URL:

http://download-bf3.blogspot.com/2011/01/viruses-2010-05-18-tar-bz2.html

Full analysis: https://app.any.run/tasks/b07504ff-e7e6-4c30-801a-3c4d69c8c047
Verdict: Malicious activity
Analysis date: February 25, 2024, 00:57:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

E03E0A78E8A259DBF07F6EDA0C00229D

SHA1:

1725BABE4E1883366AAE7032B6056F4CDED55AF2

SHA256:

7E19A32BC4D5E21B3D9E2CEFDB3A899742F4ED5A4B805227AEA920440CD45F7A

SSDEEP:

3:N1KaKEmHUzKMUVdhREkXwJn:CaRzKHoJn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3288)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1432"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3288 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3288"C:\Program Files\Internet Explorer\iexplore.exe" "http://download-bf3.blogspot.com/2011/01/viruses-2010-05-18-tar-bz2.html"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
50 021
Read events
49 822
Write events
158
Delete events
41

Modification events

(PID) Process:(3288) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3288) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3288) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31090565
(PID) Process:(3288) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3288) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31090565
(PID) Process:(3288) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3288) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3288) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3288) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3288) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
35
Text files
337
Unknown types
25

Dropped files

PID
Process
Filename
Type
1432iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\css[1].csstext
MD5:AA5AC0552564CC70FBAF350CC407F8D1
SHA256:20C4D079C2F90C7DCFAF9D141CD9259B758740DD75E3BF94DA0E47758C15F32C
1432iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:DA1C0BFFDA4486CE0EE5BB63E647F664
SHA256:11141B4D042A0D3BABDD3010B5B7D4CE2E37548B2963D0DACE4303730C1FFD66
1432iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:78BC36CDA2F5AF29B101A148C9F46873
SHA256:76B4D1B118147259CA16600A4DBDA639A212A4CD158350F59A5A918DFBC076F4
1432iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\maia[1].csstext
MD5:9E914FD11C5238C50EBA741A873F0896
SHA256:8684A32D1A10D050A26FC33192EDF427A5F0C6874C590A68D77AE6E0D186BD8A
1432iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:57FF045F34286E5DBAFE38DF8CFC3B63
SHA256:F76BEDF90B0B33FE7F0B935A98E17D1DA64CFF07F896829741CFBB62A8CF6332
1432iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAder
MD5:AC89A852C2AAA3D389B2D2DD312AD367
SHA256:0B720E19270C672F9B6E0EC40B468AC49376807DE08A814573FE038779534F45
1432iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_C62530F37AD5C5022195EB4B959CB082der
MD5:61A0D3C1230DE600EEF045BD49ED8744
SHA256:E642A5ADBCFEEA1F001A89130E379CDCB1AEC5C2524E86AB10FE9A7CF892F3C7
1432iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\671481879-analytics_autotrack[1].jstext
MD5:1C4256076FAC77893331DB4F22A9A41A
SHA256:57F24A99B10AD3F6431E857B33B26015C29C4CCCCED30375D222A35F0C4F9BB1
1432iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsiH0B4gaVQ[1].woffwoff
MD5:9C845091C3E04D05FABA9FA0A7DD3F87
SHA256:D4964864E91E640A2B1008F4ECA62CB388DB555A4B1E86FAC028BA01D139DB97
1432iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_279EB7E7074697CADB0A3844954F1B7Dder
MD5:9FC7CAA4EE9366E6EB92A9010DD7B8BA
SHA256:0264C625E06F7B0223A2DBE643208C65DA4D5B5DB686F9E04A73B2F238819482
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
31
TCP/UDP connections
105
DNS requests
42
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1432
iexplore.exe
GET
404
142.250.184.225:80
http://download-bf3.blogspot.com/2011/01/viruses-2010-05-18-tar-bz2.html
unknown
html
43.3 Kb
unknown
1432
iexplore.exe
GET
—
142.250.184.225:80
http://download-bf3.blogspot.com/img/blogger-logotype-color-black-1x.png
unknown
—
—
unknown
1432
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?31edca662c8b6304
unknown
—
—
unknown
1432
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?21e2d5edb0479497
unknown
—
—
unknown
1432
iexplore.exe
GET
200
216.58.212.170:80
http://fonts.googleapis.com/css?family=Open+Sans:300
unknown
text
216 b
unknown
1432
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fb542102ae65dd3e
unknown
—
—
unknown
1432
iexplore.exe
GET
200
216.58.206.36:80
http://www.google.com/css/maia.css
unknown
text
11.9 Kb
unknown
1432
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4088c777bef75a89
unknown
—
—
unknown
1432
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2788e0fe40679967
unknown
—
—
unknown
1432
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?bf012385ffb92421
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1432
iexplore.exe
142.250.184.225:80
download-bf3.blogspot.com
GOOGLE
US
whitelisted
1432
iexplore.exe
216.58.212.170:80
fonts.googleapis.com
GOOGLE
US
whitelisted
1432
iexplore.exe
216.58.206.36:80
www.google.com
GOOGLE
US
whitelisted
1432
iexplore.exe
142.250.184.195:443
ssl.gstatic.com
GOOGLE
US
whitelisted
1432
iexplore.exe
142.250.186.110:443
www.google-analytics.com
GOOGLE
US
whitelisted
1432
iexplore.exe
142.250.181.233:443
www.blogger.com
GOOGLE
US
unknown
1432
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted

DNS requests

Domain
IP
Reputation
download-bf3.blogspot.com
  • 142.250.184.225
unknown
fonts.googleapis.com
  • 216.58.212.170
whitelisted
www.google.com
  • 216.58.206.36
whitelisted
www.blogger.com
  • 142.250.181.233
shared
www.google-analytics.com
  • 142.250.186.110
whitelisted
ssl.gstatic.com
  • 142.250.184.195
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
  • 87.248.204.0
whitelisted
ocsp.pki.goog
  • 142.250.184.227
whitelisted
fonts.gstatic.com
  • 172.217.18.99
whitelisted
www.gstatic.com
  • 172.217.18.3
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://download-bf3.blogspot.com/2011/01/viruses-2010-05-18-tar-bz2.html