File name:

Застрахователен договор н_00114.doc

Full analysis: https://app.any.run/tasks/ca30af44-3a08-4d46-8ab3-ba14cba67914
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 17, 2020, 18:10:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
generated-doc
loader
trojan
gozi
ursnif
dreambot
evasion
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri Jan 17 01:45:00 2020, Last Saved Time/Date: Fri Jan 17 01:45:00 2020, Number of Pages: 1, Number of Words: 85, Number of Characters: 487, Security: 0
MD5:

ED311EA2FFEC4B4FC970BC64D51FB86D

SHA1:

A97AE0632508F3648BC7953F32D7B0341126D34A

SHA256:

9CE3F98C3009F49B191E59642865B7FCC04819356A6801477075570123DA9E87

SSDEEP:

3072:aM+qyNNxyhQSZ1grOnc1sn8LRMESn9oObd1:aJ9NNeQSZ1grOnc1sn8dB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Downloads executable files from the Internet

      • powershell.exe (PID: 4048)

    • Connects to CnC server

      • iexplore.exe (PID: 3532)
      • iexplore.exe (PID: 1324)
      • explorer.exe (PID: 352)

    • URSNIF was detected

      • iexplore.exe (PID: 3532)
      • iexplore.exe (PID: 1324)

    • URSNIF Shellcode was detected

      • explorer.exe (PID: 352)

    • Executes PowerShell scripts

      • mshta.exe (PID: 3824)
      • cmd.exe (PID: 3140)

    • Starts Visual C# compiler

      • powershell.exe (PID: 3792)
      • powershell.exe (PID: 912)

    • Runs injected code in another process

      • powershell.exe (PID: 3792)

    • Application was injected by another process

      • explorer.exe (PID: 352)

    • Actions looks like stealing of personal data

      • explorer.exe (PID: 352)

  • SUSPICIOUS

    • Uses RUNDLL32.EXE to load library

      • powershell.exe (PID: 4048)

    • PowerShell script executed

      • powershell.exe (PID: 4048)

    • Creates files in the user directory

      • powershell.exe (PID: 4048)
      • powershell.exe (PID: 912)
      • powershell.exe (PID: 3792)
      • explorer.exe (PID: 352)

    • Executed via COM

      • iexplore.exe (PID: 720)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 4048)

    • Reads Internet Cache Settings

      • explorer.exe (PID: 352)

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • explorer.exe (PID: 352)

    • Starts CMD.EXE for commands execution

      • explorer.exe (PID: 352)

    • Uses SYSTEMINFO.EXE to read environment

      • cmd.exe (PID: 4016)

    • Checks for external IP

      • nslookup.exe (PID: 2152)

    • Loads DLL from Mozilla Firefox

      • explorer.exe (PID: 352)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 896)

    • Starts NET.EXE for network exploration

      • cmd.exe (PID: 1972)

    • Uses TASKLIST.EXE to query information about running processes

      • cmd.exe (PID: 2408)

    • Searches for installed software

      • reg.exe (PID: 3356)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 1296)

    • Starts Microsoft Office Application

      • explorer.exe (PID: 352)

    • Creates files in the user directory

      • iexplore.exe (PID: 3532)
      • WINWORD.EXE (PID: 1296)
      • iexplore.exe (PID: 720)

    • Manual execution by user

      • powershell.exe (PID: 4048)
      • mshta.exe (PID: 3824)

    • Changes internet zones settings

      • iexplore.exe (PID: 720)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3532)
      • mshta.exe (PID: 3824)
      • iexplore.exe (PID: 1324)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 1324)
      • iexplore.exe (PID: 3532)

    • Application launched itself

      • iexplore.exe (PID: 720)

    • Reads settings of System Certificates

      • explorer.exe (PID: 352)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: -
Subject: -
Author: -
Keywords: -
Comments: -
Template: Normal.dotm
LastModifiedBy: -
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2020:01:17 01:45:00
ModifyDate: 2020:01:17 01:45:00
Pages: 1
Words: 85
Characters: 487
Security: None
CodePage: Windows Latin 1 (Western European)
Lines: 4
Paragraphs: 1
CharCountWithSpaces: 571
AppVersion: 15
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
98
Monitored processes
41
Malicious processes
8
Suspicious processes
2

