analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www.profitabledisplaycontent.com

Full analysis: https://app.any.run/tasks/fb8bf0fe-2eb4-4bd3-9698-99f9038be919
Verdict: Malicious activity
Analysis date: October 05, 2022, 01:40:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

7B76EEA3DD1C7B2DD5FC9B4D2386B683

SHA1:

0112B01843E04D600767CB2B6EB5D72D78415B9E

SHA256:

81AFB4C721D5A1D60A109A0696B8DDC7B5704193177DA86ECF6B2EC58A36ED5E

SSDEEP:

3:N8DSLoDQEuBM6EgRutGTn:2OLGuB6GT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3588)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 3016)
      • iexplore.exe (PID: 3588)

    • Reads the computer name

      • iexplore.exe (PID: 3016)
      • iexplore.exe (PID: 3588)

    • Application launched itself

      • iexplore.exe (PID: 3016)

    • Changes internet zones settings

      • iexplore.exe (PID: 3016)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3016)
      • iexplore.exe (PID: 3588)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3016)
      • iexplore.exe (PID: 3588)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3016)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3016)

    • Creates files in the user directory

      • iexplore.exe (PID: 3588)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3588)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3016"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.profitabledisplaycontent.com"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3588"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3016 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
21 354
Read events
21 237
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
17
Text files
11
Unknown types
11

Dropped files

PID
Process
Filename
Type
3588iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar4FCC.tmpcat
MD5:C75C82DE5128C3E55D72A4FF9C73F5E4
SHA256:379E2F7218F036D70E2C474BF6A09364C5623C1C5F8D5A1A16F1B9B1EC243B55
3588iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:99FBD910B82F6FAF95818662E6FAE872
SHA256:2DD0B7FB2B9E8B30DDE55318F9CEEF2327C7BC78A76F07D7011AD3564B0CFC81
3588iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar4FCA.tmpcat
MD5:C75C82DE5128C3E55D72A4FF9C73F5E4
SHA256:379E2F7218F036D70E2C474BF6A09364C5623C1C5F8D5A1A16F1B9B1EC243B55
3588iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAder
MD5:5A11C6099B9E5808DFB08C5C9570C92F
SHA256:91291A5EDC4E10A225D3C23265D236ECC74473D9893BE5BD07E202D95B3FB172
3588iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab4FB9.tmpcompressed
MD5:D15AAA7C9BE910A9898260767E2490E1
SHA256:F8EBAAF487CBA0C81A17C8CD680BDD2DD8E90D2114ECC54844CFFC0CC647848E
3588iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab4FCB.tmpcompressed
MD5:D15AAA7C9BE910A9898260767E2490E1
SHA256:F8EBAAF487CBA0C81A17C8CD680BDD2DD8E90D2114ECC54844CFFC0CC647848E
3588iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:E71E9198BAB958337F21B502A73C5B4E
SHA256:78C9BC763846859602A23925EAB2BB32607953070068DA53E6E570D3EE72C60F
3588iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:D15AAA7C9BE910A9898260767E2490E1
SHA256:F8EBAAF487CBA0C81A17C8CD680BDD2DD8E90D2114ECC54844CFFC0CC647848E
3588iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:F7983D8FD8DDD6DF665E3E5EB736D1C4
SHA256:173C1E435668AB7C8E2D30A020D2E63D66979911CDF19E0D50F68E697D2CAFC6
3588iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FC563ED0C049F66253FD0EEE62DFF7D8binary
MD5:84BC2CB9641389CF7ADF123A25BE37F2
SHA256:F7B5A248967DAC1112BEAB64E891EEA26AB2644B6F996D1EDBD99CAA6EDB2826
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
30
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3588
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?85ca62d4b52da567
US
compressed
60.9 Kb
whitelisted
3588
iexplore.exe
GET
200
184.24.77.48:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgRE1PrhzPuX3AMZCSUubH6g8Q%3D%3D
US
der
503 b
shared
3588
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?a10dd4976400b3f5
US
compressed
60.9 Kb
whitelisted
3588
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?930d7671152f423d
US
compressed
60.9 Kb
whitelisted
3016
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
3588
iexplore.exe
GET
200
216.58.212.163:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBJBetlj4ZeUEqggpI8HVMI%3D
US
der
471 b
whitelisted
3588
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?00ebef62d5cb671e
US
compressed
4.70 Kb
whitelisted
3588
iexplore.exe
GET
200
96.16.145.230:80
http://x1.c.lencr.org/
US
der
717 b
whitelisted
3588
iexplore.exe
GET
200
216.58.212.163:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQD6a7qQTCYd8hJU9n3M3mXb
US
der
472 b
whitelisted
3588
iexplore.exe
GET
200
216.58.212.163:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3588
iexplore.exe
96.16.145.230:80
x1.c.lencr.org
AKAMAI-AS
DE
suspicious
3016
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3016
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
3588
iexplore.exe
192.243.59.13:443
www.profitabledisplaycontent.com
DataWeb Global Group B.V.
US
malicious
3588
iexplore.exe
184.24.77.48:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown
3588
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
3588
iexplore.exe
172.217.16.206:443
consent.google.com
GOOGLE
US
whitelisted
3588
iexplore.exe
216.58.212.163:80
ocsp.pki.goog
GOOGLE
US
whitelisted
3588
iexplore.exe
142.250.186.142:443
google.com
GOOGLE
US
whitelisted
3588
iexplore.exe
142.250.186.163:443
www.gstatic.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
www.profitabledisplaycontent.com
  • 192.243.59.13
  • 192.243.59.20
  • 192.243.61.225
  • 192.243.59.12
  • 192.243.61.227
suspicious
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
x1.c.lencr.org
  • 96.16.145.230
whitelisted
r3.o.lencr.org
  • 184.24.77.48
  • 184.24.77.54
shared
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
google.com
  • 142.250.186.142
whitelisted
ocsp.pki.goog
  • 216.58.212.163
whitelisted
www.google.com
  • 172.217.18.4
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.profitabledisplaycontent.com