analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| download: | europe-middle-east-africa-emea |
| Full analysis: | https://app.any.run/tasks/be9658eb-d34e-432d-a98d-a1a1e073229e |
| Verdict: | Malicious activity |
| Analysis date: | October 14, 2019, 20:04:20 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | text/html |
| File info: | HTML document, UTF-8 Unicode text, with very long lines |
| MD5: | 9CF66960452113479DB4D6019FF7B700 |
| SHA1: | 43E535A7DD07492DEE96B4BBF8F6353EBD5D76F1 |
| SHA256: | 6CE93C92656234AC8EB39B1596EE57178374CAC44D03A61A8AE0E07060F8BEBA |
| SSDEEP: | 3072:EHGEbWT/d5zG0J2cTBRArTMqXJOphsRgve81Hw0HKvkH7ZqHNgdH0hHKnEHWdH21:EHDcTBRArTMqXJOphsRgG34xqz |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
Application launched itself
- iexplore.exe (PID: 2124)
Changes internet zones settings
- iexplore.exe (PID: 2124)
Reads Internet Cache Settings
- iexplore.exe (PID: 3776)
Creates files in the user directory
- iexplore.exe (PID: 3776)
Reads internet explorer settings
- iexplore.exe (PID: 3776)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .htm/html | | | HyperText Markup Language with DOCTYPE (80.6) |
|---|---|---|
| .html | | | HyperText Markup Language (19.3) |
EXIF
HTML
| Description: | Contact West Unified Communications Services offices in Europe, Middle East and Africa (EMEA). |
|---|---|
| Generator: | Drupal 7 (http://drupal.org) |
| msvalidate01: | 9C75077AE08E824E7CC3F3A25F8D182D |
| googleSiteVerification: | 9j8qiOTQ0iAaETPkP7_yL0-dg0PDQL0qW3DPvwPlvXg |
| Title: | Contact Us | EMEA |
| MobileOptimized: | width |
| HandheldFriendly: | |
| viewport: | width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no |
| HTTPEquivCleartype: | on |
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2124 | "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\europe-middle-east-africa-emea.htm | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 3776 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2124 CREDAT:79873 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
Total events
393
Read events
316
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
36
Unknown types
5
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2124 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 2124 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 3776 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\css[1].txt | text | |
MD5:583EEB8C76FC402B59587BAE634C7C9D | SHA256:B94AD164BF353693418DAA002DEC81BEDFB4BA81CADB889FAC4C337E782AB349 | |||
| 3776 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\css_9YJ6Kpp9ROwGz_vqBpCBgk30a5INlGiLJS9IjquK13k[1].css | text | |
MD5:ACE98A8118358C69B4C0F90D17C68C5B | SHA256:F5827A2A9A7D44EC06CFFBEA069081824DF46B920D94688B252F488EAB8AD779 | |||
| 3776 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\icomoon[1].eot | eot | |
MD5:49A3EA7DC495A10CCDF074F7BD8BAA9F | SHA256:6F9869087AFE803A0C0CA465206E2D4CFA1154ACE85E5B5B18BF7CF4C6DE1641 | |||
| 3776 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\css_nCfBclPckLay7fV70jgH9WLLinjDPQ2HFmWO3M7vOaE[1].css | text | |
MD5:DD270B2598068E3C7524CCA1B9F10809 | SHA256:9C27C17253DC90B6B2EDF57BD23807F562CB8A78C33D0D8716658EDCCEEF39A1 | |||
| 3776 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\css_Bb2UQwhX0P7AS13cRxramAccdjVZ8_JWvk9HT8Xn7AI[1].css | text | |
MD5:29CCFA1D4ADE50EE51BB2A8593138DFD | SHA256:05BD94430857D0FEC04B5DDC471ADA98071C763559F3F256BE4F474FC5E7EC02 | |||
| 3776 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\js_PdL425kWTzXth4_tgSJRzr0MRXcfPjnOnAQ5EMg358Y[1].js | text | |
MD5:C1543FB48C7F230BA81405B90F4ED49A | SHA256:3DD2F8DB99164F35ED878FED812251CEBD0C45771F3E39CE9C043910C837E7C6 | |||
| 3776 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\js_-9-t5t3cxgBM0qlyUvU_F3LDJA0oEpwRLCkDl8ZEGmw[1].js | text | |
MD5:85B1BC7E8EA1CA50330FC056EE9E6AD7 | SHA256:FBDFADE6DDDCC6004CD2A97252F53F1772C3240D28129C112C290397C6441A6C | |||
| 3776 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\dnserror[1] | html | |
MD5:68E03ED57EC741A4AFBBCD11FAB1BDBE | SHA256:1FF3334C3EB27033F8F37029FD72F648EDD4551FCE85FC1F5159FEAEA1439630 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
27
DNS requests
9
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2124 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
3776 | iexplore.exe | OPTIONS | 400 | 216.58.207.72:80 | http://www.googletagmanager.com/ | US | html | 1.52 Kb | whitelisted |
3776 | iexplore.exe | OPTIONS | 400 | 216.58.207.72:80 | http://www.googletagmanager.com/ | US | html | 1.52 Kb | whitelisted |
3776 | iexplore.exe | OPTIONS | 400 | 216.58.207.72:80 | http://www.googletagmanager.com/ | US | html | 1.52 Kb | whitelisted |
3776 | iexplore.exe | OPTIONS | 400 | 216.58.207.72:80 | http://www.googletagmanager.com/ | US | html | 1.52 Kb | whitelisted |
3776 | iexplore.exe | OPTIONS | 400 | 216.58.207.72:80 | http://www.googletagmanager.com/ | US | html | 1.52 Kb | whitelisted |
3776 | iexplore.exe | OPTIONS | 400 | 216.58.207.72:80 | http://www.googletagmanager.com/ | US | html | 1.52 Kb | whitelisted |
3776 | iexplore.exe | OPTIONS | 400 | 216.58.207.72:80 | http://www.googletagmanager.com/ | US | html | 1.52 Kb | whitelisted |
3776 | iexplore.exe | OPTIONS | 400 | 216.58.207.72:80 | http://www.googletagmanager.com/ | US | html | 1.52 Kb | whitelisted |
3776 | iexplore.exe | OPTIONS | 400 | 216.58.207.72:80 | http://www.googletagmanager.com/ | US | html | 1.52 Kb | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2124 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3776 | iexplore.exe | 172.217.22.10:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
3776 | iexplore.exe | 172.217.16.202:443 | maps.googleapis.com | Google Inc. | US | whitelisted |
3776 | iexplore.exe | 172.217.23.163:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
3776 | iexplore.exe | 104.20.38.125:443 | www.westuc.com | Cloudflare Inc | US | shared |
3776 | iexplore.exe | 172.217.16.132:443 | www.google.com | Google Inc. | US | whitelisted |
4 | System | 216.58.207.72:139 | www.googletagmanager.com | Google Inc. | US | whitelisted |
3776 | iexplore.exe | 136.147.110.2:443 | c.la4-c2-dfw.salesforceliveagent.com | Salesforce.com, Inc. | US | unknown |
4 | System | 216.58.207.72:445 | www.googletagmanager.com | Google Inc. | US | whitelisted |
3776 | iexplore.exe | 216.58.207.72:80 | www.googletagmanager.com | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.bing.com |
| whitelisted |
www.westuc.com |
| unknown |
fonts.googleapis.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
www.google.com |
| whitelisted |
maps.googleapis.com |
| whitelisted |
www.googletagmanager.com |
| whitelisted |
c.la4-c2-dfw.salesforceliveagent.com |
| whitelisted |
Threats
10 ETPRO signatures available at the full report