Behavior graph

Click at the process to see the details
start inject winword.exe no specs powershell.exe rundll32.exe no specs iexplore.exe #URSNIF iexplore.exe #URSNIF iexplore.exe mshta.exe no specs powershell.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs #URSNIF explorer.exe cmd.exe no specs nslookup.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs systeminfo.exe no specs powershell.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs cmd.exe no specs cmd.exe no specs net.exe no specs cmd.exe no specs cmd.exe no specs nslookup.exe cmd.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs cmd.exe no specs driverquery.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
352C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
504cmd /C "driverquery.exe >> C:\Users\admin\AppData\Local\Temp\6ACE.bin1"C:\Windows\system32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
720"C:\Program Files\Internet Explorer\iexplore.exe" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
896cmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\admin\AppData\Local\Temp\6ACE.bin1"C:\Windows\system32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\imm32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
896cmd /C "echo -------- >> C:\Users\admin\AppData\Local\Temp\6ACE.bin1"C:\Windows\system32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
912"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep unrestricted -file C:\Users\admin\Devivmgr.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
952cmd /C "echo -------- >> C:\Users\admin\AppData\Local\Temp\6ACE.bin1"C:\Windows\system32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
956net view C:\Windows\system32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
976cmd /C "echo -------- >> C:\Users\admin\AppData\Local\Temp\E1F0.bi1"C:\Windows\system32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1268systeminfo.exe C:\Windows\system32\systeminfo.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Displays system information
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\systeminfo.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
7 524
Read events
6 412
Write events
948
Delete events
164

Modification events

(PID) Process:(1296) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:$!c
Value:
2421630010050000010000000000000000000000
(PID) Process:(1296) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(1296) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(1296) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(1296) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(1296) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(1296) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(1296) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(1296) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(1296) WINWORD.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:writeName:WORDFiles
Value:
1345388606
Executable files
1
Suspicious files
11
Text files
33
Unknown types
15

Dropped files

PID
Process
Filename
Type
1296WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRA514.tmp.cvr —
MD5:—
SHA256:—
1296WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D14C5934.wmf —
MD5:—
SHA256:—
1296WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C27F3FA5.wmf —
MD5:—
SHA256:—
1296WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CAEEF962.wmf —
MD5:—
SHA256:—
1296WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E011B5FB.wmf —
MD5:—
SHA256:—
1296WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\34EB3FC0.wmf —
MD5:—
SHA256:—
1296WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A518BCC1.wmf —
MD5:—
SHA256:—
1296WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AC4F7BCE.wmf —
MD5:—
SHA256:—
1296WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\827B5D77.wmf —
MD5:—
SHA256:—
1296WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E820290C.wmf —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
20
DNS requests
15
Threats
27

