URL:

web.archive.org/web/20040905000458/lastmeasure.com

Full analysis: https://app.any.run/tasks/42e52e46-6156-447e-a733-4afc9eb572dd
Verdict: Malicious activity
Analysis date: December 06, 2023, 03:36:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

C91610EE23D1544CA5728895305D5521

SHA1:

2EA1306F6522AA943F167ACB76983563B79C500D

SHA256:

8717C426481C1D8CAE108C4DF4B587EC0CDC6E7AA8DB6A82209B82D6DB0CD6FE

SSDEEP:

3:fEhXJevRpEf:f+X8Ef

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 1864)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3176)

    • Reads the computer name

      • wmpnscfg.exe (PID: 3176)

    • Checks supported languages

      • wmpnscfg.exe (PID: 3176)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1864"C:\Program Files\Internet Explorer\iexplore.exe" "web.archive.org/web/20040905000458/lastmeasure.com"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3028"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1864 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3176"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
20 413
Read events
20 348
Write events
63
Delete events
2

Modification events

(PID) Process:(1864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(1864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(1864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(1864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
10
Text files
26
Unknown types
1

Dropped files

PID
Process
Filename
Type
3028iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
3028iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\wm_tb_nxt_on[1].pngimage
MD5:92551EA37FB1656EC298066EAB8734D9
SHA256:9A6C9FD420D028BF2B57E850D9DBA5DF9AEA7C4E3D50E7A2387DC99FD11AB5CE
3028iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:C55D23EA1407B6DA3274EC9BDC89D78B
SHA256:51E2EDD36C51D27293A31C36F6B2EB28A35F58465D24CAD2D28BA0B13DAFC409
3028iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\analytics[1].jstext
MD5:CBC1B007EB7DE0B65EDA9EF00E069EBE
SHA256:A1F3D3BE0AF279C2DA371163D037A3D46569453A855CF91ACECA0F3695C57017
3028iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771binary
MD5:A9400F7F58152B9CB835A9C977EE1A9E
SHA256:49AB70198F4138E36FF2CDFBBF1538C3BE46F49EE77A2E8A3B6082324E7E4B1C
3028iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\lastmeasure-ghostwords[1].pngimage
MD5:9B61F2268B23D81C2682DF8D4C23180C
SHA256:DD70BBE4F5BD03998350826E8433E3AA8160212B550DB6446BC119D1A65CE0AE
3028iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771der
MD5:71B51F192606F2315881A02774AF68E4
SHA256:C21D8B10259BCFDF1FEA7198469D19AC0EDDC4918D25928491BE61F1FCF286A4
3028iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2Dbinary
MD5:45FEE3C8EB693621C57FB8ABD3D810A4
SHA256:69BD6653A15A044F2FC3E6E844E23973071CD09C1B707D33FA6C76149DBE4283
3028iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\wombat[1].jstext
MD5:B71AA3EE7282F0553D4412FA9C5A2ADC
SHA256:A0D4BDD7E9FE56320601DD17093A19059A54F5DA8E0AB80F053A7F8AA0BB75E7
3028iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\valid-xhtml10[1].pngimage
MD5:A6DC3621A722636A57D889445B14022E
SHA256:F190133B71ABE0AF5DF1733CCEE8BA01FDFB5328146477567DACE15C5FCD8561
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
38
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3028
iexplore.exe
GET
302
207.241.237.3:80
http://web.archive.org/web/20040905000458/lastmeasure.com
unknown
—
—
unknown
3028
iexplore.exe
GET
302
207.241.237.3:80
http://web.archive.org/web/20040905000458cs_/http://lastmeasure.com/index.css
unknown
compressed
4.60 Kb
unknown
3028
iexplore.exe
GET
200
207.241.224.2:80
http://archive.org/includes/analytics.js?v=cf34f82
unknown
text
5.01 Kb
unknown
3028
iexplore.exe
GET
200
207.241.237.3:80
http://web.archive.org/web/20040905000458/http://lastmeasure.com/
unknown
html
4.60 Kb
unknown
3028
iexplore.exe
GET
302
207.241.237.3:80
http://web.archive.org/web/20040905000458im_/http://lastmeasure.com/images/lmlogo/lastmeasure-ghostwords.png
unknown
—
—
unknown
3028
iexplore.exe
GET
200
207.241.237.3:80
http://web.archive.org/web/20050503225307im_/http://www.lastmeasure.com/images/lmlogo/lastmeasure-ghostwords.png
unknown
image
35.4 Kb
unknown
3028
iexplore.exe
GET
302
207.241.237.3:80
http://web.archive.org/web/20040905000458im_/http://lastmeasure.com/images/gnaa.png
unknown
—
—
unknown
3028
iexplore.exe
GET
200
207.241.237.3:80
http://web.archive.org/web/20050207142402im_/http://lastmeasure.com/images/gnaa.png
unknown
image
2.04 Kb
unknown
3028
iexplore.exe
GET
302
207.241.237.3:80
http://web.archive.org/web/20040905000458im_/http://lastmeasure.com/images/valid-xhtml10.png
unknown
—
—
unknown
3028
iexplore.exe
GET
200
207.241.237.3:80
http://web.archive.org/web/20041205065633im_/http://www.lastmeasure.com/images/valid-xhtml10.png
unknown
image
2.36 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3028
iexplore.exe
207.241.237.3:80
web.archive.org
INTERNET-ARCHIVE
US
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3028
iexplore.exe
207.241.224.2:80
archive.org
INTERNET-ARCHIVE
US
malicious
3028
iexplore.exe
207.241.237.2:443
web-static.archive.org
INTERNET-ARCHIVE
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3028
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
3028
iexplore.exe
192.124.249.23:80
ocsp.godaddy.com
SUCURI-SEC
US
unknown
3028
iexplore.exe
207.241.224.2:443
archive.org
INTERNET-ARCHIVE
US
malicious

DNS requests

Domain
IP
Reputation
web.archive.org
  • 207.241.237.3
whitelisted
archive.org
  • 207.241.224.2
whitelisted
web-static.archive.org
  • 207.241.237.2
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.godaddy.com
  • 192.124.249.23
  • 192.124.249.36
  • 192.124.249.24
  • 192.124.249.41
  • 192.124.249.22
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 2.23.209.187
  • 2.23.209.130
whitelisted
analytics.archive.org
  • 207.241.225.195
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
web.archive.org/web/20040905000458/lastmeasure.com