analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://maas.mail.163.com/dashi-web-extend/html/proSignature.html?ftlId=1&name=Carl&uid=carl%40nbmarketreport.com&iconUrl=https%3A%2F%2Fmail-online.nosdn.127.net%2Fqiyelogo%2FdefaultAvatar.png&items=%5B%22carl%40nbmarketreport.com%22%5D

Full analysis: https://app.any.run/tasks/f89fbef8-029c-4c44-a590-31b081e9c005
Verdict: Malicious activity
Analysis date: January 24, 2022, 21:25:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

B49E572AF744B215C96F5FF40BB241DD

SHA1:

24C08D6C4BBBB26884EA51B9E82784143664720A

SHA256:

B87D14A54010EF4537400DA28E4DB72282C104A2969A2DB7C58007FABA4C5906

SSDEEP:

6:2AloXIUxLCALamPiMOz7lZYNnzSV+CeJVe15XG2s5g0:2AMxk7+eV+CeJ0XW2s+0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3284)
    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 612)
  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 3284)
      • iexplore.exe (PID: 1988)
      • chrome.exe (PID: 1088)
      • chrome.exe (PID: 612)
      • chrome.exe (PID: 3776)
      • chrome.exe (PID: 2256)
      • chrome.exe (PID: 1292)
      • chrome.exe (PID: 888)
      • chrome.exe (PID: 188)
    • Checks supported languages

      • iexplore.exe (PID: 1988)
      • iexplore.exe (PID: 3284)
      • chrome.exe (PID: 612)
      • chrome.exe (PID: 3752)
      • chrome.exe (PID: 3776)
      • chrome.exe (PID: 1088)
      • chrome.exe (PID: 2164)
      • chrome.exe (PID: 2076)
      • chrome.exe (PID: 2256)
      • chrome.exe (PID: 2632)
      • chrome.exe (PID: 2128)
      • chrome.exe (PID: 2140)
      • chrome.exe (PID: 3732)
      • chrome.exe (PID: 4088)
      • chrome.exe (PID: 3956)
      • chrome.exe (PID: 1292)
      • chrome.exe (PID: 888)
      • chrome.exe (PID: 3080)
      • chrome.exe (PID: 188)
    • Changes internet zones settings

      • iexplore.exe (PID: 1988)
    • Application launched itself

      • iexplore.exe (PID: 1988)
      • chrome.exe (PID: 612)
    • Reads settings of System Certificates

      • iexplore.exe (PID: 1988)
      • iexplore.exe (PID: 3284)
      • chrome.exe (PID: 3776)
    • Manual execution by user

      • chrome.exe (PID: 612)
    • Reads internet explorer settings

      • iexplore.exe (PID: 3284)
    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3284)
      • iexplore.exe (PID: 1988)
    • Reads the hosts file

      • chrome.exe (PID: 612)
      • chrome.exe (PID: 3776)
    • Reads the date of Windows installation

      • chrome.exe (PID: 188)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
19
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1988"C:\Program Files\Internet Explorer\iexplore.exe" "https://maas.mail.163.com/dashi-web-extend/html/proSignature.html?ftlId=1&name=Carl&uid=carl%40nbmarketreport.com&iconUrl=https%3A%2F%2Fmail-online.nosdn.127.net%2Fqiyelogo%2FdefaultAvatar.png&items=%5B%22carl%40nbmarketreport.com%22%5D"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3284"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1988 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
612"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
Explorer.EXE
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
3752"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6e8ed988,0x6e8ed998,0x6e8ed9a4C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
1088"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1056,13198665882789658150,12360185764567399508,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1068 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
3776"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1056,13198665882789658150,12360185764567399508,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1408 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
2128"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,13198665882789658150,12360185764567399508,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1956 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
86.0.4240.198
2076"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,13198665882789658150,12360185764567399508,131072 --enable-features=PasswordImport --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1972 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
2140"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,13198665882789658150,12360185764567399508,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2360 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
2164"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,13198665882789658150,12360185764567399508,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Total events
25 981
Read events
25 790
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
129
Text files
104
Unknown types
12

