File name:

2019-09-05-Ursnif-EXE-retrieved-by-Word-macro.exe

Full analysis: https://app.any.run/tasks/7b690a27-3538-4d15-ad2f-f9c679b6b40e
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 07:09:42
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
gozi
ursnif
dreambot
banker
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

BB686BC8C566099F8B64156AD88245E8

SHA1:

A4C2FB571C86FC5C570E19FD011F2BB156251E7E

SHA256:

A2AA14A4DFACE3C834B07901C12795F747A3C20915DF38E73EBA6D8D814BE325

SSDEEP:

98304:TY/OW62PXJNnCcBVznFp1QjLRDoxAaZM1DioJFxLqQ96DWxuG9AlUVsVrMqDtLW1:hf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • iexplore.exe (PID: 1132)
      • iexplore.exe (PID: 4692)
      • iexplore.exe (PID: 4648)
      • iexplore.exe (PID: 2904)
      • iexplore.exe (PID: 4868)
      • iexplore.exe (PID: 2772)
      • iexplore.exe (PID: 6828)

    • URSNIF has been detected (SURICATA)

      • iexplore.exe (PID: 1132)
      • iexplore.exe (PID: 4692)
      • iexplore.exe (PID: 4648)
      • iexplore.exe (PID: 2904)
      • iexplore.exe (PID: 4868)
      • iexplore.exe (PID: 2772)
      • iexplore.exe (PID: 6828)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • 2019-09-05-Ursnif-EXE-retrieved-by-Word-macro.exe (PID: 1760)

    • Contacting a server suspected of hosting an CnC

      • iexplore.exe (PID: 1132)
      • iexplore.exe (PID: 4692)
      • iexplore.exe (PID: 4648)
      • iexplore.exe (PID: 2904)
      • iexplore.exe (PID: 4868)
      • iexplore.exe (PID: 2772)
      • iexplore.exe (PID: 6828)

  • INFO

    • Checks supported languages

      • 2019-09-05-Ursnif-EXE-retrieved-by-Word-macro.exe (PID: 1760)
      • ielowutil.exe (PID: 6264)

    • Reads the computer name

      • 2019-09-05-Ursnif-EXE-retrieved-by-Word-macro.exe (PID: 1760)
      • ielowutil.exe (PID: 6264)

    • The sample compiled with english language support

      • 2019-09-05-Ursnif-EXE-retrieved-by-Word-macro.exe (PID: 1760)

    • Local mutex for internet shortcut management

      • iexplore.exe (PID: 5400)

    • Reads the software policy settings

      • slui.exe (PID: 5968)
      • slui.exe (PID: 728)

    • Checks proxy server information

      • slui.exe (PID: 728)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (49.4)
.scr | Windows screen saver (23.4)
.dll | Win32 Dynamic Link Library (generic) (11.7)
.exe | Win32 Executable (generic) (8)
.exe | Generic Win/DOS Executable (3.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2014:09:05 09:53:34+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 3005440
InitializedDataSize: 620032
UninitializedDataSize: -
EntryPoint: 0x294250
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 3.4.80.27
ProductVersionNumber: 3.4.80.27
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Havetwo GlobalLogic
FileDescription: EveningRepresent
FileVersion: 3.4.80.27
InternalName: EveningRepresent
LegalCopyright: Copyright © 2003-2015 Havetwo GlobalLogic
LegalTrademarks: EveningRepresent
ProductVersion: 3.4.80.27
ProductName: EveningRepresent
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
166
Monitored processes
28
Malicious processes
10
Suspicious processes
4

Behavior graph

Click at the process to see the details
start 2019-09-05-ursnif-exe-retrieved-by-word-macro.exe no specs sppextcomobj.exe no specs slui.exe ielowutil.exe no specs iexplore.exe iexplore.exe slui.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
728C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
872"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
904"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5400 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
976C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1116"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4380 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1132"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5232 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1760"C:\Users\admin\AppData\Local\Temp\2019-09-05-Ursnif-EXE-retrieved-by-Word-macro.exe" C:\Users\admin\AppData\Local\Temp\2019-09-05-Ursnif-EXE-retrieved-by-Word-macro.exe—explorer.exe
User:
admin
Company:
Havetwo GlobalLogic
Integrity Level:
MEDIUM
Description:
EveningRepresent
Version:
3.4.80.27
Modules
Images
c:\users\admin\appdata\local\temp\2019-09-05-ursnif-exe-retrieved-by-word-macro.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2340"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2772"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6712 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
44 765
Read events
44 497
Write events
222
Delete events
46

