URL:

http://winwheels.buzz/IKwMsx/The-URAG-Poverty-Alleviation-Subsidy

Full analysis: https://app.any.run/tasks/164dda1d-8783-4d62-b9e3-c3f54ae009d8
Verdict: Malicious activity
Analysis date: August 22, 2023, 00:52:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

2D7119E3D7F6381041D55E560E2E0F04

SHA1:

7CBFFC484A95E8977412006FC70B43CD013C3DE9

SHA256:

991996A2C89B918133C724F5DA6A95B1EFE499DD0BD92E6B8E371EE6DC5A18D4

SSDEEP:

3:N1KJMr3OCaK0lkiIATAXRc52MBKLLQ25n:CCDOCaK0K2y65lKnQ2n

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3488)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2372"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3488 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
3488"C:\Program Files\Internet Explorer\iexplore.exe" "http://winwheels.buzz/IKwMsx/The-URAG-Poverty-Alleviation-Subsidy"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\version.dll
Total events
16 187
Read events
16 133
Write events
54
Delete events
0

Modification events

(PID) Process:(3488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
15
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
2372iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:27650A03E1804DEDB7E1B16D49EAE9DF
SHA256:DB443CE421B58695EA1E110CBF121C8A83F1F4198F4343FE3165D0D0CA2B69EE
2372iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\TarEA29.tmpbinary
MD5:4FF65AD929CD9A367680E0E5B1C08166
SHA256:C8733C93CC5AAF5CA206D06AF22EE8DBDEC764FB5085019A6A9181FEB9DFDEE6
2372iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\404[1].jstext
MD5:7E73C4C4B8F06635AEB0E31095DD6878
SHA256:3B930AC1654B6CCEE28EDC89814B8FFBE736FB977D696D084AAB1F128BB751CC
3488iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8Fbinary
MD5:63D183F6881B4375537BB596981663EA
SHA256:B3EA82569F659846C5C2E0EE2BDDDC01913BAF7ACF99C67759CB47F61ED766D4
2372iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabEA28.tmpcompressed
MD5:3AC860860707BAAF32469FA7CC7C0192
SHA256:D015145D551ECD14916270EFAD773BBC9FD57FAD2228D2C24559F696C961D904
2372iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4AAD56921F29D6D1C60160D054D77433binary
MD5:59CFA01AFF3080326D1081043F86D47F
SHA256:F263AB61EA38CEFF8C4C413453C5B906EB028C95231BB357263DE92FA60931AA
3488iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8Fbinary
MD5:EC6D880CD7A5EE0E6CF753ACFF47B22B
SHA256:1A52588D22926D953528C74608703F944B27E4E6FECA4C4F8F54CE384E9E9023
2372iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:A1C509DD02D6EFE6156B18A93B8956D5
SHA256:3C088A1187DAC486FA1FB57C2C69737F4ECA5D5836810A294320D6FCB72C99AA
2372iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
3488iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\69C6F6EC64E114822DF688DC12CDD86Cbinary
MD5:CB9D835DAF8A1DD86289DCA067A6E3B4
SHA256:911E2786B82D3903B55A496DB0FBD923332DBFDDACBF6B173E8B02E2E05C5DAF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
29
DNS requests
14
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3488
iexplore.exe
GET
—
188.114.97.3:80
http://winwheels.buzz/favicon.ico
US
—
—
malicious
3488
iexplore.exe
GET
200
192.229.221.95:80
http://crl3.digicert.com/DigiCertGlobalRootCA.crl
US
binary
779 b
whitelisted
3488
iexplore.exe
GET
200
192.229.221.95:80
http://crl3.digicert.com/Omniroot2025.crl
US
binary
7.78 Kb
whitelisted
3488
iexplore.exe
GET
200
192.229.221.95:80
http://crl3.digicert.com/DigiCertGlobalRootG2.crl
US
binary
1.10 Kb
whitelisted
2372
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3acb6d4ddda297a7
US
compressed
4.70 Kb
whitelisted
2372
iexplore.exe
GET
200
188.114.96.3:80
http://winwheels.buzz/res/404.js
US
text
2.19 Kb
malicious
2372
iexplore.exe
GET
200
188.114.96.3:80
http://winwheels.buzz/IKwMsx/The-URAG-Poverty-Alleviation-Subsidy
US
html
350 b
malicious
2372
iexplore.exe
GET
200
2.16.202.121:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgOGM5%2FLiEfDO49Afie1MZjdxw%3D%3D
NL
binary
503 b
shared
2372
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?973b1dc2756525b4
US
compressed
62.3 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2372
iexplore.exe
188.114.96.3:80
winwheels.buzz
CLOUDFLARENET
NL
malicious
2372
iexplore.exe
199.59.243.224:443
d.cnzz.site
AMAZON-02
US
malicious
3488
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
2372
iexplore.exe
23.56.202.135:80
x1.c.lencr.org
AKAMAI-AS
GB
suspicious
3488
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2372
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
3488
iexplore.exe
188.114.97.3:80
winwheels.buzz
CLOUDFLARENET
NL
malicious
1088
svchost.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
3488
iexplore.exe
104.126.37.139:443
www.bing.com
Akamai International B.V.
DE
suspicious
3488
iexplore.exe
204.79.197.200:443
ieonline.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
winwheels.buzz
  • 188.114.96.3
  • 188.114.97.3
malicious
d.cnzz.site
  • 199.59.243.224
malicious
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.139
  • 104.126.37.128
whitelisted
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
x1.c.lencr.org
  • 23.56.202.135
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
crl3.digicert.com
  • 192.229.221.95
whitelisted

Threats

PID
Process
Class
Message
2372
iexplore.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.buzz domain
2372
iexplore.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.buzz domain
3488
iexplore.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.buzz domain
2372
iexplore.exe
A Network Trojan was detected
ET HUNTING Possible Obfuscator io JavaScript Obfuscation
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://winwheels.buzz/IKwMsx/The-URAG-Poverty-Alleviation-Subsidy