URL:

http://winwheels.buzz/IKwMsx/The-URAG-Poverty-Alleviation-Subsidy

Full analysis: https://app.any.run/tasks/164dda1d-8783-4d62-b9e3-c3f54ae009d8
Verdict: Malicious activity
Analysis date: August 22, 2023, 00:52:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

2D7119E3D7F6381041D55E560E2E0F04

SHA1:

7CBFFC484A95E8977412006FC70B43CD013C3DE9

SHA256:

991996A2C89B918133C724F5DA6A95B1EFE499DD0BD92E6B8E371EE6DC5A18D4

SSDEEP:

3:N1KJMr3OCaK0lkiIATAXRc52MBKLLQ25n:CCDOCaK0K2y65lKnQ2n

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3488)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2372"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3488 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
3488"C:\Program Files\Internet Explorer\iexplore.exe" "http://winwheels.buzz/IKwMsx/The-URAG-Poverty-Alleviation-Subsidy"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\version.dll
Total events
16 187
Read events
16 133
Write events
54
Delete events
0

Modification events

(PID) Process:(3488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3488) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
15
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3488iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8Fbinary
MD5:63D183F6881B4375537BB596981663EA
SHA256:B3EA82569F659846C5C2E0EE2BDDDC01913BAF7ACF99C67759CB47F61ED766D4
2372iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:3AC860860707BAAF32469FA7CC7C0192
SHA256:D015145D551ECD14916270EFAD773BBC9FD57FAD2228D2C24559F696C961D904
2372iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabEA28.tmpcompressed
MD5:3AC860860707BAAF32469FA7CC7C0192
SHA256:D015145D551ECD14916270EFAD773BBC9FD57FAD2228D2C24559F696C961D904
3488iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8Fbinary
MD5:EC6D880CD7A5EE0E6CF753ACFF47B22B
SHA256:1A52588D22926D953528C74608703F944B27E4E6FECA4C4F8F54CE384E9E9023
2372iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4AAD56921F29D6D1C60160D054D77433binary
MD5:E34F6F194BDC004E45F6F10E8004DAB6
SHA256:1F8B88708F2EB510EFC8C790BEA6EC0C2F95604EB3D07B1E02C0FA5D5721ACF7
2372iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\v[1].jstext
MD5:D1C8FE092E0A6DD765DCAB2160C1AC2D
SHA256:E27ABFFAB3DB62825209E873F0CA1E9C35785B7F3C0F14877F613041CAEE6915
3488iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86Cbinary
MD5:EAB8862FE170ECE21E81B492244CDC8F
SHA256:A058724E96D76E97DF92C125772D27567C7819278685EBCDA0152F20C2FC4166
3488iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\urlblockindex[1].binbinary
MD5:FA518E3DFAE8CA3A0E495460FD60C791
SHA256:775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7
2372iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:A1C509DD02D6EFE6156B18A93B8956D5
SHA256:3C088A1187DAC486FA1FB57C2C69737F4ECA5D5836810A294320D6FCB72C99AA
2372iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4AAD56921F29D6D1C60160D054D77433binary
MD5:59CFA01AFF3080326D1081043F86D47F
SHA256:F263AB61EA38CEFF8C4C413453C5B906EB028C95231BB357263DE92FA60931AA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
29
DNS requests
14
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3488
iexplore.exe
GET
—
188.114.97.3:80
http://winwheels.buzz/favicon.ico
US
—
—
malicious
3488
iexplore.exe
GET
200
192.229.221.95:80
http://crl3.digicert.com/Omniroot2025.crl
US
binary
7.78 Kb
whitelisted
3488
iexplore.exe
GET
200
192.229.221.95:80
http://crl3.digicert.com/DigiCertGlobalRootCA.crl
US
binary
779 b
whitelisted
3488
iexplore.exe
GET
200
192.229.221.95:80
http://crl3.digicert.com/DigiCertGlobalRootG2.crl
US
binary
1.10 Kb
whitelisted
2372
iexplore.exe
GET
200
188.114.96.3:80
http://winwheels.buzz/res/404.js
US
text
2.19 Kb
malicious
2372
iexplore.exe
GET
200
188.114.96.3:80
http://winwheels.buzz/IKwMsx/The-URAG-Poverty-Alleviation-Subsidy
US
html
350 b
malicious
2372
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3acb6d4ddda297a7
US
compressed
4.70 Kb
whitelisted
2372
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?973b1dc2756525b4
US
compressed
62.3 Kb
whitelisted
2372
iexplore.exe
GET
200
2.16.202.121:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgOGM5%2FLiEfDO49Afie1MZjdxw%3D%3D
NL
binary
503 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2372
iexplore.exe
188.114.96.3:80
winwheels.buzz
CLOUDFLARENET
NL
malicious
2372
iexplore.exe
199.59.243.224:443
d.cnzz.site
AMAZON-02
US
malicious
3488
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2372
iexplore.exe
23.56.202.135:80
x1.c.lencr.org
AKAMAI-AS
GB
suspicious
3488
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
3488
iexplore.exe
188.114.96.3:80
winwheels.buzz
CLOUDFLARENET
NL
malicious
2372
iexplore.exe
2.16.202.121:80
r3.o.lencr.org
Akamai International B.V.
NL
suspicious
3488
iexplore.exe
104.126.37.139:443
www.bing.com
Akamai International B.V.
DE
suspicious
3488
iexplore.exe
188.114.97.3:80
winwheels.buzz
CLOUDFLARENET
NL
malicious
3488
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted

DNS requests

Domain
IP
Reputation
winwheels.buzz
  • 188.114.96.3
  • 188.114.97.3
malicious
d.cnzz.site
  • 199.59.243.224
malicious
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.139
  • 104.126.37.128
whitelisted
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
x1.c.lencr.org
  • 23.56.202.135
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
crl3.digicert.com
  • 192.229.221.95
whitelisted

Threats

PID
Process
Class
Message
2372
iexplore.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.buzz domain
2372
iexplore.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.buzz domain
3488
iexplore.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.buzz domain
2372
iexplore.exe
A Network Trojan was detected
ET HUNTING Possible Obfuscator io JavaScript Obfuscation
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://winwheels.buzz/IKwMsx/The-URAG-Poverty-Alleviation-Subsidy