analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://upgradetypelast-restclicks.icu/XX6cjX6mC8hn02Jjc2pVCuxiH5IefAEm1pQl_K5aLdA?cid=6e311b8883d32a980d1015aab3022937&sid=14892298

Full analysis: https://app.any.run/tasks/3ff87c2b-b922-4421-8da6-74f42752af54
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 21, 2019, 15:38:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
adware
installcore
pup
Indicators:
MD5:

4A1D9C3AC4C181B6F60A895535243E93

SHA1:

80C54C547EA77FC78DBCD4EB103FC8FEEFE92DF0

SHA256:

56A8E5BD093A3B787DA1F1EDE1815C9DA3A780FDEE04A3F2B8AD95DC78CC1D92

SSDEEP:

3:N1KLKIv9eMGVHXKRhPAZmIsQhV008KMB+AWqcX8t2VHcWucXMd:COIV9aZmI6QMcm1cV8Wo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • adobe_flash_player[1].exe (PID: 2308)
      • adobe_flash_player[1].exe (PID: 2408)

    • Downloads executable files from the Internet

      • iexplore.exe (PID: 2248)

    • INSTALLCORE was detected

      • adobe_flash_player[1].exe (PID: 2408)

    • Connects to CnC server

      • adobe_flash_player[1].exe (PID: 2408)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2248)
      • iexplore.exe (PID: 1336)

    • Cleans NTFS data-stream (Zone Identifier)

      • adobe_flash_player[1].exe (PID: 2308)

    • Application launched itself

      • adobe_flash_player[1].exe (PID: 2308)
      • taskmgr.exe (PID: 2908)

    • Reads Environment values

      • adobe_flash_player[1].exe (PID: 2408)

    • Reads internet explorer settings

      • adobe_flash_player[1].exe (PID: 2408)

  • INFO

    • Creates files in the user directory

      • iexplore.exe (PID: 1336)
      • iexplore.exe (PID: 2248)

    • Changes internet zones settings

      • iexplore.exe (PID: 1336)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 1336)
      • iexplore.exe (PID: 2248)

    • Application launched itself

      • iexplore.exe (PID: 1336)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start iexplore.exe iexplore.exe adobe_flash_player[1].exe no specs #INSTALLCORE adobe_flash_player[1].exe explorer.exe no specs taskmgr.exe no specs taskmgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
1336"C:\Program Files\Internet Explorer\iexplore.exe" http://upgradetypelast-restclicks.icu/XX6cjX6mC8hn02Jjc2pVCuxiH5IefAEm1pQl_K5aLdA?cid=6e311b8883d32a980d1015aab3022937&sid=14892298C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2248"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1336 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2308"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\adobe_flash_player[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\adobe_flash_player[1].exe—iexplore.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Kagas Setup
Exit code:
0
Version:
1.6.5.1
2408"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\adobe_flash_player[1].exe" /RSF /ppn:YWV4dQ0KChAjb3J1FQUI /ads:1 /mnlC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\adobe_flash_player[1].exe
adobe_flash_player[1].exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Kagas Setup
Exit code:
4294967206
Version:
1.6.5.1
2536"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2908"C:\Windows\system32\taskmgr.exe" /4C:\Windows\system32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1912"C:\Windows\system32\taskmgr.exe" /1C:\Windows\system32\taskmgr.exe
taskmgr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Task Manager
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 185
Read events
1 094
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
4
Text files
80
Unknown types
7