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
352
explorer.exe
GET
—
37.34.225.14:80
http://buddy-calc.at/images/RWV1IM07e1/zeoQCrhxU_2Bx_2Bo/KnvtBDmBezaA/sNKsI27t5TV/3RAKbIZZCqkkN9/zIbxQVenbXwxWKrx9R45p/2BcD4rfpCBC_2FZd/345_2FW1QQ8sjkh/lx1jD0LB05WdoqHtsM/WMYTSEF8n/1dkUSgwoADekQsWWKUH5/bOpebuK_2FfmCysl79N/tw1Wuj7rsJAmdtzJcX/fl.jpeg
KW
—
—
malicious
352
explorer.exe
GET
—
37.34.225.14:80
http://buddy-calc.at/images/LyGAnzQ5hVbd_2B1EqWywrYgBs/Fvwoe2p/lQ0O91yI9v510EwKf/RyIA7LOZMxGqHksx0ePn_2B2dQLa5Kdxzyj/RiYpA.ttf
KW
—
—
malicious
352
explorer.exe
GET
—
190.140.198.49:80
http://securecc.ru/jupd32.bin
PA
—
—
malicious
3532
iexplore.exe
GET
—
151.251.24.148:80
http://ccsecure.ru/images/UQ7UQqrAF8pYxoB/FUy_2FUywdvf_2B6ph/QsasUyML2/a6Q0RosNa2ld8MtPSoei/u_2BUtaVA6FKhhMAKKO/LkGwJGWF5iELN7cjrjdIeq/2o_2FhfH0uDTc/NHcVmxct/vDiQqjz8_2FU1CKJY_2Fs7B/LMaA_2FlJ/ytA1dauV.avi
BG
—
—
malicious
1324
iexplore.exe
GET
—
151.251.24.148:80
http://ccsecure.ru/images/YTnB4UMLZyLkVKroJN/73X7BKEki/NFb5IF9uYjHQCH1WqRED/o1RcLrXnHbffrN00B_2/FxrvNhweZ827HVHId8hzUn/stLVHv6492_2B/S6w2GlSm/398FvrTPMbrKzF_2B5G5qAF/eiZ0fMknvP/vDv0q2OAtyHlwqqAZ/eSXP25zbN05lxF/b1md.avi
BG
—
—
malicious
4048
powershell.exe
GET
200
190.140.198.49:80
http://securecc.ru/kfoiuyrtebnvhcgxljkjh.bin
PA
executable
248 Kb
malicious
352
explorer.exe
GET
200
104.31.65.34:80
http://curlmyip.net/
US
text
11 b
shared
352
explorer.exe
GET
200
37.34.225.14:80
http://buddy-calc.at/images/BPK1z7Z91BhOzZtDJBYvY/QJqfh1awt_2BLVyE/RvMqOHoyuk4Z1o0/VJ6mTp3NhJuWPNirme/uGpofWpZi/VrQaHoZvtJSOkilpVaoL/SuDs3V9WGnilD_2BM2w/RYzoY_2FCgPL8yMT9pWb3w/uCODGnCz7zozl/gSwtob49/Aju_2B3il8Kn_2BLF6B/7.gif
KW
binary
926 b
malicious
352
explorer.exe
POST
—
37.34.225.14:80
http://buddy-calc.at/images/SB2Jteg_/2FqnIhFNpM6_2Bj5uMVPB2G/N4tK7wYxTK/aWsKGl6l1HJz53OkX/Fz4_2B8afM2r/EF_2BFpSU2B/vuwSy9OH8oCj_2/FFubTax3vG9fGUvj7Onsa/SyiYH_2FbEbWPEYP/ghe5l9J2Yl9dIsb/cYceHzHr3eWahLS_2B/Oe8cKy7im/Q3b11wCPMK7NB55zfwAs/_2BtV7eEzbjgOWJTOrV/1vf1Qd57Xj0/_2Ba4YUK.bmp
KW
—
—
malicious
352
explorer.exe
GET
200
37.34.225.14:80
http://buddy-calc.at/images/LyG/AnzQ5hVbd_2B1EqWyw/rYgBsFvwoe2plQ0O91yI9v53dFzkfQU2p/wh4vBhVb984xc7ADnaIzVathCzu54Nf67yuOhyp9NOKrNbta0o2rhtI.ttf
KW
binary
324 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
104.31.65.34:80
curlmyip.net
Cloudflare Inc
US
unknown
352
explorer.exe
190.140.198.49:80
securecc.ru
Cable Onda
PA
malicious
352
explorer.exe
37.34.225.14:80
buddy-calc.at
Mobile Telecommunications Company
KW
malicious
4048
powershell.exe
190.140.198.49:80
securecc.ru
Cable Onda
PA
malicious
720
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3532
iexplore.exe
151.251.24.148:80
securecc.ru
Blizoo Media and Broadband
BG
malicious
720
iexplore.exe
151.251.24.148:80
securecc.ru
Blizoo Media and Broadband
BG
malicious
1324
iexplore.exe
151.251.24.148:80
securecc.ru
Blizoo Media and Broadband
BG
malicious
352
explorer.exe
172.217.22.14:443
google.com
Google Inc.
US
whitelisted
352
explorer.exe
172.217.18.4:443
www.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
securecc.ru
  • 190.140.198.49
  • 186.87.135.97
  • 203.91.116.53
  • 181.59.254.21
  • 31.5.167.149
  • 201.189.190.227
  • 181.168.208.178
  • 95.219.150.97
  • 151.251.24.148
  • 213.222.130.75
malicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ccsecure.ru
  • 151.251.24.148
  • 213.222.130.75
  • 190.140.198.49
  • 186.87.135.97
  • 203.91.116.53
  • 181.59.254.21
  • 31.5.167.149
  • 201.189.190.227
  • 181.168.208.178
  • 95.219.150.97
malicious
google.com
  • 172.217.22.14
malicious
www.google.com
  • 172.217.18.4
malicious
resolver1.opendns.com
  • 208.67.222.222
shared
222.222.67.208.in-addr.arpa
  • —
unknown
myip.opendns.com
  • —
shared
curlmyip.net
  • 104.31.65.34
  • 104.31.64.34
shared
buddy-calc.at
  • 37.34.225.14
  • 37.75.49.82
  • 109.121.214.139
  • 86.105.60.33
  • 79.124.89.241
  • 92.87.103.90
  • 89.47.94.113
  • 91.83.70.44
  • 213.222.130.75
  • 79.136.8.168
malicious

Threats

PID
Process
Class
Message
4048
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4048
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3532
iexplore.exe
A Network Trojan was detected
AV TROJAN Ursnif Variant CnC Beacon 2019-09-18
3532
iexplore.exe
A Network Trojan was detected
MALWARE [PTsecurity] W32.Dreambot HTTP GET Check-in
1324
iexplore.exe
A Network Trojan was detected
MALWARE [PTsecurity] W32.Dreambot HTTP GET Check-in
2152
nslookup.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup Domain (myip.opendns .com in DNS lookup)
2152
nslookup.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup Domain (myip.opendns .com in DNS lookup)
2152
nslookup.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup Domain (myip.opendns .com in DNS lookup)
2152
nslookup.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup Domain (myip.opendns .com in DNS lookup)
1080
svchost.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup Domain (curlmyip .net in DNS lookup)
9 ETPRO signatures available at the full report
Process
Message
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Застрахователен договор н_00114.doc