analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| URL: | https://level3.com |
| Full analysis: | https://app.any.run/tasks/f598d817-ec5a-4ac0-beb2-b631c2e40da8 |
| Verdict: | Malicious activity |
| Analysis date: | September 30, 2020, 01:24:07 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | D338118896AE25A343EC9ED8023DD76E |
| SHA1: | 31BF38189BD5D619A9D39B59C70BFA25642E6903 |
| SHA256: | A7C5FE3D9B054B32CD72721F8C3F85D527A025B6927BBDED38CA97BC5897D7FD |
| SSDEEP: | 3:N8AT3ZI:2Ar2 |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executed via COM
- FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2176)
INFO
Reads settings of System Certificates
- iexplore.exe (PID: 3556)
Reads Internet Cache Settings
- iexplore.exe (PID: 3556)
- iexplore.exe (PID: 2560)
Application launched itself
- iexplore.exe (PID: 2560)
Changes internet zones settings
- iexplore.exe (PID: 2560)
Dropped object may contain Bitcoin addresses
- iexplore.exe (PID: 3556)
Creates files in the user directory
- FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2176)
- iexplore.exe (PID: 3556)
Reads internet explorer settings
- iexplore.exe (PID: 3556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
36
Monitored processes
3
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2560 | "C:\Program Files\Internet Explorer\iexplore.exe" https://level3.com | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
| 3556 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2560 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
| 2176 | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe | — | svchost.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Version: 26,0,0,131 | ||||
Total events
1 140
Read events
864
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
186
Text files
225
Unknown types
95
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2560 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 3556 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\CabE0CB.tmp | — | |
MD5:— | SHA256:— | |||
| 3556 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\TarE0CC.tmp | — | |
MD5:— | SHA256:— | |||
| 3556 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\SOICIR0O.txt | — | |
MD5:— | SHA256:— | |||
| 3556 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1E11E75149C17A93653DA7DC0B8CF53F_231F11B3AA4ABE2436D19E0D0A1BAC80 | binary | |
MD5:80D3CC0851B3016B4768AF307ED822FF | SHA256:C650F7BDE3CE9DA9D1B37EDB9F619A7053E22D40C37251FC28628BD45588584B | |||
| 3556 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1E11E75149C17A93653DA7DC0B8CF53F_4FEF7456C38D01422708C78AB0478349 | binary | |
MD5:67B0A3DF5E220E32492D9AA2C300D9D5 | SHA256:43CDCCAD9C1D262797B2F2A8AB4B723472C7CDBA745EE9A9864FDDD59899986B | |||
| 3556 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C | der | |
MD5:4B27B260B2BC64CBAC6B8E6B5347B1EB | SHA256:EE0FB1A7345BEB74D6C7F4FE9AC4BD0B78FC9FFA3C265F9D8D3FCF24CFE74E92 | |||
| 3556 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1E11E75149C17A93653DA7DC0B8CF53F_8424D4B2BBC5804F0A1059E261BEAE4D | binary | |
MD5:87FB8EFF4963F2AB7CD2E265377895BA | SHA256:B54933F77375BC96EBC14943C97AE24BA916B896B5A4C993983D3E9802124580 | |||
| 3556 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\69C6F6EC64E114822DF688DC12CDD86C | binary | |
MD5:FF48B929B9E2CA576F1C75E589B3E9A0 | SHA256:C13ACAFD50C05D8C77E5B6A1F9B61A5A96474DC1015D360A0994F1D75E85F57B | |||
| 3556 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1E11E75149C17A93653DA7DC0B8CF53F_8424D4B2BBC5804F0A1059E261BEAE4D | der | |
MD5:F8D8AE43D201DBC764C9E1A77A1C3839 | SHA256:E7EACE1C9B044D0E51135537116EBC2687F679E72C3C0A6046102A412557785F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
96
TCP/UDP connections
243
DNS requests
98
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3556 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEATgwq0x1OPawSdActqojdw%3D | US | der | 471 b | whitelisted |
3556 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEArNGJxHje5yzhDSxYnvyvU%3D | US | der | 471 b | whitelisted |
3556 | iexplore.exe | GET | 301 | 8.253.95.245:80 | http://www.level3.com/ | US | html | 148 b | suspicious |
3556 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEA6%2B%2FcNpgCs2gMJ%2BwTSt9k4%3D | US | der | 471 b | whitelisted |
3556 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D | US | der | 471 b | whitelisted |
3556 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEA6%2B%2FcNpgCs2gMJ%2BwTSt9k4%3D | US | der | 471 b | whitelisted |
3556 | iexplore.exe | GET | 301 | 8.253.95.245:80 | http://www.level3.com/en/ | US | html | 182 b | suspicious |
2560 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
3556 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D | US | der | 471 b | whitelisted |
3556 | iexplore.exe | GET | 200 | 216.58.210.3:80 | http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D | US | der | 468 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2560 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3556 | iexplore.exe | 4.59.248.134:443 | www.lumen.com | Level 3 Communications, Inc. | US | unknown |
3556 | iexplore.exe | 4.68.80.110:443 | level3.com | Level 3 Communications, Inc. | US | malicious |
3556 | iexplore.exe | 8.253.95.245:80 | www.level3.com | Global Crossing | US | unknown |
3556 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
3556 | iexplore.exe | 2.18.234.122:443 | players.brightcove.net | Akamai International B.V. | — | whitelisted |
3556 | iexplore.exe | 23.210.249.214:443 | assets.centurylink.com | Akamai International B.V. | NL | whitelisted |
3556 | iexplore.exe | 2.18.232.23:443 | assets.adobedtm.com | Akamai International B.V. | — | whitelisted |
3556 | iexplore.exe | 99.86.243.102:443 | assets.ctl.io | AT&T Services, Inc. | US | malicious |
3556 | iexplore.exe | 45.154.183.183:443 | www.centurylink.com | — | — | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
level3.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
crl3.digicert.com |
| whitelisted |
www.level3.com |
| suspicious |
www.centurylink.com |
| suspicious |
www.lumen.com |
| unknown |
assets.ctl.io |
| malicious |
assets.adobedtm.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3556 | iexplore.exe | Potential Corporate Privacy Violation | ET POLICY Executable and linking format (ELF) file download |