analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www.google.com/url?q=https%3A%2F%2Fvk.cc%2Fc7Wvjo&sa=D&50=84&usg=AFQjCNHj_a66ufJc5MfSABppuo4GGGxh6w

Full analysis: https://app.any.run/tasks/5977edba-4e3b-42ea-a063-bf686e662caa
Verdict: Malicious activity
Analysis date: November 23, 2021, 18:56:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

5BA67EC7C3BE33A05171737DE828DE49

SHA1:

9B614E2486135F789AB239EC1FCA93DB1AD7C3F9

SHA256:

9CFBCB11099E93E423034C4A3FC9D947AD681B3E095AD1FF6FB74FACC4941A42

SSDEEP:

3:N8DSLI2GBWCXjCsIUwleYkI0YETcDvGQ88BPe:2OLI2MzC3pkI0YET8cOPe

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2132)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 3388)
      • explorer.exe (PID: 4032)
      • iexplore.exe (PID: 2132)

    • Reads the computer name

      • iexplore.exe (PID: 3388)
      • iexplore.exe (PID: 2132)
      • explorer.exe (PID: 4032)

    • Changes internet zones settings

      • iexplore.exe (PID: 3388)

    • Application launched itself

      • iexplore.exe (PID: 3388)

    • Manual execution by user

      • explorer.exe (PID: 4032)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3388)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3388)
      • iexplore.exe (PID: 2132)

    • Creates files in the user directory

      • iexplore.exe (PID: 2132)
      • iexplore.exe (PID: 3388)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2132)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3388)
      • iexplore.exe (PID: 2132)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3388)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3388"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.google.com/url?q=https%3A%2F%2Fvk.cc%2Fc7Wvjo&sa=D&50=84&usg=AFQjCNHj_a66ufJc5MfSABppuo4GGGxh6w"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\iertutil.dll
2132"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3388 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
4032"C:\Windows\explorer.exe" C:\Windows\explorer.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
14 104
Read events
13 982
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
14
Text files
17
Unknown types
9

Dropped files

PID
Process
Filename
Type
3388iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\H9LLL65G.txttext
MD5:4D095A540B52AC14710E96453C89F40D
SHA256:BB57E84A400E40A0906F553A4264DB884A9D5AF06D87E5C9675752C6C5D0562D
3388iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\8IZTACVO.txttext
MD5:B398E04FE2D88AE42631B0D47648144C
SHA256:94662AD305587D50F221DFD770DCB486A89112F2B634BBE842E1CB3984DAD79E
3388iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:C0422D3C0ACF26A0D69741210DE8C209
SHA256:D087BD7630FD7F3A4C1BEC648569FB6DF9292659FFF548A228C7B959313F348E
3388iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442der
MD5:C29B10386A3A70309503CC41962CFD87
SHA256:2B99A3A468D9609BFFFB328127B7D329005069378DCE80F00D6EE29F5CA52670
3388iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442binary
MD5:4E93EDA164ED8DE62F78F7D94844CD5B
SHA256:B4EC49F77A89F6330E27D74EF0302E832F6F5BAC6960118C8D00BEF39549E753
3388iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:D43D2A37B6CA968FE2C30E248D35C7A2
SHA256:70F9D5067FD10060C53EC9761716FE6E9722356F79EF803BC13AE816F585B3B8
3388iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\S3GM3S64.txttext
MD5:2735438A6040D6111E2E1E1BCD30052F
SHA256:C58E284229557E34BEDE03B30054CC920F9A87C974613C42A91002CDDCAF9464
3388iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:6B9604A488D77CE13F0648B03064FC77
SHA256:85362438946F14ED0E6F62ADA94B973ECBD607E531D809D9DD920F6A8EE59F4B
3388iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\urlblockindex[1].binbinary
MD5:FA518E3DFAE8CA3A0E495460FD60C791
SHA256:775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7
2132iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_111AC30492F08E9F44014C285449AA12binary
MD5:E4FF1764CE1E8E896D1A3BA7AD029A6E
SHA256:41E6FDF4E7E5649F3D2E1FA656CABB526753233BE27CE1E9062D29E56E16AA71
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
38
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3388
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3388
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
US
der
471 b
whitelisted
3388
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
3388
iexplore.exe
GET
—
23.32.238.232:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?cff5c9033c50a36e
US
—
—
whitelisted
2132
iexplore.exe
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
2132
iexplore.exe
GET
200
93.186.225.208:80
http://away.vk.com/away.php
RU
html
270 b
whitelisted
2132
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDCMALD23T9tFCKEtuA%3D%3D
US
der
1.46 Kb
whitelisted
2132
iexplore.exe
GET
200
67.27.234.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6141ac0f80a558b7
US
compressed
4.70 Kb
whitelisted
3388
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
2132
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCCwQAAAAAAURO8EJH
US
der
1.41 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
142.250.181.228:443
www.google.com
Google Inc.
US
whitelisted
3388
iexplore.exe
204.79.197.200:443
ieonline.microsoft.com
Microsoft Corporation
US
whitelisted
3388
iexplore.exe
104.111.242.51:443
go.microsoft.com
Akamai International B.V.
NL
unknown
3388
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3388
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3388
iexplore.exe
23.32.238.232:80
ctldl.windowsupdate.com
XO Communications
US
unknown
3388
iexplore.exe
131.253.33.203:443
www.msn.com
Microsoft Corporation
US
whitelisted
3388
iexplore.exe
8.253.204.249:80
ctldl.windowsupdate.com
Global Crossing
US
suspicious
3388
iexplore.exe
131.253.33.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2132
iexplore.exe
142.250.181.228:443
www.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.google.com
  • 142.250.181.228
  • 142.250.185.100
whitelisted
api.bing.com
  • 13.107.13.80
whitelisted
www.bing.com
  • 131.253.33.200
  • 13.107.22.200
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ctldl.windowsupdate.com
  • 8.253.204.249
  • 67.27.234.126
  • 8.241.89.126
  • 8.253.207.120
  • 67.27.158.126
  • 23.32.238.232
  • 23.32.238.201
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
go.microsoft.com
  • 104.111.242.51
whitelisted
www.msn.com
  • 131.253.33.203
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.google.com/url?q=https%3A%2F%2Fvk.cc%2Fc7Wvjo&sa=D&50=84&usg=AFQjCNHj_a66ufJc5MfSABppuo4GGGxh6w