analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Davidson S.html

Full analysis: https://app.any.run/tasks/8a8095de-9bef-4098-b774-3c8bac7fce58
Verdict: Malicious activity
Analysis date: July 17, 2019, 18:58:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
phishing
phish-microsoft
Indicators:
MIME: text/html
File info: HTML document, ASCII text
MD5:

B4CAE3009E17A10BFDEC81DF58EE17D4

SHA1:

A36023D9898DBAE38594AA76F02FD8B71B3EA575

SHA256:

A524FF6C4A668E99185E8A083143CEAE5A3C89F6ACF5ED624DD7ABBCDDFDA02F

SSDEEP:

6:qF/sGYmaAEdx5lLkQwEVELIVeK2/f0r8nGMRJiKOMeAatMP8FWIhgSZm4QL:3tAEdxnLhO+hM+qstw8Q8QL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 804)
  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2948)
      • iexplore.exe (PID: 3512)
    • Changes internet zones settings

      • iexplore.exe (PID: 3512)
    • Application launched itself

      • iexplore.exe (PID: 3512)
      • firefox.exe (PID: 804)
    • Reads internet explorer settings

      • iexplore.exe (PID: 3440)
      • iexplore.exe (PID: 2948)
    • Reads CPU info

      • firefox.exe (PID: 804)
    • Manual execution by user

      • firefox.exe (PID: 804)
    • Creates files in the user directory

      • firefox.exe (PID: 804)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.html | HyperText Markup Language (100)

EXIF

HTML

Title: Miss Call.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
8
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe no specs iexplore.exe firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe

Process information

PID
CMD
Path
Indicators
Parent process
3512"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\Davidson S.htmlC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3440"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3512 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exeiexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2948"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3512 CREDAT:137473C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
804"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe
explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
67.0.4
2168"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="804.0.1137771731\146658414" -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 804 "\\.\pipe\gecko-crash-server-pipe.804" 1176 gpuC:\Program Files\Mozilla Firefox\firefox.exefirefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
67.0.4
1636"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="804.3.1852166111\2139400897" -childID 1 -isForBrowser -prefsHandle 1740 -prefMapHandle 828 -prefsLen 1 -prefMapSize 188076 -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 804 "\\.\pipe\gecko-crash-server-pipe.804" 1732 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
67.0.4
2856"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="804.13.1903508430\585921574" -childID 2 -isForBrowser -prefsHandle 2688 -prefMapHandle 2692 -prefsLen 5842 -prefMapSize 188076 -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 804 "\\.\pipe\gecko-crash-server-pipe.804" 2704 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
67.0.4
3220"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="804.20.296712857\1470869878" -childID 3 -isForBrowser -prefsHandle 3528 -prefMapHandle 3532 -prefsLen 6671 -prefMapSize 188076 -parentBuildID 20190619235627 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 804 "\\.\pipe\gecko-crash-server-pipe.804" 3544 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
67.0.4
Total events
1 057
Read events
978
Write events
78
Delete events
1

Modification events

(PID) Process:(3512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(3512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000078000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{E9AA9DC3-A8C4-11E9-95C0-5254004A04AF}
Value:
0
(PID) Process:(3512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(3512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
2
(PID) Process:(3512) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E30707000300110012003A003300B400
Executable files
2
Suspicious files
77
Text files
43
Unknown types
53

Dropped files

PID
Process
Filename
Type
3512iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\favicon[1].ico
MD5:
SHA256:
3512iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
MD5:
SHA256:
3512iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF321575E6B10B0403.TMP
MD5:
SHA256:
804firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin
MD5:
SHA256:
804firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm
MD5:
SHA256:
804firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js
MD5:
SHA256:
804firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pluginreg.dat.tmp
MD5:
SHA256:
804firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp
MD5:
SHA256:
3440iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019071720190718\index.datdat
MD5:594993A94E6F0C5F60D15079AA8AB876
SHA256:0AB3284C584468750D25D1974DB7FA6B3B69A102545039BD4D4B37DF0201881F
804firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:FD4AC055B608CF2C11C9B2C796A4FE1A
SHA256:1D8A349613F7DCB71BF648C8C7F780F3953A2BC53435846289101FD77D8887AF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
46
DNS requests
92
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
804
firefox.exe
POST
200
216.58.205.227:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
804
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
804
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
804
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
804
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
804
firefox.exe
POST
200
216.58.205.227:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
804
firefox.exe
POST
200
216.58.205.227:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
804
firefox.exe
POST
200
216.58.205.227:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
804
firefox.exe
GET
200
2.16.186.112:80
http://detectportal.firefox.com/success.txt
unknown
text
8 b
whitelisted
3512
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3512
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
804
firefox.exe
2.16.186.112:80
detectportal.firefox.com
Akamai International B.V.
whitelisted
804
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
804
firefox.exe
35.166.166.56:443
tiles.services.mozilla.com
Amazon.com, Inc.
US
unknown
2948
iexplore.exe
173.231.211.236:443
classikats.com
tzulo, inc.
US
unknown
804
firefox.exe
108.128.247.43:443
location.services.mozilla.com
AT&T Services, Inc.
US
unknown
804
firefox.exe
52.34.92.178:443
push.services.mozilla.com
Amazon.com, Inc.
US
unknown
804
firefox.exe
173.231.211.236:443
classikats.com
tzulo, inc.
US
unknown
804
firefox.exe
216.58.205.227:80
ocsp.pki.goog
Google Inc.
US
whitelisted
804
firefox.exe
216.58.206.10:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
classikats.com
  • 173.231.211.236
unknown
detectportal.firefox.com
  • 2.16.186.112
  • 2.16.186.50
whitelisted
a1089.dscd.akamai.net
  • 2.16.186.50
  • 2.16.186.112
whitelisted
location.services.mozilla.com
  • 108.128.247.43
  • 52.50.56.62
  • 52.210.139.31
whitelisted
locprod1-elb-eu-west-1.prod.mozaws.net
  • 52.210.139.31
  • 52.50.56.62
  • 108.128.247.43
whitelisted
push.services.mozilla.com
  • 52.34.92.178
whitelisted
autopush.prod.mozaws.net
  • 52.34.92.178
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
cs9.wac.phicdn.net
  • 93.184.220.29
whitelisted

Threats

No threats detected
No debug info