URL:

https://www.taqaglobal.com/whistleblower-hotline

Full analysis: https://app.any.run/tasks/c9c15763-71fe-46df-85cb-ef7e5f464061
Verdict: Malicious activity
Analysis date: December 18, 2018, 21:06:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

E932A54396FF510C2CC4216C30ED6A59

SHA1:

8A700E4C205DD4E6246E4CED1879549B6B3DECCF

SHA256:

6254FB243A4070718DBAB4B50D7641C200D652186B3423FF1DFC3A1407387900

SSDEEP:

3:N8DSL0CEHkIJNXZl9:2OL0CEHBJN/9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3760)

    • Changes internet zones settings

      • iexplore.exe (PID: 3492)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3760)

    • Creates files in the user directory

      • iexplore.exe (PID: 3760)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3320)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3492)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3492)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3492)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3320C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Exit code:
0
Version:
26,0,0,131
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_26_0_0_131_activex.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3492"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3760"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3492 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
490
Read events
409
Write events
76
Delete events
5

Modification events

(PID) Process:(3492) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3492) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3492) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3492) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(3492) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3492) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3492) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{C9CE2DAB-0308-11E9-834A-5254004A04AF}
Value:
0
(PID) Process:(3492) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(3492) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
3
(PID) Process:(3492) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E2070C0002001200150006001E00DD02
Executable files
0
Suspicious files
5
Text files
99
Unknown types
10

Dropped files

PID
Process
Filename
Type
3492iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
3492iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3760iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\whistleblower-hotline[1].htmhtml
MD5:—
SHA256:—
3760iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\system.messages[1].csstext
MD5:ECBAED7E190BD0F2270D971CAAF3C5E7
SHA256:D0BBAD771A8A5AC5F9446791109693AECA1D676D44CED48F8514857F7D3E6FD0
3760iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\system.base[1].csstext
MD5:110CAA93C3FFF11BFABFE651D0135248
SHA256:BF6028E15A460586C16ADB0210D268374501F60ECF36F11E554E2FFD089C636B
3760iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\aggregator[1].csstext
MD5:D766B63A3E998DA7228C1B714532424A
SHA256:9BA34F7CB62402E542051EEB9F7C83F068E1944156E78458480285E11CDF8B31
3760iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\field[1].csstext
MD5:3FD6BF194FE0784421357BD19F77C161
SHA256:E3AD317A103B4271C6D00CB97957C0D8E0F5BFD6CDC74976D022DD526963ECDF
3760iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\date[1].csstext
MD5:A38A9E7D6490B8140D71E1E9950A1A4F
SHA256:1DBC835B3F505CBCDDF95FC329BA74416A6247867C722A8C083D47641A64A0F4
3760iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\comment[1].csstext
MD5:963A483E773DE7DFD310013EF2E2817F
SHA256:DD1C7822082E5D2CDA6242DF595462DFFC97BFB4EC52B3DD9AF2A9ABB27BCA82
3760iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\system.theme[1].csstext
MD5:1BC1DE873E1CA018D2C42DA789344283
SHA256:FF7750952A601DBF03688B01A2ECED6E5671A8335393EB063201BB732F12C99A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
93
DNS requests
10
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3760
iexplore.exe
GET
200
52.84.214.94:80
http://x.ss2.us/x.cer
US
der
1.27 Kb
whitelisted
3492
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
3760
iexplore.exe
GET
200
2.18.213.91:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
unknown
compressed
55.2 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3492
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3760
iexplore.exe
150.129.116.196:443
www.taqaglobal.com
Pioneer Elabs Ltd.
IN
unknown
3760
iexplore.exe
104.111.219.46:443
ws.sharethis.com
Akamai International B.V.
NL
whitelisted
3760
iexplore.exe
172.217.168.40:443
ssl.google-analytics.com
Google Inc.
US
whitelisted
3760
iexplore.exe
2.18.213.91:80
www.download.windowsupdate.com
Akamai International B.V.
—
whitelisted
3760
iexplore.exe
52.84.214.94:80
x.ss2.us
—
US
unknown
3760
iexplore.exe
37.139.12.133:443
cookie-script.com
Digital Ocean, Inc.
NL
unknown
3760
iexplore.exe
2.16.186.146:443
c.sharethis.mgr.consensu.org
Akamai International B.V.
—
whitelisted
3760
iexplore.exe
216.58.215.234:443
ajax.googleapis.com
Google Inc.
US
whitelisted
3492
iexplore.exe
150.129.116.196:443
www.taqaglobal.com
Pioneer Elabs Ltd.
IN
unknown

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.taqaglobal.com
  • 150.129.116.196
unknown
ws.sharethis.com
  • 104.111.219.46
shared
www.images-home.com
  • 13.237.170.44
  • 13.239.150.82
  • 54.79.69.98
suspicious
ssl.google-analytics.com
  • 172.217.168.40
whitelisted
x.ss2.us
  • 52.84.214.94
  • 52.84.214.59
  • 52.84.214.26
  • 52.84.214.170
whitelisted
www.download.windowsupdate.com
  • 2.18.213.91
  • 2.18.215.73
  • 2.18.215.74
  • 2.18.215.65
  • 2.18.213.123
  • 2.18.215.50
  • 2.18.215.90
whitelisted
cookie-script.com
  • 37.139.12.133
  • 37.139.11.147
  • 185.14.187.88
whitelisted
c.sharethis.mgr.consensu.org
  • 2.16.186.146
  • 2.16.186.243
whitelisted
ajax.googleapis.com
  • 216.58.215.234
  • 172.217.168.10
  • 172.217.168.42
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.taqaglobal.com/whistleblower-hotline