download:

001220.html

Full analysis: https://app.any.run/tasks/791feca8-fcf7-4f61-a9cf-3819ba8516ee
Verdict: Malicious activity
Analysis date: July 24, 2019, 05:59:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/html
File info: HTML document, UTF-8 Unicode text, with very long lines
MD5:

09D5C0F8E6FB8B68992F9CC06C22BA47

SHA1:

CA16E580367E9E5442E357F1E158EF2D80C0AB2E

SHA256:

8C16BD55C4745F9319A7291F9C8BA5CA7FC8676BD866214FFEE39EBCF6F22981

SSDEEP:

768:kfnjPYBfFQbUfxZkFQdJpgroNV96+4MpT:sjPYBfFQIfDkFQjpgroNV96+4M1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to CnC server

      • iexplore.exe (PID: 3336)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 3844)

    • Creates files in the user directory

      • iexplore.exe (PID: 3336)

    • Application launched itself

      • iexplore.exe (PID: 3844)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3336)

    • Dropped object may contain TOR URL's

      • iexplore.exe (PID: 3336)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3336)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.htm/html | HyperText Markup Language with DOCTYPE (80.6)
.html | HyperText Markup Language (19.3)

EXIF

HTML

ContentType: text/html;charset=utf-8
Description: Q＆A:「クレーム」と「苦情」はどう違うのでしょうか。また、「顧客不満足」はどう分けて定義したらよいでしょうか。
Keywords: Q＆A,クレーム,苦情,顧客不満足,,社内研修,社員研修,マニュアル制作,業務マニュアル,営業マニュアル,OJT,目標管理,5S,5Sに力を入れています,問題解決,人事評価,なぜなぜ分析,webマニュアル,マニュアルの作り方,ナビゲート,社員教育,人材育成,研修講師,研修プログラム,新入社員研修,イントラ,神奈川,横浜
Title: 「クレーム」と「苦情」はどう違うのでしょうか。また、「顧客不満足」はどう分けて定義したらよいでしょうか。 | Q＆A | ナビゲート
Copyright: (C) Navigate, Inc. All Rights Reserved.
twitterCard: summary
twitterDescription: クレームにまつわる言葉の定義は諸説あるようです。 ク
twitterTitle: 「クレーム」と「苦情」はどう違うのでしょうか。また、「顧客不満足」はどう分けて定義したらよいでしょうか。 | Q＆A | ナビゲート
twitterSite: @Navigate_inc
twitterCreator: @Navigate_inc
viewport: width=device-width,initial-scale=1
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3336"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3844 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3844"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\001220.htmlC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
400
Read events
326
Write events
73
Delete events
1

Modification events

(PID) Process:(3844) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3844) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3844) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3844) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(3844) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3844) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000078000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3844) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{3574DA67-ADD8-11E9-95C0-5254004A04AF}
Value:
0
(PID) Process:(3844) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(3844) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
2
(PID) Process:(3844) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E30707000300180005003B0022002B02
Executable files
0
Suspicious files
0
Text files
17
Unknown types
2

Dropped files

PID
Process
Filename
Type
3844iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\favicon[1].ico —
MD5:—
SHA256:—
3844iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3336iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\share_button[1].php —
MD5:—
SHA256:—
3336iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@google[1].txttext
MD5:—
SHA256:—
3336iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\plusone[1].jshtml
MD5:—
SHA256:—
3336iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\noConnect[1]image
MD5:3CB8FACCD5DE434D415AB75C17E8FD86
SHA256:6976C426E3AC66D66303C114B22B2B41109A7DE648BA55FFC3E5A53BD0DB09E7
3336iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\errorPageStrings[1]text
MD5:1A0563F7FB85A678771450B131ED66FD
SHA256:EB5678DE9D8F29CA6893D4E6CA79BD5AB4F312813820FE4997B009A2B1A1654C
3336iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\httpErrorPagesScripts[1]text
MD5:E7CA76A3C9EE0564471671D500E3F0F3
SHA256:58268CA71A28973B756A48BBD7C9DC2F6B87B62AE343E582CE067C725275B63C
3336iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\dnserror[1]html
MD5:68E03ED57EC741A4AFBBCD11FAB1BDBE
SHA256:1FF3334C3EB27033F8F37029FD72F648EDD4551FCE85FC1F5159FEAEA1439630
3336iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\share_button[1].htmhtml
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
52
DNS requests
12
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3844
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
3336
iexplore.exe
OPTIONS
400
172.217.21.200:80
http://www.googletagmanager.com/
US
html
1.52 Kb
whitelisted
3336
iexplore.exe
OPTIONS
400
172.217.21.200:80
http://www.googletagmanager.com/
US
html
1.52 Kb
whitelisted
3336
iexplore.exe
GET
200
23.111.228.220:80
http://statcounter.biz/optout/set/lat?jsonp=__twb_cb_422903179&key=1b3622eba14d06227e&cv=1531358697&t=1531358697632
NL
—
—
malicious
3336
iexplore.exe
OPTIONS
400
172.217.21.200:80
http://www.googletagmanager.com/
US
html
1.52 Kb
whitelisted
3336
iexplore.exe
OPTIONS
400
172.217.21.200:80
http://www.googletagmanager.com/
US
html
1.52 Kb
whitelisted
3336
iexplore.exe
OPTIONS
400
172.217.21.200:80
http://www.googletagmanager.com/
US
html
1.52 Kb
whitelisted
3336
iexplore.exe
OPTIONS
400
172.217.21.200:80
http://www.googletagmanager.com/
US
html
1.52 Kb
whitelisted
3336
iexplore.exe
OPTIONS
400
172.217.21.200:80
http://www.googletagmanager.com/
US
html
1.52 Kb
whitelisted
3336
iexplore.exe
OPTIONS
400
172.217.21.200:80
http://www.googletagmanager.com/
US
html
1.52 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3336
iexplore.exe
172.217.23.174:443
apis.google.com
Google Inc.
US
whitelisted
3336
iexplore.exe
157.112.183.64:443
www.navigate-inc.co.jp
SAKURA Internet Inc.
JP
unknown
4
System
172.217.21.200:445
www.googletagmanager.com
Google Inc.
US
whitelisted
3336
iexplore.exe
93.184.220.66:443
platform.twitter.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3336
iexplore.exe
172.217.21.200:80
www.googletagmanager.com
Google Inc.
US
whitelisted
4
System
172.217.21.200:139
www.googletagmanager.com
Google Inc.
US
whitelisted
3336
iexplore.exe
31.13.92.14:443
static.xx.fbcdn.net
Facebook, Inc.
IE
whitelisted
3336
iexplore.exe
31.13.92.36:443
www.facebook.com
Facebook, Inc.
IE
whitelisted
3336
iexplore.exe
23.111.228.220:80
statcounter.biz
—
NL
malicious

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
apis.google.com
  • 172.217.23.174
whitelisted
www.navigate-inc.co.jp
  • 157.112.183.64
unknown
statcounter.biz
  • 23.111.228.220
  • 64.58.121.60
  • 64.58.126.236
  • 172.241.69.28
  • 172.241.69.20
  • 172.241.69.4
  • 23.111.228.4
malicious
worldnaturenet.xyz
  • —
whitelisted
platform.twitter.com
  • 93.184.220.66
whitelisted
www.googletagmanager.com
  • 172.217.21.200
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared
www.facebook.com
  • 31.13.92.36
whitelisted
static.xx.fbcdn.net
  • 31.13.92.14
whitelisted

Threats

PID
Process
Class
Message
3336
iexplore.exe
A Network Trojan was detected
ET MALWARE LNKR CnC Activity M1
10 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
001220.html