analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| URL: | http://webcompanion.com |
| Full analysis: | https://app.any.run/tasks/e7a8d44c-b808-4650-854b-73ebeffcaf56 |
| Verdict: | Malicious activity |
| Analysis date: | July 16, 2019, 23:12:37 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | 0333902C52454FD719C03DB51936F593 |
| SHA1: | C71FB9489A201CA26A6FBB3800D6D9AA2A1B916C |
| SHA256: | 5D6824ED85EC511398EED3EF75EAF911BBE9347BE5029A01822346E881CE824C |
| SSDEEP: | 3:N1KJAmgDKn:COmg+n |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executed via COM
- FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2736)
INFO
Creates files in the user directory
- iexplore.exe (PID: 3592)
- iexplore.exe (PID: 3696)
- FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2736)
Reads internet explorer settings
- iexplore.exe (PID: 3592)
Application launched itself
- iexplore.exe (PID: 3696)
Reads Internet Cache Settings
- iexplore.exe (PID: 3592)
Changes internet zones settings
- iexplore.exe (PID: 3696)
Reads settings of System Certificates
- iexplore.exe (PID: 3592)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
35
Monitored processes
3
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 3696 | "C:\Program Files\Internet Explorer\iexplore.exe" "http://webcompanion.com" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 3592 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3696 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 2736 | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe | — | svchost.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Version: 26,0,0,131 | ||||
Total events
453
Read events
389
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
31
Unknown types
8
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3696 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 3696 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 3592 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\THOJPES7\adaware_web_companion_logo[1].svg | — | |
MD5:— | SHA256:— | |||
| 3592 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@webcompanion[1].txt | text | |
MD5:4F642196E2D113A06B99013B2CE21DC9 | SHA256:8A024B56FEB1989B82560868F05F6204C477F79978768333D8ED43A891D0A98D | |||
| 3592 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\RIMVM10U\css[1].txt | text | |
MD5:5F51F4B8620AA0FC9F966D3BE245C17C | SHA256:594789BE3ECE8B17FDC33E52C59829C9E6C3709BFD29F60A7D8D8581F684C048 | |||
| 3592 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\RIMVM10U\icone_ad_block[1].svg | image | |
MD5:7DB3D2E30CB01B7B81E1310E700CB411 | SHA256:170C75A54F41502CAFCA6D9F39ABB85CFCDD60BCF85094405C8CCF69ACB7AA11 | |||
| 3592 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat | dat | |
MD5:006B493BFAD8F7530A10EA96E63048CD | SHA256:22F61781B7F8D5DB9C640801F7FF9946E51830786FB563E97CF4C2D471F58EF4 | |||
| 3592 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\RIMVM10U\icomoon[1].eot | eot | |
MD5:0AAD5489C128504BCDFD38C5055EB18A | SHA256:4BF8F4753B1A17D2BD071B692845C758F564AB896CFC135E4636429ADF628EEE | |||
| 3592 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\8BW8CI0Y\webcompanion_com[1].htm | html | |
MD5:AAE4144615A27B560F7BF259028AF282 | SHA256:034A22387B53EF04C477749B614353682EF6B77D8A939FC50A2C8EA2394A454A | |||
| 3592 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\THOJPES7\icon_social_share[1].svg | image | |
MD5:EB36CE9BDC007341BDA2D021F9BB51FE | SHA256:03F9F118376F3C9E92FFACF38ADE952D20ADD8FA741EBE73B9E942536424F6A8 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
18
DNS requests
10
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3592 | iexplore.exe | GET | 200 | 104.17.177.102:80 | http://webcompanion.com/images/header-bg.png | US | image | 32.5 Kb | malicious |
3592 | iexplore.exe | GET | 200 | 104.17.177.102:80 | http://webcompanion.com/css/custom.css | US | text | 4.39 Kb | malicious |
3592 | iexplore.exe | GET | 200 | 104.17.177.102:80 | http://webcompanion.com/fonts/icomoon.eot?4wnbrd | US | eot | 1.86 Kb | malicious |
3592 | iexplore.exe | GET | 200 | 104.17.177.102:80 | http://webcompanion.com/images/heart_icon.svg | US | image | 386 b | malicious |
3592 | iexplore.exe | GET | 200 | 104.17.177.102:80 | http://webcompanion.com/images/icon_url_blocker.svg | US | image | 621 b | malicious |
3592 | iexplore.exe | GET | 200 | 104.17.177.102:80 | http://webcompanion.com/images/icon_social_share.svg | US | image | 355 b | malicious |
3592 | iexplore.exe | GET | 200 | 104.20.183.9:80 | http://cdn.inspectlet.com/inspectlet.js?wid=897777169&r=434255 | US | text | 68.6 Kb | whitelisted |
3592 | iexplore.exe | GET | 200 | 104.17.177.102:80 | http://webcompanion.com/ | US | html | 7.49 Kb | malicious |
3592 | iexplore.exe | GET | 200 | 104.17.177.102:80 | http://webcompanion.com/images/eb_icon.svg | US | image | 568 b | malicious |
3592 | iexplore.exe | GET | 200 | 104.17.177.102:80 | http://webcompanion.com/images/icone_private_search.svg | US | image | 446 b | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3696 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3592 | iexplore.exe | 104.17.177.102:80 | webcompanion.com | Cloudflare Inc | US | shared |
3592 | iexplore.exe | 172.217.23.138:443 | ajax.googleapis.com | Google Inc. | US | whitelisted |
3592 | iexplore.exe | 172.217.16.138:443 | ajax.googleapis.com | Google Inc. | US | whitelisted |
3592 | iexplore.exe | 216.58.207.35:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
3696 | iexplore.exe | 104.17.177.102:80 | webcompanion.com | Cloudflare Inc | US | shared |
3592 | iexplore.exe | 192.0.77.2:443 | i2.wp.com | Automattic, Inc | US | suspicious |
3592 | iexplore.exe | 104.20.183.9:80 | cdn.inspectlet.com | Cloudflare Inc | US | shared |
3592 | iexplore.exe | 216.58.207.78:443 | www.google-analytics.com | Google Inc. | US | whitelisted |
3592 | iexplore.exe | 216.58.206.8:443 | www.googletagmanager.com | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
webcompanion.com |
| malicious |
www.bing.com |
| whitelisted |
ajax.googleapis.com |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
www.googletagmanager.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
i2.wp.com |
| whitelisted |
i1.wp.com |
| whitelisted |
www.google-analytics.com |
| whitelisted |
cdn.inspectlet.com |
| whitelisted |