analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| URL: | https://surl.me/6f4yf |
| Full analysis: | https://app.any.run/tasks/0fb7ed8f-4885-4dfa-81fb-a1168fea181d |
| Verdict: | Malicious activity |
| Analysis date: | November 29, 2020, 11:08:54 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | EE02AD889FF5EFEACB67B77B7388CF97 |
| SHA1: | F7D3D26791BA0518E350179079F40A9F962E6CEF |
| SHA256: | 6550FEB2A1FF523282F897D63740BC09FEEF6C60EE2B1EBDC89BD485960AFDC1 |
| SSDEEP: | 3:N8dZR+on:2N+o |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
Reads settings of System Certificates
- iexplore.exe (PID: 2344)
- iexplore.exe (PID: 2388)
Changes settings of System certificates
- iexplore.exe (PID: 2388)
Changes internet zones settings
- iexplore.exe (PID: 2388)
Creates files in the user directory
- iexplore.exe (PID: 2388)
Application launched itself
- iexplore.exe (PID: 2388)
Reads internet explorer settings
- iexplore.exe (PID: 2344)
Adds / modifies Windows certificates
- iexplore.exe (PID: 2388)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
35
Monitored processes
2
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2388 | "C:\Program Files\Internet Explorer\iexplore.exe" "https://surl.me/6f4yf" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
| 2344 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2388 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
Total events
1 027
Read events
935
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
21
Text files
57
Unknown types
10
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2344 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Cab1B4.tmp | — | |
MD5:— | SHA256:— | |||
| 2344 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Tar1B5.tmp | — | |
MD5:— | SHA256:— | |||
| 2388 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 2344 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\logo[1].gif | image | |
MD5:5D7EB8E356E1AF01826BA2961BF16FBD | SHA256:6D736979191338F1FA66E6002B45888B65BF8068DBF16A18B1575CF3F5B0155B | |||
| 2344 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT | smt | |
MD5:55A6046AE61E1DA667A883C2108886C1 | SHA256:B496F769FE7DE19A61782EE4BFD0886F7CE678BAF0E2C93E6590EC25157FA554 | |||
| 2344 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08 | der | |
MD5:D9A7C71F2455317845563B02C39B84C8 | SHA256:C5B24A2E28E55081E315826ED0127557077434F24D5C3EFF803C45AA4EF1B827 | |||
| 2344 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08 | binary | |
MD5:CE8FD7962FD33CC1B87AFC315FFEE18F | SHA256:51FEF0BC11AF69FBD9FA62D9D5B4EBC60A2222B0CEC912BDA6FDFFD753E5800A | |||
| 2344 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\9KKWQS3Q.htm | html | |
MD5:AA9E45330975EE6CDBBBFAD1A001AEEC | SHA256:4DF96FE1942523BB62269882EB69576D18DF9D61B613174A2E073443D1FDFB15 | |||
| 2344 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\l_EN[1].png | image | |
MD5:4197A0E7DB0FEBFA2B89B355F778C1C2 | SHA256:0A480866B96565F21D6BBFB28015A3EE13D0391918D3C4D0DC9CD43791C7DFDB | |||
| 2344 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8282537A1700AEC149BE2706B94BE70A | binary | |
MD5:F92D6D6BEE222E9A83BEDF2A19DA3C54 | SHA256:FEB6E4115B88F408C0F18AF8647C3CF5969A533452CD74ABCD72FC53A777ADA6 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
69
TCP/UDP connections
76
DNS requests
18
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2344 | iexplore.exe | GET | 200 | 23.55.163.71:80 | http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D | US | der | 1.37 Kb | whitelisted |
2344 | iexplore.exe | GET | 200 | 23.55.163.48:80 | http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgPpHm4MqpiaH%2F7cWFAwYxoKTQ%3D%3D | US | der | 527 b | whitelisted |
2344 | iexplore.exe | GET | 200 | 43.243.110.180:80 | http://momomeifu.com/sidebar/sendtofriend.php?rule=1uuem0bb5nnp96v&quickly=stick&hand=am | HK | html | 105 b | unknown |
2388 | iexplore.exe | GET | 302 | 43.243.110.180:80 | http://momomeifu.com/favicon.ico | HK | html | 206 b | unknown |
2344 | iexplore.exe | GET | 200 | 85.254.72.9:80 | http://hotbestshop.su/images/chcm/logo.gif | LV | image | 4.08 Kb | suspicious |
2344 | iexplore.exe | GET | 200 | 23.55.163.71:80 | http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D | US | der | 1.37 Kb | whitelisted |
2344 | iexplore.exe | GET | 200 | 85.254.72.9:80 | http://hotbestshop.su/ | LV | html | 9.41 Kb | suspicious |
2388 | iexplore.exe | GET | 403 | 85.254.72.9:80 | http://hotbestshop.su/ | LV | html | 168 b | suspicious |
2344 | iexplore.exe | GET | 200 | 85.254.72.9:80 | http://hotbestshop.su/images/chcm/l_EN.png | LV | image | 668 b | suspicious |
2344 | iexplore.exe | GET | 200 | 85.254.72.9:80 | http://hotbestshop.su/images/chcm/l_DE.png | LV | image | 407 b | suspicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2344 | iexplore.exe | 23.55.163.48:80 | ocsp.int-x3.letsencrypt.org | Akamai International B.V. | US | unknown |
2344 | iexplore.exe | 23.55.163.68:80 | ocsp.int-x3.letsencrypt.org | Akamai International B.V. | US | suspicious |
2344 | iexplore.exe | 23.55.163.71:80 | isrg.trustid.ocsp.identrust.com | Akamai International B.V. | US | suspicious |
2344 | iexplore.exe | 144.217.15.46:443 | surl.me | OVH SAS | CA | suspicious |
2388 | iexplore.exe | 13.107.21.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2388 | iexplore.exe | 43.243.110.180:80 | momomeifu.com | Sun Network (Hong Kong) Limited - HongKong Backbone | HK | unknown |
2344 | iexplore.exe | 43.243.110.180:80 | momomeifu.com | Sun Network (Hong Kong) Limited - HongKong Backbone | HK | unknown |
2388 | iexplore.exe | 85.254.72.9:80 | hotbestshop.su | LATNET SERVISS Ltd. | LV | suspicious |
— | — | 85.254.72.9:80 | hotbestshop.su | LATNET SERVISS Ltd. | LV | suspicious |
2388 | iexplore.exe | 204.79.197.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
surl.me |
| suspicious |
isrg.trustid.ocsp.identrust.com |
| whitelisted |
ocsp.int-x3.letsencrypt.org |
| whitelisted |
momomeifu.com |
| unknown |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
hotbestshop.su |
| suspicious |
iecvlist.microsoft.com |
| whitelisted |
r20swj13mr.microsoft.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Potentially Bad Traffic | ET DNS Query for .su TLD (Soviet Union) Often Malware Related |
2388 | iexplore.exe | Potentially Bad Traffic | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |
2344 | iexplore.exe | Potentially Bad Traffic | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |
2344 | iexplore.exe | Potentially Bad Traffic | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |
2344 | iexplore.exe | Potentially Bad Traffic | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |
2344 | iexplore.exe | Potentially Bad Traffic | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |
2344 | iexplore.exe | Potentially Bad Traffic | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |
2344 | iexplore.exe | Potentially Bad Traffic | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |
2344 | iexplore.exe | Potentially Bad Traffic | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |
2344 | iexplore.exe | Potentially Bad Traffic | ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related |