| File name: | fuck_niggers_10.hta |
| Full analysis: | https://app.any.run/tasks/039dc32a-0ab9-484d-992a-4bf327191cec |
| Verdict: | Malicious activity |
| Analysis date: | May 18, 2025, 03:29:35 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | text/html |
| File info: | HTML document, ASCII text, with very long lines (496), with no line terminators |
| MD5: | 5CD418A305DCD6C77DE94484690ABEEF |
| SHA1: | D39CEFCE933556A5B54FEB63D9C8EDACFB7AAE61 |
| SHA256: | B76033213E847D0DC2FD6DF84B792632569C82E61E49235945C6634B78D3342A |
| SSDEEP: | 12:kxvsCk9cE3MotZjo/XU86lJEa/cqANFt6EWe+EFWDrcxYI:kbxw8/k86ga/JANFkEEEFWXTI |
| .html | | | HyperText Markup Language (100) |
|---|
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 780 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | SppExtComObj.Exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1660 | "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6656 CREDAT:9476 /prefetch:2 | C:\Program Files (x86)\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2616 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5692 --field-trial-handle=2424,i,8447176556650607699,2578684011700803164,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 4172 | "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding | C:\Program Files (x86)\Internet Explorer\ielowutil.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Low-Mic Utility Tool Version: 11.00.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4696 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5796 --field-trial-handle=2424,i,8447176556650607699,2578684011700803164,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 4896 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4988 | "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6656 CREDAT:9474 /prefetch:2 | C:\Program Files (x86)\Internet Explorer\iexplore.exe | — | iexplore.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5204 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5684 --field-trial-handle=2424,i,8447176556650607699,2578684011700803164,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 5260 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2424,i,8447176556650607699,2578684011700803164,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 122.0.2365.59 Modules
| |||||||||||||||
| 5332 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5884 --field-trial-handle=2424,i,8447176556650607699,2578684011700803164,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| (PID) Process: | (6656) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Suggested Sites |
| Operation: | write | Name: | DataStreamEnabledState |
Value: 0 | |||
| (PID) Process: | (6656) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Suggested Sites |
| Operation: | write | Name: | MigrationTime |
Value: DB847CA30259DA01 | |||
| (PID) Process: | (6656) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | DisableFirstRunCustomize |
Value: 1 | |||
| (PID) Process: | (6656) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | IE10RunOncePerInstallCompleted |
Value: 1 | |||
| (PID) Process: | (6656) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | IE10RunOnceCompletionTime |
Value: DB847CA30259DA01 | |||
| (PID) Process: | (6656) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | IEAppEolNotificationLastShownTimeStamp |
Value: 5C5D2518A5C7DB01 | |||
| (PID) Process: | (6656) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6656) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6656) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (6656) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6656 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF1D70E8558C817A1C.TMP | binary | |
MD5:2FF92697AAAB800996527AF88062D954 | SHA256:A2909E61C0DEB6C9C5B9C02C39EB614BFAA9FE1E42CAD3275FDFF9D0F002B8C6 | |||
