analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://www.xxgasm.com

Full analysis: https://app.any.run/tasks/223c14c3-5c54-4530-9824-c1abbd5be3df
Verdict: Malicious activity
Analysis date: February 15, 2022, 04:44:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

59AE7E0FB271AAD1E8EFFFCF2CA0CBED

SHA1:

AAF189BA7DADC4FFF004721A072CBCD86C32DB1C

SHA256:

8611E87714C41C66277EB07DACA0104A78BDA45124DE9ACD3E36F2715F031964

SSDEEP:

3:N1KJS4/W2dIn:Cc4/On

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3788)

    • Checks supported languages

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 2304)

    • Reads the computer name

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 2304)

    • Executed via COM

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 2304)

    • Creates files in the user directory

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 2304)

  • INFO

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2188)
      • iexplore.exe (PID: 3788)

    • Reads the computer name

      • iexplore.exe (PID: 3788)
      • iexplore.exe (PID: 2188)

    • Application launched itself

      • iexplore.exe (PID: 2188)

    • Changes internet zones settings

      • iexplore.exe (PID: 2188)

    • Checks supported languages

      • iexplore.exe (PID: 2188)
      • iexplore.exe (PID: 3788)

    • Creates files in the user directory

      • iexplore.exe (PID: 2188)
      • iexplore.exe (PID: 3788)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3788)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2188)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2188)
      • iexplore.exe (PID: 3788)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2188)

    • Reads CPU info

      • iexplore.exe (PID: 3788)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
3
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe flashutil32_32_0_0_453_activex.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2188"C:\Program Files\Internet Explorer\iexplore.exe" "http://www.xxgasm.com"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3788"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2188 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2304C:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe
Integrity Level:
MEDIUM
Description:
Adobe� Flash� Player Installer/Uninstaller 32.0 r0
Version:
32,0,0,453
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_32_0_0_453_activex.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
26 643
Read events
26 408
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
39
Text files
147
Unknown types
43

Dropped files

PID
Process
Filename
Type
2188iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:0EDB00115298FCB1B0861694D7C2AC93
SHA256:AC01D5DB93DA4BAE25175BAB4BC8A7DD18FE5643EB6969F17FE8AFA0884EF1EB
3788iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar80E5.tmpcat
MD5:D99661D0893A52A0700B8AE68457351A
SHA256:BDD5111162A6FA25682E18FA74E37E676D49CAFCB5B7207E98E5256D1EF0D003
3788iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751der
MD5:54E9306F95F32E50CCD58AF19753D929
SHA256:45F94DCEB18A8F738A26DA09CE4558995A4FE02B971882E8116FC9B59813BB72
3788iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:4EE0F8E5EE003DD498FC11558E14EAB3
SHA256:43E983B92DEBAC4BCAE4E260D246C42044A334DE7F23560D3DF491CDFF52B2BA
3788iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar80E7.tmpcat
MD5:D99661D0893A52A0700B8AE68457351A
SHA256:BDD5111162A6FA25682E18FA74E37E676D49CAFCB5B7207E98E5256D1EF0D003
2188iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:C1845CEC77F0BA7419C571DCF0DB7654
SHA256:B71C03985D9F86E965A120398820E2EE195FB3D62BC7D77DF3C9B980E366F752
3788iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C1008DA0CAF9226FE08DADE21B054C47binary
MD5:CB0BAB53040568175DCA0EE08A2641BF
SHA256:0959508F64362C176D4393D69EC0CFD4991F2FE699433F46A36DE75297EA2068
3788iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:054CE317AC7A55E9A53CDC90D08D9DCD
SHA256:718CD6E431A172245A90C58C7B37AE743A3BE178664F57846F964E0ABCC2ED39
3788iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\G9CTM88S.htmhtml
MD5:E39A8E51084638FC4BD5573F7C19365C
SHA256:53C07FC140CF9BEF59B2D0128197D3B94D0C24910E14A773EE724A1E6ED7C255
3788iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C1008DA0CAF9226FE08DADE21B054C47der
MD5:764340F410F7D74725C358F62D934059
SHA256:792BAFCA5F6C61C75F3C70B67967AEF103C2D9848DC8F24048A646EAD347C37C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
38
TCP/UDP connections
125
DNS requests
53
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3788
iexplore.exe
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEHI5G%2Bbavp8MCgAAAAEz%2BiM%3D
US
der
471 b
whitelisted
3788
iexplore.exe
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
2188
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3788
iexplore.exe
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
3788
iexplore.exe
GET
200
104.89.32.83:80
http://x1.c.lencr.org/
NL
der
717 b
whitelisted
3788
iexplore.exe
GET
200
104.18.30.182:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
3788
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
3788
iexplore.exe
GET
200
104.18.30.182:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEBN9U5yqfDGppDNwGWiEeo0%3D
US
der
727 b
whitelisted
3788
iexplore.exe
GET
200
104.18.30.182:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEBEUnVAIkR2ADFo6hrdrMVQ%3D
US
der
471 b
whitelisted
3788
iexplore.exe
GET
200
104.18.30.182:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEBN9U5yqfDGppDNwGWiEeo0%3D
US
der
727 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2188
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2188
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2188
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
3788
iexplore.exe
104.89.32.83:80
x1.c.lencr.org
Akamai Technologies, Inc.
NL
suspicious
3788
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
3788
iexplore.exe
185.94.236.244:443
adserver.juicyads.com
Mojohost B.v.
NL
unknown
3788
iexplore.exe
173.208.189.242:80
www.xxgasm.com
WholeSale Internet, Inc.
US
suspicious
3788
iexplore.exe
173.208.189.242:443
www.xxgasm.com
WholeSale Internet, Inc.
US
suspicious
3788
iexplore.exe
142.250.184.225:443
4.bp.blogspot.com
Google Inc.
US
whitelisted
3788
iexplore.exe
104.21.27.152:443
cdn.adult.xyz
Cloudflare Inc
US
suspicious

DNS requests

Domain
IP
Reputation
www.xxgasm.com
  • 173.208.189.242
unknown
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
xxgasm.com
  • 173.208.189.242
whitelisted
x1.c.lencr.org
  • 104.89.32.83
whitelisted
r3.o.lencr.org
  • 95.101.89.74
  • 95.101.89.75
  • 92.123.195.28
  • 92.123.195.35
shared
js.juicyads.com
  • 143.204.2.47
  • 143.204.2.4
  • 143.204.2.87
  • 143.204.2.117
whitelisted
adserver.juicyads.com
  • 185.94.236.244
suspicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://www.xxgasm.com