analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://buffstreamz.com/nba-streams

Full analysis: https://app.any.run/tasks/40f9fe8f-51dd-4a20-9d31-b9a9fc21f2ca
Verdict: Malicious activity
Analysis date: January 18, 2020, 07:42:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

93699A6CAD32B997708E28D8341E64C9

SHA1:

69D8BC49C101FF610E0AFB4BBF9F9543DB3D05F5

SHA256:

A6E3B2B6F1BE0F318DBBA1B2651BE4FD58C954DC9E8D6D3105F8ACF78AC09EE9

SSDEEP:

3:N1KcWKxhKLBVEIW:Cc/xhKVVEIW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 4084)

  • INFO

    • Creates files in the user directory

      • iexplore.exe (PID: 1764)
      • iexplore.exe (PID: 3332)
      • chrome.exe (PID: 4084)

    • Changes internet zones settings

      • iexplore.exe (PID: 3332)

    • Application launched itself

      • iexplore.exe (PID: 3332)
      • chrome.exe (PID: 4084)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1764)

    • Reads the hosts file

      • chrome.exe (PID: 4084)
      • chrome.exe (PID: 492)

    • Manual execution by user

      • chrome.exe (PID: 4084)

    • Reads settings of System Certificates

      • chrome.exe (PID: 492)
      • iexplore.exe (PID: 1764)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 1764)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
82
Monitored processes
47
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3332"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
1764"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3332 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
4084"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
1516"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6ceda9d0,0x6ceda9e0,0x6ceda9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
1712"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3960 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3764"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1028,8681117437135470185,6936422518938339660,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=8523816849841709012 --mojo-platform-channel-handle=1040 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
492"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1028,8681117437135470185,6936422518938339660,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=13997455409422090407 --mojo-platform-channel-handle=1616 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
720"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,8681117437135470185,6936422518938339660,131072 --enable-features=PasswordImport --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=17497224372045797469 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2232 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
3368"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,8681117437135470185,6936422518938339660,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4958761556769570647 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2396 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
1976"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,8681117437135470185,6936422518938339660,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=2774388539687330876 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2440 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Total events
1 135
Read events
944
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
91
Text files
425
Unknown types
29

Dropped files

PID
Process
Filename
Type
3332iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
3332iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
1764iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@buffstreamz[1].txttext
MD5:7A6758138B86B4B2A19252170C1DCEC3
SHA256:18F32D1082CAF643C2D9AD8620B9FDBC28921BDBEC8A3BB876813D247B85CD28
1764iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:910A5C440C666C6DD3D10C86600D2999
SHA256:5F5455560CFBA05B2F30FC370305528A4E478CEE48D909368EB3AA8D1C0ACBBA
1764iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:91F0EA82D6789F4530947DCF06A25876
SHA256:4A2D1405D21284C99F5E971BFBCEAE854A1B244BEBDFEF09637C160F159C0A39
1764iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U4NP2E50\custom.min[1].csstext
MD5:DF619B16BD030CA3B7DEB77F67932422
SHA256:C9351680FA9A2A2751387D254EDE4A01AD6268838310E09580DD78DD1416F157
1764iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.datdat
MD5:A66BB232D75255AF81F11983C80476B5
SHA256:F6113B09169112A4DC972A26BE7EB174F9348941D445D0D109375FCA716B19BB
1764iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6O2BSNHX\css[2].txttext
MD5:B913A3E83B8F6ABE02C62B07689ED9F6
SHA256:529E0F99E87C2EE4B1AB383641E16DF5C846E7DE6D0CE5F753F57234C435DABF
1764iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6O2BSNHX\nba-streams[1].htmhtml
MD5:185B807DBB84E5AECB9E7668AAEEF234
SHA256:E255DD0969A8709EF53FC8E9EF6A55BF652098BFD4DFAA0928DCA9EC8B60E05B
1764iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1W9QXVOS\basketball[1].csstext
MD5:1E8313A786F77B58D96DF09DEEC5BB0C
SHA256:04DD1C25C426E16033F548C53F2AF1C21C218AB3EA67716395F1FCC6AB81DA63
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
36
TCP/UDP connections
79
DNS requests
54
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1764
iexplore.exe
GET
200
104.18.38.160:80
http://buffstreamz.com/assets/css/style.css
US
text
3.21 Kb
malicious
1764
iexplore.exe
GET
404
104.18.38.160:80
http://buffstreamz.com/assets/css/BebasNeue-webfont.eot?
US
html
222 b
malicious
1764
iexplore.exe
GET
200
104.18.38.160:80
http://buffstreamz.com/assets/css/custom.min.css
US
text
932 b
malicious
1764
iexplore.exe
GET
200
104.18.38.160:80
http://buffstreamz.com/assets/css/bootstrap.min.css
US
text
19.7 Kb
malicious
1764
iexplore.exe
GET
200
104.18.38.160:80
http://buffstreamz.com/assets/css/basketball.css
US
text
2.03 Kb
malicious
1764
iexplore.exe
GET
200
104.18.38.160:80
http://buffstreamz.com/nba-streams/
US
html
2.85 Kb
malicious
1764
iexplore.exe
GET
200
104.18.38.160:80
http://buffstreamz.com/assets/css/custom.min.css
US
text
932 b
malicious
1764
iexplore.exe
GET
200
104.18.38.160:80
http://buffstreamz.com/assets/css/basketball.css
US
text
2.03 Kb
malicious
1764
iexplore.exe
GET
200
104.18.38.160:80
http://buffstreamz.com/assets/css/custom.min.css
US
text
932 b
malicious
1764
iexplore.exe
GET
200
104.18.38.160:80
http://buffstreamz.com/nba-streams/
US
html
2.85 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1764
iexplore.exe
216.58.205.234:443
ajax.googleapis.com
Google Inc.
US
whitelisted
3332
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
1764
iexplore.exe
172.217.16.138:443
fonts.googleapis.com
Google Inc.
US
whitelisted
1764
iexplore.exe
104.18.38.160:80
buffstreamz.com
Cloudflare Inc
US
unknown
1764
iexplore.exe
104.17.65.4:443
cdnjs.cloudflare.com
Cloudflare Inc
US
unknown
1764
iexplore.exe
209.197.3.15:443
maxcdn.bootstrapcdn.com
Highwinds Network Group, Inc.
US
whitelisted
1764
iexplore.exe
216.58.207.35:443
fonts.gstatic.com
Google Inc.
US
whitelisted
1764
iexplore.exe
23.210.248.44:80
s7.addthis.com
Akamai International B.V.
NL
whitelisted
492
chrome.exe
172.217.21.227:443
www.gstatic.com
Google Inc.
US
whitelisted
492
chrome.exe
172.217.22.35:443
clientservices.googleapis.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
buffstreamz.com
  • 104.18.38.160
  • 104.18.39.160
malicious
ajax.googleapis.com
  • 216.58.205.234
whitelisted
fonts.googleapis.com
  • 172.217.16.138
whitelisted
fonts.gstatic.com
  • 216.58.207.35
whitelisted
maxcdn.bootstrapcdn.com
  • 209.197.3.15
whitelisted
cdnjs.cloudflare.com
  • 104.17.65.4
  • 104.17.64.4
whitelisted
s7.addthis.com
  • 23.210.248.44
whitelisted
clientservices.googleapis.com
  • 172.217.22.35
whitelisted
accounts.google.com
  • 172.217.23.109
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://buffstreamz.com/nba-streams