File name:

2019-05-03-Ursnif-retrieved-by-Word-macro.exe

Full analysis: https://app.any.run/tasks/9e9bae3d-e6aa-4116-89cd-05415c140b3f
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 03:23:10
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
gozi
ursnif
dreambot
banker
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

92F77609F4DBB0833CB024A3E3A4C116

SHA1:

140CEB574737761FA50622FA967575466985DB1C

SHA256:

9ABFB714DE8FD134FAA9C99F213D300E2C3D655F1F6DF401C7C96A00D600648B

SSDEEP:

6144:cvck0SbLecu2lxHERvcY3cG876kM/XdLP4RhDetdFKnmQpnevq/Bj4XZVBXxZYut:ckHEec3vHExcY3cR76EqAEJgp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • iexplore.exe (PID: 3676)
      • iexplore.exe (PID: 2088)
      • iexplore.exe (PID: 672)
      • iexplore.exe (PID: 4728)
      • iexplore.exe (PID: 4164)
      • iexplore.exe (PID: 3024)
      • iexplore.exe (PID: 5528)
      • iexplore.exe (PID: 5124)
      • iexplore.exe (PID: 4976)

    • URSNIF has been detected (SURICATA)

      • iexplore.exe (PID: 3676)
      • iexplore.exe (PID: 2088)
      • iexplore.exe (PID: 672)
      • iexplore.exe (PID: 4728)
      • iexplore.exe (PID: 3024)
      • iexplore.exe (PID: 4164)
      • iexplore.exe (PID: 5124)
      • iexplore.exe (PID: 5528)
      • iexplore.exe (PID: 4976)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • 2019-05-03-Ursnif-retrieved-by-Word-macro.exe (PID: 1244)

    • Contacting a server suspected of hosting an CnC

      • iexplore.exe (PID: 3676)
      • iexplore.exe (PID: 2088)
      • iexplore.exe (PID: 672)
      • iexplore.exe (PID: 4728)
      • iexplore.exe (PID: 3024)
      • iexplore.exe (PID: 5124)
      • iexplore.exe (PID: 4164)
      • iexplore.exe (PID: 5528)
      • iexplore.exe (PID: 4976)

  • INFO

    • Reads the computer name

      • 2019-05-03-Ursnif-retrieved-by-Word-macro.exe (PID: 1244)
      • ielowutil.exe (PID: 5344)

    • The sample compiled with english language support

      • 2019-05-03-Ursnif-retrieved-by-Word-macro.exe (PID: 1244)

    • Checks supported languages

      • 2019-05-03-Ursnif-retrieved-by-Word-macro.exe (PID: 1244)
      • ielowutil.exe (PID: 5344)

    • Reads the software policy settings

      • slui.exe (PID: 6944)
      • slui.exe (PID: 6592)

    • Local mutex for internet shortcut management

      • iexplore.exe (PID: 6988)

    • Checks proxy server information

      • slui.exe (PID: 6592)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:05:03 10:08:31+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 118272
InitializedDataSize: 238080
UninitializedDataSize: -
EntryPoint: 0x737a
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 13.8.34.76
ProductVersionNumber: 13.8.34.76
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Breakthrough Technologies South
FileDescription: Breakthrough Technologies Chord Clean
FileVersion: 13.8.34.76
InternalName: doescoat.exe
LegalCopyright: Copyright (c) Breakthrough Technologies, 2019. All rights reserved
LegalTrademarks: Breakthrough Technologies
OriginalFileName: doescoat.exe
ProductName: Breakthrough Technologies Test
ProductVersion: 13.8.34.76
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
169
Monitored processes
30
Malicious processes
10
Suspicious processes
7

Behavior graph

Click at the process to see the details
start 2019-05-03-ursnif-retrieved-by-word-macro.exe no specs sppextcomobj.exe no specs slui.exe ielowutil.exe no specs iexplore.exe #URSNIF iexplore.exe slui.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
672"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5136 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
732"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1244"C:\Users\admin\AppData\Local\Temp\2019-05-03-Ursnif-retrieved-by-Word-macro.exe" C:\Users\admin\AppData\Local\Temp\2019-05-03-Ursnif-retrieved-by-Word-macro.exe—explorer.exe
User:
admin
Company:
Breakthrough Technologies South
Integrity Level:
MEDIUM
Description:
Breakthrough Technologies Chord Clean
Version:
13.8.34.76
Modules
Images
c:\users\admin\appdata\local\temp\2019-05-03-ursnif-retrieved-by-word-macro.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1324"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2088"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5036 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2244"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3024"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1324 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3676"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6988 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3800"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
41 382
Read events
41 091
Write events
241
Delete events
50

