File name:

2019-05-03-Ursnif-retrieved-by-Word-macro.exe

Full analysis: https://app.any.run/tasks/9e9bae3d-e6aa-4116-89cd-05415c140b3f
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 03:23:10
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
gozi
ursnif
dreambot
banker
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

92F77609F4DBB0833CB024A3E3A4C116

SHA1:

140CEB574737761FA50622FA967575466985DB1C

SHA256:

9ABFB714DE8FD134FAA9C99F213D300E2C3D655F1F6DF401C7C96A00D600648B

SSDEEP:

6144:cvck0SbLecu2lxHERvcY3cG876kM/XdLP4RhDetdFKnmQpnevq/Bj4XZVBXxZYut:ckHEec3vHExcY3cR76EqAEJgp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • URSNIF has been detected (SURICATA)

      • iexplore.exe (PID: 3676)
      • iexplore.exe (PID: 2088)
      • iexplore.exe (PID: 672)
      • iexplore.exe (PID: 4728)
      • iexplore.exe (PID: 3024)
      • iexplore.exe (PID: 4164)
      • iexplore.exe (PID: 5528)
      • iexplore.exe (PID: 5124)
      • iexplore.exe (PID: 4976)

    • Connects to the CnC server

      • iexplore.exe (PID: 3676)
      • iexplore.exe (PID: 672)
      • iexplore.exe (PID: 2088)
      • iexplore.exe (PID: 4728)
      • iexplore.exe (PID: 3024)
      • iexplore.exe (PID: 4164)
      • iexplore.exe (PID: 5124)
      • iexplore.exe (PID: 5528)
      • iexplore.exe (PID: 4976)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • 2019-05-03-Ursnif-retrieved-by-Word-macro.exe (PID: 1244)

    • Contacting a server suspected of hosting an CnC

      • iexplore.exe (PID: 3676)
      • iexplore.exe (PID: 2088)
      • iexplore.exe (PID: 672)
      • iexplore.exe (PID: 4728)
      • iexplore.exe (PID: 3024)
      • iexplore.exe (PID: 4164)
      • iexplore.exe (PID: 5124)
      • iexplore.exe (PID: 5528)
      • iexplore.exe (PID: 4976)

  • INFO

    • Reads the computer name

      • 2019-05-03-Ursnif-retrieved-by-Word-macro.exe (PID: 1244)
      • ielowutil.exe (PID: 5344)

    • Reads the software policy settings

      • slui.exe (PID: 6944)
      • slui.exe (PID: 6592)

    • Local mutex for internet shortcut management

      • iexplore.exe (PID: 6988)

    • Checks proxy server information

      • slui.exe (PID: 6592)

    • Checks supported languages

      • 2019-05-03-Ursnif-retrieved-by-Word-macro.exe (PID: 1244)
      • ielowutil.exe (PID: 5344)

    • The sample compiled with english language support

      • 2019-05-03-Ursnif-retrieved-by-Word-macro.exe (PID: 1244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:05:03 10:08:31+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 118272
InitializedDataSize: 238080
UninitializedDataSize: -
EntryPoint: 0x737a
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 13.8.34.76
ProductVersionNumber: 13.8.34.76
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Breakthrough Technologies South
FileDescription: Breakthrough Technologies Chord Clean
FileVersion: 13.8.34.76
InternalName: doescoat.exe
LegalCopyright: Copyright (c) Breakthrough Technologies, 2019. All rights reserved
LegalTrademarks: Breakthrough Technologies
OriginalFileName: doescoat.exe
ProductName: Breakthrough Technologies Test
ProductVersion: 13.8.34.76
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
169
Monitored processes
30
Malicious processes
10
Suspicious processes
7

Behavior graph

Click at the process to see the details
start 2019-05-03-ursnif-retrieved-by-word-macro.exe no specs sppextcomobj.exe no specs slui.exe ielowutil.exe no specs iexplore.exe #URSNIF iexplore.exe slui.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
672"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5136 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
732"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1244"C:\Users\admin\AppData\Local\Temp\2019-05-03-Ursnif-retrieved-by-Word-macro.exe" C:\Users\admin\AppData\Local\Temp\2019-05-03-Ursnif-retrieved-by-Word-macro.exe—explorer.exe
User:
admin
Company:
Breakthrough Technologies South
Integrity Level:
MEDIUM
Description:
Breakthrough Technologies Chord Clean
Version:
13.8.34.76
Modules
Images
c:\users\admin\appdata\local\temp\2019-05-03-ursnif-retrieved-by-word-macro.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1324"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2088"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5036 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2244"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3024"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1324 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3676"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6988 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3800"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
41 382
Read events
41 091
Write events
241
Delete events
50

