URL:

http://ec.ccm2.net/es.ccm.net/download/files/MyWIFIRouter_setup-3.0.0.exe

Full analysis: https://app.any.run/tasks/4dbe67d0-7dcb-4fe8-994d-1e578d22827f
Verdict: Malicious activity
Analysis date: May 27, 2020, 15:55:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

023B0C7CE8A23FB41F1D3F93AA94FC0C

SHA1:

D4AA7A088EC9D149B099B7102D9D6C3C8EA94550

SHA256:

7535ACED2F525FAD43BB4EBD37DFB867BB32D76F5BED745C6F2D3104F97DE54C

SSDEEP:

3:N1Kb3/ZK8LfS3jRtWhLWdA:Cb/H23tMWdA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • MyWIFIRouter_setup-3.0.0.exe (PID: 3536)
      • MyWIFIRouter_setup-3.0.0.exe (PID: 2192)
      • nsF668.tmp (PID: 3916)
      • nsF82E.tmp (PID: 1312)
      • nsFC09.tmp (PID: 2164)
      • nsF9E5.tmp (PID: 3656)
      • nsFDBF.tmp (PID: 3200)
      • nsFFE3.tmp (PID: 1944)
      • ns199.tmp (PID: 860)
      • ns350.tmp (PID: 608)
      • ns1A93.tmp (PID: 4084)
      • ns1562.tmp (PID: 1084)
      • ns2552.tmp (PID: 1468)
      • bmrep.exe (PID: 3140)
      • WiFiGxSvc.exe (PID: 2044)
      • WiFiGxSvc.exe (PID: 3648)
      • ns2718.tmp (PID: 1936)
      • bmrep.exe (PID: 2512)
      • insert.exe (PID: 3936)
      • txn_reporter_routine.exe (PID: 2504)
      • ns554D.tmp (PID: 3192)
      • nsF435.tmp (PID: 312)
      • WiFiGxSvc.exe (PID: 2964)
      • ns56C5.tmp (PID: 1940)
      • snetcfg.exe (PID: 684)
      • ns582E.tmp (PID: 3020)
      • snetcfg.exe (PID: 4000)
      • snetcfg.exe (PID: 2876)
      • txn_reporter_routine.exe (PID: 2748)
      • Wi-Fi.exe (PID: 3408)

    • Loads dropped or rewritten executable

      • insert.exe (PID: 3936)
      • WiFiGxSvc.exe (PID: 2964)
      • WiFiGxSvc.exe (PID: 3648)
      • txn_reporter_routine.exe (PID: 2504)
      • MyWIFIRouter_setup-3.0.0.exe (PID: 2192)
      • WiFiGxSvc.exe (PID: 2044)
      • snetcfg.exe (PID: 4000)
      • snetcfg.exe (PID: 684)
      • snetcfg.exe (PID: 2876)
      • Wi-Fi.exe (PID: 3408)
      • txn_reporter_routine.exe (PID: 2748)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 716)
      • iexplore.exe (PID: 3920)
      • MyWIFIRouter_setup-3.0.0.exe (PID: 2192)
      • snetcfg.exe (PID: 2876)
      • DrvInst.exe (PID: 3388)

    • Starts CMD.EXE for commands execution

      • nsF668.tmp (PID: 3916)
      • nsF82E.tmp (PID: 1312)
      • nsF9E5.tmp (PID: 3656)
      • nsFC09.tmp (PID: 2164)
      • nsFDBF.tmp (PID: 3200)
      • ns350.tmp (PID: 608)
      • nsFFE3.tmp (PID: 1944)
      • ns199.tmp (PID: 860)
      • insert.exe (PID: 3936)
      • nsF435.tmp (PID: 312)
      • ns554D.tmp (PID: 3192)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 1904)
      • cmd.exe (PID: 2960)
      • cmd.exe (PID: 532)
      • cmd.exe (PID: 2680)
      • cmd.exe (PID: 2896)
      • cmd.exe (PID: 2364)
      • cmd.exe (PID: 2512)
      • cmd.exe (PID: 3748)
      • cmd.exe (PID: 3808)
      • cmd.exe (PID: 2276)
      • cmd.exe (PID: 2416)

    • Creates files in the program directory

      • MyWIFIRouter_setup-3.0.0.exe (PID: 2192)
      • cmd.exe (PID: 1704)
      • Wi-Fi.exe (PID: 3408)

