URL:

https://mega.nz/file/0K9iSLyQ#ChVaaHCds_AXILQY3eDIbWfBvA7eGvAED9UbDkSorH4

Full analysis: https://app.any.run/tasks/96628732-fc06-4ebf-9be6-c2134d16dd50
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: January 08, 2024, 12:57:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
wannacry
ransomware
wannacryptor
Indicators:
MD5:

15D3E22C887421A5FCD1DAF884B64D25

SHA1:

D65EE9AAA6ED20283199462C7BDD73E2B2CF80DF

SHA256:

8E4ECE00AE5104D140C4E9F056767B02AD302D41098FA5887EBB125FCD864450

SSDEEP:

3:N8X/iUAy3tYFbki9hxuz:2lAeapAz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Wannacry exe files

      • WannaCry.exe (PID: 1572)
      • !WannaDecryptor!.exe (PID: 2500)

    • Renames files like ransomware

      • $uckyLocker.exe (PID: 2732)

    • Writes a file to the Word startup folder

      • WannaCry.exe (PID: 1572)

    • WannaCry Ransomware is detected

      • WannaCry.exe (PID: 1572)

    • Modifies files in the Chrome extension folder

      • WannaCry.exe (PID: 1572)

    • Actions looks like stealing of personal data

      • WannaCry.exe (PID: 1572)

  • SUSPICIOUS

    • Changes the desktop background image

      • $uckyLocker.exe (PID: 2732)

    • Starts CMD.EXE for commands execution

      • WannaCry.exe (PID: 1572)

    • Executing commands from a ".bat" file

      • WannaCry.exe (PID: 1572)

    • The process executes VB scripts

      • cmd.exe (PID: 664)

    • Uses TASKKILL.EXE to kill process

      • WannaCry.exe (PID: 1572)

    • Reads the Internet Settings

      • !WannaDecryptor!.exe (PID: 2500)

    • Creates files like ransomware instruction

      • WannaCry.exe (PID: 1572)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2040)
      • msedge.exe (PID: 2444)
      • msedge.exe (PID: 2248)
      • msedge.exe (PID: 4088)
      • msedge.exe (PID: 3368)

    • Manual execution by a user

      • msedge.exe (PID: 2444)
      • msedge.exe (PID: 2248)
      • msedge.exe (PID: 3368)
      • msedge.exe (PID: 4088)
      • wmpnscfg.exe (PID: 2096)
      • WINWORD.EXE (PID: 3312)
      • rundll32.exe (PID: 604)

    • Checks supported languages

      • wmpnscfg.exe (PID: 2096)
      • $uckyLocker.exe (PID: 2732)
      • WannaCry.exe (PID: 1572)
      • !WannaDecryptor!.exe (PID: 2500)

    • Reads the computer name

      • wmpnscfg.exe (PID: 2096)
      • $uckyLocker.exe (PID: 2732)
      • WannaCry.exe (PID: 1572)
      • !WannaDecryptor!.exe (PID: 2500)

    • Drops the executable file immediately after the start

      • msedge.exe (PID: 3752)
      • msedge.exe (PID: 3368)
      • WannaCry.exe (PID: 1572)

    • The process uses the downloaded file

      • msedge.exe (PID: 2328)
      • msedge.exe (PID: 3368)
      • msedge.exe (PID: 2728)

    • Reads the machine GUID from the registry

      • $uckyLocker.exe (PID: 2732)
      • WannaCry.exe (PID: 1572)

    • Process drops legitimate windows executable

      • msedge.exe (PID: 3752)
      • WannaCry.exe (PID: 1572)
      • msedge.exe (PID: 3368)

    • Dropped object may contain TOR URL's

      • WannaCry.exe (PID: 1572)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 2648)

    • Creates files or folders in the user directory

      • WannaCry.exe (PID: 1572)

    • Create files in a temporary directory

      • WannaCry.exe (PID: 1572)

    • Creates files in the program directory

      • WannaCry.exe (PID: 1572)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
120
Monitored processes
67
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs wmpnscfg.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs $uckylocker.exe no specs $uckylocker.exe msedge.exe no specs rundll32.exe no specs winword.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs #WANNACRY wannacry.exe cmd.exe no specs cscript.exe no specs #WANNACRY !wannadecryptor!.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
452"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3836 --field-trial-handle=1324,i,13462889132637834693,7289494031743431913,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
584"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3784 --field-trial-handle=1324,i,13462889132637834693,7289494031743431913,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
604"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3548 --field-trial-handle=1256,i,15103621604195595137,17793758352310849434,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
604"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\regularbutC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
664C:\Windows\system32\cmd.exe /c 255951704718933.batC:\Windows\System32\cmd.exe—WannaCry.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
668"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=4076 --field-trial-handle=1324,i,13462889132637834693,7289494031743431913,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
864"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2040 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
920"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4248 --field-trial-handle=1324,i,13462889132637834693,7289494031743431913,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1172"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2296 --field-trial-handle=1324,i,13462889132637834693,7289494031743431913,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1196"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=664 --field-trial-handle=1324,i,13462889132637834693,7289494031743431913,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
38 312
Read events
37 929
Write events
236
Delete events
147

Modification events

(PID) Process:(2040) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2040) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2040) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2040) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2040) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2040) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2040) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2040) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2040) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2040) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
50
Suspicious files
2 291
Text files
292
Unknown types
0

