analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| URL: | https://yourfreetube.net |
| Full analysis: | https://app.any.run/tasks/c1bfa020-7c99-4af8-a869-3b13734805b2 |
| Verdict: | Malicious activity |
| Analysis date: | January 11, 2019, 11:25:40 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | 4B26A92C92CA6ED9D3E8E9E2F717AD13 |
| SHA1: | 638C07F707DEF4FFB1FB35F64FD60575E8D243F0 |
| SHA256: | 9E9ABE7E1317A8A1FCE96C9733D29076ACEA344F4CA5F45CE7A552EDFAA58BDA |
| SSDEEP: | 3:N8uT7QJRn:2uf0Rn |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
Application launched itself
- iexplore.exe (PID: 2720)
- firefox.exe (PID: 3516)
Changes internet zones settings
- iexplore.exe (PID: 2720)
Reads internet explorer settings
- iexplore.exe (PID: 3300)
Reads Internet Cache Settings
- iexplore.exe (PID: 3300)
Reads settings of System Certificates
- iexplore.exe (PID: 2720)
Creates files in the user directory
- iexplore.exe (PID: 3300)
- iexplore.exe (PID: 2720)
- FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3996)
- firefox.exe (PID: 3516)
Reads CPU info
- firefox.exe (PID: 3516)
- firefox.exe (PID: 3412)
- firefox.exe (PID: 2744)
- firefox.exe (PID: 3416)
Writes to a desktop.ini file (may be used to cloak folders)
- firefox.exe (PID: 3412)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
38
Monitored processes
7
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2720 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 3300 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2720 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 3996 | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe | — | svchost.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Exit code: 0 Version: 26,0,0,131 | ||||
| 3516 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | explorer.exe | |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 61.0.2 | ||||
| 3412 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3516.0.551678772\1629403932" -childID 1 -isForBrowser -prefsHandle 1500 -prefsLen 8309 -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3516 "\\.\pipe\gecko-crash-server-pipe.3516" 1548 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 61.0.2 | ||||
| 2744 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3516.6.293541264\303440408" -childID 2 -isForBrowser -prefsHandle 2272 -prefsLen 11442 -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3516 "\\.\pipe\gecko-crash-server-pipe.3516" 2264 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 61.0.2 | ||||
| 3416 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3516.12.1177280000\1884727266" -childID 3 -isForBrowser -prefsHandle 3036 -prefsLen 11808 -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3516 "\\.\pipe\gecko-crash-server-pipe.3516" 3052 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 61.0.2 | ||||
Total events
1 096
Read events
1 022
Write events
73
Delete events
1
Modification events
| (PID) Process: | (2720) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
| (PID) Process: | (2720) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2720) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (2720) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones |
| Operation: | write | Name: | SecuritySafe |
Value: 1 | |||
| (PID) Process: | (2720) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (2720) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2720) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active |
| Operation: | write | Name: | {AC75ED7D-1593-11E9-BAD8-5254004A04AF} |
Value: 0 | |||
| (PID) Process: | (2720) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
| Operation: | write | Name: | Type |
Value: 4 | |||
| (PID) Process: | (2720) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
| Operation: | write | Name: | Count |
Value: 3 | |||
| (PID) Process: | (2720) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
| Operation: | write | Name: | Time |
Value: E307010005000B000B001A0002000B02 | |||
Executable files
0
Suspicious files
136
Text files
195
Unknown types
100
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2720 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 2720 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 3300 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@yourfreetube[1].txt | — | |
MD5:— | SHA256:— | |||
| 3300 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\yourfreetube_net[1].txt | — | |
MD5:— | SHA256:— | |||
| 3300 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\css[4].txt | text | |
