URL:

https://urldefense.com/v3/__https://t.information.microsoft.com/r/?id=ha9cab49,1dd2468f,1dd24693__;!!Om87Lau1Cg!PIJuZzLNtWHY7AH4NhDwjJXSIxG0EUEv3A9CQNcr6mODwruxBFj_X-_VXx_HYFGOuycuoODQCw4dfQ4Z14cAidDScqck2Do$

Full analysis: https://app.any.run/tasks/a42ddf10-944e-4da0-a77d-c3c08568ec2d
Verdict: Malicious activity
Analysis date: October 23, 2023, 13:10:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
phishing
Indicators:
SHA1:

99E9794C057607A0A9F586C44B187B1DA37AF460

SHA256:

5E683F446043D3F2A40492699A79CA7E414408B5AAAA55BA7E5024BD8A81DE84

SSDEEP:

6:2UJtIrhVkKMKLDaHBVcAO6f8NduSDhYDeWvgDpcB:2U04aLDqBVcb6kHDhYDesMcB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • PHISHING was detected

      • iexplore.exe (PID: 3124)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1440)

    • Application launched itself

      • iexplore.exe (PID: 3820)

    • Checks supported languages

      • wmpnscfg.exe (PID: 1440)

    • Reads the computer name

      • wmpnscfg.exe (PID: 1440)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 1440)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe #PHISHING iexplore.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1440"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\user32.dll
3124"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3820 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3820"C:\Program Files\Internet Explorer\iexplore.exe" "https://urldefense.com/v3/__https://t.information.microsoft.com/r/?id=ha9cab49,1dd2468f,1dd24693__;!!Om87Lau1Cg!PIJuZzLNtWHY7AH4NhDwjJXSIxG0EUEv3A9CQNcr6mODwruxBFj_X-_VXx_HYFGOuycuoODQCw4dfQ4Z14cAidDScqck2Dof7f81a39-5f63-5b42-9efd-1f13b5431005quot;C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
20 527
Read events
20 452
Write events
72
Delete events
3

Modification events

(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
0
Suspicious files
40
Text files
176
Unknown types
0

Dropped files

PID
Process
Filename
Type
3124iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
3124iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:023BBEC4CFA2CB290C518EE85F8455C8
SHA256:9C551E51253E5BCA53717908DFADD4FBE3FE72994839934131971E6412D4A77A
3124iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\72BA427A91F50409B9EAC87F2B59B951_B60F9D16E3C6B9D1675C5B66DD367947binary
MD5:457C8D67B21F0F5C34A0B4C89D1BE6BC
SHA256:95149C7C730EEB0C792A45D5D1E21CF9676FF3FED13877B24FB24192F4802B87
3124iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868binary
MD5:8FFA704D93BD4438462F793951DD24CC
SHA256:C8A56FCDD31C70FB3436BCAF06E84C877001AEC124D09D8ED77C072C474A5395
3124iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833Bbinary
MD5:0E19E475496CFF760609B86A61453ADC
SHA256:3E4AA889298543AF4F3864D64BB652A4A7061D1C77B4CC1C586CD9B98AE1ECFF
3124iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:7F95B1A23A518844C8618C4C41ACC610
SHA256:02809BA8BA25718D08FF748725A4C628200521C709BD5F8C244EB0EAA6F1712A
3124iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\72BA427A91F50409B9EAC87F2B59B951_B60F9D16E3C6B9D1675C5B66DD367947binary
MD5:46574B6C82B560807492D7CA159A54FB
SHA256:84E0C40F5CC4AAD7ADBCAB32A7A18B116C7717C9EE3F66A0820A8754DF07AD13
3124iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\12D25EEC119B36D4F609776800B40F1F_02F47AFC75C8FDA4640A34F2ED71C796binary
MD5:892A0BF177418B6292511EFB0CE89C6D
SHA256:CBDD8A73F95F993623295B197C65393CCFB1F38508D415E2C6EE94DA4398D72A
3124iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868binary
MD5:38973C32ADE268658B40DF59E8D2AD54
SHA256:A33E2D655298881688D99F104558A2A045463D9F591FFE94B6FEE60549DD67B6
3124iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\PUK58ZSW.txttext
MD5:FB8B33C51C3D76821E36609AEF728ED5
SHA256:5CD47A88D8B79D3319A4F22FBC478AEC1491BC6BD53A34CE89730F069E29F5FB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
75
DNS requests
48
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3124
iexplore.exe
GET
200
104.18.15.101:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
binary
1.42 Kb
unknown
3124
iexplore.exe
GET
200
104.18.14.101:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEQDVGelRES3OWAe4fXaxaBVe
unknown
binary
472 b
unknown
3124
iexplore.exe
GET
200
104.18.15.101:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEBN9U5yqfDGppDNwGWiEeo0%3D
unknown
binary
2.18 Kb
unknown
3124
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
3124
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D
unknown
binary
471 b
unknown
3124
iexplore.exe
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBTGiIgTPSKVrjq%2B8RiHf4oAukNOPgQUDyBd16FXlduSzyvQx8J3BM5ygHYCEzMAsMEpbomD9EhmXqAAAACwwSk%3D
unknown
binary
1.74 Kb
unknown
3124
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
unknown
binary
471 b
unknown
3124
iexplore.exe
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRS%2FsoQjbTlq1Jokw0nyC%2FyFeJLtQQUAKuR%2FCFiJpeaqHkbYUGQYKliZ%2F0CEzMAq3jSnC6NJvnfgWkAAACreNI%3D
unknown
binary
1.74 Kb
unknown
3124
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
binary
471 b
unknown
3124
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c189f0c0dd257189
unknown
compressed
4.66 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3124
iexplore.exe
52.204.90.22:443
—
AMAZON-AES
US
unknown
3124
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
3124
iexplore.exe
104.18.15.101:80
ocsp.comodoca.com
CLOUDFLARENET
—
unknown
3124
iexplore.exe
104.18.14.101:80
ocsp.comodoca.com
CLOUDFLARENET
—
unknown
3124
iexplore.exe
52.177.62.210:443
t.information.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3124
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3124
iexplore.exe
204.79.197.203:80
oneocsp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
ocsp.comodoca.com
  • 104.18.15.101
  • 104.18.14.101
whitelisted
ocsp.usertrust.com
  • 104.18.15.101
  • 104.18.14.101
whitelisted
ocsp.sectigo.com
  • 104.18.14.101
  • 104.18.15.101
whitelisted
t.information.microsoft.com
  • 52.177.62.210
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
support.microsoft.com
  • 184.30.20.112
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted

Threats

PID
Process
Class
Message
3124
iexplore.exe
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Phishing domain observed in TLS SNI ( .azurefd .net)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://urldefense.com/v3/__https://t.information.microsoft.com/r/?id=ha9cab49,1dd2468f,1dd24693__;!!Om87Lau1Cg!PIJuZzLNtWHY7AH4NhDwjJXSIxG0EUEv3A9CQNcr6mODwruxBFj_X-_VXx_HYFGOuycuoODQCw4dfQ4Z14cAidDScqck2Do$