URL:

http://www.ipts.com/download.php

Full analysis: https://app.any.run/tasks/1c7032d5-4452-4d16-9055-5ba5cd842b5e
Verdict: Malicious activity
Analysis date: February 13, 2022, 01:25:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

0AC36F368FE6991E15DC2CCA640C56F7

SHA1:

FE2B79CF6FA2DCF3FAECF288A398BB0725D4ED74

SHA256:

5CA83E8492D7E4C381A639D133544E658061501147C98F76B44D690AD713074C

SSDEEP:

3:N1KJS4rLdIKBKKV:Cc4rLdMKV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ipts.exe (PID: 1840)
      • ipts.exe (PID: 3364)
      • ipts.exe (PID: 1884)
      • ipts.exe (PID: 3092)
      • ipts.exe (PID: 2432)
      • ipts.exe (PID: 2008)
      • ipts.exe (PID: 2060)

    • Changes the autorun value in the registry

      • ipts.exe (PID: 1840)

    • Loads dropped or rewritten executable

      • ipts.exe (PID: 3364)
      • ipts.exe (PID: 1884)
      • ipts.exe (PID: 2432)
      • ipts.exe (PID: 3092)
      • ipts.exe (PID: 2008)
      • ipts.exe (PID: 2060)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3536)
      • iexplore.exe (PID: 1268)
      • ipts.exe (PID: 1840)

    • Reads the computer name

      • WinRAR.exe (PID: 2604)
      • ipts.exe (PID: 1840)
      • ipts.exe (PID: 3364)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 2604)

    • Checks supported languages

      • ipts.exe (PID: 1840)
      • WinRAR.exe (PID: 2604)
      • ipts.exe (PID: 3364)
      • ipts.exe (PID: 3092)
      • ipts.exe (PID: 1884)
      • ipts.exe (PID: 2432)
      • ipts.exe (PID: 2008)
      • ipts.exe (PID: 2060)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2604)

    • Reads internet explorer settings

      • ipts.exe (PID: 1840)

    • Reads CPU info

      • ipts.exe (PID: 1840)

    • Application launched itself

      • ipts.exe (PID: 1840)
      • ipts.exe (PID: 3364)

    • Reads the time zone

      • ipts.exe (PID: 1884)
      • ipts.exe (PID: 3092)
      • ipts.exe (PID: 2008)
      • ipts.exe (PID: 2060)

    • Creates files in the user directory

      • ipts.exe (PID: 1840)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 3536)
      • explorer.exe (PID: 3316)
      • iexplore.exe (PID: 1268)

    • Reads the computer name

      • iexplore.exe (PID: 3536)
      • explorer.exe (PID: 3316)
      • iexplore.exe (PID: 1268)

    • Application launched itself

      • iexplore.exe (PID: 3536)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1268)

    • Manual execution by user

      • explorer.exe (PID: 3316)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3536)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3536)

    • Creates files in the user directory

      • iexplore.exe (PID: 1268)
      • iexplore.exe (PID: 3536)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3536)
      • ipts.exe (PID: 3364)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3536)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3536)

    • Changes internet zones settings

      • iexplore.exe (PID: 3536)

    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 2604)
      • ipts.exe (PID: 3364)

