analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www.google.com

Full analysis: https://app.any.run/tasks/3b07382f-8a4c-4a0e-b447-8ab12ceab70b
Verdict: Malicious activity
Analysis date: January 11, 2019, 11:18:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

8FFDEFBDEC956B595D257F0AAEEFD623

SHA1:

EF7EFC9839C3EE036F023E9635BC3B056D6EE2DB

SHA256:

AC6BB669E40E44A8D9F8F0C94DFC63734049DCF6219AAC77F02EDF94B9162C09

SSDEEP:

3:N8DSLIK:2OLIK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3220)
      • iexplore.exe (PID: 2936)
      • iexplore.exe (PID: 456)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2936)
      • iexplore.exe (PID: 3120)

    • Changes internet zones settings

      • iexplore.exe (PID: 2936)
      • iexplore.exe (PID: 3120)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3220)
      • iexplore.exe (PID: 456)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2936)
      • iexplore.exe (PID: 3120)

    • Reads Microsoft Office registry keys

      • iexplore.exe (PID: 2936)
      • iexplore.exe (PID: 3120)

    • Creates files in the user directory

      • iexplore.exe (PID: 2936)
      • iexplore.exe (PID: 3220)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2084)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3032)
      • iexplore.exe (PID: 456)

    • Application launched itself

      • iexplore.exe (PID: 2936)
      • iexplore.exe (PID: 3120)
      • chrome.exe (PID: 2408)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2936)
      • chrome.exe (PID: 2408)
      • iexplore.exe (PID: 3120)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
25
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2936"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3220"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2936 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2084C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Exit code:
0
Version:
26,0,0,131
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_26_0_0_131_activex.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2408"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1036"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=68.0.3440.106 --initial-client-data=0x78,0x7c,0x80,0x74,0x84,0x6f6000b0,0x6f6000c0,0x6f6000ccC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2272"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2404 --on-initialized-event-handle=304 --parent-handle=308 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3368"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=996,6398895881604324598,971455225490347307,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=7F5017F24A273D11A6E31CF53C8B34AD --mojo-platform-channel-handle=1004 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3708"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=996,6398895881604324598,971455225490347307,131072 --enable-features=PasswordImport --service-pipe-token=2B6C8C55A71D63E3C7B3A5C6CDAAAD12 --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=2B6C8C55A71D63E3C7B3A5C6CDAAAD12 --renderer-client-id=5 --mojo-platform-channel-handle=1920 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2264"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=996,6398895881604324598,971455225490347307,131072 --enable-features=PasswordImport --service-pipe-token=368E55F0673DDE1D7D7A2C85190D2D99 --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=368E55F0673DDE1D7D7A2C85190D2D99 --renderer-client-id=3 --mojo-platform-channel-handle=1540 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2136"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=996,6398895881604324598,971455225490347307,131072 --enable-features=PasswordImport --disable-gpu-compositing --service-pipe-token=89CACD9601F86F1D7391FE92FE6B2AC4 --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=89CACD9601F86F1D7391FE92FE6B2AC4 --renderer-client-id=6 --mojo-platform-channel-handle=1424 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
1 679
Read events
1 368
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
155
Text files
391
Unknown types
26

