analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://cdn.krnl.ca/getkey.php

Full analysis: https://app.any.run/tasks/46dfd79c-26b5-4761-b8b9-7cb03f42001d
Verdict: Malicious activity
Analysis date: August 18, 2021, 12:11:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

FF84F1144D30036B04B53780538198ED

SHA1:

47176FD2A7FD3D0ED8C675E464F37D732E833E49

SHA256:

6DE3CAB9FDD544C1A919BF06682E61C9B83F942AEE9A0A09260F2A425644890A

SSDEEP:

3:N8cALVZAREx:2cuAREx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 4084)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 4084)
      • iexplore.exe (PID: 4056)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 4084)
      • iexplore.exe (PID: 4056)

    • Reads the computer name

      • iexplore.exe (PID: 4056)
      • iexplore.exe (PID: 4084)

    • Changes settings of System certificates

      • iexplore.exe (PID: 4056)

    • Changes internet zones settings

      • iexplore.exe (PID: 4056)

    • Application launched itself

      • iexplore.exe (PID: 4056)

    • Reads internet explorer settings

      • iexplore.exe (PID: 4084)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 4056)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 4084)
      • iexplore.exe (PID: 4056)

    • Creates files in the user directory

      • iexplore.exe (PID: 4056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
4056"C:\Program Files\Internet Explorer\iexplore.exe" "https://cdn.krnl.ca/getkey.php"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\version.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\iertutil.dll
4084"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:4056 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
Total events
10 533
Read events
10 403
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
15
Text files
27
Unknown types
18

Dropped files

PID
Process
Filename
Type
4056iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442binary
MD5:A97E2CBDF32CCBF7EC22D113D642CA86
SHA256:11D9F66118F18BB708E12027B5477A3DD1507DB06FFB87E6EA2FF6944417B951
4084iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:8F37AC601B48978EABBD62C7E9E537A9
SHA256:EFE6F3E1AD57A052458AD998C4FE1FDC7943CAEB4A2EEC1ED12CBBDBC77EC7EF
4084iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAder
MD5:DE27664DA1E04C94901FCC3880064613
SHA256:7E59CE8A2D7D1E1201E535A3175BFAF239B9F5DA7BE265C18C5FF1E1BC696282
4056iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:AF6195BA09D6A833F53CE57EB5167E47
SHA256:8C492DB47A79B04AA167166B658BA8E219E0BD67594D8465FDF7F263951E72D7
4084iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:DD4D5B39FC07EB1039E04BD86516DE18
SHA256:7E6A12469A999BF133F9DD369E4B887A9678DE38709B700618C527E257F73F99
4084iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:CD38A38603207E9371CBE6620910818D
SHA256:91BADD810D11E8BAE7830B7535E8E2D6D82E8E9F1511CCCEB4258E36580039BB
4084iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\getkey[1].htmhtml
MD5:C7FBF385906D58E74517F10A15BA2E02
SHA256:8C2A28AC341F20526F9DFE6E38A73AED05D191CBB6C7958595283EAE7909EA00
4056iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442der
MD5:4AD19D960B58C4123BC75D9BC85591B4
SHA256:D845D28B440B7FE6C32E4869BA332BB57F72FAF44CFC04B47E67DFC715256018
4084iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\style[1].csstext
MD5:9C679B8281FD794366C51A49AE116A6E
SHA256:F906B0B97B943A7FC2EFD1EBBECF869C23C4A6A900EF0DCD0281EBC052AA70D9
4084iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:70F3B68767F59E9A3378DB2DE613FA76
SHA256:64B7170B30A56F35A9752D388E5975B2C5D658FF4E324F7E791CBCE2C47BE713
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
43
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1672
svchost.exe
GET
304
67.27.159.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?880ee01b2c3de996
US
—
—
whitelisted
4084
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
4056
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
1672
svchost.exe
GET
304
67.27.159.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a4a8b423b0895b18
US
—
—
whitelisted
4084
iexplore.exe
GET
200
142.250.186.99:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDhyYQfbVYwHgoAAAAA9vFG
US
der
472 b
whitelisted
4084
iexplore.exe
GET
200
142.250.186.99:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBtpDEx%2Fx4YJCgAAAADyw4g%3D
US
der
471 b
whitelisted
4084
iexplore.exe
GET
200
142.250.186.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
4084
iexplore.exe
GET
200
142.250.186.99:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
4056
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
4084
iexplore.exe
GET
200
142.250.186.99:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDI380UVVMsAwoAAAAA9u6E
US
der
472 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4084
iexplore.exe
67.27.159.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
malicious
4056
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
4056
iexplore.exe
131.253.33.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
—
—
131.253.33.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
—
—
142.250.186.170:443
fonts.googleapis.com
Google Inc.
US
whitelisted
4084
iexplore.exe
142.250.186.170:443
fonts.googleapis.com
Google Inc.
US
whitelisted
—
—
192.168.100.2:53
—
—
—
whitelisted
4084
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
4084
iexplore.exe
172.67.147.98:443
cdn.krnl.ca
—
US
malicious
—
—
172.67.147.98:443
cdn.krnl.ca
—
US
malicious

DNS requests

Domain
IP
Reputation
www.microsoft.com
  • —
whitelisted
cdn.krnl.ca
  • 172.67.147.98
  • 104.21.39.171
malicious
ctldl.windowsupdate.com
  • 67.27.159.254
  • 67.26.83.254
  • 8.248.119.254
  • 67.27.235.254
  • 8.248.131.254
whitelisted
api.bing.com
  • 13.107.13.80
whitelisted
www.bing.com
  • 131.253.33.200
  • 13.107.22.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
fonts.googleapis.com
  • 142.250.186.170
whitelisted
www.google.com
  • 142.250.184.228
whitelisted
ocsp.pki.goog
  • 142.250.186.99
whitelisted
www.gstatic.com
  • 142.250.185.99
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://cdn.krnl.ca/getkey.php