URL:

supabase.co

Full analysis: https://app.any.run/tasks/51d89410-8f4f-44e0-a17f-fd8c5333c5f5
Verdict: Malicious activity
Analysis date: January 31, 2024, 13:20:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

06D0F6584EF10E1A175853277CF61366

SHA1:

E1F686E67726AA5F52EFF4C38CAC4A084553BF0B

SHA256:

AEF011625590227CB87C5CC8C14BB8E2173AF7C79D47C94705A55B82027FFA96

SSDEEP:

3:+BK:n

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
268"C:\Program Files\Internet Explorer\iexplore.exe" "supabase.co"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1604"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:268 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
12 180
Read events
12 095
Write events
77
Delete events
8

Modification events

(PID) Process:(268) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(268) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(268) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(268) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(268) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(268) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(268) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(268) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(268) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(268) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
13
Text files
44
Unknown types
0

Dropped files

PID
Process
Filename
Type
1604iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:9ECBBE18ACA184E6A33A39DA08D8679E
SHA256:220D79757EFF69A1BF2BEA1E5CF035930050B413A3AA8371DA9514B034FE3364
1604iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:60FE01DF86BE2E5331B0CDBE86165686
SHA256:C08CCBC876CD5A7CDFA9670F9637DA57F6A1282198A9BC71FC7D7247A6E5B7A8
1604iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:7F00ABE6B3CD38C03032D78227B73AB8
SHA256:ED9169EEE226870B0342C0CECF95D27B4E3141F0F1B04C5A5A3C705E04F193CF
1604iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab42F9.tmpcompressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
1604iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar42FA.tmpcat
MD5:9C0C641C06238516F27941AA1166D427
SHA256:4276AF3669A141A59388BC56A87F6614D9A9BDDDF560636C264219A7EB11256F
1604iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
1604iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\6QRFB06O.htmhtml
MD5:F7A6A42521D7A418B2454F523E9E3495
SHA256:42DA08567B96446E617F518CFDBD51E4698E23EB8E8E13FE2C338FB32C814235
1604iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\7681-d79aca8b0524fb54[1].jstext
MD5:621B83CFB448788E86ED2A020E8B3742
SHA256:718924F804419D1A0DD24468234F0A44A9C713B7E7B8CE7A75A9B052D9558E1A
1604iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\4462-d3a99eae6a999437[1].jstext
MD5:B1E1DFD6DB0B5269EB76B1C3C0DEE0E8
SHA256:EBE8CEBE4AF97156424BC8CB5ECA0C6F3C9D41F91A2FB037722E79D939485841
1604iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\573.aa4116661855e4de[1].jstext
MD5:AEDA6057E3174B89B51B9A25EBC26AE5
SHA256:829978618F464D97659E8013D739CAAE4F864F1E64DD231EEBC148B5BF2DDE60
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
27
DNS requests
11
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
268
iexplore.exe
GET
—
76.76.21.21:80
http://supabase.co/favicon.ico
unknown
—
—
unknown
1604
iexplore.exe
GET
—
76.76.21.21:80
http://supabase.co/
unknown
—
—
unknown
1604
iexplore.exe
GET
304
2.22.242.131:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?58b09451c6662268
unknown
—
—
unknown
1604
iexplore.exe
GET
200
2.22.242.131:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?d7a4c83e7f191cf0
unknown
compressed
65.2 Kb
unknown
1604
iexplore.exe
GET
200
2.23.197.184:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
268
iexplore.exe
GET
304
2.22.242.131:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?95d95b669c097e41
unknown
—
—
unknown
268
iexplore.exe
GET
304
2.22.242.131:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4c4bae6a1643aa04
unknown
—
—
unknown
268
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
313 b
unknown
268
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1604
iexplore.exe
76.76.21.21:80
supabase.co
AMAZON-02
US
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1604
iexplore.exe
76.76.21.21:443
supabase.co
AMAZON-02
US
unknown
268
iexplore.exe
76.76.21.21:80
supabase.co
AMAZON-02
US
unknown
1604
iexplore.exe
2.22.242.131:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
1604
iexplore.exe
2.23.197.184:80
x1.c.lencr.org
CW Vodafone Group PLC
GB
unknown
268
iexplore.exe
2.19.96.24:443
www.bing.com
Akamai International B.V.
DE
unknown
268
iexplore.exe
2.22.242.131:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
supabase.co
  • 76.76.21.21
malicious
ctldl.windowsupdate.com
  • 2.22.242.131
  • 2.22.242.130
  • 2.22.242.82
  • 2.22.242.11
  • 2.22.242.97
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 2.19.96.24
  • 2.19.96.17
  • 2.19.96.128
  • 2.19.96.10
  • 2.19.96.131
  • 2.19.96.19
  • 2.19.96.129
  • 2.19.96.130
  • 2.19.96.11
whitelisted
x1.c.lencr.org
  • 2.23.197.184
whitelisted
supabase.com
  • 76.76.21.21
unknown
ocsp.digicert.com
  • 192.229.221.95
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO DNS Query to Online Application Hosting Domain (supabase .co)
1080
svchost.exe
Misc activity
ET INFO Supabase Development Platform Related Domain in DNS Lookup
1604
iexplore.exe
Misc activity
ET INFO Observed Online Application Hosting Domain (supabase .co in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
supabase.co