| URL: | time4tv.top |
| Full analysis: | https://app.any.run/tasks/4b552516-d5cb-4079-b073-c03ca29b97af |
| Verdict: | Malicious activity |
| Analysis date: | June 05, 2024, 10:18:27 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | 97C6AA06E2867A476AC939C15EAE4B94 |
| SHA1: | 64DCB5F48CCB3DBB9060EF7798BD287261028E2D |
| SHA256: | A4D7F6FFFD10F7A2471E29B1617613DB561BD16737682DBFD1F294FCEF9FD59A |
| SSDEEP: | 3:s3TL0:kH0 |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
Checks supported languages
- wmpnscfg.exe (PID: 316)
Reads the computer name
- wmpnscfg.exe (PID: 316)
Application launched itself
- iexplore.exe (PID: 3968)
Manual execution by a user
- wmpnscfg.exe (PID: 316)
The process uses the downloaded file
- FlashUtil32_32_0_0_453_ActiveX.exe (PID: 2232)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
38
Monitored processes
4
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 316 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2232 | C:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe -Embedding | C:\Windows\System32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe | — | svchost.exe | |||||||||||
User: admin Company: Adobe Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 32.0 r0 Version: 32,0,0,453 Modules
| |||||||||||||||
| 3968 | "C:\Program Files\Internet Explorer\iexplore.exe" "time4tv.top" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 4024 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3968 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
Total events
42 389
Read events
42 254
Write events
100
Delete events
35
Modification events
| (PID) Process: | (3968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPDaysSinceLastAutoMigration |
Value: 1 | |||
| (PID) Process: | (3968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPLastLaunchLowDateTime |
Value: | |||
| (PID) Process: | (3968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPLastLaunchHighDateTime |
Value: 31110961 | |||
| (PID) Process: | (3968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
| Operation: | write | Name: | NextCheckForUpdateLowDateTime |
Value: | |||
| (PID) Process: | (3968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
| Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 31110961 | |||
| (PID) Process: | (3968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (3968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (3968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (3968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
| (PID) Process: | (3968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
Executable files
0
Suspicious files
95
Text files
198
Unknown types
46
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4024 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\menu[1].css | text | |
MD5:0A91080A75E3841937361AB50A740E5B | SHA256:55D5F4849ABE941E283B4B4A272A76DEA83B1CB52B9CE40DC84FE5BD1055BCD1 | |||
| 4024 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\FVEVT0L7.htm | html | |
MD5:7F8D651826C5326E8F66088DB839B6FF | SHA256:4DB699E8874918838C5D14C1D6CE38DAD07963E004EB989AA9790DEB2C246D31 | |||
| 4024 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\premier-sports[1].jpg | image | |
MD5:B1CA4303D6D8E5F2EC47D7A0E14EA24C | SHA256:4E62B8EBD36CA80A540CB817A6571376257147B150AD2F885D19560C9299D662 | |||
| 4024 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\espn-live[1].jpg | image | |
MD5:F3A2AACA4713299AAEF789DE40442C0E | SHA256:86624A73D8E129F400500CE6AF30A805783CE0A7FE7CDC4014B56904A8E0B2D0 | |||
| 4024 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\style[1].css | text | |
MD5:7F0C30B879271CB490FBB0CE00AE4862 | SHA256:82751E187C5D88E96F4F65C671D1EDA6564EDDCD730C77FEA083C5929D1BA354 | |||
| 4024 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\attheraces[1].png | image | |
MD5:7A6FAE29D20343AC64DE5BC45ED63464 | SHA256:213B9D5B7D2D47720EDC2820040520FE034C4C37152726AA1F78BEE9B038FC52 | |||
| 4024 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\bbc1-live-stream[1].png | image | |
MD5:483B1F3ABE73B7EF2F98DD4F46CA2360 | SHA256:8668ADD0BE6C60F7B93B462891AE884AF1BCA8485290C48D4F81826C39B18E39 | |||
| 4024 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\sky-sports-news[1].jpg | image | |
MD5:6A029A71BA76E82AE7FF6676FEA4AEEA | SHA256:769CA38D47063AEFE6CAEBFBCC3EA1EFDE7FBB17965D95167F4F79F223394CD8 | |||
| 4024 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\bts1[1].jpg | image | |
MD5:B233D6CEF03C565F6F6F7AAB02C5C8FD | SHA256:CBB07DEEF7AF0465233ACF2D0F0F9AA9D889BC9C2B006AFC334AF295B80E0C04 | |||
| 4024 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\bootstrap[1].css | text | |
MD5:98332B9D1CE1AB24DA399FEABAA6E73E | SHA256:400A0FCDBCE8C168A92B5C4515AA62600BAA75638CFF35BD7FC00FF947088DA4 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
95
TCP/UDP connections
155
DNS requests
51
Threats
4
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4024 | iexplore.exe | GET | 200 | 188.114.97.3:80 | http://time4tv.top/ | unknown | — | — | unknown |
4024 | iexplore.exe | GET | 200 | 188.114.97.3:80 | http://time4tv.top/css/menu.css | unknown | — | — | unknown |
4024 | iexplore.exe | GET | 200 | 188.114.97.3:80 | http://time4tv.top/css/tab.css | unknown | — | — | unknown |
4024 | iexplore.exe | GET | — | 188.114.97.3:80 | http://time4tv.top/css/bootstrap.css | unknown | — | — | unknown |
4024 | iexplore.exe | GET | 200 | 188.114.97.3:80 | http://time4tv.top/css/style.css | unknown | — | — | unknown |
4024 | iexplore.exe | GET | 200 | 188.114.97.3:80 | http://time4tv.top/images/logo.png | unknown | — | — | unknown |
4024 | iexplore.exe | GET | — | 188.114.97.3:80 | http://time4tv.top/images/sky-sports-f1.jpg | unknown | — | — | unknown |
4024 | iexplore.exe | GET | 200 | 188.114.97.3:80 | http://time4tv.top/images/bbc1-live-stream.png | unknown | — | — | unknown |
4024 | iexplore.exe | GET | 200 | 188.114.97.3:80 | http://time4tv.top/images/attheraces.png | unknown | — | — | unknown |
4024 | iexplore.exe | GET | — | 188.114.97.3:80 | http://time4tv.top/images/sky-sports-1.jpg | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1088 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
4024 | iexplore.exe | 188.114.97.3:80 | time4tv.top | CLOUDFLARENET | NL | unknown |
4024 | iexplore.exe | 199.232.192.193:443 | i.imgur.com | FASTLY | US | unknown |
4024 | iexplore.exe | 51.81.205.45:443 | ultraimg.com | OVH SAS | US | unknown |
4024 | iexplore.exe | 23.215.20.4:80 | s7.addthis.com | Akamai International B.V. | US | unknown |
4024 | iexplore.exe | 208.93.230.16:80 | st.chatango.com | CHATANGO | US | unknown |
4024 | iexplore.exe | 192.243.59.12:80 | wesmallproclaim.com | DataWeb Global Group B.V. | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
time4tv.top |
| unknown |
s7.addthis.com |
| whitelisted |
wesmallproclaim.com |
| malicious |
i.imgur.com |
| shared |
ultraimg.com |
| unknown |
st.chatango.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.comodoca.com |
| whitelisted |
www.rt.com |
| unknown |
www.betteradsystem.com |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1088 | svchost.exe | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
4024 | iexplore.exe | Potentially Bad Traffic | ET INFO HTTP Request to a *.top domain |
4024 | iexplore.exe | Misc activity | ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M1 |
4024 | iexplore.exe | Misc activity | ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M3 |