analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| URL: | http://luxrarealty.com/Dropbox.http |
| Full analysis: | https://app.any.run/tasks/ae7c9100-4a1c-4b86-9c1e-884f742d55cc |
| Verdict: | Malicious activity |
| Analysis date: | September 19, 2019, 10:15:16 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 49DCDB94D07C76BCB6BA5801AF1ECEC3 |
| SHA1: | 5B0F3F47ABAA7BE2D6F1542AE732B9ADB7C73A6C |
| SHA256: | 622AAC97E4707CBCCAA6D3B971641CE4A7E1D1C86249A27F1BFEFC4ABA54278B |
| SSDEEP: | 3:N1KSQ2yd3EHKJn:CSZges |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
Application launched itself
- iexplore.exe (PID: 2880)
Reads Internet Cache Settings
- iexplore.exe (PID: 3384)
Reads settings of System Certificates
- iexplore.exe (PID: 2880)
Reads internet explorer settings
- iexplore.exe (PID: 3384)
Changes internet zones settings
- iexplore.exe (PID: 2880)
Adds / modifies Windows certificates
- iexplore.exe (PID: 2880)
Changes settings of System certificates
- iexplore.exe (PID: 2880)
Creates files in the user directory
- iexplore.exe (PID: 2880)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
35
Monitored processes
2
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2880 | "C:\Program Files\Internet Explorer\iexplore.exe" "http://luxrarealty.com/Dropbox.http" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 3384 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2880 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
Total events
440
Read events
365
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
32
Unknown types
7
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2880 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 2880 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 3384 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3JNIZFUO\login[1].php | — | |
MD5:— | SHA256:— | |||
| 3384 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat | dat | |
MD5:A8CE5A30AFD1552D3683871BF243D89C | SHA256:47F5E804B18E2B2937407F99555294EE31F23FDE40E943C65AE0142125D3468D | |||
| 3384 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:D46BC2AB3E214555C4F85FC2F31AC278 | SHA256:AA0F0020756BB1B5655B9E696437F5AB76D7EC4A81281B86F5D1917F0718B39E | |||
| 3384 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OMS6R2X3\animation-vflzHcTyC[1].css | text | |
MD5:CC7713C829F9CE536C471FD215C11040 | SHA256:79F96700543DBD7A21C830FA974FAE3AD275A4994BD850C2CAC7DFF05A5CAC29 | |||
| 3384 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3JNIZFUO\modal-vflS6pGZb[1].css | text | |
MD5:C1AA8BDB57713ED8AA3C10C143074374 | SHA256:2C7A993C52DA910CB419F0C10A12A4A35EEF31203137E965F9EC85E5AEFF205A | |||
| 3384 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UQ9BB1J5\index-vfl0GyzuL[1].css | text | |
MD5:D06CB3B8B7FEA292574FD692DE8D7D7D | SHA256:D0923ABAEF6BCA75B89A58DE0057D11A9A00B5B2312D2FF5FC65C79AAE28C2E4 | |||
| 3384 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3JNIZFUO\css[1].css | text | |
MD5:8A1AEC66452BABAA5F6BBC72D0AAF662 | SHA256:B11C92C67F0E619DA65A796C0126C885653BA87955526E77C59D8E727E0B3C00 | |||
| 3384 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3JNIZFUO\login[1].htm | html | |
MD5:3A6D67D86D0E4107511FB1DD4BA6B3AD | SHA256:BCE7AA05565D6DD15579DA491DEA5F094F755F81322CD498B26ECB456277C63B | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
14
DNS requests
7
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3384 | iexplore.exe | GET | 200 | 107.180.41.13:80 | http://luxrarealty.com/Dropbox.http/asset/media_text-vfl6jBpfO.css | US | text | 923 b | malicious |
3384 | iexplore.exe | GET | 301 | 107.180.41.13:80 | http://luxrarealty.com/Dropbox.http | US | html | 244 b | malicious |
3384 | iexplore.exe | GET | 200 | 107.180.41.13:80 | http://luxrarealty.com/Dropbox.http/asset/animation-vflzHcTyC.css | US | text | 258 b | malicious |
3384 | iexplore.exe | GET | 200 | 107.180.41.13:80 | http://luxrarealty.com/Dropbox.http/asset/responsive_classes-vflX9R-EH.css | US | text | 160 b | malicious |
3384 | iexplore.exe | GET | 200 | 107.180.41.13:80 | http://luxrarealty.com/Dropbox.http/asset/index-vfl0GyzuL.css | US | text | 3.17 Kb | malicious |
3384 | iexplore.exe | GET | 302 | 107.180.41.13:80 | http://luxrarealty.com/Dropbox.http/ | US | html | 244 b | malicious |
3384 | iexplore.exe | GET | 200 | 107.180.41.13:80 | http://luxrarealty.com/Dropbox.http/asset/web_sprites.css | US | text | 7.81 Kb | malicious |
3384 | iexplore.exe | GET | 200 | 107.180.41.13:80 | http://luxrarealty.com/Dropbox.http/asset/dropbox_logo_text_2015-vfld7_dJ8.svg | US | image | 1.39 Kb | malicious |
3384 | iexplore.exe | GET | 200 | 107.180.41.13:80 | http://luxrarealty.com/Dropbox.http/li33ve/ | US | html | 2.77 Kb | malicious |
3384 | iexplore.exe | GET | 200 | 107.180.41.13:80 | http://luxrarealty.com/Dropbox.http/img/Microsoft%20Account.png | US | image | 338 b | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3384 | iexplore.exe | 172.217.18.10:443 | ajax.googleapis.com | Google Inc. | US | whitelisted |
2880 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3384 | iexplore.exe | 172.217.21.234:443 | ajax.googleapis.com | Google Inc. | US | whitelisted |
3384 | iexplore.exe | 107.180.41.13:80 | luxrarealty.com | GoDaddy.com, LLC | US | malicious |
2880 | iexplore.exe | 104.16.99.29:443 | cfl.dropboxstatic.com | Cloudflare Inc | US | shared |
3384 | iexplore.exe | 172.217.22.99:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
2880 | iexplore.exe | 184.31.91.81:443 | auth.gfx.ms | Akamai International B.V. | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
luxrarealty.com |
| malicious |
www.bing.com |
| whitelisted |
ajax.googleapis.com |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
cfl.dropboxstatic.com |
| shared |
auth.gfx.ms |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3384 | iexplore.exe | A Network Trojan was detected | MALWARE [PTsecurity] Google Drive Phishing Landing |
3384 | iexplore.exe | A Network Trojan was detected | ET CURRENT_EVENTS Dropbox Phishing Landing 2018-01-18 |
3384 | iexplore.exe | A Network Trojan was detected | ET CURRENT_EVENTS Dropbox Phishing Landing May 31 2017 |
3384 | iexplore.exe | Potentially Bad Traffic | ET CURRENT_EVENTS Microsoft Account Phishing Landing 2018-08-07 |