    • Creates files in the user directory

      • MyWIFIRouter_setup-3.0.0.exe (PID: 2192)

    • Reads Environment values

      • txn_reporter_routine.exe (PID: 2504)
      • txn_reporter_routine.exe (PID: 2748)

    • Executed as Windows Service

      • WiFiGxSvc.exe (PID: 3648)
      • alg.exe (PID: 1932)

    • Reads Internet Cache Settings

      • bmrep.exe (PID: 3140)
      • bmrep.exe (PID: 2512)

    • Starts application with an unusual extension

      • MyWIFIRouter_setup-3.0.0.exe (PID: 2192)

    • Creates files in the Windows directory

      • DrvInst.exe (PID: 3388)
      • snetcfg.exe (PID: 2876)

    • Removes files from Windows directory

      • DrvInst.exe (PID: 3388)
      • snetcfg.exe (PID: 2876)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 3388)
      • snetcfg.exe (PID: 2876)

    • Creates a software uninstall entry

      • MyWIFIRouter_setup-3.0.0.exe (PID: 2192)

    • Executed via COM

      • DrvInst.exe (PID: 3388)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 716)
      • iexplore.exe (PID: 3920)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 716)

    • Application launched itself

      • iexplore.exe (PID: 716)

    • Changes internet zones settings

      • iexplore.exe (PID: 716)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 716)
      • DrvInst.exe (PID: 3388)

    • Dropped object may contain Bitcoin addresses

      • MyWIFIRouter_setup-3.0.0.exe (PID: 2192)

    • Creates files in the user directory

      • iexplore.exe (PID: 716)

    • Adds / modifies Windows certificates

      • DrvInst.exe (PID: 3388)
      • iexplore.exe (PID: 716)

    • Changes settings of System certificates

      • DrvInst.exe (PID: 3388)
      • iexplore.exe (PID: 716)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
115
Monitored processes
57
Malicious processes
6
Suspicious processes
10