Modification events

(PID) Process:(6988) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(6988) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(6988) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6988) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6988) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6988) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{915929E3-0928-11F0-B4ED-18F7786F96EE}
Value:
0
(PID) Process:(6988) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch
Operation:writeName:Version
Value:
WS not running
(PID) Process:(6988) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:FullScreen
Value:
no
(PID) Process:(6988) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(6988) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery
Operation:writeName:Active
Value:
0
Executable files
0
Suspicious files
50
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3676iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DATbinary
MD5:0392ADA071EB68355BED625D8F9695F3
SHA256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
6988iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{915929E3-0928-11F0-B4ED-18F7786F96EE}.datbinary
MD5:504797387462F719265FC1DA1DDC7B65
SHA256:92AE360F85D53ACB778F99EEFF4EA01156EA537157BA05C5FECFC3398AD54068
6988iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF15381804AC0DF566.TMPbinary
MD5:A3D527E18863300D9F0A71CBBB8F38B4
SHA256:DD388661B02FA154FBEFAE6D618528A46A81BA1FBE4E6F59AB64D88C0E6EFDD8
3676iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\SmartScreenCache.datbinary
MD5:0940B24B6E5D5CD32BFC643A4FC8B9F7
SHA256:BADCB7910CBFFEB5201B54AAEDE1E16A9742EE3F08986BAC9CBEAD82C65DAA99
6676iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFE871141097CE5451.TMPbinary
MD5:C63A12AADB418C91435B7BE76F6D9DBB
SHA256:47D934E6C4B21412BD2A610B77A95127252BD6BF9155A22A40F97210375F61B2
6676iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{AA669E38-0928-11F0-B4ED-18F7786F96EE}.datbinary
MD5:25B42CB8EE3771A4F092C387FBE7C387
SHA256:CF90B6F1D47590ED6CA57955C33A4604ED51AA446E438F44338E0305375B89C5
6988iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{915929E5-0928-11F0-B4ED-18F7786F96EE}.datbinary
MD5:A433306DFC1764133CE441E177B582AC
SHA256:6210D03F45DDEFA5573052B1E86669FEFA2E3856786A2FB4CD926E16A251048C
6676iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{AA669E3A-0928-11F0-B4ED-18F7786F96EE}.datbinary
MD5:19A7A0FA9AD4BFC87C4C177D5A4136F5
SHA256:AFF4835ADF3F4A54261793113E445F0CF02CCF61042D6A6E5F8AEC6822FD38DE
5036iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF9DB1A62D19F5CB52.TMPbinary
MD5:69F7933891B10739519270D905232ACD
SHA256:5AFC81E8320B3197A45D7556F3F3B784E5F783881DE42AC2DBB996B933C8F434
5136iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{C4C43F3D-0928-11F0-B4ED-18F7786F96EE}.datbinary
MD5:BB743831080C5FD68D2352B3537E92EF
SHA256:EB131F0F1ED0355356C66A259F86CFA90EC3E5ABAEE60E44EDBCCF723EF661E3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
87
DNS requests
25
Threats
15

