analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://filetransfer.io/manage-package/WZ9jsswM#

Full analysis: https://app.any.run/tasks/5bfaa4fc-279c-4f0b-88d7-8894a310b4de
Verdict: Malicious activity
Analysis date: October 05, 2022, 04:10:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

39634C511844E6254A4C894FBFB57AA6

SHA1:

E892754AED500245E0AD32A8BBC53AA0970A28C5

SHA256:

7DDCCC79209919C344CFC61472C00CF82D366C84BB86927CF0579A648667FA94

SSDEEP:

3:N8rdMCtUvtRGn:2xMjFgn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2484)
  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 3068)
    • Checks supported languages

      • iexplore.exe (PID: 2484)
      • iexplore.exe (PID: 3068)
    • Reads the computer name

      • iexplore.exe (PID: 3068)
      • iexplore.exe (PID: 2484)
    • Application launched itself

      • iexplore.exe (PID: 3068)
    • Reads settings of System Certificates

      • iexplore.exe (PID: 2484)
      • iexplore.exe (PID: 3068)
    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3068)
      • iexplore.exe (PID: 2484)
    • Reads internet explorer settings

      • iexplore.exe (PID: 2484)
    • Creates files in the user directory

      • iexplore.exe (PID: 2484)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3068"C:\Program Files\Internet Explorer\iexplore.exe" "https://filetransfer.io/manage-package/WZ9jsswM#"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2484"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3068 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Total events
12 220
Read events
12 121
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
9
Text files
19
Unknown types
10

Dropped files

PID
Process
Filename
Type
3068iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442binary
MD5:C951E0F182C58ABDDD7157770191956A
SHA256:82AA2AE26C3D28D69861DDC28D8CE6782FADC9EE4ECA08CBB05EE991F581FE1F
2484iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:AAC640E61FD4FAFC3F52FE9826FF92A6
SHA256:F613A8B4529627A7807C4F35B6686B470AFA14E8EA5C3CA209839530B1CC301E
2484iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\GXV3ZNEX.txttext
MD5:BBE2EFF7EE91FDF245AA8D83FCE84A88
SHA256:412698A8B4A1918828225A9FF4E4593177FEB0EA48E32F983989C6BAB8B643F4
2484iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\unsupported-browser[1].htmhtml
MD5:DA779B9C95098C5BB185BCDE89D0EA93
SHA256:FFF2962FD34EF7539A141EA1413F55881E168B640076122A00D4F71163419D6A
2484iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:730A4129BE3CEAF0FD2EABD552EFF5FE
SHA256:8D32F8D4B316C4B65C15BF0171D6AD826F590DBC842CE712897902B4ACA9448F
2484iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:87AAD071DDAAAD8ADB70E4DABCC1A750
SHA256:2D558A3FE733F9893095B3758FF661E7B48DB7D8D725D7AC9EDBFFABC65D1613
2484iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:B9786A057C72AD4FC6DB0A2BF11C0F91
SHA256:ADA2770396BDA95EEFF14FEB9F78B5B71E765F84C1E013E06F29B7030EC000F7
3068iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442der
MD5:B8BDA0B382A7D056A4241B388338B778
SHA256:7BAA967F6686CCE471826B20FFA5CB7FEB4BF3C5C0BF43F51F08E84EB5850DD2
2484iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:0275171F2D3201A459C9CABE008B1168
SHA256:6B4B08ED4F9722BA2B73FCA99611A7D5085446FA1C6D790961B493DAF2812C4B
2484iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
29
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2484
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
2484
iexplore.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
3068
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
2484
iexplore.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
2484
iexplore.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGOlwNI5ZtyUEgHpNAgRyd0%3D
US
der
471 b
whitelisted
2484
iexplore.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDcThR%2BKEYP2BK026EbsM6F
US
der
472 b
whitelisted
2484
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d8da3f1ad444728e
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3068
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2484
iexplore.exe
188.114.97.3:443
filetransfer.io
CLOUDFLARENET
NL
malicious
2484
iexplore.exe
142.250.74.200:443
www.googletagmanager.com
GOOGLE
US
suspicious
3068
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
2484
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
2484
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
2484
iexplore.exe
142.250.186.131:80
ocsp.pki.goog
GOOGLE
US
whitelisted
3068
iexplore.exe
188.114.97.3:443
filetransfer.io
CLOUDFLARENET
NL
malicious
2484
iexplore.exe
66.102.1.154:443
stats.g.doubleclick.net
GOOGLE
US
whitelisted
2484
iexplore.exe
172.217.16.206:443
www.google-analytics.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
filetransfer.io
  • 188.114.97.3
  • 188.114.96.3
malicious
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
www.googletagmanager.com
  • 142.250.74.200
whitelisted
ocsp.pki.goog
  • 142.250.186.131
whitelisted
www.google-analytics.com
  • 172.217.16.206
whitelisted
region1.google-analytics.com
  • 216.239.32.36
  • 216.239.34.36
whitelisted
stats.g.doubleclick.net
  • 66.102.1.154
  • 66.102.1.155
  • 66.102.1.157
  • 66.102.1.156
whitelisted

Threats

PID
Process
Class
Message
Potentially Bad Traffic
ET INFO Commonly Abused File Sharing Domain in DNS Lookup (filetransfer .io)
2484
iexplore.exe
Potentially Bad Traffic
ET INFO Commonly Abused File Sharing Domain (filetransfer .io in TLS SNI)
2484
iexplore.exe
Potentially Bad Traffic
ET INFO Commonly Abused File Sharing Domain (filetransfer .io in TLS SNI)
2484
iexplore.exe
Potentially Bad Traffic
ET INFO Commonly Abused File Sharing Domain (filetransfer .io in TLS SNI)
2484
iexplore.exe
Potentially Bad Traffic
ET INFO Commonly Abused File Sharing Domain (filetransfer .io in TLS SNI)
2484
iexplore.exe
Potentially Bad Traffic
ET INFO Commonly Abused File Sharing Domain (filetransfer .io in TLS SNI)
3068
iexplore.exe
Potentially Bad Traffic
ET INFO Commonly Abused File Sharing Domain (filetransfer .io in TLS SNI)
2484
iexplore.exe
Potentially Bad Traffic
ET INFO Commonly Abused File Sharing Domain (filetransfer .io in TLS SNI)
3068
iexplore.exe
Potentially Bad Traffic
ET INFO Commonly Abused File Sharing Domain (filetransfer .io in TLS SNI)
No debug info