MD5:697F0E89509ABD6F5058D3B61F407AC1 | SHA256:7F1DEEA0CC532039E87C8B57F9B700CA4D770F431A78BB1C77856B78FA63A693 | |||
| 3300 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\css[1].txt | text | |
MD5:3203BC5C0548E5F4B24E73F6A95B133E | SHA256:74EF43484522B05C166FE4D26D241787F68159874D512C2DCC89FB22F7AC7F72 | |||
| 3300 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\yourfreetube_net[1].htm | html | |
MD5:F310B40693C0746C4B3632A10FD64749 | SHA256:EF7C817C4899F4B749FF8B5821C6B8C5E9C87C608DD370BF79FF2A79E1F9F1FB | |||
| 3300 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\css[1].txt | text | |
MD5:FB0E6BA726D83BAC9ADE7E720D13EAC7 | SHA256:CEDE69CDC9A555B3B0D00E8EB022A964E75FAEA964358E8C26CAFAAA54F18F61 | |||
| 3300 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\css[2].txt | text | |
MD5:31B8F0AA107CBDE0D92B91FED8E82190 | SHA256:CD4B6D4596F12172F2FC3D4D3210114D7D4630D5D0AF9DB04856603241A5103E | |||
| 3300 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@yourfreetube[2].txt | text | |
MD5:F1C9F46C66FC3107E806A6D93A1355AA | SHA256:AF60F85BF490FED75640F3747D693863DEE03C2616F9A85C66E16EF0F3321EC8 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
85
TCP/UDP connections
329
DNS requests
180
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3300 | iexplore.exe | GET | 200 | 104.27.134.239:80 | http://www.tubst.net/media/player/logo/logo.png | US | image | 13.5 Kb | suspicious |
3300 | iexplore.exe | GET | 200 | 104.27.134.239:80 | http://www.tubst.net/media/player/skins/default/center_btn.png | US | image | 4.64 Kb | suspicious |
3300 | iexplore.exe | GET | 200 | 104.27.134.239:80 | http://www.tubst.net/media/player/skins/default/btn_mail.png | US | image | 3.30 Kb | suspicious |
3300 | iexplore.exe | GET | 200 | 104.27.134.239:80 | http://www.tubst.net/media/player/skins/default/options_bot_sh.png | US | image | 2.75 Kb | suspicious |
3300 | iexplore.exe | GET | 200 | 104.27.134.239:80 | http://www.tubst.net/media/player/skins/default/btn_close.png | US | image | 2.80 Kb | suspicious |
3300 | iexplore.exe | GET | 200 | 104.27.134.239:80 | http://www.tubst.net/media/player/skins/default/btn_replay.png | US | image | 3.41 Kb | suspicious |
3300 | iexplore.exe | GET | 200 | 104.27.134.239:80 | http://www.tubst.net/media/player/skins/default/related_next.png | US | image | 3.09 Kb | suspicious |
3300 | iexplore.exe | GET | 200 | 104.27.134.239:80 | http://www.tubst.net/media/player/skins/default/ads_prev.png | US | image | 2.79 Kb | suspicious |
3300 | iexplore.exe | GET | 200 | 104.27.134.239:80 | http://www.tubst.net/media/player/skins/default/related_prev.png | US | image | 3.07 Kb | suspicious |
3300 | iexplore.exe | GET | 200 | 104.27.134.239:80 | http://www.tubst.net/media/player/skin.php?t=default&b=1&r=1&e=0&s=0&m=1&p=0&mc=0x999999&rc=0x999999&ec=0x999999&rec=0x999999&cc=0x000000&tc=0x999999&sc=0x999999&anc=0x999999&atc=0xFFA200&abc=0xF1F1F1&alc=0x999999&video=210 | US | html | 1.10 Kb | suspicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2720 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3300 | iexplore.exe | 104.27.185.157:443 | yourfreetube.net | Cloudflare Inc | US | shared |
3300 | iexplore.exe | 172.217.22.106:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
3300 | iexplore.exe | 173.194.76.82:443 | html5shim.googlecode.com | Google Inc. | US | whitelisted |
3300 | iexplore.exe | 104.27.184.157:443 | yourfreetube.net | Cloudflare Inc | US | shared |
3300 | iexplore.exe | 172.217.22.67:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
3300 | iexplore.exe | 23.210.248.44:443 | s7.addthis.com | Akamai International B.V. | NL | whitelisted |
3300 | iexplore.exe | 104.27.181.43:443 | www.youfreeporntube.net | Cloudflare Inc | US | shared |
3300 | iexplore.exe | 209.197.3.15:443 | maxcdn.bootstrapcdn.com | Highwinds Network Group, Inc. | US | whitelisted |
3300 | iexplore.exe | 104.28.20.70:443 | www.youfreeporntube.com | Cloudflare Inc | US | shared |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.bing.com |
| whitelisted |
yourfreetube.net |
| unknown |
html5shim.googlecode.com |
| whitelisted |
www.yourfreetube.net |
| unknown |
maxcdn.bootstrapcdn.com |
| whitelisted |
css3-mediaqueries-js.googlecode.com |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
s7.addthis.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
www.youfreeporntube.net |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3300 | iexplore.exe | Potential Corporate Privacy Violation | ET POLICY Outdated Flash Version M1 |