Dropped files

PID
Process
Filename
Type
864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C3DC60960231FAD57B887269F19717EEbinary
MD5:E78DDD64137ACFEA91EF59EEE974C403
SHA256:0B47D6E89D74725C2AF21F67BDB57802CAD24C26DE57B5FB3FFFFA2188BE1989
864iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\mega-2_2879965684bb69348fce22212f5d3a81f44aca5ff71117b9f1455af0376ef075[1].csstext
MD5:443F3BC862E03226C0A83A44A0677AC4
SHA256:2879965684BB69348FCE22212F5D3A81F44ACA5FF71117B9F1455AF0376EF075
864iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\0K9iSLyQ[1].htmhtml
MD5:F93B1D8059DA4AE0665117C79257E822
SHA256:7B8640CBB2F236A439AC519B57C2DB7F0812A88BFA8E52E007C088945FE6465C
864iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\update[1].csstext
MD5:7F1D6E96A8DEC2E138B3D02DEEFD10C0
SHA256:BC37C003BCFEDA79B30D4DE5C6902E113638F6F2D136C93FCBCC3D0CD48588E3
864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:53AEE0CAD7E30A2F4A31207497516B88
SHA256:57D90B48A27CAD03279F455904621AF9AE42200223D2F602E7B0FF8F4D8D8912
864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C3DC60960231FAD57B887269F19717EEbinary
MD5:26BE53B97D2CD139E3E0C6CBF90543E2
SHA256:50821B1472728E0018DFA7B023B2BA90A0C0CB05109971209F50C1ED008416CF
864iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\update[1].htmhtml
MD5:3CCE71310D950389CE2A333A03A3C79A
SHA256:2DC160F601C165CCC27DF7CE887B7D2621F1391691D99DAD71B66E4CE39098D9
864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:CF93404AEBACDF7D1FBEA37633947548
SHA256:88C92BE43E1FA93DE8E36E46067503969AC55AC44E527EF708AAE1AE938F0543
864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:26C8DB7453D4978010F497E95D71C7C2
SHA256:6935B3B27BECCF9E35EB7B227A70A2CB7BC2D9356AADB96B76315738FF9C74D7
864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6AA9AFE29318034A5C2C6A313791682Abinary
MD5:4359C0890CBEB281EA6F339CEFE068FC
SHA256:87828D0057EBBC02B373E0E6FCAE12FE4DC4FBCD07824C7CB49EB0823942BCEC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
163
DNS requests
248
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
864
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6f825234c2810feb
unknown
compressed
4.66 Kb
unknown
864
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2f131cf452408714
unknown
compressed
4.66 Kb
unknown
864
iexplore.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
864
iexplore.exe
GET
200
184.24.77.57:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgPYL88ZzhdJ6lkOlBHYgXDsVw%3D%3D
unknown
binary
503 b
unknown
864
iexplore.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
binary
2.18 Kb
unknown
864
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
binary
1.42 Kb
unknown
864
iexplore.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEAGZc036%2BYg9tbsuXOzWpV4%3D
unknown
binary
471 b
unknown
2040
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?85105a2067e5fff2
unknown
—
—
unknown
2040
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3459b2d391457a37
unknown
—
—
unknown
2040
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
312 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
864
iexplore.exe
31.216.145.5:443
mega.nz
Datacenter Luxembourg S.A.
LU
unknown
864
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
864
iexplore.exe
69.192.161.44:80
x1.c.lencr.org
AKAMAI-AS
DE
unknown
864
iexplore.exe
184.24.77.57:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown
864
iexplore.exe
66.203.124.37:443
eu.static.mega.co.nz
Datacenter Luxembourg S.A.
LU
unknown
864
iexplore.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown
864
iexplore.exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
shared

DNS requests

Domain
IP
Reputation
mega.nz
  • 31.216.145.5
  • 31.216.144.5
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
x1.c.lencr.org
  • 69.192.161.44
whitelisted
r3.o.lencr.org
  • 184.24.77.57
  • 184.24.77.46
  • 184.24.77.81
  • 184.24.77.62
  • 184.24.77.56
  • 184.24.77.65
  • 184.24.77.78
  • 184.24.77.45
  • 184.24.77.77
shared
eu.static.mega.co.nz
  • 66.203.124.37
  • 89.44.169.134
  • 89.44.169.132
shared
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.sectigo.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
api.bing.com
  • 13.107.13.80
whitelisted
www.bing.com
  • 104.126.37.161
  • 104.126.37.171
  • 104.126.37.177
  • 104.126.37.185
  • 104.126.37.160
  • 104.126.37.155
  • 104.126.37.162
  • 104.126.37.178
  • 104.126.37.179
  • 104.126.37.153
  • 104.126.37.168
  • 104.126.37.136
  • 104.126.37.170
  • 104.126.37.163
  • 104.126.37.139
  • 104.126.37.128
  • 104.126.37.123
  • 104.126.37.130
  • 104.126.37.137
  • 104.126.37.152
  • 104.126.37.184
  • 104.126.37.186
  • 104.126.37.145
  • 104.126.37.154
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO File Sharing Related Domain in DNS Lookup (mega .nz)
864
iexplore.exe
Misc activity
ET INFO File Sharing Domain Observed in TLS SNI (mega .nz)
864
iexplore.exe
Misc activity
ET INFO File Sharing Domain Observed in TLS SNI (mega .nz)
1080
svchost.exe
Misc activity
ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)
2040
iexplore.exe
Misc activity
ET INFO File Sharing Domain Observed in TLS SNI (mega .nz)
2040
iexplore.exe
Misc activity
ET INFO File Sharing Domain Observed in TLS SNI (mega .nz)
3752
msedge.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
3752
msedge.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://mega.nz/file/0K9iSLyQ#ChVaaHCds_AXILQY3eDIbWfBvA7eGvAED9UbDkSorH4