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3676
iexplore.exe
GET
404
49.13.77.253:80
http://nvr82644ooei.info/images/r4xwEMCAwoDmRS/OPpg39xLDPuxCXFeEKdtA/ruEhs8w_2FaBan1_/2Bz9o_2FL4uPTBl/O0h3y_2BCRz6jqeI1H/J_2Fggl_2/B3ImWEoDnI6DENkN9Owp/ewdibNYuxmr5LddK0Gy/L3o0MVubYJmeF4B1Vsgc2s/td0J8Yyp.avi
unknown
—
—
malicious
672
iexplore.exe
GET
404
49.13.77.253:80
http://nay27lawrenceu.top/images/MlSuLoS62/cANg5c9igO0g5oE_2Bhl/G2j_2F2cXMAQk970D1b/5X74ertFLjMmg5MpbME332/yXpz3KtYVCZ_2/FYqtWb96/ALRRNfAAmVRcOqbWYy4VZDl/PjBWluxFvM/HAGbkUoJzHzY_2B_2/B57Yk5BQlCp5z/PWS6Lm.avi
unknown
—
—
malicious
3024
iexplore.exe
GET
404
49.13.77.253:80
http://nay27lawrenceu.top/images/nHSyau_2BOOpiRRJ1m7Xp/8r6B4qnlsD2WCPSH/lU5GJgwIoMU5kGQ/I5BVuQZ5fhO_2BhHZc/UZ0Idf_2B/GwweY69DU0CN08DuMdsV/eSedPyX_2Bq1q6vpj4P/fTBgPGy7m86MAyYEIRcVbp/N40_2BbZzlmtB/IZSgdQoR/uaGLVrIcnhk/EswjvKkc/L.avi
unknown
—
—
malicious
4728
iexplore.exe
GET
404
49.13.77.253:80
http://wee2684iy62.club/images/58fR0vqZ_2F9I/tHxr1JH7/C6A9idBAOpIW3OR7I_2BYMi/nmiXKBWxZ_/2BHHH1tX33gOd6qEa/_2F9qh3Ku_2B/MBO5ClxkSGz/dp8hRQUuG3Y0eX/nSG1ABQ228p0ZWADyTC8C/vrMjvVDys_2F5H7p/OxKM_2FOMmI/9KHjyrbz.avi
unknown
—
—
malicious
5124
iexplore.exe
GET
404
49.13.77.253:80
http://nvr82644ooei.info/images/VI_2Fko9/ajGsIhSl4BuiIZJ78K9uVKy/pFcFHtZpzs/tRDeKbTT_2BUsHLMG/KAKAOv41Y1m0/Mwi_2BD5Pqh/Vq0ck_2B9v48jw/dmKDxgF7cQWOe2yCr_2B9/kuJ90AESjrG1cmY1/PftnM_2Bd5cC3te/Sy6bod1z/PvZCcl5.avi
unknown
—
—
malicious
5528
iexplore.exe
GET
404
49.13.77.253:80
http://nay27lawrenceu.top/images/GCadhthJuZ/jTsKovjCYjBxy7_2F/jK3uIN7FNNlt/NEaxnqINihz/MHnMZIKOwOB2_2/B0iS_2BPhYlIEukFkhndD/onYYFgGv1vPt6Si_/2FyjMj3zWVG87KR/m1RxMzUoBLIwaaxYLp/esqdokjNT/T3HpwsEuWEh/C_2BoR.avi
unknown
—
—
malicious
4164
iexplore.exe
GET
404
49.13.77.253:80
http://wee2684iy62.club/images/PerACME2FNTJKe/QhAvyURdJ9khAF_2BXD0i/9IbQK0khaVmzdCIe/guEGwufuoIjukNX/CKfgPaGUC7Sf5f4Ems/gCk7gHOos/wOC9bYH0B12U3q7RmrKK/vvqqysmVw3Lay_2BmSd/Vx3I22RqHGcDx7/itgXzDl3.avi
unknown
—
—
malicious
4120
iexplore.exe
GET
404
49.13.77.253:80
http://wee2684iy62.club/images/iiErsLqod1rJM2/G8y5PnLINvgAEWXKISsEB/DZ4p4OOcbE1T0OPl/Vjhnkr011dDisrj/eSBQ8DlsOh1qQp_2B7/WMrcqQz_2/FDNULimgN0ZYwsnN0vtA/aTr3oIP29GYA4vsLZpg/jTZ_2FUrJX652WXbXBO3Z6/FVs50aqbUA/OJdKmofD/ZBb5Z.avi
unknown
—
—
unknown
4976
iexplore.exe
GET
404
49.13.77.253:80
http://nvr82644ooei.info/images/VxjSC3qZu/bOHiTn8zgzz5Dd5XdNtU/u1KzpnStaczDR_2FvMy/iFFq62UHPw_2FlM7ldCXeG/vZtkckdnnOtd7/vIaRwLOC/7mmdgmW_2F86an2smc9SG3f/91QWuAlmUq/82ffn_2B4bHp64KFi/tNYKhOVKhMsh/37tsQ3lcRMN/n4bgFf4OBf/p7TUh.avi
unknown
—
—
malicious
4696
iexplore.exe
GET
404
49.13.77.253:80
http://wee2684iy62.club/images/QNrZWKUFjj/oxTXOxSZQW5nF03xq/fbPCc4f3onEJ/accQ2i1GeYe/ijz8stfGVMDOPQ/bGMq4gCTuYlc2wa5KNeTR/jJkfZJA5RitLyZ8g/Z2BtSVUb47_2FBd/Jn0kV_2FDu7Ux3bk1J/j9XiTvhvU1UP8/i1RWLCx.avi
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3676
iexplore.exe
49.13.77.253:80
nvr82644ooei.info
Hetzner Online GmbH
DE
malicious
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1388
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 142.250.184.238
whitelisted
nvr82644ooei.info
  • 49.13.77.253
malicious
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.31.69
  • 40.126.31.129
  • 20.190.159.0
  • 20.190.159.131
  • 20.190.159.75
  • 40.126.31.0
  • 40.126.31.67
  • 20.190.159.64
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
  • 2603:1030:800:5::bfee:a08d
whitelisted
18.31.95.13.in-addr.arpa
  • —
unknown
d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown

Threats

PID
Process
Class
Message
3676
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
2088
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
2088
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
672
iexplore.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
672
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
4728
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
4728
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
3024
iexplore.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
3024
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2019-05-03-Ursnif-retrieved-by-Word-macro.exe