    • Reads the hosts file

      • ipts.exe (PID: 3364)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
11
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start iexplore.exe iexplore.exe explorer.exe no specs winrar.exe ipts.exe ipts.exe ipts.exe no specs ipts.exe no specs ipts.exe no specs ipts.exe no specs ipts.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1268"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3536 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
1840"C:\Users\admin\AppData\Local\Temp\Rar$EXb2604.28252\ipts.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2604.28252\ipts.exe
WinRAR.exe
User:
admin
Company:
Spiritsoft
Integrity Level:
MEDIUM
Description:
Traffic Spirit
Exit code:
0
Version:
2020.11.19.37
1884"C:\Users\admin\AppData\Local\Temp\Rar$EXb2604.28252\ipts.exe" --type=renderer --touch-events=enabled --lang=en-US --runtask --device-scale-factor=1 --num-raster-threads=2 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="3364.0.114281681\1389287337" /prefetch:1C:\Users\admin\AppData\Local\Temp\Rar$EXb2604.28252\ipts.exe—ipts.exe
User:
admin
Company:
Spiritsoft
Integrity Level:
LOW
Description:
Traffic Spirit
Exit code:
0
Version:
2020.11.19.37
2008"C:\Users\admin\AppData\Local\Temp\Rar$EXb2604.28252\ipts.exe" --type=renderer --touch-events=enabled --lang=en-US --runtask --device-scale-factor=1 --num-raster-threads=2 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="3364.3.2112264107\1656896482" /prefetch:1C:\Users\admin\AppData\Local\Temp\Rar$EXb2604.28252\ipts.exe—ipts.exe
User:
admin
Company:
Spiritsoft
Integrity Level:
LOW
Description:
Traffic Spirit
Exit code:
0
Version:
2020.11.19.37
2060"C:\Users\admin\AppData\Local\Temp\Rar$EXb2604.28252\ipts.exe" --type=renderer --touch-events=enabled --lang=en-US --runtask --device-scale-factor=1 --num-raster-threads=2 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="3364.4.217653996\1075047753" /prefetch:1C:\Users\admin\AppData\Local\Temp\Rar$EXb2604.28252\ipts.exe—ipts.exe
User:
admin
Company:
Spiritsoft
Integrity Level:
LOW
Description:
Traffic Spirit
Exit code:
0
Version:
2020.11.19.37
2432"C:\Users\admin\AppData\Local\Temp\Rar$EXb2604.28252\ipts.exe" --type=ppapi --channel="3364.2.888297975\1563264375" --ppapi-flash-args --lang=en-US --device-scale-factor=1 --runtask --ignored=" --type=renderer " /prefetch:3C:\Users\admin\AppData\Local\Temp\Rar$EXb2604.28252\ipts.exe—ipts.exe
User:
admin
Company:
Spiritsoft
Integrity Level:
LOW
Description:
Traffic Spirit
Exit code:
0
Version:
2020.11.19.37
2604"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\ipts_377290.7z"C:\Program Files\WinRAR\WinRAR.exe
iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
3092"C:\Users\admin\AppData\Local\Temp\Rar$EXb2604.28252\ipts.exe" --type=renderer --touch-events=enabled --lang=en-US --runtask --device-scale-factor=1 --num-raster-threads=2 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="3364.1.1789170987\360029012" /prefetch:1C:\Users\admin\AppData\Local\Temp\Rar$EXb2604.28252\ipts.exe—ipts.exe
User:
admin
Company:
Spiritsoft
Integrity Level:
LOW
Description:
Traffic Spirit
Exit code:
0
Version:
2020.11.19.37
3316"C:\Windows\explorer.exe" C:\Windows\explorer.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3364"C:\Users\admin\AppData\Local\Temp\Rar$EXb2604.28252\ipts.exe" --runtask --tpid=1 --ppid=730C:\Users\admin\AppData\Local\Temp\Rar$EXb2604.28252\ipts.exe
ipts.exe
User:
admin
Company:
Spiritsoft
Integrity Level:
MEDIUM
Description:
Traffic Spirit
Exit code:
0
Version:
2020.11.19.37
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
7
Suspicious files
624
Text files
426
Unknown types
57

