download:

csct-002-%E9%AC%BC%E8%A9%B0%E3%82%81%E3%81%AE%E3%82%AA%E3%83%A1%E3%82%B3

Full analysis: https://app.any.run/tasks/d3b972e0-157c-4e82-9406-fd4941ec98f5
Verdict: No threats detected
Analysis date: October 16, 2019, 20:05:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/html
File info: HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
MD5:

15B6A4D6C8A8BD6C4F57DA97BFEB7F4F

SHA1:

836728A5B76EBC853217D37EEFC7DA9FACB57BDC

SHA256:

6E44BC9136F6B6BF8A783377D31B267F9B15BD76477D0B496888EB6F51211810

SSDEEP:

3072:LXjgiIhaSaTkO1zDJUWkaXKk6Hl8YDw3YqJ8zgsZfNlQf8Q2qmg5hD9aRoSOI4dh:/PDJUDh2k8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 1324)

    • Creates files in the user directory

      • iexplore.exe (PID: 2136)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2136)

    • Changes internet zones settings

      • iexplore.exe (PID: 1324)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2136)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2136)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2136)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.htm/html | HyperText Markup Language with DOCTYPE (80.6)
.html | HyperText Markup Language (19.3)

EXIF

HTML

twitterCard: summary_large_image
twitterSite: Avgle
twitterUrl: https://avgle.com/video/_YWhKht9ThT/csct-002-鬼詰めのオメコ
twitterDescription: CSCT-002 鬼詰めのオメコ
twitterDomain: avgle.com
twitterTitle: CSCT-002 鬼詰めのオメコ
twitterImage: https://static-clst.avgle.com/videos/tmb10/328815/default.jpg
Title: CSCT-002 鬼詰めのオメコ - Avgle
HTTPEquivXUACompatible: IE=edge
viewport: width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no
Robots: index, follow
RevisitAfter: 1 days
Keywords: CSCT, CSCT-002, 鬼詰めのオメコ, 鬼滅之刃, 鬼滅の刃, 鬼滅, 鬼刃, cosplay, 兄妹
Description: CSCT-002 鬼詰めのオメコCSCT-002 鬼詰めのオメコ
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1324"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\54f1ba4e-c229-4a87-b27c-4f36914c5df0.htmC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2136"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1324 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
404
Read events
333
Write events
70
Delete events
1

Modification events

(PID) Process:(1324) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1324) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1324) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1324) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2136) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore
Operation:writeName:Type
Value:
3
(PID) Process:(2136) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore
Operation:writeName:Count
Value:
2
(PID) Process:(2136) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore
Operation:writeName:Time
Value:
E3070A0003001000140005003000FE01
(PID) Process:(1324) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1324) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000092000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(1324) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{5793A6DB-F050-11E9-AB41-5254004A04AF}
Value:
0
Executable files
0
Suspicious files
0
Text files
7
Unknown types
1

Dropped files

PID
Process
Filename
Type
1324iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
1324iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2136iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\loader[1].jstext
MD5:—
SHA256:—
1324iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\favicon[1].pngimage
MD5:9FB559A691078558E77D6848202F6541
SHA256:6D8A01DC7647BC218D003B58FE04049E24A9359900B7E0CEBAE76EDF85B8B914
2136iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\VideoJS[1].eoteot
MD5:00103E881A36640A08F869FF6888F0FD
SHA256:B59C6B140454CFBC4AE3AC6D8B888DAC7F0E0BFA20590B485615D9EBCE1AB370
2136iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\video-js.min[1].csstext
MD5:F0EFA69B01F044B768AB790C31E66946
SHA256:9B967A69371E3AF4E63C91981001D84776D23811A57F5C9C6B3A96B6C2DA9310
2136iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\jquery.min[1].jstext
MD5:4F252523D4AF0B478C810C2547A63E19
SHA256:668B046D12DB350CCBA6728890476B3EFEE53B2F42DBB84743E5E9F1AE0CC404
2136iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\js.cookie.min[1].jstext
MD5:45F12DE4D7B95A193ECDC5CFDE664BB9
SHA256:39B8FE6364621725FF90431A34AF0F87976D95C00CBFD1D0F3711A3F1FA1A07B
2136iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\clipboard.min[1].jstext
MD5:D3D323FD9A370C90E83427D50F383A63
SHA256:74511BFA45EC3A55C3154E1AF7E1307C713CCF58542611064D46F7CE48726D83
2136iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\toastr.min[1].jstext
MD5:B36F28DE584845317DE40A7219C82B1C
SHA256:DDB96C25DE07962FFBC0243E6E68177CE74AEE9FD950CB4F5D8D3C8E6C524A09
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
18
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1324
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
104.19.195.151:445
cdnjs.cloudflare.com
Cloudflare Inc
US
shared
2136
iexplore.exe
104.19.195.151:443
cdnjs.cloudflare.com
Cloudflare Inc
US
shared
1324
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2136
iexplore.exe
185.98.53.4:443
avgle.topgirlsdating.com
—
NL
unknown
4
System
104.19.199.151:445
cdnjs.cloudflare.com
Cloudflare Inc
US
shared
4
System
104.19.197.151:445
cdnjs.cloudflare.com
Cloudflare Inc
US
shared
4
System
104.19.198.151:445
cdnjs.cloudflare.com
Cloudflare Inc
US
shared
4
System
104.19.198.151:139
cdnjs.cloudflare.com
Cloudflare Inc
US
shared
2136
iexplore.exe
151.101.66.109:443
cdn.jsdelivr.net
Fastly
US
unknown
4
System
104.19.196.151:445
cdnjs.cloudflare.com
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
cdnjs.cloudflare.com
  • 104.19.195.151
  • 104.19.196.151
  • 104.19.199.151
  • 104.19.197.151
  • 104.19.198.151
whitelisted
cdn.jsdelivr.net
  • 151.101.2.109
  • 151.101.66.109
  • 151.101.130.109
  • 151.101.194.109
whitelisted
avgle.topgirlsdating.com
  • 185.98.53.4
unknown
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
s7.addthis.com
  • 23.210.248.44
whitelisted
adserver.juicyads.com
  • 199.241.97.149
suspicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
csct-002-%E9%AC%BC%E8%A9%B0%E3%82%81%E3%81%AE%E3%82%AA%E3%83%A1%E3%82%B3