analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://yourpnncom.site/login.php?cmd=login_submit&id=8832ae39136fb470b3fbbf9f47b4570d8832ae39136fb470b3fbbf9f47b4570d&session=8832ae39136fb470b3fbbf9f47b4570d8832ae39136fb470b3fbbf9f47b4570d

Full analysis: https://app.any.run/tasks/968fa483-8524-40a7-a0c0-7bd4d43eea05
Verdict: Malicious activity
Analysis date: December 06, 2018, 16:41:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

451C236A961F8E01DED4E9A683949196

SHA1:

93830EC44A212C866C49AFF4770084D12F86D7BE

SHA256:

838AAA7E2F92A46162F8932B79863E26E6B5CC2D6598BE7C8B9A164788153A70

SSDEEP:

3:N1KHp/QRRKPPVNJJGQoQD9dUUAbrDH0oVBoRrDH0oVByLlWZbrDH0oVBoRrDH0or:CxvPPVVHIZvxopx2lWZvxopxn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 3512)

    • Application launched itself

      • iexplore.exe (PID: 3512)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3792)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3792)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
32
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3512"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3792"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3512 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
381
Read events
319
Write events
59
Delete events
3

Modification events

(PID) Process:(3512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(3512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{DD8EAC8B-F975-11E8-834A-5254004A04AF}
Value:
0
(PID) Process:(3512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(3512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
3
(PID) Process:(3512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E2070C000400060010002A000700C101
Executable files
0
Suspicious files
0
Text files
8
Unknown types
2

Dropped files

PID
Process
Filename
Type
3512iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
3512iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3792iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\button_locatePNC[1].pngimage
MD5:85B330743A4F2D4C78619B98E2B86BA9
SHA256:4690E4F3F5ACA58D5AD6805DA5FC3D395BA5F7A418D57EF060C01C25453CAB52
3792iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\button_signOn[1].pngimage
MD5:50B67B294149D39076AD54AE20708EB2
SHA256:90B8F5F31E649AEE7EE98455C6F06EC95EE14CA5F5FAA8A86308AE40A9F1CF3C
3792iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012018120620181207\index.datdat
MD5:050E33F463B97C950F677E0F3D2357E2
SHA256:84F0E729347A7B35DB7C50C38158354EC761AA85027DE3A7084A0B03F6F0909B
3792iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\login[1].htmhtml
MD5:17B72C4317AB39372C0BC5556ACCF15D
SHA256:E09C9A2F7756CD32A692D949C992D64B0A433DFD33B052F24F2E6AA5F5F9D197
3512iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\favicon[1].icoimage
MD5:BB3C43BB251F059AE122DFA2D22910AB
SHA256:B0024D29EEA9E098122459E2116CFB4EC0E2792FC169AA5E3F3E04C51DB4C5B6
3792iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\button_aboutPNCmobile[1].pngimage
MD5:E4D23562AB75DBE4ABD860CAD9AAFF0C
SHA256:6C6C24E8FA7714F42FDAF29DAA5977CF485523473FD54BCE763A14B5B1A2D5C3
3512iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012018120620181207\index.datdat
MD5:D96498BE743679F4F410C8F053ED2CE5
SHA256:1F94D215E96CE059373D3F827EBD343D2FA96B98A2AF10D5714AEBADA96A8DDA
3792iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\header_lg[1].jpgimage
MD5:1622C5C8532D40D7DE43A24C2B4379FF
SHA256:ACBF87594A100FEC775F07670CA078830124B9C7CD60846B467EF1E20567E962
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
6
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3792
iexplore.exe
GET
200
191.209.26.45:80
http://yourpnncom.site/button_signOn.png
BR
image
1.55 Kb
malicious
3792
iexplore.exe
GET
200
191.209.26.45:80
http://yourpnncom.site/header_lg.jpg
BR
image
5.14 Kb
malicious
3792
iexplore.exe
GET
200
191.209.26.45:80
http://yourpnncom.site/login.php?cmd=login_submit&id=8832ae39136fb470b3fbbf9f47b4570d8832ae39136fb470b3fbbf9f47b4570d&session=8832ae39136fb470b3fbbf9f47b4570d8832ae39136fb470b3fbbf9f47b4570d
BR
html
4.62 Kb
malicious
3792
iexplore.exe
GET
200
191.209.26.45:80
http://yourpnncom.site/button_aboutPNCmobile.png
BR
image
2.07 Kb
malicious
3512
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
3512
iexplore.exe
GET
200
191.209.26.45:80
http://yourpnncom.site/favicon.ico
BR
image
4.19 Kb
malicious
3792
iexplore.exe
GET
200
191.209.26.45:80
http://yourpnncom.site/button_locatePNC.png
BR
image
1.65 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3512
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3512
iexplore.exe
191.209.26.45:80
yourpnncom.site
TELEFÔNICA BRASIL S.A
BR
suspicious
3792
iexplore.exe
191.209.26.45:80
yourpnncom.site
TELEFÔNICA BRASIL S.A
BR
suspicious

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
yourpnncom.site
  • 191.209.26.45
malicious

Threats

PID
Process
Class
Message
3792
iexplore.exe
A Network Trojan was detected
SC PHISHING PDF/Phishing - unknown malware
3792
iexplore.exe
A Network Trojan was detected
MALWARE [PTsecurity] Google Drive Phishing Landing
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://yourpnncom.site/login.php?cmd=login_submit&id=8832ae39136fb470b3fbbf9f47b4570d8832ae39136fb470b3fbbf9f47b4570d&session=8832ae39136fb470b3fbbf9f47b4570d8832ae39136fb470b3fbbf9f47b4570d