URL:

yg5sjx5kzy.com

Full analysis: https://app.any.run/tasks/600ed557-7d71-4ca7-b794-8865a1207e70
Verdict: Malicious activity
Analysis date: February 20, 2024, 04:59:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

623592D45FED9C2A94B31570B4B70753

SHA1:

11578C6D0AC262EBE9C410B52D94D84D402A70DF

SHA256:

8507CB6E18B9232D11DAB1BB024A7A12AC4EB1B6D29A6CB4E5B4CA4763088384

SSDEEP:

3:z2Mn:qM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Hola-Setup.exe (PID: 2888)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Hola-Setup.exe (PID: 2888)

    • Reads security settings of Internet Explorer

      • Hola-Setup-Core.exe (PID: 1556)
      • Hola-Setup-Core.exe (PID: 2972)

    • Reads settings of System Certificates

      • Hola-Setup-Core.exe (PID: 1556)
      • Hola-Setup-Core.exe (PID: 2972)

    • Checks Windows Trust Settings

      • Hola-Setup-Core.exe (PID: 1556)
      • Hola-Setup-Core.exe (PID: 2972)

    • Adds/modifies Windows certificates

      • Hola-Setup-Core.exe (PID: 1556)

    • Reads the Internet Settings

      • Hola-Setup-Core.exe (PID: 1556)
      • Hola-Setup-Core.exe (PID: 2972)

    • Application launched itself

      • Hola-Setup-Core.exe (PID: 1556)

    • Executes as Windows Service

      • PresentationFontCache.exe (PID: 1792)

  • INFO

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3656)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 3664)
      • iexplore.exe (PID: 3656)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3656)

    • Application launched itself

      • iexplore.exe (PID: 3656)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3664)
      • iexplore.exe (PID: 3656)

    • Manual execution by a user

      • Hola-Setup.exe (PID: 3072)
      • Hola-Setup.exe (PID: 2888)

    • Checks supported languages

      • Hola-Setup.exe (PID: 2888)
      • Hola-Setup-Core.exe (PID: 1556)
      • Hola-Setup-Core.exe (PID: 2972)
      • PresentationFontCache.exe (PID: 1792)

    • Create files in a temporary directory

      • Hola-Setup.exe (PID: 2888)
      • Hola-Setup-Core.exe (PID: 1556)
      • Hola-Setup-Core.exe (PID: 2972)

    • Reads the machine GUID from the registry

      • Hola-Setup-Core.exe (PID: 1556)
      • Hola-Setup-Core.exe (PID: 2972)
      • PresentationFontCache.exe (PID: 1792)

    • Reads the software policy settings

      • Hola-Setup-Core.exe (PID: 1556)
      • Hola-Setup-Core.exe (PID: 2972)

    • Reads the computer name

      • Hola-Setup-Core.exe (PID: 1556)
      • Hola-Setup-Core.exe (PID: 2972)
      • PresentationFontCache.exe (PID: 1792)

    • Reads Environment values

      • Hola-Setup-Core.exe (PID: 1556)
      • Hola-Setup-Core.exe (PID: 2972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe hola-setup.exe no specs hola-setup.exe hola-setup-core.exe hola-setup-core.exe presentationfontcache.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1556.\Hola-Setup-Core.exeC:\Users\admin\AppData\Local\Temp\7zSA081.tmp\Hola-Setup-Core.exe
Hola-Setup.exe
User:
admin
Company:
Hola Networks Ltd.
Integrity Level:
HIGH
Description:
Hola VPN Setup
Exit code:
0
Version:
1.0.8678.23934
Modules
Images
c:\users\admin\appdata\local\temp\7zsa081.tmp\hola-setup-core.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1792C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exeC:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe—services.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
PresentationFontCache.exe
Exit code:
0
Version:
3.0.6920.4902 built by: NetFXw7
Modules
Images
c:\windows\microsoft.net\framework\v3.0\wpf\presentationfontcache.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2888"C:\Users\admin\Downloads\Hola-Setup.exe" C:\Users\admin\Downloads\Hola-Setup.exe
explorer.exe
User:
admin
Company:
Hola Networks Ltd.
Integrity Level:
HIGH
Description:
Hola Setup
Exit code:
0
Version:
1.0.8678.23934
Modules
Images
c:\users\admin\downloads\hola-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2972".\Hola-Setup-Core.exe" --monitor 1540C:\Users\admin\AppData\Local\Temp\7zSA081.tmp\Hola-Setup-Core.exe
Hola-Setup-Core.exe
User:
admin
Company:
Hola Networks Ltd.
Integrity Level:
HIGH
Description:
Hola VPN Setup
Exit code:
0
Version:
1.0.8678.23934
Modules
Images
c:\users\admin\appdata\local\temp\7zsa081.tmp\hola-setup-core.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3072"C:\Users\admin\Downloads\Hola-Setup.exe" C:\Users\admin\Downloads\Hola-Setup.exe—explorer.exe
User:
admin
Company:
Hola Networks Ltd.
Integrity Level:
MEDIUM
Description:
Hola Setup
Exit code:
3221226540
Version:
1.0.8678.23934
Modules
Images
c:\users\admin\downloads\hola-setup.exe
c:\windows\system32\ntdll.dll
3656"C:\Program Files\Internet Explorer\iexplore.exe" "yg5sjx5kzy.com"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3664"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3656 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
33 285
Read events
33 057
Write events
159
Delete events
69