Dropped files

PID
Process
Filename
Type
1336iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico —
MD5:—
SHA256:—
1336iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
1336iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF4AEB40068445EA47.TMP —
MD5:—
SHA256:—
1336iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{60F12D5E-4BEF-11E9-A302-5254004A04AF}.datbinary
MD5:80784D3A0F1F03DAB95EB30BC1CDB5E5
SHA256:205F74ED75BBADE8C70CAB45C8476DF4C63818FE111A4E8D0AF34CF4906828EE
1336iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\adobe_flash_player[1].exeexecutable
MD5:5DC55D0829B4375E7EA2113F78FFFF6D
SHA256:55B9009D9CF3D7D702C71CFF1A02D97E16C30FC6C1C060D149CF904259EE26BE
2248iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:D05FA5C6222C61E841D78184865B4757
SHA256:803CDD7DC42DAD31A4AA7BE76D5F0EAE86FC5FE8C3EB43A703B4102E13669EF8
1336iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019032120190322\index.datdat
MD5:2E57B24FB2334D6EBEEF0195DB443C93
SHA256:8182DD17030513A15687B7676ABA1DE8E953A67E5CA283D3E26A06322DB26D20
2248iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019032120190322\index.datdat
MD5:3A06CB21BDCB0D8E97395FDBDC6737CE
SHA256:BAC2533BCE46A3E49F81C590508D3095E46250C64545AAEB1745B0693CD36CDC
2248iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\QRYRNLG4\adobe_flash_player_0425753326[1].exeexecutable
MD5:5DC55D0829B4375E7EA2113F78FFFF6D
SHA256:55B9009D9CF3D7D702C71CFF1A02D97E16C30FC6C1C060D149CF904259EE26BE
2248iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:48ED73C2B592BC61D0A598631B09B44C
SHA256:80967723459E14744E3DE80659C77B3ADF6C543D52FBD7FF45EBA73223A827C1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
5
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2248
iexplore.exe
GET
302
54.152.140.188:80
http://products.apps.co.me/ic_refresh/dl.php?cid=LS0eZ2y23zUWKivequtoi3HJEiL2cvocCpJ9LflYiqdY_WoR7RWPVxkktFFKZGsKs-DiaAMvhjWZ6TeRIK2nj-FPrOCvnL2LAQ9Otk2weeL8zBAwrffx56-qdhAZEgz2uu9MeR-E0DWk8OWBs0TQtT4FO_QCCuUy-uG5KL6-d7wwj1-vxkREHcuKXfg-BAtFpgFJuvLA0Zs7JlYbydIPTQ&channel=oko_ddl_ie_Eedge_15319&fn={fn}
US
—
—
unknown
2248
iexplore.exe
GET
200
13.32.222.226:80
http://d23uib91h71t70.cloudfront.net/5yxydkr48)0zx/adobe_flash_player.exe
US
executable
2.03 Mb
whitelisted
2408
adobe_flash_player[1].exe
POST
200
52.214.73.247:80
http://vpn.ferelar-yofi.com/
IE
—
—
malicious
2408
adobe_flash_player[1].exe
POST
200
52.214.73.247:80
http://vpn.ferelar-yofi.com/
IE
—
—
malicious
2248
iexplore.exe
GET
302
51.158.26.248:80
http://upgradetypelast-restclicks.icu/XX6cjX6mC8hn02Jjc2pVCuxiH5IefAEm1pQl_K5aLdA?cid=6e311b8883d32a980d1015aab3022937&sid=14892298
GB
html
158 b
suspicious
1336
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1336
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2248
iexplore.exe
13.32.222.226:80
d23uib91h71t70.cloudfront.net
Amazon.com, Inc.
US
whitelisted
2408
adobe_flash_player[1].exe
52.214.73.247:80
vpn.ferelar-yofi.com
Amazon.com, Inc.
IE
malicious
2248
iexplore.exe
54.152.140.188:80
products.apps.co.me
Amazon.com, Inc.
US
unknown
2248
iexplore.exe
51.158.26.248:80
upgradetypelast-restclicks.icu
—
GB
suspicious

DNS requests

Domain
IP
Reputation
upgradetypelast-restclicks.icu
  • 51.158.26.248
unknown
products.apps.co.me
  • 54.152.140.188
unknown
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
d23uib91h71t70.cloudfront.net
  • 13.32.222.226
  • 13.32.222.6
  • 13.32.222.241
  • 13.32.222.24
whitelisted
vpn.ferelar-yofi.com
  • 52.214.73.247
  • 54.194.149.175
malicious

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .icu Domain
2248
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2248
iexplore.exe
Misc activity
ET INFO EXE - Served Attached HTTP
2408
adobe_flash_player[1].exe
Misc activity
ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M2
2408
adobe_flash_player[1].exe
Misc activity
ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M1
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://upgradetypelast-restclicks.icu/XX6cjX6mC8hn02Jjc2pVCuxiH5IefAEm1pQl_K5aLdA?cid=6e311b8883d32a980d1015aab3022937&sid=14892298