analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://movie.timbervalleyfarm.com/hqtdkaslfeps

Full analysis: https://app.any.run/tasks/2b9de0af-c5ee-4d89-99fc-0593d3b792fe
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Analysis date: March 31, 2020, 11:42:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
gozi
ursnif
dreambot
Indicators:
MD5:

E67118363C97AED436AC8AF961BE856D

SHA1:

C2F8D9035398579F1C6F3E0EEB11038C40451E48

SHA256:

684897DF4E4F8CBC7189E18B73A33A3A1BCD2A28B7CA29F875F9E80F547EF427

SSDEEP:

3:N1KTGlM6y0JAXEGYAVW:COJ2YA8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • player.exe (PID: 3120)
      • player.exe (PID: 2420)
    • Connects to CnC server

      • iexplore.exe (PID: 3552)
      • iexplore.exe (PID: 772)
      • iexplore.exe (PID: 2184)
      • iexplore.exe (PID: 3468)
    • DREAMBOT was detected

      • iexplore.exe (PID: 3552)
      • iexplore.exe (PID: 772)
      • iexplore.exe (PID: 2184)
      • iexplore.exe (PID: 3468)
    • URSNIF was detected

      • iexplore.exe (PID: 3552)
      • iexplore.exe (PID: 772)
      • iexplore.exe (PID: 2184)
      • iexplore.exe (PID: 3468)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2336)
    • Executed via COM

      • iexplore.exe (PID: 4036)
      • iexplore.exe (PID: 2692)
      • iexplore.exe (PID: 3584)
      • iexplore.exe (PID: 1688)
    • Reads Internet Cache Settings

      • player.exe (PID: 3120)
  • INFO

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3924)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3924)
      • iexplore.exe (PID: 3276)
      • iexplore.exe (PID: 3552)
      • iexplore.exe (PID: 4036)
      • iexplore.exe (PID: 772)
      • iexplore.exe (PID: 332)
      • iexplore.exe (PID: 2692)
      • iexplore.exe (PID: 2804)
      • iexplore.exe (PID: 2184)
      • iexplore.exe (PID: 3584)
      • iexplore.exe (PID: 3468)
      • iexplore.exe (PID: 2696)
      • iexplore.exe (PID: 2732)
      • iexplore.exe (PID: 1688)
    • Application launched itself

      • iexplore.exe (PID: 3924)
      • iexplore.exe (PID: 4036)
      • iexplore.exe (PID: 2692)
      • iexplore.exe (PID: 3584)
    • Changes internet zones settings

      • iexplore.exe (PID: 3924)
      • iexplore.exe (PID: 4036)
      • iexplore.exe (PID: 2692)
      • iexplore.exe (PID: 3584)
      • iexplore.exe (PID: 1688)
    • Creates files in the user directory

      • iexplore.exe (PID: 3552)
      • iexplore.exe (PID: 3924)
    • Reads internet explorer settings

      • iexplore.exe (PID: 3276)
      • iexplore.exe (PID: 3552)
      • iexplore.exe (PID: 772)
      • iexplore.exe (PID: 332)
      • iexplore.exe (PID: 2184)
      • iexplore.exe (PID: 3468)
      • iexplore.exe (PID: 2804)
      • iexplore.exe (PID: 2696)
      • mshta.exe (PID: 1800)
      • iexplore.exe (PID: 2732)
    • Manual execution by user

      • explorer.exe (PID: 404)
      • mshta.exe (PID: 1800)
    • Reads settings of System Certificates

      • iexplore.exe (PID: 3924)
    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3924)
    • Changes settings of System certificates

      • iexplore.exe (PID: 3924)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
60
Monitored processes
19
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start iexplore.exe iexplore.exe winrar.exe player.exe player.exe no specs #URSNIF iexplore.exe explorer.exe no specs iexplore.exe no specs iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe no specs #URSNIF iexplore.exe mshta.exe no specs iexplore.exe no specs iexplore.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3924"C:\Program Files\Internet Explorer\iexplore.exe" "http://movie.timbervalleyfarm.com/hqtdkaslfeps"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3276"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3924 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2336"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\video_17.zip"C:\Program Files\WinRAR\WinRAR.exe
iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3120"C:\Users\admin\AppData\Local\Temp\Rar$EXb2336.32635\player.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2336.32635\player.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
2420"C:\Users\admin\AppData\Local\Temp\Rar$EXb2336.34760\player.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2336.34760\player.exeWinRAR.exe
User:
admin
Integrity Level:
MEDIUM
3552"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3924 CREDAT:4134163 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
404"C:\Windows\explorer.exe" C:\Windows\explorer.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4036"C:\Program Files\Internet Explorer\iexplore.exe" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
332"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:4036 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exeiexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
772"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:4036 CREDAT:3085574 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Total events
10 075
Read events
3 018
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
27
Text files
34
Unknown types
3