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe mywifirouter_setup-3.0.0.exe no specs mywifirouter_setup-3.0.0.exe nsf435.tmp no specs cmd.exe no specs taskkill.exe no specs nsf668.tmp no specs cmd.exe no specs taskkill.exe no specs nsf82e.tmp no specs cmd.exe no specs taskkill.exe no specs nsf9e5.tmp no specs cmd.exe no specs taskkill.exe no specs nsfc09.tmp no specs cmd.exe no specs taskkill.exe no specs nsfdbf.tmp no specs cmd.exe no specs taskkill.exe no specs nsffe3.tmp no specs cmd.exe no specs taskkill.exe no specs ns199.tmp no specs cmd.exe no specs taskkill.exe no specs ns350.tmp no specs cmd.exe no specs taskkill.exe no specs ns1562.tmp no specs txn_reporter_routine.exe no specs ns1a93.tmp no specs insert.exe cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs wifigxsvc.exe bmrep.exe wifigxsvc.exe ns2552.tmp no specs wifigxsvc.exe ns2718.tmp no specs bmrep.exe ns554d.tmp no specs cmd.exe no specs snetcfg.exe no specs ns56c5.tmp no specs snetcfg.exe no specs ns582e.tmp no specs snetcfg.exe drvinst.exe wi-fi.exe txn_reporter_routine.exe no specs alg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
312"C:\Users\admin\AppData\Local\Temp\nskCEE9.tmp\nsF435.tmp" "cmd.exe" " /c taskkill /IM Wi-Fi.exe /F"C:\Users\admin\AppData\Local\Temp\nskCEE9.tmp\nsF435.tmp—MyWIFIRouter_setup-3.0.0.exe
User:
admin
Integrity Level:
HIGH
Exit code:
128
Modules
Images
c:\users\admin\appdata\local\temp\nskcee9.tmp\nsf435.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
532"cmd.exe" " /c taskkill /IM WiFiGxSvc.exe /F"C:\Windows\system32\cmd.exe—nsF9E5.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
128
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
608"C:\Users\admin\AppData\Local\Temp\nskCEE9.tmp\ns350.tmp" "cmd.exe" " /c taskkill /IM TX_Httpd.exe /F"C:\Users\admin\AppData\Local\Temp\nskCEE9.tmp\ns350.tmp—MyWIFIRouter_setup-3.0.0.exe
User:
admin
Integrity Level:
HIGH
Exit code:
128
Modules
Images
c:\users\admin\appdata\local\temp\nskcee9.tmp\ns350.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
684"C:\Program Files\Wi-Fi\snetcfg.exe" -u ms_txwifinatC:\Program Files\Wi-Fi\snetcfg.exe—ns56C5.tmp
User:
admin
Company:
Windows (R) Win 7 DDK provider
Integrity Level:
HIGH
Description:
network config sample
Exit code:
1
Version:
6.1.7600.16385
Modules
Images
c:\program files\wi-fi\snetcfg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
716"C:\Program Files\Internet Explorer\iexplore.exe" "http://ec.ccm2.net/es.ccm.net/download/files/MyWIFIRouter_setup-3.0.0.exe"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
860"C:\Users\admin\AppData\Local\Temp\nskCEE9.tmp\ns199.tmp" "cmd.exe" " /c taskkill /IM download.exe /F"C:\Users\admin\AppData\Local\Temp\nskCEE9.tmp\ns199.tmp—MyWIFIRouter_setup-3.0.0.exe
User:
admin
Integrity Level:
HIGH
Exit code:
128
Modules
Images
c:\users\admin\appdata\local\temp\nskcee9.tmp\ns199.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
928taskkill /IM Wi-Fi.exe /F"C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
1084"C:\Users\admin\AppData\Local\Temp\nskCEE9.tmp\ns1562.tmp" C:\Program Files\Wi-Fi\txn_reporter_routine.exe "--url wifigx.log.tx-network.com/wifigx.php -p a=INSTALL&s=N/A"C:\Users\admin\AppData\Local\Temp\nskCEE9.tmp\ns1562.tmp—MyWIFIRouter_setup-3.0.0.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nskcee9.tmp\ns1562.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1312"C:\Users\admin\AppData\Local\Temp\nskCEE9.tmp\nsF82E.tmp" "cmd.exe" " /c taskkill /IM bmser.exe /F"C:\Users\admin\AppData\Local\Temp\nskCEE9.tmp\nsF82E.tmp—MyWIFIRouter_setup-3.0.0.exe
User:
admin
Integrity Level:
HIGH
Exit code:
128
Modules
Images
c:\users\admin\appdata\local\temp\nskcee9.tmp\nsf82e.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1344taskkill /IM WiFiGxSvc.exe /F"C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
Total events
6 097
Read events
1 149
Write events
3 757
Delete events
1 191

Modification events

(PID) Process:(716) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
1358602680
(PID) Process:(716) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30815295
(PID) Process:(716) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(716) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(716) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(716) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(716) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(716) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A1000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(716) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(716) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
82
Suspicious files
54
Text files
144
Unknown types
13

