analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://txtme.page/tdv

Full analysis: https://app.any.run/tasks/b14a3cb9-314e-4909-a429-c48176e59114
Verdict: Malicious activity
Analysis date: August 12, 2022, 14:06:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

AA3E67DAE1088222F7451738E26D2806

SHA1:

B5ED7D30FD1F698FABFC9BBE8D3CCB7F80FFC8A0

SHA256:

7EFB25BBF0F7F9B886EF905301179A3D2A4617C5EE040CCB3721D5635BA7DE27

SSDEEP:

3:N8VR9LuDKnT:279LSKT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2892)
      • iexplore.exe (PID: 2592)
      • iexplore.exe (PID: 3416)
      • iexplore.exe (PID: 692)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 2592)
      • iexplore.exe (PID: 2892)
      • iexplore.exe (PID: 3416)
      • iexplore.exe (PID: 692)

    • Checks supported languages

      • iexplore.exe (PID: 2592)
      • iexplore.exe (PID: 2892)
      • iexplore.exe (PID: 3416)
      • iexplore.exe (PID: 692)

    • Changes internet zones settings

      • iexplore.exe (PID: 2592)

    • Application launched itself

      • iexplore.exe (PID: 2592)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2892)
      • iexplore.exe (PID: 2592)
      • iexplore.exe (PID: 692)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2892)
      • iexplore.exe (PID: 2592)
      • iexplore.exe (PID: 692)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2892)
      • iexplore.exe (PID: 3416)
      • iexplore.exe (PID: 692)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2592)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2592)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iexplore.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2592"C:\Program Files\Internet Explorer\iexplore.exe" "https://txtme.page/tdv"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2892"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2592 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3416"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2592 CREDAT:3806480 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
692"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2592 CREDAT:4003117 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\version.dll
c:\windows\system32\rpcrt4.dll
Total events
32 401
Read events
32 154
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
37
Text files
54
Unknown types
31

Dropped files

PID
Process
Filename
Type
2592iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:29D19A9B85F8A57E8048C7ACB0B3B750
SHA256:6CE2FA0346BB765839DC53BA887563618296E9D79C4DE036D2148EFAF72367D6
2892iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:589C442FC7A0C70DCA927115A700D41E
SHA256:2E5CB72E9EB43BAAFB6C6BFCC573AAC92F49A8064C483F9D378A9E8E781A526A
2892iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\TarA698.tmpcat
MD5:7EE994C83F2744D702CBA18693ED1758
SHA256:5DB917AB6DC8A42A43617850DFBE2C7F26A7F810B229B349E9DD2A2D615671D2
2892iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabA697.tmpcompressed
MD5:589C442FC7A0C70DCA927115A700D41E
SHA256:2E5CB72E9EB43BAAFB6C6BFCC573AAC92F49A8064C483F9D378A9E8E781A526A
2892iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61binary
MD5:968C977C8BB779EAC354E99EA7EC38F0
SHA256:C4E5BC2A719A3D3C37A787884D200454DD9C1D2686A5C791C13E8564ABB31007
2592iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:90AEEB0C6728E479806072454BB82FAE
SHA256:B449E7E318E9093B171319E3446516AB9D2E25D0A4F1396647F4B084DC26D6B4
2892iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:3B552AB501AA6742C9F84AD9000DB6A1
SHA256:61FAC459EF428E1BE779E199E5F2E94F89AE3D96678FD20C0B608FD35BFC0B44
2892iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\TarA6AA.tmpcat
MD5:7EE994C83F2744D702CBA18693ED1758
SHA256:5DB917AB6DC8A42A43617850DFBE2C7F26A7F810B229B349E9DD2A2D615671D2
2892iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:FF704D89C2640263F59941B5CB203F66
SHA256:369D5ACE6E255F32D8844CA69AEDE587DD652F061B409EE9673A600A4BF3E475
2892iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabA6A9.tmpcompressed
MD5:589C442FC7A0C70DCA927115A700D41E
SHA256:2E5CB72E9EB43BAAFB6C6BFCC573AAC92F49A8064C483F9D378A9E8E781A526A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
75
DNS requests
35
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2592
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
2892
iexplore.exe
GET
200
96.16.145.230:80
http://x2.c.lencr.org/
US
der
300 b
whitelisted
2892
iexplore.exe
GET
200
13.107.4.50:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c412a69be32e3d1a
US
compressed
60.2 Kb
whitelisted
2892
iexplore.exe
GET
200
184.24.77.76:80
http://e1.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTvkAFw3ViPKmUeIVEf3NC7b1ErqwQUWvPtK%2Fw2wjd5uVIw6lRvz1XLLqwCEgQKu%2FWVw9LluJHY1qUcR3Dyfw%3D%3D
US
der
345 b
whitelisted
2892
iexplore.exe
GET
200
13.107.4.50:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?badbd1bf4833b5f0
US
compressed
60.2 Kb
whitelisted
692
iexplore.exe
GET
200
192.124.249.41:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
US
der
1.69 Kb
whitelisted
692
iexplore.exe
GET
200
104.18.32.68:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEBN9U5yqfDGppDNwGWiEeo0%3D
US
der
2.18 Kb
whitelisted
2592
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
692
iexplore.exe
GET
200
192.124.249.41:80
http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D
US
der
1.66 Kb
whitelisted
2892
iexplore.exe
GET
200
96.16.145.230:80
http://x1.c.lencr.org/
US
der
717 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2592
iexplore.exe
131.253.33.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2892
iexplore.exe
13.107.4.50:80
ctldl.windowsupdate.com
Microsoft Corporation
US
whitelisted
2892
iexplore.exe
172.67.207.85:443
txtme.page
—
US
malicious
2592
iexplore.exe
13.107.4.50:80
ctldl.windowsupdate.com
Microsoft Corporation
US
whitelisted
2892
iexplore.exe
96.16.145.230:80
x1.c.lencr.org
Akamai Technologies, Inc.
US
suspicious
2892
iexplore.exe
184.24.77.76:80
e1.o.lencr.org
Time Warner Cable Internet LLC
US
suspicious
2592
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
692
iexplore.exe
172.67.207.85:443
txtme.page
—
US
malicious
2592
iexplore.exe
152.199.19.161:443
r20swj13mr.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
692
iexplore.exe
104.18.32.68:80
ocsp.comodoca.com
Cloudflare Inc
US
suspicious

DNS requests

Domain
IP
Reputation
txtme.page
  • 172.67.207.85
  • 104.21.85.159
unknown
ctldl.windowsupdate.com
  • 13.107.4.50
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 131.253.33.200
  • 13.107.22.200
  • 13.107.21.200
  • 204.79.197.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
x1.c.lencr.org
  • 96.16.145.230
whitelisted
x2.c.lencr.org
  • 96.16.145.230
whitelisted
e1.o.lencr.org
  • 184.24.77.76
  • 184.24.77.54
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted

Threats

Found threats are available for the paid subscriptions
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://txtme.page/tdv