analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| URL: | http://gg.gg/ORuedL |
| Full analysis: | https://app.any.run/tasks/fb9f6a28-b30e-4716-8179-ef37b5ee0e2e |
| Verdict: | Malicious activity |
| Analysis date: | December 03, 2019, 01:03:00 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 7FD7ABCDD579061DF0A2E771000CC6EB |
| SHA1: | 30234D65746139C434AC11FB9DFE6E7438A0D42E |
| SHA256: | 83A0374EB2F46A74680A35E07544553522BF53335341BDB206916371EF5371A0 |
| SSDEEP: | 3:N1KZCLBKq7p:C8QO |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
Reads Internet Cache Settings
- iexplore.exe (PID: 444)
Reads settings of System Certificates
- iexplore.exe (PID: 3912)
- iexplore.exe (PID: 444)
Creates files in the user directory
- iexplore.exe (PID: 444)
- iexplore.exe (PID: 3912)
Reads internet explorer settings
- iexplore.exe (PID: 444)
Application launched itself
- iexplore.exe (PID: 3912)
Changes internet zones settings
- iexplore.exe (PID: 3912)
Changes settings of System certificates
- iexplore.exe (PID: 3912)
Adds / modifies Windows certificates
- iexplore.exe (PID: 3912)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
35
Monitored processes
2
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 3912 | "C:\Program Files\Internet Explorer\iexplore.exe" "http://gg.gg/ORuedL" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 444 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3912 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
Total events
414
Read events
338
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
28
Unknown types
7
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3912 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 3912 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 444 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MRMUZI46\dl3_sharefiles-en_com[1].txt | — | |
MD5:— | SHA256:— | |||
| 444 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.dat | dat | |
MD5:EE7C06410D114EB2E1CE2592DBE6C0B8 | SHA256:D81BAF09088F585027FFE64CC33C818F6052BB31D69406B689A2B3FA27623E4A | |||
| 444 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\XXBIHXVG\d0b13d7b18c18a26b56c[1].js | text | |
MD5:A1C6655A13C6F1E1BBB7C2461C469B18 | SHA256:BAC6BC1EFBD609095CB073F57C995AA33529055FB341F9B8D7A1E50D3612CC7C | |||
| 444 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:831EDF0F3806FBFF20C5462485F78899 | SHA256:BF1F2511BF70BA15261CA105EA2719463BC5BD66D66E216915C0AC2B0A52F5E1 | |||
| 444 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\JPSX67XC\3ac2a94475dfbabc31fc[1].js | text | |
MD5:AF3FD3C8FB378DB2AC02E6385F60B3DE | SHA256:2051EFF6E1FC2629EC620C71E20E2F0237BB5E7D9D1E2055E16BD32E2A27D9AE | |||
| 444 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MRMUZI46\14e2ca9cf38be418e34f[1].js | text | |
MD5:1420CE8F1641B5487C408A1477227EE8 | SHA256:81F759A01671DB8F9A04DF884878305847C99DC2F27F020827DD8E698D5C9AA0 | |||
| 444 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\ZRY3YNWV\771c33cbffb5e58f8dc2[1].js | text | |
MD5:4483F4D2876485221741F4F46443D65C | SHA256:B78A84405876D75997B9C047CEBD313CE91DEB429729CFEB34A711B462F8F691 | |||
| 444 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\JPSX67XC\0807127b1e3448f678fc[1].js | text | |
MD5:523C4A4467422997E2C280EA08A9B938 | SHA256:EC2A43CCAFA6E2665BE2D500BF5DCC3CC0C6CA340ADFA33912DF0F7CEDC10FBE | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
17
DNS requests
8
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
444 | iexplore.exe | GET | 301 | 91.224.140.71:80 | http://gg.gg/ORuedL | NL | — | — | shared |
3912 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3912 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
444 | iexplore.exe | 88.99.66.31:443 | iplogger.org | Hetzner Online GmbH | DE | malicious |
444 | iexplore.exe | 91.224.140.71:80 | gg.gg | Innovation IT Solutions LTD | NL | suspicious |
— | — | 151.101.2.110:443 | js-agent.newrelic.com | Fastly | US | suspicious |
444 | iexplore.exe | 162.216.250.12:443 | datagrtpd.egnyte.com | Bloomip Inc. | NL | unknown |
444 | iexplore.exe | 66.42.32.158:443 | dl3.sharefiles-en.com | — | US | unknown |
3912 | iexplore.exe | 66.42.32.158:443 | dl3.sharefiles-en.com | — | US | unknown |
444 | iexplore.exe | 162.247.242.21:443 | bam.nr-data.net | New Relic | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
gg.gg |
| shared |
dl3.sharefiles-en.com |
| unknown |
www.bing.com |
| whitelisted |
iplogger.org |
| shared |
datagrtpd.egnyte.com |
| unknown |
sharefiles-en.com |
| unknown |
js-agent.newrelic.com |
| whitelisted |
bam.nr-data.net |
| whitelisted |
Threats
3 ETPRO signatures available at the full report