Dropped files

PID
Process
Filename
Type
3920iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\MyWIFIRouter_setup-3.0.0[1].exe —
MD5:—
SHA256:—
716iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF21D511CA20A59A2B.TMP —
MD5:—
SHA256:—
716iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\MyWIFIRouter_setup-3.0.0.exe.fkmwgn7.partial:Zone.Identifier —
MD5:—
SHA256:—
716iexplore.exeC:\Users\admin\AppData\Local\Temp\CabE04D.tmp —
MD5:—
SHA256:—
716iexplore.exeC:\Users\admin\AppData\Local\Temp\TarE04E.tmp —
MD5:—
SHA256:—
716iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verE0AD.tmp —
MD5:—
SHA256:—
2192MyWIFIRouter_setup-3.0.0.exeC:\Users\admin\AppData\Local\Temp\nskCEE9.tmp\System.dllexecutable
MD5:—
SHA256:—
3920iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\MyWIFIRouter_setup-3.0.0.exe.fkmwgn7.partialexecutable
MD5:—
SHA256:—
716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203der
MD5:—
SHA256:—
716iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\MyWIFIRouter_setup-3.0.0.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
19
DNS requests
22
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3140
bmrep.exe
GET
—
72.52.179.175:80
http://ww12.wifids.com/
US
—
—
malicious
2512
bmrep.exe
GET
—
72.52.179.175:80
http://tj.wifids.com/tj.html?hmsr=guanwang&hmmd=install&hmpl=2014.12.01.001&hmkw=&hmci=
US
—
—
malicious
3408
Wi-Fi.exe
GET
—
72.52.179.175:80
http://bmupd.wifids.com/version/bmupd_7.xml
US
—
—
malicious
716
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
716
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
3140
bmrep.exe
GET
302
72.52.179.175:80
http://tj.wifids.com/tj.html?hmsr=guanwang&hmmd=install&hmpl=2014.12.01.001&hmkw=&hmci=
US
text
15 b
malicious
716
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
3936
insert.exe
GET
404
72.52.179.175:80
http://inser.wifids.com/html/server_7_167.html
US
text
39 b
malicious
3408
Wi-Fi.exe
GET
404
192.186.249.103:80
http://www.mywifirouter.me/DownClient/index.html
US
html
857 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3920
iexplore.exe
2.16.107.74:80
ec.ccm2.net
Akamai International B.V.
—
suspicious
716
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
716
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3936
insert.exe
72.52.179.175:80
inser.wifids.com
Liquid Web, L.L.C
US
malicious
3140
bmrep.exe
103.235.46.39:80
www.baidu.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
HK
unknown
2512
bmrep.exe
103.235.46.39:80
www.baidu.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
HK
unknown
2512
bmrep.exe
72.52.179.175:80
inser.wifids.com
Liquid Web, L.L.C
US
malicious
3140
bmrep.exe
72.52.179.175:80
inser.wifids.com
Liquid Web, L.L.C
US
malicious
716
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3648
WiFiGxSvc.exe
103.235.46.39:80
www.baidu.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
HK
unknown

DNS requests

Domain
IP
Reputation
ec.ccm2.net
  • 2.16.107.74
  • 2.16.107.58
malicious
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
wifigx.log.tx-network.com
  • —
unknown
inser.wifids.com
  • 72.52.179.175
malicious
www.baidu.com
  • 103.235.46.39
whitelisted
tj.wifids.com
  • 72.52.179.175
malicious

Threats

PID
Process
Class
Message
3920
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3920
iexplore.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
Process
Message
WiFiGxSvc.exe
Èí¼þÃû³Æ:WiFi¹²Ïí¾«Áé3.0£¨¶à¹úÓïÑ԰棩 Èí¼þid:7 ·þÎñÃû³Æ:MyWiFiRouterDHCP ÇþµÀid:167 ÏÔʾÃû£ºMyWiFiRouterDHCP ÏêϸÐÅÏ¢:To register and update WIFI shared device IP address. If this service is stopped, WIFI sharing device will not receive dynamic I×
WiFiGxSvc.exe
Èí¼þÃû³Æ:WiFi¹²ÏíȎ
WiFiGxSvc.exe
Èí¼þÃû³Æ:WiFi¹²Ïí¾«Áé3.0£¨¶à¹úÓïÑ԰棩 Èí¼þid:7 ·þÎñÃû³Æ:MyWiFiRouterDHCP ÇþµÀid:167 ÏÔʾÃû£ºMyWiFiRouterDHCP ÏêϸÐÅÏ¢:To register and update WIFI shared device IP address. If this service is stopped, WIFI sharing device will not receive dynamic I×
WiFiGxSvc.exe
ÅäÖÃÎļþÐÅÏ¢/r/n
WiFiGxSvc.exe
Èí¼þÃû³Æ:WiFi¹²Ïí¾«Áé3.0£¨¶à¹úÓïÑ԰棩 Èí¼þid:7 ·þÎñÃû³Æ:MyWiFiRouterDHCP ÇþµÀid:167 ÏÔʾÃû£ºMyWiFiRouterDHCP ÏêϸÐÅÏ¢:To register and update WIFI shared device IP address. If this service is stopped, WIFI sharing device will not receive dynamic I×
WiFiGxSvc.exe
ÅäÖÃÎļþÐÅÏ¢/r/n
WiFiGxSvc.exe
-------UacTread----
Wi-Fi.exe
[C:\Program Files\Wi-Fi\update\status.xml] is not exists
Wi-Fi.exe
-------------------------------CheckLocalStatus start----------------------------
Wi-Fi.exe
-------------------------------CheckLocalStatus end----------------------------
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://ec.ccm2.net/es.ccm.net/download/files/MyWIFIRouter_setup-3.0.0.exe