Dropped files

PID
Process
Filename
Type
612chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61EF1940-264.pma
MD5:
SHA256:
3284iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7229E30BCFD0992128433D951137A421_68449AB10F865F5D92B716441C889881der
MD5:F599FADC7B2D7557000BDF181B2A9131
SHA256:65A1A8BE57D260DA89DC13F5A9D8881E8F0E9725B75D1635C6FD404D8542FD7C
3284iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_F7F9B7BDCC367A8E3539D28F7D4D4BA2der
MD5:ADAC833C695226818F1D4C45687AD2F7
SHA256:2EFFED24B861F8237D2C23AA1339AF13AF4F10421E586D0CC3FE345E1BDAAD10
3284iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\proSignature[1].htmhtml
MD5:553D83EE8232855E871C7B6147206934
SHA256:BFF3F89FECCF3C23AFD2803041B70EABA71D3A3A0178C986E830AFAA1D30B215
3284iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_F7F9B7BDCC367A8E3539D28F7D4D4BA2binary
MD5:2811A4A029FB4601D0D5FB912A391C04
SHA256:DE6F5757591673C1A953CA7735B80938CF984E139EF23ED7F5CC24C4B2C464C1
3284iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:33011E2F4272AF16CC2F023810591061
SHA256:3ADDF340A7F511A899F67D79123A176844C44F8C9F80D682EB95E8275E39F93F
612chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datbinary
MD5:9C016064A1F864C8140915D77CF3389A
SHA256:0E7265D4A8C16223538EDD8CD620B8820611C74538E420A88E333BE7F62AC787
3284iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7229E30BCFD0992128433D951137A421_68449AB10F865F5D92B716441C889881binary
MD5:AB6B9310DB66A6AFADD1BA47A718EE1F
SHA256:0AD5D391649436FDF1FCEE0555259C3EDEB817C0E984498FAB116FF55130B56D
612chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:8FF312A95D60ED89857FEB720D80D4E1
SHA256:946A57FAFDD28C3164D5AB8AB4971B21BD5EC5BFFF7554DBF832CB58CC37700B
3752chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pmabinary
MD5:03C4F648043A88675A920425D824E1B3
SHA256:F91DBB7C64B4582F529C968C480D2DCE1C8727390482F31E4355A27BB3D9B450
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
61
DNS requests
30
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3284
iexplore.exe
GET
200
93.184.220.29:80
http://crl.digicert-cn.com/DigiCertGlobalRootCA.crl
US
der
631 b
whitelisted
3284
iexplore.exe
GET
200
79.133.177.229:80
http://ocsp.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoEcNCWvIoSyJCm34Ju7Es%3D
RU
der
471 b
whitelisted
1988
iexplore.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/Omniroot2025.crl
US
der
7.68 Kb
whitelisted
3284
iexplore.exe
GET
200
79.133.177.230:80
http://ocsp.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEA9XJzvKHSzUawu5%2FQ%2By7Xk%3D
RU
der
471 b
whitelisted
3284
iexplore.exe
GET
200
47.246.48.205:80
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRXf%2BqAIajMnZeiQcx27p1CzET2wQUJG%2BRP4mHhw4ywkAY38VM60%2FISTICEAbd%2FBKAv0Oq9cNIYDHCV2A%3D
US
der
471 b
whitelisted
3284
iexplore.exe
GET
200
47.246.48.205:80
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAsTYrbuap0%2Blokw8W4gfTk%3D
US
der
471 b
whitelisted
1988
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3776
chrome.exe
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
crx
242 Kb
whitelisted
3284
iexplore.exe
GET
200
67.27.157.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5b810eac8f0d199b
US
compressed
4.70 Kb
whitelisted
3284
iexplore.exe
GET
200
67.27.157.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c6b966393682f9ed
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3776
chrome.exe
142.250.181.228:443
www.google.com
Google Inc.
US
whitelisted
1988
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3284
iexplore.exe
47.246.48.205:80
ocsp.digicert.cn
US
unknown
1988
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3284
iexplore.exe
79.133.177.230:80
ocsp.dcocsp.cn
SOT LINE Limited Company
RU
malicious
3284
iexplore.exe
123.126.96.184:443
maas.mail.163.com
China Unicom Beijing Province Network
CN
suspicious
3284
iexplore.exe
163.171.133.124:443
mailpub.nosdn.127.net
US
malicious
3776
chrome.exe
142.250.185.78:443
clients2.google.com
Google Inc.
US
whitelisted
3284
iexplore.exe
67.27.157.126:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
192.168.100.2:53
whitelisted

DNS requests

Domain
IP
Reputation
maas.mail.163.com
  • 123.126.96.184
whitelisted
www.microsoft.com
whitelisted
ctldl.windowsupdate.com
  • 67.27.157.126
  • 67.27.233.254
  • 67.26.83.254
  • 8.253.207.121
  • 8.253.95.120
whitelisted
ocsp.digicert.cn
  • 47.246.48.205
whitelisted
mailpub.nosdn.127.net
  • 163.171.133.124
malicious
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ocsp.dcocsp.cn
  • 79.133.177.230
  • 79.133.177.229
  • 79.133.177.228
  • 79.133.177.227
  • 79.133.177.226
  • 79.133.177.225
  • 79.133.177.232
  • 79.133.177.231
whitelisted
clients2.google.com
  • 142.250.185.78
whitelisted

Threats

No threats detected
No debug info