Dropped files

PID
Process
Filename
Type
3276iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\video_17.zip.qcw5v5x.partial
MD5:
SHA256:
3924iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFEF33D026CDE31DE6.TMP
MD5:
SHA256:
3924iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\video_17.zip.qcw5v5x.partial:Zone.Identifier
MD5:
SHA256:
3924iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
MD5:
SHA256:
3924iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF972AD08A5EE124FD.TMP
MD5:
SHA256:
3924iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3ICSQ5OV31QJJ9XRBN53.temp
MD5:
SHA256:
3924iexplore.exeC:\Users\admin\AppData\Local\Temp\Cab3452.tmp
MD5:
SHA256:
3924iexplore.exeC:\Users\admin\AppData\Local\Temp\Tar3453.tmp
MD5:
SHA256:
3924iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver34E0.tmp
MD5:
SHA256:
3924iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Q0RNRMGP.txt
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
25
DNS requests
22
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3276
iexplore.exe
GET
200
31.148.99.73:80
http://movie.timbervalleyfarm.com/hqtdkaslfeps
RU
compressed
113 Kb
suspicious
3924
iexplore.exe
GET
200
72.21.91.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
3924
iexplore.exe
GET
200
72.21.91.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
3552
iexplore.exe
GET
200
62.109.31.180:80
http://link.philippeschellekens.com/images/VoPgMkd_/2Fp9F2C3JVRDY6uemPQrCag/n5uoFL9npq/xZx5eTwkOxVzFRMNJ/J1uOUm0nJGsl/2EnYm6ASW7H/Y2jWqP1hpeRuJ4/n6AibVE_2FKZiqzxUsG5i/EFZ_2FEZmQEnj0l3/R8edzu84ADgihLZ/gNgyVVgg/V.avi
RU
html
925 b
malicious
3924
iexplore.exe
GET
200
72.21.91.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
3468
iexplore.exe
GET
200
62.109.31.180:80
http://link.philippeschellekens.com/images/jMRUFUUoK5lpl/qAL8ZKfk/7ir92uN7cPJ77C0eYeuOQ94/G_2FIXWYzF/eHTk_2FGYEJ7Dcsy2/o3Ded6hatd9X/ZsbuKsvFDVB/xBA8xZFQxYSCJJ/WUlHgxo5DTQFFuxiEaOv9/JUXJjHHRiyygMyi1/4FVUzLmMLO9GZXt/KLu1l3r0Y/CfeomD.avi
RU
html
925 b
malicious
772
iexplore.exe
GET
200
62.109.31.180:80
http://link.philippeschellekens.com/images/PDkH2MWpSCtSFh/SRvCcYfCRGpulvLC5aEx5/DHeedCtIhSqPxC_2/BHNthAYyUgI_2Bw/_2BfntbW_2FXrBagyt/OA2xqmuZL/VvRMpBq4e4Quq4DYz6fe/sgs_2FEb63vVb34Zg3t/c8JEVdznqb_2BfuQYcKS_2/F6fREXJ6wM0fd/idYMYmBt/X265hbrKl/P.avi
RU
html
925 b
malicious
2184
iexplore.exe
GET
200
62.109.31.180:80
http://link.philippeschellekens.com/images/0opqmi_2F3Ct1IuoW4/oukXWAoCz/nCeUwZeGg67jU29pQiFe/_2BqOtXCnL2Oe5co8tk/93r2NL5pNVmwBlaqTCYL44/1gsKEX_2FNPkH/cKanB4sK/UG_2BdD_2B9LMKHc4M6LQ7U/51RGAGz7Gk/apVIqF0Ho39CAGbZJ/FKvxzAbApdg3/JNVj_2BJpgn/F.avi
RU
html
925 b
malicious
3924
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
3924
iexplore.exe
GET
200
62.109.31.180:80
http://link.philippeschellekens.com/favicon.ico
RU
image
5.30 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3924
iexplore.exe
152.199.19.161:443
r20swj13mr.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3276
iexplore.exe
31.148.99.73:80
movie.timbervalleyfarm.com
MAROSNET Telecommunication Company LLC
RU
suspicious
3924
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3924
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3924
iexplore.exe
72.21.91.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3924
iexplore.exe
72.21.81.200:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3552
iexplore.exe
62.109.31.180:80
link.philippeschellekens.com
JSC ISPsystem
RU
malicious
772
iexplore.exe
62.109.31.180:80
link.philippeschellekens.com
JSC ISPsystem
RU
malicious
3468
iexplore.exe
62.109.31.180:80
link.philippeschellekens.com
JSC ISPsystem
RU
malicious
3924
iexplore.exe
62.109.31.180:80
link.philippeschellekens.com
JSC ISPsystem
RU
malicious

DNS requests

Domain
IP
Reputation
movie.timbervalleyfarm.com
  • 31.148.99.73
unknown
iecvlist.microsoft.com
  • 72.21.81.200
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
mcc.avast.com
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
ocsp.digicert.com
  • 72.21.91.29
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
link.philippeschellekens.com
  • 62.109.31.180
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
3552
iexplore.exe
A Network Trojan was detected
AV TROJAN Ursnif Variant CnC Beacon 2019-09-18
3552
iexplore.exe
A Network Trojan was detected
MALWARE [PTsecurity] W32.Dreambot HTTP GET Check-in
772
iexplore.exe
A Network Trojan was detected
AV TROJAN Ursnif Variant CnC Beacon 2019-09-18
772
iexplore.exe
A Network Trojan was detected
MALWARE [PTsecurity] W32.Dreambot HTTP GET Check-in
772
iexplore.exe
A Network Trojan was detected
MALWARE [PTsecurity] Ursnif
2184
iexplore.exe
A Network Trojan was detected
AV TROJAN Ursnif Variant CnC Beacon 2019-09-18
2184
iexplore.exe
A Network Trojan was detected
MALWARE [PTsecurity] W32.Dreambot HTTP GET Check-in
2184
iexplore.exe
A Network Trojan was detected
MALWARE [PTsecurity] Ursnif
3468
iexplore.exe
A Network Trojan was detected
AV TROJAN Ursnif Variant CnC Beacon 2019-09-18
3468
iexplore.exe
A Network Trojan was detected
MALWARE [PTsecurity] W32.Dreambot HTTP GET Check-in
6 ETPRO signatures available at the full report
No debug info