Modification events

(PID) Process:(5400) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5400) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5400) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(5400) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(5400) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5400) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{3C4DAD96-0948-11F0-B4ED-18F7786F96EE}
Value:
0
(PID) Process:(5400) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MAO Settings
Operation:writeName:DiscardLoadTimes
Value:
DB847CA30259DA01
(PID) Process:(904) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(904) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Content
Operation:writeName:CacheLimit
Value:
337920
(PID) Process:(904) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
0
Suspicious files
46
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
904iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DATbinary
MD5:0392ADA071EB68355BED625D8F9695F3
SHA256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
5232iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF0C03324B93E2D11E.TMPbinary
MD5:D680E692488F603DDF392C65AE117563
SHA256:491404BA8B19BB1CFC11F267590D26214A63671250A6405B44332D30F9BD1F20
904iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\SmartScreenCache.datbinary
MD5:5C8D6039FB81483B8A56CEA9AEE2553F
SHA256:284D5F6FCDCD5A93B930957C00D80686B43462130EEB22583F0CB24A01182D4F
5232iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{56077AF7-0948-11F0-B4ED-18F7786F96EE}.datbinary
MD5:46CFA666F0ACBFAE7104A252F180DC0F
SHA256:9A40FC355640BC6D207774A971034AC41047C04D37A56F3D75CA570B3DB0DE68
5400iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{3C4DAD96-0948-11F0-B4ED-18F7786F96EE}.datbinary
MD5:72BAE12B813CCC91F01F689B3DE45238
SHA256:AD4E6254F8D010C7A5031C350AB674F18970382E2E28B027C21A17E556BE80EC
5232iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFFDCB206A1BFDA1EC.TMPbinary
MD5:25623241FE068E185EB5BC41EAAFD00F
SHA256:8969C6A502B67B58EA128A798FC6EACEDF3EBF2FD75AC6EDD3F0105FB4381A76
5400iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF046D9F61E2B08E28.TMPbinary
MD5:DD2A9E2BC448BD3E6870DE5910F8B4C0
SHA256:42ED5ACA5FE356F52C81DC01F9D93B254DBFCABD6575090A8C50782033FE9624
5232iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{56077AF9-0948-11F0-B4ED-18F7786F96EE}.datbinary
MD5:0DC0B0F9266B634878AE17C8CE056B88
SHA256:5ADD25F6148B132E409DE714E4300B35DF34D008C180507CCF5D8AB68E8C4AB9
5400iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF64FA742CBFC59172.TMPbinary
MD5:531E7FC4A18CD9DFE5A6D97C4EEC6803
SHA256:A21804B4325CF1588591AB11B1DD907EA82F554FAB7DE03F3943043FB01B1058
5400iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{3C4DAD98-0948-11F0-B4ED-18F7786F96EE}.datbinary
MD5:A102F711167413CAE04F3BFB54ADECF5
SHA256:F59F71361843AABFBA551BCEF3F5747B35FC05ED51E08F3E60EE9FCFDD9925FD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
86
DNS requests
30
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
904
iexplore.exe
GET
404
142.250.184.238:80
http://google.com/images/iPJ8s_2FDYluv1YlaSSj/z9637FcqjeKRSLIrHSB/N6DItBS9G7L6coQtlsW3Yc/o3OCERmC0NHvN/od4iKpAD/_2Bqc4KvTkVUQqozdEjSU_2/FtVsSWe31K/JINDFV_2FJZG8V9U8/x9cIjHhtTnMT/QQQFZN97vg7/WLA.avi
unknown
—
—
whitelisted
4648
iexplore.exe
GET
404
49.13.77.253:80
http://g73jorgegisselle.xyz/images/Iyz2Rgo5rPJuEAv/4FAYSWoVTpW67Gjfpf/10zqihO3Y/IDCYehzE8cJ_2FQ1FByK/G0WC7A_2F3PIoXro1Tn/slNCw8VCIsfVokG2qj0OY_/2BkLHZZHbMbae/Y3IJwTVB/ezk_2Fc4rleMspwt4n6clQW/yafTVOSa/5Iy.avi
