analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://rl.ammyy.com/

Full analysis: https://app.any.run/tasks/19bd47c1-5612-4265-aee5-92e35b368260
Verdict: Malicious activity
Analysis date: October 20, 2020, 09:06:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
Indicators:
MD5:

AE3CC04A2DF93515C81EA317FC689E4C

SHA1:

32CAFB1FE628EF959162F81A6A0A06509B18F6A0

SHA256:

A280333AF761C422F7AB2A5588C36B849ABA78140BCEED4C67FADDEBB3C7ABCC

SSDEEP:

3:N1KM45GK3n:CMgGG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Checks for external IP

      • iexplore.exe (PID: 3948)
  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 2740)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3948)
      • iexplore.exe (PID: 2740)
    • Reads settings of System Certificates

      • iexplore.exe (PID: 2740)
    • Application launched itself

      • iexplore.exe (PID: 2740)
    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2740)
    • Changes settings of System certificates

      • iexplore.exe (PID: 2740)
    • Reads internet explorer settings

      • iexplore.exe (PID: 3948)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2740"C:\Program Files\Internet Explorer\iexplore.exe" "http://rl.ammyy.com/"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3948"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2740 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Total events
747
Read events
669
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
9
Text files
4
Unknown types
3

Dropped files

PID
Process
Filename
Type
2740iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
MD5:
SHA256:
2740iexplore.exeC:\Users\admin\AppData\Local\Temp\CabBF4D.tmp
MD5:
SHA256:
2740iexplore.exeC:\Users\admin\AppData\Local\Temp\TarBF4E.tmp
MD5:
SHA256:
2740iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verBF9D.tmp
MD5:
SHA256:
2740iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203der
MD5:AEBD8A27FCEB32B4F5081BB89FBBFCC8
SHA256:5D0F375F38FD85F23614B44D518FFD91875FE8F56C88885B9081B87082980381
3948iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\GE5EE42T.htmtext
MD5:8F893F40C6E1BDA89B39CDFEDDB487B9
SHA256:D18E6C46C4CD4AD8529EBF9D4B28C2A3A3DD7689DAF5436252E3AB91FE629F58
2740iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203binary
MD5:F47CA29C924A177950ED4B0DB56FB023
SHA256:D7D4543DB5EB96D4665AEF88486F93DB536C56E3CEDD11A8A151343D9509096E
2740iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\imagestore\f7ruq93\imagestore.datbinary
MD5:FB86A0E50612F0FDC0769994A0C5FD1B
SHA256:EF2CE9BBED09CCAE0B296859FBBCFF13883CE1DA66362616E3DECF0A34B050DF
2740iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\urlblockindex[1].binbinary
MD5:FA518E3DFAE8CA3A0E495460FD60C791
SHA256:775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7
2740iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\favicon[1].icoimage
MD5:9FB559A691078558E77D6848202F6541
SHA256:6D8A01DC7647BC218D003B58FE04049E24A9359900B7E0CEBAE76EDF85B8B914
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
12
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2740
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
2740
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
3948
iexplore.exe
GET
200
188.42.129.148:80
http://rl.ammyy.com/
NL
text
132 b
suspicious
2740
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
2740
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2740
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3948
iexplore.exe
188.42.129.148:80
rl.ammyy.com
Servers.com, Inc.
NL
malicious
2740
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2740
iexplore.exe
188.42.129.148:80
rl.ammyy.com
Servers.com, Inc.
NL
malicious

DNS requests

Domain
IP
Reputation
rl.ammyy.com
  • 188.42.129.148
suspicious
api.bing.com
  • 13.107.13.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

PID
Process
Class
Message
3948
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY IP Check (rl. ammyy. com)
No debug info