analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://cosmeticsrc.com

Full analysis: https://app.any.run/tasks/d6976a34-be3c-401f-91e0-11dc04413e78
Verdict: Malicious activity
Analysis date: October 19, 2020, 22:48:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

D89DCBD12AF3E179CC6B354C62C13BB3

SHA1:

3846F27440FF0F32229E1ABC98D84F3F9CAD7A6B

SHA256:

80936C7B73F71B5D44AC998E036B4A9B21E88EE63A2EDDE61D43AE7013095CAF

SSDEEP:

3:N8XP1BMK:2NBMK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 628)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 628)
      • iexplore.exe (PID: 352)

    • Changes internet zones settings

      • iexplore.exe (PID: 628)

    • Reads internet explorer settings

      • iexplore.exe (PID: 352)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 628)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 352)
      • iexplore.exe (PID: 628)

    • Changes settings of System certificates

      • iexplore.exe (PID: 628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
628"C:\Program Files\Internet Explorer\iexplore.exe" https://cosmeticsrc.comC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
352"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:628 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Total events
694
Read events
619
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
14
Text files
10
Unknown types
7

Dropped files

PID
Process
Filename
Type
628iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
352iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabA84E.tmp —
MD5:—
SHA256:—
352iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\TarA84F.tmp —
MD5:—
SHA256:—
628iexplore.exeC:\Users\admin\AppData\Local\Temp\CabBC82.tmp —
MD5:—
SHA256:—
628iexplore.exeC:\Users\admin\AppData\Local\Temp\TarBC92.tmp —
MD5:—
SHA256:—
628iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verBCB3.tmp —
MD5:—
SHA256:—
352iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08der
MD5:AF315FA1A389D30310D95403D7DC486E
SHA256:E080E402317DE429DC4A761928298D49107D3D7CDCEDBB0BA06AA90CC214C501
352iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E1AEE17C638D2F23C9B17E5C38BD91D1binary
MD5:A58FD69848FE50DACF20DFB94E10CA19
SHA256:499459CF7505725AA372A099A0C613746A08C13697CFC18177C19DA04FF659C1
352iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DATsmt
MD5:9C79052CD4702AB47E3269B42E873AC7
SHA256:27174FF21A72F50A2731A7454133B29C2397AA53ABD8848C6FED36A36F0E25EE
352iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08binary
MD5:1AB326DD39D81277146E62E5AE56429B
SHA256:CBF8802B501C3E1CC4D31364F5EF44BA7DCE43A4ACA07D147E7698D0E3B376A6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
19
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
352
iexplore.exe
GET
200
95.100.39.43:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
DE
der
1.37 Kb
whitelisted
628
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
352
iexplore.exe
GET
200
95.100.39.43:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
DE
der
1.37 Kb
whitelisted
628
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
628
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
628
iexplore.exe
GET
200
13.107.21.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
352
iexplore.exe
GET
200
72.247.185.67:80
http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgTUULGa6iuJ59TVfhClU89%2Bpg%3D%3D
NL
der
527 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
628
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
352
iexplore.exe
95.100.39.59:80
ocsp.int-x3.letsencrypt.org
Akamai International B.V.
DE
whitelisted
352
iexplore.exe
172.241.69.4:443
cosmeticsrc.com
—
NL
malicious
352
iexplore.exe
95.100.39.43:80
isrg.trustid.ocsp.identrust.com
Akamai International B.V.
DE
whitelisted
352
iexplore.exe
23.111.228.4:443
cosmeticsrc.com
—
NL
malicious
628
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
352
iexplore.exe
72.247.185.67:80
ocsp.int-x3.letsencrypt.org
Akamai International B.V.
NL
unknown
—
—
13.107.21.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
628
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
cosmeticsrc.com
  • 172.241.69.4
  • 23.111.228.4
  • 23.111.228.220
  • 172.241.69.28
  • 64.58.126.236
  • 172.241.69.20
  • 64.58.121.60
malicious
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
isrg.trustid.ocsp.identrust.com
  • 95.100.39.43
  • 95.100.39.48
whitelisted
ocsp.int-x3.letsencrypt.org
  • 95.100.39.59
  • 72.247.185.67
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://cosmeticsrc.com