Dropped files

PID
Process
Filename
Type
2936iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
2936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3220iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@google[2].txt —
MD5:—
SHA256:—
3220iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\google_com[1].txt —
MD5:—
SHA256:—
3220iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\porn_com[1].txt —
MD5:—
SHA256:—
2936iexplore.exeC:\Users\admin\AppData\Local\Temp\StructuredQuery.logtext
MD5:9E2D30774BBD856F8BDBAF6C1C93896C
SHA256:116ED15DBA65BF345F7D2ACE29DC5772D80FA0235F08F8132F6B818F342C424F
3220iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\gtm[1].jstext
MD5:8BAFB7BED23631887DA9C757C82ED521
SHA256:66B47BABE2F98A9EE8FBC326717F7936E20D64E4D1DC3DAD2F7B1D868E16D12D
3220iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\main-148[1].jstext
MD5:D6F7519D2DA9637C0B3F1F41169AD621
SHA256:DCB9D30AF1B585B4821AC8B0F413E9AF94E7D52543A54A4AD46443507CB1CC11
3220iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@google[1].txttext
MD5:DA8719CEF2F3A799592A4852CF8397E9
SHA256:390110097CF5AC85926901D250F4DFBF872DAD5BF9503D691E1333CF35FD7544
2936iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019011120190112\index.datdat
MD5:BED5951201A17FEEE6E402960A5A47A8
SHA256:2D0DED6B906BFFC3FDD42CB5969FE360736C97E0C0C1566F346B7D4763E35CEF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
218
TCP/UDP connections
511
DNS requests
251
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3220
iexplore.exe
GET
—
209.225.49.90:80
http://mercadolibre.com.ve/
AR
—
—
whitelisted
3220
iexplore.exe
GET
301
94.199.252.153:80
http://porn.com/
NL
—
—
whitelisted
2408
chrome.exe
GET
200
151.101.2.219:80
http://b.cdnst.net/javascript/prebid.1.17.0.min.js
US
text
43.1 Kb
whitelisted
2408
chrome.exe
GET
200
23.38.55.104:80
http://zdstatic.speedtest.net/jst/zdconsent.js?version=2578676
NL
text
5.25 Kb
whitelisted
2408
chrome.exe
GET
200
216.58.208.40:80
http://www.googletagmanager.com/gtm.js?id=GTM-K7SNBZ
US
text
37.1 Kb
whitelisted
2408
chrome.exe
GET
200
151.101.2.219:80
http://www.speedtest.net/
US
html
27.6 Kb
whitelisted
2408
chrome.exe
GET
200
184.30.221.206:80
http://c.aaxads.com/aax.js?pub=AAXB54Y5G&hst=www.speedtest.net&ver=1.2
NL
text
90.6 Kb
whitelisted
2408
chrome.exe
GET
200
151.101.2.219:80
http://b.cdnst.net/fonts/gauge_mono.woff2
US
woff2
1.55 Kb
whitelisted
2408
chrome.exe
GET
200
151.101.2.219:80
http://b.cdnst.net/fonts/HCo_fonts.css
US
text
108 Kb
whitelisted
2408
chrome.exe
GET
204
54.236.176.212:80
http://l.betrad.com/site/v3/660/150/1/1/1/1/18610?consent=1
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2936
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3220
iexplore.exe
216.58.208.40:443
www.googletagmanager.com
Google Inc.
US
whitelisted
3220
iexplore.exe
94.199.252.153:443
porn.com
Viking Host B.V.
NL
unknown
3220
iexplore.exe
209.225.49.90:80
mercadolibre.com.ve
MercadoLibre Inc.
AR
unknown
3220
iexplore.exe
94.199.252.153:80
porn.com
Viking Host B.V.
NL
unknown
3220
iexplore.exe
67.22.48.102:443
mediav.porn.com
Reflected Networks, Inc.
NL
unknown
2936
iexplore.exe
173.194.76.104:443
www.google.com
Google Inc.
US
whitelisted
3220
iexplore.exe
172.217.18.110:443
www.google-analytics.com
Google Inc.
US
whitelisted
3220
iexplore.exe
173.194.76.104:443
www.google.com
Google Inc.
US
whitelisted
3220
iexplore.exe
173.194.76.147:443
www.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.google.com
  • 173.194.76.104
  • 173.194.76.147
  • 173.194.76.103
  • 173.194.76.99
  • 173.194.76.105
  • 173.194.76.106
  • 216.58.208.36
  • 216.58.207.36
whitelisted
mercadolibre.com.ve
  • 209.225.49.90
  • 216.33.197.90
whitelisted
porn.com
  • 94.199.252.153
whitelisted
www.porn.com
  • 94.199.252.153
suspicious
mediav.porn.com
  • 67.22.48.102
  • 67.22.48.104
  • 67.22.48.100
  • 66.254.122.100
  • 66.254.122.102
  • 66.254.122.104
suspicious
www.googletagmanager.com
  • 216.58.208.40
whitelisted
www.google-analytics.com
  • 172.217.18.110
whitelisted
clientservices.googleapis.com
  • 216.58.207.35
whitelisted
www.gstatic.com
  • 172.217.16.131
whitelisted

Threats

PID
Process
Class
Message
2408
chrome.exe
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
2408
chrome.exe
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
2408
chrome.exe
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.google.com