Modification events

(PID) Process:(6988) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(6988) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(6988) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6988) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6988) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6988) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{915929E3-0928-11F0-B4ED-18F7786F96EE}
Value:
0
(PID) Process:(6988) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch
Operation:writeName:Version
Value:
WS not running
(PID) Process:(6988) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:FullScreen
Value:
no
(PID) Process:(6988) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(6988) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery
Operation:writeName:Active
Value:
0
Executable files
0
Suspicious files
50
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6988iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{915929E5-0928-11F0-B4ED-18F7786F96EE}.datbinary
MD5:A433306DFC1764133CE441E177B582AC
SHA256:6210D03F45DDEFA5573052B1E86669FEFA2E3856786A2FB4CD926E16A251048C
6988iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFC1829AFA2B92EA24.TMPbinary
MD5:6E14C356AFE6E0B632D5E142A48DF71A
SHA256:487E1062C359CA6C112E244701CB9895FF27CE31D7DCCE5050E7835E987E2A34
3676iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\SmartScreenCache.datbinary
MD5:0940B24B6E5D5CD32BFC643A4FC8B9F7
SHA256:BADCB7910CBFFEB5201B54AAEDE1E16A9742EE3F08986BAC9CBEAD82C65DAA99
6676iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF240184A5B18345E1.TMPbinary
MD5:A2D2AD1971226B9556EE038E0FB2429C
SHA256:1E1AB8BA42170950689B4EBD184AC6E65BACB6239BB2553F116A95B39DCCA0B6
3676iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DATbinary
MD5:0392ADA071EB68355BED625D8F9695F3
SHA256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
6988iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{915929E3-0928-11F0-B4ED-18F7786F96EE}.datbinary
MD5:504797387462F719265FC1DA1DDC7B65
SHA256:92AE360F85D53ACB778F99EEFF4EA01156EA537157BA05C5FECFC3398AD54068
5136iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF8FCE61D6BC5064E9.TMPbinary
MD5:8F7FB9F9F6BCC848F2B5280EE13AE5C4
SHA256:472E61EDFB186D7A60F92D5D8A6CEC9A60A208043173D5527D44F33196B955A9
732iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF04321D91EC282D12.TMPbinary
MD5:1E2ED1EB77FC5F73F9B0D3AC05647C56
SHA256:C5824153EBC5AD9C3447341342E17CEBB4022102D3B7A5E0F6E1CB696FACF9CB
5136iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{C4C43F3B-0928-11F0-B4ED-18F7786F96EE}.datbinary
MD5:A1C696FC31B34712EA5317BC7000FEFE
SHA256:FCA58BA1150F3C2E6C675EBA92246F6FB46B8199912A2CBA9C1F68447FFC8C1B
732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{D19C034E-0928-11F0-B4ED-18F7786F96EE}.datbinary
MD5:3327E2E581825611B91B95C8D3E14F5C
SHA256:E88C925B695FCA55CC55E4B517DD901A7EC5407DDC3FA8607F0196D513A6AAFD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
87
DNS requests
25
Threats
15

