analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://trafikverket.via-em.com/a/plink/redir/16452bdecb3d444e3b90218bfdd39adc0a31c6d4c967fb530c04869e6c4ceaa63dae4f11/aHR0cHM6Ly9oLXQ2MC5zaG9wP2U9TVdWeWMySnBibk53WldOQWMyVmtaVzVoTG1kdllpNXRlQT09/scramble_v1-t13j3SHcM7Swtdnv4WGwzzT1iDpQZ07BJMzIBwT0o/92359079.html

Full analysis: https://app.any.run/tasks/a302c80f-df27-4032-b26e-6aabe554cc19
Verdict: Malicious activity
Analysis date: October 04, 2022, 19:57:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

392D3A0FD9E4C9FC0D5084EF25E9ED8B

SHA1:

126F3C5C23400C50ADC421DA99B81ED71A6D3FBD

SHA256:

7443E3705251CFCDA03D093EF9645EF62B3EDC0D4589DB656E15F8E798D288E4

SSDEEP:

6:2W+ThXhdyhT+TVpvIvMBlKE5UGlH0ogyLX:2rxhdyhKT7eMbqGlUuz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2052)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 2052)
      • iexplore.exe (PID: 2880)

    • Reads the computer name

      • iexplore.exe (PID: 2880)
      • iexplore.exe (PID: 2052)

    • Changes internet zones settings

      • iexplore.exe (PID: 2880)

    • Application launched itself

      • iexplore.exe (PID: 2880)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2052)
      • iexplore.exe (PID: 2880)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2880)
      • iexplore.exe (PID: 2052)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2052)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2880)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2880)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2880"C:\Program Files\Internet Explorer\iexplore.exe" "https://trafikverket.via-em.com/a/plink/redir/16452bdecb3d444e3b90218bfdd39adc0a31c6d4c967fb530c04869e6c4ceaa63dae4f11/aHR0cHM6Ly9oLXQ2MC5zaG9wP2U9TVdWeWMySnBibk53WldOQWMyVmtaVzVoTG1kdllpNXRlQT09/scramble_v1-t13j3SHcM7Swtdnv4WGwzzT1iDpQZ07BJMzIBwT0o/92359079.html"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2052"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2880 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
16 295
Read events
16 178
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
15
Text files
7
Unknown types
10