Dropped files

PID
Process
Filename
Type
3536iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\imagestore\f7ruq93\imagestore.datbinary
MD5:—
SHA256:—
1268iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\ipts_377290[1].7zcompressed
MD5:—
SHA256:—
1268iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\AEL0VF4W.txttext
MD5:—
SHA256:—
1268iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\27QNNJPO.txttext
MD5:—
SHA256:—
1268iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\download[1].htmhtml
MD5:—
SHA256:—
1268iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\file[1].pngimage
MD5:—
SHA256:—
1268iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\core[1].jshtml
MD5:—
SHA256:—
1268iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\1OBOATJ1.txttext
MD5:—
SHA256:—
1268iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\UZGGPDGN.txttext
MD5:—
SHA256:—
1268iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\z_stat[1].jstext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
476
TCP/UDP connections
1 345
DNS requests
441
Threats
257

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
iexplore.exe
GET
—
47.88.10.215:80
http://www.ipts.com/images/xz_down.png
JP
—
—
malicious
3536
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
1268
iexplore.exe
GET
200
47.88.10.215:80
http://www.ipts.com/download.php
JP
html
2.63 Kb
malicious
1268
iexplore.exe
GET
200
58.215.157.250:80
http://c.cnzz.com/core.php?web_id=1255129158&t=z
CN
html
621 b
whitelisted
1268
iexplore.exe
GET
200
47.88.10.215:80
http://www.ipts.com/images/file.png
JP
image
9.87 Kb
malicious
1268
iexplore.exe
GET
200
154.94.7.127:80
http://dl.ipts.com/v5/ipts_377290.7z
US
compressed
26.8 Mb
unknown
3536
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
1268
iexplore.exe
GET
200
58.215.157.250:80
http://s4.cnzz.com/z_stat.php?id=1255129158
CN
text
3.95 Kb
whitelisted
3536
iexplore.exe
GET
200
47.88.10.215:80
http://www.ipts.com/favicon.ico
JP
image
2.49 Kb
malicious
1268
iexplore.exe
GET
200
47.88.10.215:80
http://www.ipts.com/images/xz_normal.png
JP
image
3.32 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
iexplore.exe
58.215.157.250:80
s4.cnzz.com
AS Number for CHINANET jiangsu province backbone
CN
unknown
1268
iexplore.exe
47.88.10.215:80
www.ipts.com
Alibaba (China) Technology Co., Ltd.
JP
suspicious
—
—
47.246.136.160:80
cnzz.mmstat.com
—
US
unknown
1268
iexplore.exe
154.94.7.127:80
dl.ipts.com
MULTACOM CORPORATION
US
unknown
1268
iexplore.exe
203.119.175.170:80
z11.cnzz.com
—
CN
unknown
1268
iexplore.exe
47.246.136.160:80
cnzz.mmstat.com
—
US
unknown
1840
ipts.exe
47.88.10.215:80
www.ipts.com
Alibaba (China) Technology Co., Ltd.
JP
suspicious
3536
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3536
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3536
iexplore.exe
104.111.242.51:443
go.microsoft.com
Akamai International B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
www.ipts.com
  • 47.88.10.215
malicious
s4.cnzz.com
  • 58.215.157.250
  • 218.94.207.228
whitelisted
z11.cnzz.com
  • 203.119.175.170
whitelisted
c.cnzz.com
  • 58.215.157.250
  • 218.94.207.228
whitelisted
cnzz.mmstat.com
  • 47.246.136.160
whitelisted
pcookie.cnzz.com
  • 59.82.14.134
whitelisted
api.bing.com
  • 13.107.5.80
  • 172.67.139.42
  • 104.21.46.133
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
dl.ipts.com
  • 154.94.7.127
unknown
ctldl.windowsupdate.com
  • 8.253.204.121
  • 8.253.95.249
  • 67.27.157.254
  • 67.27.158.126
  • 8.253.95.120
  • 23.32.238.178
  • 23.32.238.201
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .ml Domain
3364
ipts.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.ml domain
3364
ipts.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.ml domain
3364
ipts.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.ml domain
3364
ipts.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.ml domain
3364
ipts.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.ml domain
3364
ipts.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.ml domain
3364
ipts.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.ml domain
3364
ipts.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.ml domain
3364
ipts.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.ml domain
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://www.ipts.com/download.php