Modification events

(PID) Process:(3656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31089593
(PID) Process:(3656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31089593
(PID) Process:(3656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
7
Suspicious files
14
Text files
23
Unknown types
3

Dropped files

PID
Process
Filename
Type
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FDCC27A142E421CAE33B19B381FB4D2Dbinary
MD5:F2971BAF0DD40E57DBE2C03DDF346C35
SHA256:8B38C93C4BA7433420F7ACCD749B892D4341C7BC464696E5BD4072B9229D8AC7
3664iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\YKEZUMG5.htmhtml
MD5:6E1E6142413667DE627BD1E6089770CC
SHA256:7748EC9758B70C24B75FB04BEFACFB67B3DD93D93D7549E17C31D2864F080DDE
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:FB91282DC5831423662AA292CD50B11D
SHA256:2D0446B084643851B51B16C2EEE1D986C0F06ED76DDF056C170B544A53944B03
3656iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Abinary
MD5:AC067709550F61023F60893431B341E8
SHA256:974CF6271F788C0EC06C5009E85BFBBAFB29E29D86D0DE3F80812A2D45DAD557
3656iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\imagestore\f7ruq93\imagestore.datbinary
MD5:201F4AFC61E6BA7E7470F283C168AA90
SHA256:23F63E5C41502A9BEF8CBE5CF050A3B011CD56D4E5ED685F9B3B129B6CF208BE
3656iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Abinary
MD5:6A38D1DC35006AF835BE0358D10947DF
SHA256:726572A5C1A8ADDA8D4A80794C42A80FB3CAA345AEA71D0B189CDEE3910902CC
3664iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\map[1].pngimage
MD5:7122E8CD8DD40D0F9540DF0E394D032B
SHA256:09002156F6765153613086EFA9082601505BF2B8784B023361264B6C73367F41
3656iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
3656iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\favicon[2].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
3656iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
45
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3664
iexplore.exe
GET
302
107.22.193.119:80
http://yg5sjx5kzy.com/
unknown
html
138 b
unknown
3664
iexplore.exe
GET
304
23.32.238.219:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?148aa66c17cd606b
unknown
—
—
unknown
3664
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
binary
1.42 Kb
unknown
3664
iexplore.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
binary
2.18 Kb
unknown
3664
iexplore.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQCkPYbZy1zGfVhAfBmc5PBx
unknown
binary
472 b
unknown
3656
iexplore.exe
GET
304
23.32.238.219:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?70d85e3b0e586cab
unknown
—
—
unknown
3656
iexplore.exe
GET
304
23.32.238.219:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b23edf5cfbe16fd7
unknown
—
—
unknown
3656
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
3656
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
312 b
unknown
3656
iexplore.exe
GET
—
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3664
iexplore.exe
107.22.193.119:80
yg5sjx5kzy.com
AMAZON-AES
US
unknown
3664
iexplore.exe
107.22.193.119:443
yg5sjx5kzy.com
AMAZON-AES
US
unknown
3664
iexplore.exe
23.32.238.219:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3664
iexplore.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown
3664
iexplore.exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
shared
3664
iexplore.exe
169.150.247.38:443
cdn4.yg5sjx5kzy.com
—
GB
unknown
3656
iexplore.exe
107.22.193.119:443
yg5sjx5kzy.com
AMAZON-AES
US
unknown

DNS requests

Domain
IP
Reputation
yg5sjx5kzy.com
  • 107.22.193.119
  • 54.225.121.9
unknown
ctldl.windowsupdate.com
  • 23.32.238.219
  • 23.32.238.226
  • 23.32.238.232
  • 23.32.238.178
  • 23.32.238.208
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.sectigo.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
cdn4.yg5sjx5kzy.com
  • 169.150.247.38
unknown
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.179
  • 104.126.37.160
  • 104.126.37.161
  • 104.126.37.177
  • 104.126.37.163
  • 104.126.37.176
  • 104.126.37.128
  • 104.126.37.130
  • 104.126.37.131
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
Process
Message
Hola-Setup-Core.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
Hola-Setup-Core.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
Hola-Setup-Core.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
Hola-Setup-Core.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
Hola-Setup-Core.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
Hola-Setup-Core.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
Hola-Setup-Core.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
Hola-Setup-Core.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
Hola-Setup-Core.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
Hola-Setup-Core.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
yg5sjx5kzy.com