C9399FCE074BEFA9983EC7D11DDCEF9
SHA256:8D97ED4A50AB4A5FB2956032B8C615D712E89FD676681B3523C1764514155A76
2220iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:28CC3D4B0DA8A29A9DCD6D4755C84342
SHA256:A4CA2DD1D4545838F7A9102623442BC76BDEB2185E9991A294BCB0B6456DDA0E
2984iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DE5046D52438F8F4BA2FE2F770A8AA96_CB8BCCF3100ED9DE1F94E9DE5BE7F170binary
MD5:A4B6C6657EAC6BC827FDE169452D895B
SHA256:C12432538234C1C86F8536FC680E876B8D5F2777CF17AC9D70B2ACC68836BE81
2984iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0270780F846F08BEFE0DD8112D932FEFder
MD5:1FC17C73BC148286DB8A15B86E7DE804
SHA256:E7F52E47104490569D66BA30A193F349E2E50065E0BFCF474D56644F8E0A5342
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
32
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2984
iexplore.exe
GET
—
93.184.220.29:80
http://crl3.digicert.com/sha2-ev-server-g3.crl
US
—
—
whitelisted
2984
iexplore.exe
GET
200
93.184.220.29:80
http://crl4.digicert.com/sha2-ev-server-g3.crl
US
binary
523 Kb
whitelisted
2220
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2984
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJ9L2KGL92BpjF3kAtaDtxauTmhgQUPdNQpdagre7zSmAKZdMh1Pj41g8CEAoIoPYH8AScgXOj0yKW3ww%3D
US
der
471 b
whitelisted
2984
iexplore.exe
GET
200
192.124.249.36:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
US
der
1.69 Kb
whitelisted
2984
iexplore.exe
GET
200
93.184.220.29:80
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl
US
der
592 b
whitelisted
2220
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
2220
iexplore.exe
GET
200
8.252.188.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?45ec249fb7233d46
US
compressed
4.70 Kb
whitelisted
2984
iexplore.exe
GET
200
8.253.129.229:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ca43cadba97343b8
US
compressed
4.70 Kb
whitelisted
2984
iexplore.exe
GET
200
192.124.249.36:80
http://ocsp.godaddy.com//MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCAE1AknHvX72
US
der
1.74 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2220
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2984
iexplore.exe
67.199.248.10:443
bit.ly
Bitly Inc
US
shared
2984
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2220
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2984
iexplore.exe
67.199.248.11:443
bit.ly
Bitly Inc
US
shared
2220
iexplore.exe
13.107.22.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2984
iexplore.exe
8.253.129.204:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
unknown
2220
iexplore.exe
8.252.188.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
2220
iexplore.exe
8.253.129.204:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
unknown
2984
iexplore.exe
8.252.188.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
bit.ly
  • 67.199.248.10
  • 67.199.248.11
shared
ctldl.windowsupdate.com
  • 8.252.188.254
  • 8.253.129.204
  • 8.253.129.229
  • 8.252.188.126
  • 8.250.203.254
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 13.107.22.200
  • 131.253.33.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
crl4.digicert.com
  • 93.184.220.29
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
crl3.digicert.com
  • 93.184.220.29
whitelisted
leadtrainings.com
  • 160.153.138.217
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://bit.ly/UptimeMaintenance15-16August