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3676
iexplore.exe
GET
404
49.13.77.253:80
http://nvr82644ooei.info/images/r4xwEMCAwoDmRS/OPpg39xLDPuxCXFeEKdtA/ruEhs8w_2FaBan1_/2Bz9o_2FL4uPTBl/O0h3y_2BCRz6jqeI1H/J_2Fggl_2/B3ImWEoDnI6DENkN9Owp/ewdibNYuxmr5LddK0Gy/L3o0MVubYJmeF4B1Vsgc2s/td0J8Yyp.avi
unknown
—
—
malicious
2088
iexplore.exe
GET
404
49.13.77.253:80
http://nvr82644ooei.info/images/vy4Dp0Q6/NbzaRwaUfsDzfOHLX5_2Bu4/aQmK3kaIn9/aBzL8muGcXH5MXRxc/1_2BrU_2FP26/tiprlXhiBiO/2_2FKMKrsOmf7r/9TPRJNX5VN91_2F5BDgyk/T5hFsMVDAIaEYGcq/BWdogxhwer6VQIn/3XyPLnki/7yVr7.avi
unknown
—
—
malicious
672
iexplore.exe
GET
404
49.13.77.253:80
http://nay27lawrenceu.top/images/MlSuLoS62/cANg5c9igO0g5oE_2Bhl/G2j_2F2cXMAQk970D1b/5X74ertFLjMmg5MpbME332/yXpz3KtYVCZ_2/FYqtWb96/ALRRNfAAmVRcOqbWYy4VZDl/PjBWluxFvM/HAGbkUoJzHzY_2B_2/B57Yk5BQlCp5z/PWS6Lm.avi
unknown
—
—
malicious
4728
iexplore.exe
GET
404
49.13.77.253:80
http://wee2684iy62.club/images/58fR0vqZ_2F9I/tHxr1JH7/C6A9idBAOpIW3OR7I_2BYMi/nmiXKBWxZ_/2BHHH1tX33gOd6qEa/_2F9qh3Ku_2B/MBO5ClxkSGz/dp8hRQUuG3Y0eX/nSG1ABQ228p0ZWADyTC8C/vrMjvVDys_2F5H7p/OxKM_2FOMmI/9KHjyrbz.avi
unknown
—
—
malicious
4696
iexplore.exe
GET
404
49.13.77.253:80
http://wee2684iy62.club/images/QNrZWKUFjj/oxTXOxSZQW5nF03xq/fbPCc4f3onEJ/accQ2i1GeYe/ijz8stfGVMDOPQ/bGMq4gCTuYlc2wa5KNeTR/jJkfZJA5RitLyZ8g/Z2BtSVUb47_2FBd/Jn0kV_2FDu7Ux3bk1J/j9XiTvhvU1UP8/i1RWLCx.avi
unknown
—
—
unknown
5796
iexplore.exe
GET
404
49.13.77.253:80
http://nvr82644ooei.info/images/2ftPyrGBSe/lxqbsPdZqFJGdzNvc/HkdWT9KzkpHJ/h6NEEBQcx_2/B9fzFOoejnzXLr/0PwH0sZ2ysNh2f2XziJPk/2R0nPvDJ7Q3PRHBL/ANxDWQopV1UHobt/UEQgf3u7rinIcOMGUD/KQe3a2uYJtRas/k_2FwsU.avi
unknown
—
—
malicious
3024
iexplore.exe
GET
404
49.13.77.253:80
http://nay27lawrenceu.top/images/nHSyau_2BOOpiRRJ1m7Xp/8r6B4qnlsD2WCPSH/lU5GJgwIoMU5kGQ/I5BVuQZ5fhO_2BhHZc/UZ0Idf_2B/GwweY69DU0CN08DuMdsV/eSedPyX_2Bq1q6vpj4P/fTBgPGy7m86MAyYEIRcVbp/N40_2BbZzlmtB/IZSgdQoR/uaGLVrIcnhk/EswjvKkc/L.avi
unknown
—
—
malicious
4164
iexplore.exe
GET
404
49.13.77.253:80
http://wee2684iy62.club/images/PerACME2FNTJKe/QhAvyURdJ9khAF_2BXD0i/9IbQK0khaVmzdCIe/guEGwufuoIjukNX/CKfgPaGUC7Sf5f4Ems/gCk7gHOos/wOC9bYH0B12U3q7RmrKK/vvqqysmVw3Lay_2BmSd/Vx3I22RqHGcDx7/itgXzDl3.avi
unknown
—
—
malicious
5124
iexplore.exe
GET
404
49.13.77.253:80
http://nvr82644ooei.info/images/VI_2Fko9/ajGsIhSl4BuiIZJ78K9uVKy/pFcFHtZpzs/tRDeKbTT_2BUsHLMG/KAKAOv41Y1m0/Mwi_2BD5Pqh/Vq0ck_2B9v48jw/dmKDxgF7cQWOe2yCr_2B9/kuJ90AESjrG1cmY1/PftnM_2Bd5cC3te/Sy6bod1z/PvZCcl5.avi
unknown
—
—
malicious
4120
iexplore.exe
GET
404
49.13.77.253:80
http://wee2684iy62.club/images/iiErsLqod1rJM2/G8y5PnLINvgAEWXKISsEB/DZ4p4OOcbE1T0OPl/Vjhnkr011dDisrj/eSBQ8DlsOh1qQp_2B7/WMrcqQz_2/FDNULimgN0ZYwsnN0vtA/aTr3oIP29GYA4vsLZpg/jTZ_2FUrJX652WXbXBO3Z6/FVs50aqbUA/OJdKmofD/ZBb5Z.avi
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3676
iexplore.exe
49.13.77.253:80
nvr82644ooei.info
Hetzner Online GmbH
DE
malicious
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1388
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 142.250.184.238
whitelisted
nvr82644ooei.info
  • 49.13.77.253
malicious
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.31.69
  • 40.126.31.129
  • 20.190.159.0
  • 20.190.159.131
  • 20.190.159.75
  • 40.126.31.0
  • 40.126.31.67
  • 20.190.159.64
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
  • 2603:1030:800:5::bfee:a08d
whitelisted
18.31.95.13.in-addr.arpa
  • —
unknown
d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown

Threats

PID
Process
Class
Message
3676
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
2088
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
2088
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
672
iexplore.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
672
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
4728
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
4728
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
3024
iexplore.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
3024
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2019-05-03-Ursnif-retrieved-by-Word-macro.exe