analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://www.alliance-2022.com/

Full analysis: https://app.any.run/tasks/9e7493c1-248e-43eb-afb4-e7fa399c0144
Verdict: Malicious activity
Analysis date: January 24, 2022, 15:32:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

331A4A2872E2CF1E91D092FF4B74952C

SHA1:

DE702A9D8C8DD0C6F8543F4AF5FC1E7A9A4B26B7

SHA256:

813A75853DCCA1D1121012AE8BCA81B787AE17D3E33261D83B20CF976445D520

SSDEEP:

3:N1KJS4MMaqVXbGG:Cc4MMaqVrGG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3284)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 1536)
      • iexplore.exe (PID: 3284)

    • Reads the computer name

      • iexplore.exe (PID: 1536)
      • iexplore.exe (PID: 3284)

    • Application launched itself

      • iexplore.exe (PID: 1536)

    • Changes internet zones settings

      • iexplore.exe (PID: 1536)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3284)
      • iexplore.exe (PID: 1536)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 1536)
      • iexplore.exe (PID: 3284)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1536)

    • Creates files in the user directory

      • iexplore.exe (PID: 3284)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3284)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1536)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1536"C:\Program Files\Internet Explorer\iexplore.exe" "http://www.alliance-2022.com/"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3284"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1536 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\version.dll
Total events
11 326
Read events
11 197
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
12
Text files
22
Unknown types
12

Dropped files

PID
Process
Filename
Type
3284iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\016CC90FDFF5AB6D1CA83FDB93EA6642binary
MD5:EBE429C0E3D68BB5A6DBFF531E01A2B8
SHA256:F06BF67298717E0B0F1CE10226920A666754F28AE6A113B3BB05835BBE3BE0BF
3284iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:93AFDFCBB8363C9F8021E242C3824B45
SHA256:86826DDCDD879D669FA986B20B36FEDF445BF99374DF4A2AFB7DC340BA867B42
3284iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:2AEFCF4172B24E513CF373B8C9F10BF2
SHA256:3951DB69BB7F7070C3E2C7F1DF9376B71A9A3D54534D9A4ED63F079A71C62FC2
1536iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:8AF7377FFF6DC33F77DC9928D0634E95
SHA256:06DA19F6F837F8E7FE97B615414442C129FA3B54EA5B705155392DC654600B4C
3284iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\JBRLR9CF.htmhtml
MD5:7CE7C7E075990F85AF99BA64F4E20CA7
SHA256:0329202416FECBCDD6CC08293DA971B4FE55268FAF0D6CB3222D96D1D9E24214
3284iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\main-6f3a47b3c5[1].jstext
MD5:6F3A47B3C53EFB9B230184CCBC0588F8
SHA256:17FFB1C9CE77613587161FF9A529C0B120981F6D963CAAD3CD2AA3ECEA433A8A
3284iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\016CC90FDFF5AB6D1CA83FDB93EA6642der
MD5:766F04900E2629D6BC736163F28D537D
SHA256:E81F427771B5CE4F9A5F2524DD37AF23FEE470745CE591F845A70F4AFA462C60
3284iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\mitsubishi-black[1].svgimage
MD5:0D8842E96D9260D57082CDB69E96DED7
SHA256:34090A68B7F6C372EAE21DB63E011BA736C68F8B8DB3C5AB2A4786BAD4B8F55D
3284iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dder
MD5:3764883055DA6FFC81E4A929CA5072C1
SHA256:7FF45E2195491FA6A2F3CECEE4B52D9E964CB6719448431B1C7B702E98076920
3284iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Eder
MD5:49639B4124119DFEB7616D8DD50F9BB7
SHA256:7F935C9D0A9BD17558459D5A6387B61452011BEA4589AD94A6F2435540A373B5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
35
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1536
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3284
iexplore.exe
GET
200
104.18.31.182:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEBjb7JF8nw75nxZP8Yam5Xg%3D
US
der
471 b
whitelisted
3284
iexplore.exe
GET
200
104.18.30.182:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
3284
iexplore.exe
GET
200
104.18.31.182:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
3284
iexplore.exe
GET
301
143.204.98.120:80
http://www.alliance-2022.com/
US
html
183 b
malicious
1536
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3284
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC2PrP09fGo%2BgoAAAABK3x6
US
der
472 b
whitelisted
3284
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
3284
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
3284
iexplore.exe
GET
200
8.248.143.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5808ba936ca84f66
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1536
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
1536
iexplore.exe
13.107.22.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3284
iexplore.exe
143.204.98.120:443
www.alliance-2022.com
—
US
suspicious
3284
iexplore.exe
143.204.98.120:80
www.alliance-2022.com
—
US
suspicious
3284
iexplore.exe
104.18.30.182:80
ocsp.comodoca.com
Cloudflare Inc
US
suspicious
3284
iexplore.exe
8.248.143.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
malicious
1536
iexplore.exe
143.204.98.120:443
www.alliance-2022.com
—
US
suspicious
3284
iexplore.exe
104.18.31.182:80
ocsp.comodoca.com
Cloudflare Inc
US
unknown
1536
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3284
iexplore.exe
142.250.184.195:80
ocsp.pki.goog
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.alliance-2022.com
  • 143.204.98.120
  • 143.204.98.17
  • 143.204.98.119
  • 143.204.98.36
malicious
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 13.107.22.200
  • 131.253.33.200
whitelisted
ctldl.windowsupdate.com
  • 8.248.143.254
  • 8.253.207.121
  • 8.248.133.254
  • 67.26.81.254
  • 8.248.145.254
  • 209.197.3.8
whitelisted
ocsp.comodoca.com
  • 104.18.30.182
  • 104.18.31.182
whitelisted
ocsp.usertrust.com
  • 104.18.31.182
  • 104.18.30.182
whitelisted
ocsp.sectigo.com
  • 104.18.31.182
  • 104.18.30.182
whitelisted
code.jquery.com
  • 69.16.175.42
  • 69.16.175.10
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
www.google-analytics.com
  • 172.217.18.110
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://www.alliance-2022.com/