analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://sunicks-agora.digitaljobler.com/application?data=0pZEesM_OTWpJYK4BOKzEr0FsVUCTXGf&showage=yes&showassets=yes&districthidden=yes&district=OPEN

Full analysis: https://app.any.run/tasks/f79042d5-191a-4356-8c60-4df38625179a
Verdict: Malicious activity
Analysis date: December 05, 2022, 17:36:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

A08DF8704ADEE3092D8746E90CA552A0

SHA1:

F3BB6DD48E56CE2656AF82F66460E8BE33A94915

SHA256:

897C2A060D01506DE5CE2244731173D778A16971F376A7EA87D9590CEEA98D34

SSDEEP:

3:N8d4ZG3REOy2+MQKERV0r84VIFIwHERNKWWBdMdw9ZMEQ:2CZcdy2kV0r84VuNQN/WBOGyEQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2800)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2800"C:\Program Files\Internet Explorer\iexplore.exe" "https://sunicks-agora.digitaljobler.com/application?data=0pZEesM_OTWpJYK4BOKzEr0FsVUCTXGf&showage=yes&showassets=yes&districthidden=yes&district=OPEN"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1792"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2800 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
11 171
Read events
11 038
Write events
131
Delete events
2

Modification events

(PID) Process:(2800) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2800) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
738809936
(PID) Process:(2800) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31000784
(PID) Process:(2800) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(2800) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31000784
(PID) Process:(2800) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2800) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2800) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2800) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2800) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
19
Text files
64
Unknown types
20

Dropped files

PID
Process
Filename
Type
2800iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442binary
MD5:E51B306CAC53EB6C076FFA383F6E7965
SHA256:D2A636EAEF20C652EFF0CF41A36A71C02E31377B220358FE3160E5936293F122
1792iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\application[1].htmhtml
MD5:BBCA808B8731C6D210DD39A9B5AE8C21
SHA256:D502EAD691F0B506B0818A3AE62CDA1A5DE5DEB94E2EEF5E8442951D5762A7F5
2800iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:E2776B38FACE466BAB835F0E0C1D0CB6
SHA256:1C55AB9260581D5F031E6737AF235111E0FDDA941F611925A65AF72796F92654
1792iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2Dbinary
MD5:0BADBF4AE210240EAF4007DC0322D36C
SHA256:B3956F4D82070088A20720CEC3B7B2D30F979A6FB5BA7B15FB6501068B9F9B3B
1792iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\RI8VMPAN.txttext
MD5:AFFCA485630BB0C1BAD7A6D4DD5D284A
SHA256:44CD287B66844F473A9DA77386844AB436B4A14DE8C302EA22FB6F0ABE00324A
1792iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\M4JEAKGE.txttext
MD5:C34F0886EFB97EA027D6214DD399D86E
SHA256:17537C764E05542F6F8E2B46D6971203F5F60FAF76D50BD78F1BEC77B86E2915
1792iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771binary
MD5:9B7B2181387E667CEFA2A09EE2BD75D0
SHA256:B7D6C66FA069DD8163CBD5E04EA96B974CFAAA2FFA9C94EE153AC82FECED688E
1792iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\WP2Z7RZE.txttext
MD5:307B35D553ECCB6B534AFEDC83545A75
SHA256:5A36637A5302DC08A63084323061EDCF429A8A4189BB479F8DFAADEA99839E2A
1792iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\69E9ACE7C69B5785CAEC7E6752945013_9D46C12B9F47759EFC3359E4AA2AD5BCder
MD5:4215755B84E198DF74F3D3DA1A383AF4
SHA256:7C29ED6FE2F3609329D47E1169CAC8C57B669A29B7AEAFA949631279E52AD0B4
1792iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771der
MD5:0C030FA3C40CACAE0B8AF8C83EB87B9D
SHA256:6B92F8B1E58E335ED50DE9FDE95327EA00365D43748D66C63BE47A6754E3A728
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
66
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1792
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
1792
iexplore.exe
GET
200
192.124.249.22:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
US
der
1.69 Kb
whitelisted
1792
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDreCS75DAIaRKqvCi%2FvL9c
US
der
472 b
whitelisted
1792
iexplore.exe
GET
200
192.124.249.22:80
http://ocsp.godaddy.com//MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQD5Q0YH2Hq2cQ%3D%3D
US
der
1.74 Kb
whitelisted
1792
iexplore.exe
GET
200
192.124.249.22:80
http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D
US
der
1.66 Kb
whitelisted
2800
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
1792
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
1792
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEAyaaRgE2Hr8KHhl%2FF88jPw%3D
US
der
279 b
whitelisted
1792
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDdWo6wOT965hJYnmhNNbgJ
US
der
472 b
whitelisted
1792
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2800
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
2800
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1792
iexplore.exe
142.250.185.74:443
fonts.googleapis.com
GOOGLE
US
whitelisted
1792
iexplore.exe
52.71.54.183:443
—
AMAZON-AES
US
unknown
2800
iexplore.exe
8.248.117.254:80
ctldl.windowsupdate.com
LEVEL3
US
malicious
1792
iexplore.exe
52.20.144.10:443
—
AMAZON-AES
US
unknown
1792
iexplore.exe
188.114.96.3:443
cdn.lr-ingest.io
CLOUDFLARENET
NL
malicious
1792
iexplore.exe
192.124.249.22:80
ocsp.godaddy.com
SUCURI-SEC
US
suspicious
1792
iexplore.exe
172.217.18.104:443
www.googletagmanager.com
GOOGLE
US
suspicious
1792
iexplore.exe
142.250.185.131:80
ocsp.pki.goog
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ctldl.windowsupdate.com
  • 8.248.117.254
  • 8.253.95.249
  • 8.248.131.254
  • 8.253.204.120
  • 8.253.207.120
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ocsp.godaddy.com
  • 192.124.249.22
  • 192.124.249.24
  • 192.124.249.41
  • 192.124.249.36
  • 192.124.249.23
whitelisted
fonts.googleapis.com
  • 142.250.185.74
whitelisted
cdn.lr-ingest.io
  • 188.114.96.3
  • 188.114.97.3
whitelisted
www.googletagmanager.com
  • 172.217.18.104
whitelisted
ocsp.pki.goog
  • 142.250.185.131
whitelisted
fonts.gstatic.com
  • 142.250.184.227
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://sunicks-agora.digitaljobler.com/application?data=0pZEesM_OTWpJYK4BOKzEr0FsVUCTXGf&showage=yes&showassets=yes&districthidden=yes&district=OPEN