analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://bit.ly/3PjTK2A

Full analysis: https://app.any.run/tasks/a7a77410-d114-4004-afa2-acd68279799a
Verdict: Malicious activity
Analysis date: August 12, 2022, 16:53:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

1F989088006EC7313259625ACEBE6D84

SHA1:

DB6A58A6AD975DF1253D032D05BE5E0465E2DB76

SHA256:

A8BE20469F0990E59B94576FB8A87049986527F3CAFAC4BD3DAB141BE99AD379

SSDEEP:

3:N8kS1gXk:25

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3428)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 2968)
      • iexplore.exe (PID: 3428)

    • Checks supported languages

      • iexplore.exe (PID: 2968)
      • iexplore.exe (PID: 3428)

    • Application launched itself

      • iexplore.exe (PID: 2968)

    • Changes internet zones settings

      • iexplore.exe (PID: 2968)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2968)
      • iexplore.exe (PID: 3428)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3428)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2968)
      • iexplore.exe (PID: 3428)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2968)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2968"C:\Program Files\Internet Explorer\iexplore.exe" "https://bit.ly/3PjTK2A"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3428"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2968 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
14 481
Read events
14 234
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
24
Text files
48
Unknown types
20

Dropped files

PID
Process
Filename
Type
2968iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:EE87BB11E233C12009CC11725035DBDC
SHA256:D82930A5B051B3C3F1639C24E83BDDF41D5AA66E467A0944D1AC3D59AE6330C5
2968iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:EE0FB3E05449FF5BBEC885BF9EBCB373
SHA256:D1A6ED6D9CA097561541FC6ED20D57E03B0A4DB0273ED8F83AA6B5F0C6F1BA8F
3428iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4D1ED785E3365DE6C966A82E99CCE8EA_BE51B43F9F95B8E556690D4EA2757FD1binary
MD5:B4880D095141B453A2BFC07C015D499A
SHA256:7473ADBF741DF6951AF1EAD458069ED1A4E740C9BA111E178992D842E34464DA
3428iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:73A3A02D0FEF3F2D354BB56A52BC7B59
SHA256:3E93FE966A6C91E429F8B5BF0877EE632149A99AAA8592DB0B8E1B30DBB1F5B0
2968iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:B2A5C7B363ADB8523774F9D10805FD03
SHA256:A7E00FCA88BFFEC17BD0949C2B4BA4BC67E51D2E5A30FABD2192E663CBFF1EE8
3428iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\3PjTK2A[1].htmhtml
MD5:469C130FFFCEA35E35A0F817804628C5
SHA256:B0EA43FD4A4D8B2BB6D078F37AE742418168235FCBEE2D6E3E8364E2640019A0
3428iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4D1ED785E3365DE6C966A82E99CCE8EA_BE51B43F9F95B8E556690D4EA2757FD1der
MD5:92E86D4AC09860E29EE6161870A1A226
SHA256:520878A1D16FC85C66647E3FB25B2BA9C1DC4DB6B70092E40C77EC853F75CA68
3428iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619der
MD5:A2EE1E05DD5D28CC0AC5A940744D2708
SHA256:6FD11CB46A8EB4DC7E89F8EB493FFB75FBF946128A33DAA893030497BE412A84
3428iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619binary
MD5:C1CEAC69E5EF0D3A7B605E359E089ACC
SHA256:C41D628F16F5F134ADB7CF9BDBA57997FD6EE2E264E6E24401CE603EDA53A0FD
3428iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:99C378DEAB8353E86AF2A3B95C07CA7D
SHA256:3A8BB9E7E5A9AA27015F64E77BFF55D3026D9F0E231EBAD72BCBF57642A3832B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
68
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2968
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3428
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D
US
der
471 b
whitelisted
3428
iexplore.exe
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
3428
iexplore.exe
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
3428
iexplore.exe
GET
200
8.248.141.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?81d2fd86d95b0dd7
US
compressed
60.2 Kb
whitelisted
3428
iexplore.exe
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDGaM9nfILxSxIGz%2Bm2TRwQ
US
der
472 b
whitelisted
3428
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHUeP1PjGFkz6V8I7O6tApc%3D
US
der
1.41 Kb
whitelisted
2968
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3428
iexplore.exe
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECCBPKL7m42dCp7ufoAXGvc%3D
US
der
471 b
whitelisted
2968
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3428
iexplore.exe
67.199.248.11:443
bit.ly
Bitly Inc
US
shared
2968
iexplore.exe
13.107.22.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3428
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2968
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3428
iexplore.exe
142.250.186.97:443
hotgrls1174.page.link
Google Inc.
US
whitelisted
2968
iexplore.exe
8.248.141.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
3428
iexplore.exe
67.199.248.10:443
bit.ly
Bitly Inc
US
shared
3428
iexplore.exe
96.16.145.230:80
x1.c.lencr.org
Akamai Technologies, Inc.
US
suspicious
3428
iexplore.exe
142.250.185.99:80
ocsp.pki.goog
Google Inc.
US
whitelisted
3428
iexplore.exe
2.16.186.41:80
r3.o.lencr.org
Akamai International B.V.
—
whitelisted

DNS requests

Domain
IP
Reputation
bit.ly
  • 67.199.248.10
  • 67.199.248.11
shared
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 13.107.22.200
  • 131.253.33.200
whitelisted
ctldl.windowsupdate.com
  • 8.248.141.254
  • 8.253.95.249
  • 67.26.139.254
  • 67.27.233.126
  • 8.241.121.254
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
hotgrls1174.page.link
  • 142.250.186.97
malicious
ocsp.pki.goog
  • 142.250.185.99
whitelisted
hotangelsgirls15.online
  • 188.130.138.176
unknown
x1.c.lencr.org
  • 96.16.145.230
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://bit.ly/3PjTK2A