| 1660 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8SFCICQF\arrows[1].png | image | |
MD5:0CB2E5165DC9324EB462199F04E1FFA9 | SHA256:67DFF0AAD873050F12609885F2264417CCDD0D438311000A704C89F0865F7865 | |||
| 1660 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA0E581ABAB923313BBAD105DEC35C16 | binary | |
MD5:9C7441920C52117B884475B3CC0000BC | SHA256:2B598BA8E056FC516D8903E3477F8FBB8F9DC2D8D82AF321D2E494FD714BC93A | |||
| 1660 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\0CBLTDI3\sale_form[1].js | text | |
MD5:64F809E06446647E192FCE8D1EC34E09 | SHA256:F52CBD664986AD7ED6E71C448E2D31D1A16463E4D9B7BCA0C6BE278649CCC4F3 | |||
| 1660 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\SG5UMOCJ\UP53X9NI.htm | html | |
MD5:0311B009A873292040B4C39E3A694DDF | SHA256:42D80EFC59883A6DEFF2274DF7DF0D65B3FC6A543BD7D0115BF5BB7B558FA1F9 | |||
| 1660 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 | binary | |
MD5:E192462F281446B5D1500D474FBACC4B | SHA256:F1BA9F1B63C447682EBF9DE956D0DA2A027B1B779ABEF9522D347D3479139A60 | |||
| 1660 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656 | binary | |
MD5:51B16CD826C07DAD3E0B42AE0B6E9465 | SHA256:FAA10E40007F35F4502A3E0A4842C4F7723B0DF3120A0E686BE8A8F4E1BDD702 | |||
| 7404 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF10ccc8.TMP | — | |
MD5:— | SHA256:— | |||
| 7404 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 7404 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF10cd83.TMP | — | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1660 | iexplore.exe | GET | 200 | 69.192.161.44:80 | http://x1.c.lencr.org/ | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1660 | iexplore.exe | GET | 200 | 3.167.227.86:80 | http://r11.c.lencr.org/84.crl | unknown | — | — | whitelisted |
1660 | iexplore.exe | GET | 200 | 76.223.26.96:80 | http://ww3.daftar.site/?subid1=40cdf775-3397-11f0-9b62-0bc06849b362 | unknown | — | — | unknown |
1660 | iexplore.exe | GET | 200 | 18.66.145.213:80 | http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D | unknown | — | — | whitelisted |
1660 | iexplore.exe | GET | 200 | 185.53.178.30:80 | http://c.parkingcrew.net/scripts/sale_form.js | unknown | — | — | whitelisted |
6656 | iexplore.exe | GET | 200 | 76.223.26.96:80 | http://ww3.daftar.site/favicon.ico | unknown | — | — | unknown |
1660 | iexplore.exe | GET | 200 | 18.66.121.69:80 | http://d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/img/arrows.png | unknown | — | — | whitelisted |
1660 | iexplore.exe | GET | 200 | 76.223.26.96:80 | http://ww3.daftar.site/munin/a/tr/browserjs?domain=daftar.site&toggle=browserjs&uid=MTc0NzUzODk4NC40OTU3OjkyMGE0NjMxNTRlMDNjMWU4ODY1OTUxNzBjYjFiNGYxZTY5ZDY5YjdmODQzNzk4YjQ3MmVhNTEzZmMzOGVlZmQ6NjgyOTU0Mjg3OTA1Nw%3D%3D | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.216.77.6:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
1660 | iexplore.exe | 216.245.197.44:443 | daftar.site | LIMESTONENETWORKS | US | unknown |
1660 | iexplore.exe | 69.192.161.44:80 | x1.c.lencr.org | AKAMAI-AS | DE | whitelisted |
1660 | iexplore.exe | 3.167.227.86:80 | r11.c.lencr.org | — | US | whitelisted |
1660 | iexplore.exe | 76.223.26.96:80 | ww3.daftar.site | AMAZON-02 | US | unknown |
3216 | svchost.exe | 172.211.123.249:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
daftar.site |
| unknown |
x1.c.lencr.org |
| whitelisted |
r11.c.lencr.org |
| whitelisted |
ww3.daftar.site |
| unknown |
client.wns.windows.com |
| whitelisted |
euob.astarsbuilding.com |
| unknown |
PID | Process | Class | Message |
|---|---|---|---|
1660 | iexplore.exe | Misc activity | ET INFO Observed ZeroSSL SSL/TLS Certificate |
1660 | iexplore.exe | Misc activity | ET INFO Observed ZeroSSL SSL/TLS Certificate |
7664 | msedge.exe | Misc activity | ET INFO Observed ZeroSSL SSL/TLS Certificate |
7664 | msedge.exe | Misc activity | ET INFO Observed ZeroSSL SSL/TLS Certificate |