analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| URL: | https://is.gd/0yHqIT |
| Full analysis: | https://app.any.run/tasks/846a4ec1-aa5a-4aeb-b470-d696dca682ad |
| Verdict: | Malicious activity |
| Analysis date: | November 08, 2019, 17:04:50 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 1116412515AEF06E903D36FB492B374E |
| SHA1: | 1BEE0FCD9C03034BD26B84C46CA362D4E29BBE37 |
| SHA256: | 6D5E3DCBB47B369DFA6F7582D008C7A32321F902CD535F116203486E1447F6C9 |
| SSDEEP: | 3:N81c7:21c7 |
MALICIOUS
No malicious indicators.SUSPICIOUS
Application launched itself
- WINWORD.EXE (PID: 436)
Starts Microsoft Office Application
- iexplore.exe (PID: 2572)
- WINWORD.EXE (PID: 436)
INFO
Creates files in the user directory
- iexplore.exe (PID: 2728)
- iexplore.exe (PID: 2572)
- WINWORD.EXE (PID: 436)
Application launched itself
- iexplore.exe (PID: 2572)
Reads internet explorer settings
- iexplore.exe (PID: 2728)
Changes internet zones settings
- iexplore.exe (PID: 2572)
Reads Internet Cache Settings
- iexplore.exe (PID: 2572)
- iexplore.exe (PID: 2728)
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 436)
- WINWORD.EXE (PID: 2212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
39
Monitored processes
4
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2572 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 2728 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2572 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 436 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1RXQ88NI\contract[1].doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | iexplore.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
| 2212 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Embedding | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | WINWORD.EXE |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
Total events
3 098
Read events
2 197
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
3
Text files
30
Unknown types
9
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2728 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1YP9R13L\app1_box-en_com[1].txt | — | |
MD5:— | SHA256:— | |||
| 2728 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat | dat | |
MD5:8798639BE04BD673201EBA39CBF9B6C6 | SHA256:9BD294BE9C96D36AFBB448C607B6EC5501A3669940C0F0B471863E8483E89F64 | |||
| 2728 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\FN84IACE\preview[1].css | text | |
MD5:CCBE854ADF33849A252CF0B4DCA1EFA1 | SHA256:C99C88BFA58048B644A3EE3913E48D153BCCF8FDBAFC739976ADA3D8B2A57A37 | |||
| 2728 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\QRVJX1NL\uploads-manager-enduser[1].css | text | |
MD5:E73A14C7F316D07AA832A7B871F3DE79 | SHA256:E8AFB2C11671E96F5E8602AF801D0064376D93C71D852C1B76D4047BD603CBEC | |||
| 2728 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1YP9R13L\app1_box-en_com[1].htm | html | |
MD5:B7A622D998CA3D9FE6873C47466853E6 | SHA256:33B0D9FDD9A7597B5CE9D8D1EFBE3CF2933343168BBA9BE7F7805DEA5949201D | |||
| 2728 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1YP9R13L\uploads-manager-enduser[1].js | text | |
MD5:A40930289957B9923BCF09CEA0B616DF | SHA256:56B675CCA7E1E411A048239C28B1F022708420CD277CFCFEE5FF7BE5010649A7 | |||
| 2728 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\FN84IACE\collection-detail-pagefavoritesfeedpreview-componentsrecentss[1].js | text | |
MD5:AB9FC63C1F469688F7CBD216A43A6A23 | SHA256:DA56C6976796E2D1B3BB08B8CBC64775B91891884B79215C084B35B38083A5B3 | |||
| 2728 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1RXQ88NI\preview-componentsuploads-manager-enduser[1].js | text | |
MD5:058C31387F05D89D683FB802CF2B0B3A | SHA256:39D65715A768558643C3A2ADA003169A2085853AF0E7FF797036305A87B95252 | |||
| 2728 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1RXQ88NI\feedpreview-components[1].css | text | |
MD5:E87193CD13CE95F98BA00BDB2A511C8D | SHA256:B7830E8688532BCC7C08DE1E6725C7A8E1A9911DC2FA73CCB247C0AA96776700 | |||
| 2728 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1RXQ88NI\feedpreview-components[1].js | text | |
MD5:192F61A4158940ABC6103152B56FD9D2 | SHA256:49B9E25AA797869D6004E03FCD47EEB85454615E2D4D0961B3C6A14EDE46DC9E | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
9
DNS requests
4
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2572 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2728 | iexplore.exe | 104.25.22.21:443 | is.gd | Cloudflare Inc | US | shared |
2728 | iexplore.exe | 88.99.66.31:443 | iplogger.org | Hetzner Online GmbH | DE | malicious |
2728 | iexplore.exe | 45.67.228.39:443 | app1.box-en.com | — | — | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.bing.com |
| whitelisted |
is.gd |
| shared |
app1.box-en.com |
| suspicious |
iplogger.org |
| shared |
Threats
4 ETPRO signatures available at the full report