Dropped files

PID
Process
Filename
Type
2052iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894binary
MD5:DBEC67A83FAB1F9517347BDD9D8FC639
SHA256:A5BE02752B56B17CF1A44EE63727BBC8FB8AB1703C7D639792423A2C192F96A0
2052iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4Fbinary
MD5:A7C0C30F50C4CE144AB03DC548C6B958
SHA256:606B4A0C2D730E56BE903A8652D530F5324F88FD8B0D23782129730B6170464A
2880iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442der
MD5:B8BDA0B382A7D056A4241B388338B778
SHA256:7BAA967F6686CCE471826B20FFA5CB7FEB4BF3C5C0BF43F51F08E84EB5850DD2
2880iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442binary
MD5:C69E25461BAA0DBEFD5B48E8EB0AB85E
SHA256:2C4D62F663CF4F77E9976D5479F987AB06D011F5B3BAEC996921139F564A9604
2052iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D6243C18F0F8F9AEC6638DD210F1984_85B7CF60D9ED504DC0C1A390B732D8F0der
MD5:BBE305FF4F3DF1D07FD353F1B051E408
SHA256:115BF15C01AFE086CF546B72BDA0093D8A1AC5E32DB517CD5765D41DE7C291F1
2880iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:F1298C9192FC5A067D71CF5023E73B17
SHA256:C551B372AFD11AC5CE406B1E971567B653AF805002F3B7B09A60D0334E1001D0
2052iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabFDA.tmpcompressed
MD5:D15AAA7C9BE910A9898260767E2490E1
SHA256:F8EBAAF487CBA0C81A17C8CD680BDD2DD8E90D2114ECC54844CFFC0CC647848E
2052iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4Fder
MD5:FCCDD7010386F27BC94A82BBA6081813
SHA256:D8B3AB356EBBA0C37A2A6ED07119C722EADCC78F5EB7B0938665F239F3243499
2052iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D6243C18F0F8F9AEC6638DD210F1984_85B7CF60D9ED504DC0C1A390B732D8F0binary
MD5:0582C5DFFA0A54A3CB561291F2A76114
SHA256:0A2741B58203EB540B75B210C92833403A542CD8B2063562C24179D9F4137AF9
2052iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62binary
MD5:789A9CF4B2588A3454F686F20446D07C
SHA256:B932BAAD7036F3D6DB86D0473E214C7388A4D75FF4CC8B3F9F3AC6CE6980AD99
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
32
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2052
iexplore.exe
GET
200
65.9.58.56:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
2052
iexplore.exe
GET
200
52.222.250.42:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D
US
der
1.39 Kb
shared
2052
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
2052
iexplore.exe
GET
200
184.24.77.79:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgMzBumonfVjlWk7LK3W2IgnMg%3D%3D
US
der
503 b
shared
2880
iexplore.exe
GET
200
23.216.77.80:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2f858e4afebb5e2a
US
compressed
4.70 Kb
whitelisted
2880
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
2052
iexplore.exe
GET
200
23.216.77.69:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?4ab9e29cb872535e
US
compressed
60.9 Kb
whitelisted
2052
iexplore.exe
GET
200
99.86.1.61:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
—
—
GET
200
18.155.152.104:80
http://ocsp.sca1b.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEAU5mwyCtsC3EA6VBf3pL58%3D
US
der
471 b
whitelisted
2880
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2880
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2880
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
2052
iexplore.exe
23.216.77.80:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
suspicious
2880
iexplore.exe
23.216.77.80:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
suspicious
2052
iexplore.exe
65.9.58.56:80
o.ss2.us
AMAZON-02
US
unknown
2052
iexplore.exe
143.204.215.75:443
trafikverket.via-em.com
AMAZON-02
US
suspicious
2052
iexplore.exe
99.86.1.61:80
ocsp.rootg2.amazontrust.com
AMAZON-02
US
whitelisted
2052
iexplore.exe
23.216.77.69:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
suspicious
2052
iexplore.exe
184.24.77.79:80
r3.o.lencr.org
Akamai International B.V.
DE
suspicious
2052
iexplore.exe
178.63.172.30:443
h-t60.shop
Hetzner Online GmbH
DE
unknown

DNS requests

Domain
IP
Reputation
trafikverket.via-em.com
  • 143.204.215.75
  • 143.204.215.129
  • 143.204.215.44
  • 143.204.215.35
suspicious
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ctldl.windowsupdate.com
  • 23.216.77.80
  • 23.216.77.69
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
o.ss2.us
  • 65.9.58.56
  • 65.9.58.194
  • 65.9.58.66
  • 65.9.58.231
whitelisted
ocsp.rootg2.amazontrust.com
  • 99.86.1.61
  • 99.86.1.91
  • 99.86.1.190
  • 99.86.1.226
whitelisted
ocsp.rootca1.amazontrust.com
  • 52.222.250.42
  • 52.222.250.112
  • 52.222.250.185
  • 52.222.250.174
shared
ocsp.sca1b.amazontrust.com
  • 18.155.152.104
  • 18.155.152.166
  • 18.155.152.27
  • 18.155.152.42
whitelisted
h-t60.shop
  • 178.63.172.30
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://trafikverket.via-em.com/a/plink/redir/16452bdecb3d444e3b90218bfdd39adc0a31c6d4c967fb530c04869e6c4ceaa63dae4f11/aHR0cHM6Ly9oLXQ2MC5zaG9wP2U9TVdWeWMySnBibk53WldOQWMyVmtaVzVoTG1kdllpNXRlQT09/scramble_v1-t13j3SHcM7Swtdnv4WGwzzT1iDpQZ07BJMzIBwT0o/92359079.html