Malware analysis http://secured-login.net Malicious activity

Add for printing

URL:	http://secured-login.net
Full analysis:	https://app.any.run/tasks/831f4508-074a-4561-92cc-a285e09cd5a6
Verdict:	Malicious activity
Analysis date:	January 17, 2019, 16:33:55
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:	69464990741E3EBE9373241A9966551D
SHA1:	AC763DCCCC960F7569D9A976364F38C2476107AF
SHA256:	94E28697AA0A21F23BB310CDF336FE299016AC4B8D9CA70F7A0B75D3770E788A
SSDEEP:	3:N1KNAGCkIJZ5:CSGCk03

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 240 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 180 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (68.0.3440.106)
Google Update Helper (1.3.33.17)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
Mozilla Firefox 61.0.2 (x86 en-US) (61.0.2)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
No suspicious indicators.
INFO
- Changes internet zones settings
  - iexplore.exe (PID: 2972)
- Application launched itself
  - iexplore.exe (PID: 2972)
- Reads internet explorer settings
  - iexplore.exe (PID: 3128)
- Reads Internet Cache Settings
  - iexplore.exe (PID: 3128)
  - iexplore.exe (PID: 2972)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Parent process
2972	"C:\Program Files\Internet Explorer\iexplore.exe" -nohome	C:\Program Files\Internet Explorer\iexplore.exe	explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)
3128	"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2972 CREDAT:71937	C:\Program Files\Internet Explorer\iexplore.exe	iexplore.exe
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)

Add for printing

Total events

442

Read events

376

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
2972	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\favicon[1].ico		—
		MD5:—	SHA256:—
2972	iexplore.exe	C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico		—
		MD5:—	SHA256:—
3128	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\login[1].txt		—
		MD5:—	SHA256:—
2972	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\favicon-af6643024af4ecfc57b7e5358608edc94ccd3042dc4849ccdc5befa304b79bf1[1].ico		—
		MD5:—	SHA256:—
3128	iexplore.exe	C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat		dat
		MD5:F6BF9DF69D0E77BE5D2D19E93B4191F0	SHA256:9D1F81318D97E603378C932178256092F841CADBCA20695216616FC11B02F3D1
3128	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\css[1].txt		text
		MD5:C659E7FDB61D563EC77C2761F501478D	SHA256:6BA00B381E64CA0E98769E0E4D8C406B859B85FF630C131BEF94279C2F5760C9
3128	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\css[2].txt		text
		MD5:4C7DAD4090D0A72B34CC1BCD13885C73	SHA256:4CD4BD4AF907718DD6B740F3A4710FA82BD3EA724274EEFDE8D3DDB54DAB894F
3128	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\vendor-545197d9f1bc4b4700f8[1].js		text
		MD5:E26A55A850E9A4F5F6DDD406136EA980	SHA256:40B9AA91D80BDF47F289D8E9D4A3EBB51EC4BF332AFFD6037E40DF0AA3775986
3128	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\login[1].htm		html
		MD5:50C30826A6592FDB8CF2B39C0901C935	SHA256:73C32BCE4F468A6CA9AED47A90FB671E78E283B9B84241C02B175A5F64451045
3128	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\application-019e126e4edbf2748b22e69b1305fd3acb931692a7d7a670d091cf2a0460c670[1].css		text
		MD5:6A870ECD7856CE1CD80FB891C06CF543	SHA256:019E126E4EDBF2748B22E69B1305FD3ACB931692A7D7A670D091CF2A0460C670

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
3128	iexplore.exe	GET	200	52.3.198.50:80	http://secured-login.net/login	US	html	4.46 Kb	whitelisted
3128	iexplore.exe	GET	200	52.3.198.50:80	http://secured-login.net/assets/application-019e126e4edbf2748b22e69b1305fd3acb931692a7d7a670d091cf2a0460c670.css	US	text	167 Kb	whitelisted
3128	iexplore.exe	GET	200	52.3.198.50:80	http://secured-login.net/packs/vendor-545197d9f1bc4b4700f8.js	US	text	90.4 Kb	whitelisted
3128	iexplore.exe	GET	200	52.3.198.50:80	http://secured-login.net/assets/font-awesome/fa-regular-400-473a9adc2b00aa237a66b820706d1c0255efb0fe6864760042fd576be97fd9ae.eot	US	eot	39.6 Kb	whitelisted
3128	iexplore.exe	GET	200	52.3.198.50:80	http://secured-login.net/assets/bootstrap/glyphicons-halflings-regular-13634da87d9e23f8c3ed9108ce1724d183a39ad072e73e1b3d8cbf646d2d0407.eot?	US	eot	19.6 Kb	whitelisted
3128	iexplore.exe	GET	301	52.3.198.50:80	http://secured-login.net/	US	html	96 b	whitelisted
3128	iexplore.exe	GET	200	52.3.198.50:80	http://secured-login.net/assets/application-784a43c4e711cf668205abe41cc9c17867fcd44eae58972b48404843851ac315.js	US	text	844 Kb	whitelisted
2972	iexplore.exe	GET	200	52.3.198.50:80	http://secured-login.net/assets/favicon-af6643024af4ecfc57b7e5358608edc94ccd3042dc4849ccdc5befa304b79bf1.ico	US	image	341 b	whitelisted
2972	iexplore.exe	GET	200	204.79.197.200:80	http://www.bing.com/favicon.ico	US	image	237 b	whitelisted
3128	iexplore.exe	GET	200	52.3.198.50:80	http://secured-login.net/assets/font-awesome/fa-solid-900-263c75a8cab8bdd6b642f29ddbf3bbb0b83af4a66e45604c93cbbf970996b5b3.eot	US	eot	164 Kb	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
2972	iexplore.exe	204.79.197.200:80	www.bing.com	Microsoft Corporation	US	whitelisted
3128	iexplore.exe	172.217.22.3:443	fonts.gstatic.com	Google Inc.	US	whitelisted
3128	iexplore.exe	172.217.18.10:443	fonts.googleapis.com	Google Inc.	US	whitelisted
2972	iexplore.exe	52.3.198.50:80	secured-login.net	Amazon.com, Inc.	US	suspicious
3128	iexplore.exe	52.3.198.50:80	secured-login.net	Amazon.com, Inc.	US	suspicious

DNS requests

Domain	IP	Reputation
www.bing.com	204.79.197.200 13.107.21.200	whitelisted
secured-login.net	52.3.198.50 52.5.107.1 54.210.238.192 52.5.60.200 34.193.132.179	whitelisted
fonts.googleapis.com	172.217.18.10	whitelisted
fonts.gstatic.com	172.217.22.3	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

http://secured-login.net

69464990741E3EBE9373241A9966551D

AC763DCCCC960F7569D9A976364F38C2476107AF

94E28697AA0A21F23BB310CDF336FE299016AC4B8D9CA70F7A0B75D3770E788A

3:N1KNAGCkIJZ5:CSGCk03

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

INFO

Changes internet zones settings

Application launched itself

Reads internet explorer settings

Reads Internet Cache Settings

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings