Find similar analyses in TI Lookup
Analysis date (UTC): 4 March 2026, 12:21Analysis environment: Windows 10 Pro, build 19044, x64

https://www.axaservices.ma/

MD5:BD8961DC0DC372A078D2FB97906C2296
SHA1:E6696C329B9D255C3C74E860A10F906B77222C28
SHA256:623E816085B940EC28F2B43F82F563574DBE0B36221B2F12793032E2781A2849

Analysis result

Threat level:Malicious activity
Tags:
clickfixphishingetherhiding
Full analysis:Analysis https://www.axaservices.ma/ Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

ClickFix phishing has been detected

  • msedge.exe (PID: 7348)

ETHERHIDING has been detected (SURICATA)

  • msedge.exe (PID: 6828)

SUSPICIOUS

Uses RUNDLL32.EXE to run a file without a DLL extension

  • rundll32.exe (PID: 1036)

Potential Corporate Privacy Violation

  • msedge.exe (PID: 6828)

Uses RUNDLL32.EXE to load library

  • cmd.exe (PID: 7960)

INFO

Drops script file

  • msedge.exe (PID: 7348)
  • msedge.exe (PID: 8312)

Checks supported languages

  • identity_helper.exe (PID: 7240)

Manual execution by a user

  • cmd.exe (PID: 7960)

Reads Environment values

  • identity_helper.exe (PID: 7240)

Reads the computer name

  • identity_helper.exe (PID: 7240)

Application launched itself

  • msedge.exe (PID: 7348)

Threats

PIDProcessClassMessage
6828msedge.exeMisc activityET INFO Observed Smart Chain Domain in DNS Lookup (bsc-testnet .drpc .org)
6828msedge.exeMisc activityET INFO Observed Smart Chain Domain in DNS Lookup (bsc-testnet .drpc .org)
6828msedge.exeMisc activityET INFO Observed Smart Chain Domain in TLS SNI (bsc-testnet .drpc .org)
6828msedge.exeNot Suspicious TrafficINFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
6828msedge.exeNot Suspicious TrafficINFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
6828msedge.exeMisc activityET INFO Observed Smart Chain Domain in DNS Lookup (data-seed-prebsc-1-s1 .bnbchain .org)
6828msedge.exeMisc activityET INFO Observed Smart Chain Domain in TLS SNI (data-seed-prebsc-1-s1 .bnbchain .org)
6828msedge.exeMisc activityET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
6828msedge.exeMisc activityET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
6828msedge.exeMisc activityET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN

© 2017-2026 ANY.RUN LLC. ALL RIGHTS RESERVED