unknown
—
—
malicious
1132
iexplore.exe
GET
404
49.13.77.253:80
http://f39fxnzeanabelle.xyz/images/vNqgu31NTmIjz9qr/9ovVuyUHGNDi_2B/VOdUjjpQeN2UmuZIGZ/Q1_2Fq7rI/p_2F4f1B31y6_2FX_2Fz/pOFpUlIBtoY7_2FHuxe/QB3ftPZP7a_2BeBM5VFVHk/aBObou0s4xL5S/gP8R8P4y/_2FE0KMF2EYO_2FiTphk_2F/t3lZ461.avi
unknown
—
—
malicious
4692
iexplore.exe
GET
404
49.13.77.253:80
http://vroyceolga.xyz/images/RAeIGy_2BPnO4/iGd9yrPo/_2FuYvYUIxqLpKWD0VY0J2M/DfsQ3VGT2A/AC0DONoxyK5wcr_2F/dx_2BDFgvWNW/Xitn0HsdDEV/utOaI_2FTEkBEZ/aO_2BOCR3CVie_2F_2FsA/Vi_2BOa0MRMW5pfC/_2BpPAIl_2FAZHi/0iMHdwOwqU/pw.avi
unknown
—
—
malicious
4868
iexplore.exe
GET
404
49.13.77.253:80
http://f39fxnzeanabelle.xyz/images/VgJrdC5au4Na/Q_2FHWo7QxT/d_2F_2BjHXKfVZ/AVVD2MoebbhWokS1XDzxj/R4nAQJ00Eh93KYHr/0JDTeskTUST2vcp/lAZDoy0nuGArKjZFEe/igZVGVmOo/_2FaSBHgCixNkN1NIgH1/uzTAMsJVHbapk8NCm/0YaBk.avi
unknown
—
—
malicious
2904
iexplore.exe
GET
404
142.250.184.238:80
http://google.com/images/cMRLjTuqDAxq9VvFojzu3/_2FPpjo20rgKujI0/u_2BIQ0A5i3beTg/WnFEbssPV1UYG_2B9I/NsoyezkmW/gzBktPbJaInhZSL9YV1U/JB2aI4A5CrVB9woKWXm/MYB6wLVWCDd_2BzmDL_2B1/4LiK5QGj3/WpTQmqgi/zaQ.avi
unknown
—
—
whitelisted
6760
iexplore.exe
GET
404
49.13.77.253:80
http://vroyceolga.xyz/images/h5irJPdF06WOW4/XQi7on0Zd5Dq1PVPtbl3_/2BgJfWyD4APG_2Bh/pcE7EtbGAQwCxvK/HWznNenSBymPLATbWz/qYkVGw_2B/Ox1HviO2apPnrv61dExU/wNJ975DfbzPRpCr6aEB/Wg7bliKP0V92CKyz_2Fbvr/Yn6r.avi
unknown
—
—
malicious
2772
iexplore.exe
GET
404
49.13.77.253:80
http://g73jorgegisselle.xyz/images/bI6WAL_2BWMWFbdZv/KgbjQK1cMG26/Zv2_2FofvD_/2FBRk9V94wHkF0/IwrFZ_2FwcFw_2F7IIWVd/g_2F9Su8Hy_2FvHh/6vYB932qUj7ubxM/bB_2FCcYs_2FtPIMPd/H8SdiC7OQ/N3Y8KtTGXVVTp6gCl5JF/ITQ_2BKB_2Bj4oPs/EVf.avi
unknown
—
—
malicious
6828
iexplore.exe
GET
404
216.58.206.46:80
http://google.com/images/O0HwAieq0Uz9W/D_2FE3Qg/oaYG72_2B5O1Po1oJJDJnj7/_2FzoaQ9Et/igGghchKJN4WD4mVl/bLMZ3V_2F26V/CuafYIZ_2Fm/du1FBa1YQJvKeF/Xwg2NnRGJQAOh8Vqyr4Iq/52ywF1pgGZIcCRl9/7sncevo5a/lvYBkf.avi
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
904
iexplore.exe
142.250.184.238:80
google.com
GOOGLE
US
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4408
backgroundTaskHost.exe
20.223.36.55:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
google.com
  • 142.250.184.238
  • 216.58.206.46
whitelisted
client.wns.windows.com
  • 40.115.3.253
  • 20.197.71.89
whitelisted
login.live.com
  • 20.190.159.4
  • 40.126.31.73
  • 20.190.159.68
  • 40.126.31.3
  • 40.126.31.67
  • 20.190.159.73
  • 40.126.31.69
  • 40.126.31.130
whitelisted
arc.msn.com
  • 20.223.36.55
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
  • 2603:1030:c02:2::284
whitelisted
15.164.165.52.in-addr.arpa
  • —
unknown
4.8.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0.2.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted

Threats

PID
Process
Class
Message
1132
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
1132
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
4692
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
4692
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
4648
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
2904
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
4868
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
2772
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
2772
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
2772
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2019-09-05-Ursnif-EXE-retrieved-by-Word-macro.exe