analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://brandequity.economictimes.indiatimes.com/etl.php?url=https://benedettisaic.com.ar/tpue/settings/jonathan.lee/[email protected]

Full analysis: https://app.any.run/tasks/419784bf-ed7d-4b2a-af26-780dd67a3695
Verdict: Malicious activity
Analysis date: April 01, 2023, 09:32:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

7676E24F8EA7EBCA9926FC07971CAB41

SHA1:

EDA2FF8FA6BDBF42DE11A68852B1FC79CB8C0033

SHA256:

63A3BB9A8B9E46A49BA1248A41CD2C0461C57C85039B227482D77035A9967332

SSDEEP:

3:N8aoMFd8h/MUdwvLnwQ6VYw3sLGeK6vxwVYWLLS/WLL8ndI:2bMIh/MfzwhOw8LGeK6vxmYWLLgWLLyI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the Internet Settings

      • OUTLOOK.EXE (PID: 3392)

    • Searches for installed software

      • OUTLOOK.EXE (PID: 3392)

  • INFO

    • Checks supported languages

      • OUTLOOK.EXE (PID: 3392)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 3392)

    • Application launched itself

      • iexplore.exe (PID: 2696)

    • Create files in a temporary directory

      • iexplore.exe (PID: 2696)
      • iexplore.exe (PID: 3204)
      • OUTLOOK.EXE (PID: 3392)

    • Reads the machine GUID from the registry

      • OUTLOOK.EXE (PID: 3392)

    • Creates files or folders in the user directory

      • OUTLOOK.EXE (PID: 3392)

    • Reads the computer name

      • OUTLOOK.EXE (PID: 3392)

    • The process checks LSA protection

      • OUTLOOK.EXE (PID: 3392)

    • Process checks computer location settings

      • OUTLOOK.EXE (PID: 3392)

    • Checks proxy server information

      • OUTLOOK.EXE (PID: 3392)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe outlook.exe no specs outlook.exe

Process information

PID
CMD
Path
Indicators
Parent process
2696"C:\Program Files\Internet Explorer\iexplore.exe" "https://brandequity.economictimes.indiatimes.com/etl.php?url=https://benedettisaic.com.ar/tpue/settings/jonathan.lee/[email protected]"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
3204"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2696 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
3236"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" -c IPM.Note /m "mailto:[email protected]"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\outlook.exe
3392"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" -c IPM.Note /m "mailto:[email protected]"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
Total events
46 530
Read events
45 532
Write events
952
Delete events
46

Modification events

(PID) Process:(2696) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2696) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2696) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2696) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2696) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2696) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2696) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2696) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2696) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2696) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
32
Text files
46
Unknown types
26

Dropped files

PID
Process
Filename
Type
3204iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:81F271FC935F3F881C61F39413B128D2
SHA256:0B9B162748173A3447DF6A6E1018282EA2629376C14EE924F116F2C1E5EB5CD2
2696iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442der
MD5:7DB845ACB718291C22814AC5C3E936E9
SHA256:A834C4A03A2F23E8732585E76B073DF89E0A6CD077BB2C08AECD48C9F57BCC2B
3204iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\DM2TQ6S1.txttext
MD5:422A90DF5D0BFA2947500FB15DC7D5EB
SHA256:D7793E5D6557527847307AD888F5732D8A0A81B2105C011CF1A7FEF7321A2A7C
3204iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\V2XWWY7R.txttext
MD5:80F6358123027A027843B2B737D8EFCA
SHA256:972E0B74105D5A455685234032EB0A50B6119966D8AF78860F0FEC5C8CB0BFA1
3204iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:15F3F81A05FBE73992E171ADC948504E
SHA256:BA5071BE3A072CF5F8E1A4EF98EE553E9BB6AE2AD5A7FB3147E84EB71F3094BF
3204iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\X56VW4YP.txttext
MD5:85ED8567DC738A3D4F66BED1E6345F3C
SHA256:E914AB81B0F1E4F1EB4BA7C5FA55A336796F37AE9273103AD047119D54BEBF29
3204iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04der
MD5:21ED9CA0F4579A63723066FAB3CDB1E9
SHA256:818A6653F6011A83D251998208826644FE68D228A739C87EC14E470E10817889
2696iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442binary
MD5:DC04164860A38615A607AFF3FA66DC92
SHA256:2A4FE39C30300F1295BE30B37CA327D278BFD708B7AC5A4B91EFA2C15CEAA542
3204iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\V1J1J09P.txttext
MD5:CB7F7D3EA2FD46880B92ECDEA2D4B38B
SHA256:381628629389B2DF51BE8372578C7AC727A39E9BB29AF8B2BD397809B3E8C2B8
3204iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\A3D5Q0SE.txttext
MD5:85414D519EC6CBA0685DF00CD4FE0120
SHA256:E55C7C328EA5C40213367759D32A5BFDED2874AEB7DD0C01CFD8787446DD19C9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
21
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3204
iexplore.exe
GET
200
95.101.54.107:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgNLALrHsXG6zwZTFwfYE7KENw%3D%3D
DE
der
503 b
shared
2696
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
3204
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
3204
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
3204
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?d729af5ece66d986
US
compressed
61.1 Kb
whitelisted
3204
iexplore.exe
GET
200
23.37.41.57:80
http://x1.c.lencr.org/
NL
der
717 b
whitelisted
3204
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?76ce3b6368335e5d
US
compressed
4.70 Kb
whitelisted
3392
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
3204
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?b983db5669f14d8e
US
compressed
61.1 Kb
whitelisted
3204
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?94000ae1bd6474a5
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3204
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2696
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
3204
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
2696
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3204
iexplore.exe
95.101.54.107:80
r3.o.lencr.org
Akamai International B.V.
DE
suspicious
2696
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3204
iexplore.exe
104.109.57.57:443
brandequity.economictimes.indiatimes.com
AKAMAI-AS
DE
whitelisted
3392
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3204
iexplore.exe
23.37.41.57:80
x1.c.lencr.org
AKAMAI-AS
DE
suspicious
3204
iexplore.exe
190.183.195.2:443
benedettisaic.com.ar
Gigared S.A.
AR
suspicious

DNS requests

Domain
IP
Reputation
brandequity.economictimes.indiatimes.com
  • 104.109.57.57
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
benedettisaic.com.ar
  • 190.183.195.2
unknown
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
x1.c.lencr.org
  • 23.37.41.57
whitelisted
r3.o.lencr.org
  • 95.101.54.107
  • 95.101.54.131
shared
use.fontawesome.com
  • 172.64.132.15
  • 172.64.133.15
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://brandequity.economictimes.indiatimes.com/etl.php?url=https://benedettisaic.com.ar/tpue/settings/jonathan.lee/[email protected]