| download: | index.html |
| Full analysis: | https://app.any.run/tasks/7d3d6aad-fd60-4b68-bce9-26e061d08145 |
| Verdict: | Malicious activity |
| Analysis date: | June 15, 2019, 17:25:56 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | text/html |
| File info: | HTML document, UTF-8 Unicode text, with very long lines |
| MD5: | 7DCB8E93512146B166288261DEFBFFD1 |
| SHA1: | CDEE9E9EB5B1924AEED42BBE8648ECC836DAD61A |
| SHA256: | B96ABD87C8A1C754CB765E43424B60CFA431521C2ED0562AED74E9B2D3892E5C |
| SSDEEP: | 1536:RjV2VClySvxMFsQEiDWjpP17F/vqu7CvqL3W89lLLByiTxUT6NMr4L8OJdwZwerk:5k5SqWX1POWvK3vWcmW58ScL |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
Application launched itself
- iexplore.exe (PID: 3960)
Changes internet zones settings
- iexplore.exe (PID: 3960)
Reads internet explorer settings
- iexplore.exe (PID: 2872)
Reads settings of System Certificates
- iexplore.exe (PID: 2872)
Adds / modifies Windows certificates
- iexplore.exe (PID: 2872)
Changes settings of System certificates
- iexplore.exe (PID: 2872)
Reads Internet Cache Settings
- iexplore.exe (PID: 2872)
- iexplore.exe (PID: 3960)
Creates files in the user directory
- iexplore.exe (PID: 2872)
- WINWORD.EXE (PID: 2448)
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 2448)
Manual execution by user
- WINWORD.EXE (PID: 2448)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .htm/html | | | HyperText Markup Language with DOCTYPE (80.6) |
|---|---|---|
| .html | | | HyperText Markup Language (19.3) |
EXIF
HTML
| ContentType: | text/html; charset=UTF-8 |
|---|---|
| HTTPEquivXUACompatible: | IE=edge |
| msapplicationConfig: | none |
| Description: | Pornhub is the world’s leading free porn site. Choose from millions of hardcore videos that stream quickly and in high quality, including amazing VR Porn. The largest adult site on the Internet just keeps getting better. We have more pornstars and real amateurs than anyone else. It’s fast, it’s free, it’s Pornhub! |
| Title: | Free Porn Videos & Sex Movies - Porno, XXX, Porn Tube | Pornhub |
Total processes
37
Monitored processes
3
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2448 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\watchprovided.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
| 2872 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3960 CREDAT:79873 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3960 | "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\index.html.htm | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
1 386
Read events
960
Write events
411
Delete events
15
Modification events
| (PID) Process: | (3960) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
| (PID) Process: | (3960) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (3960) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (3960) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones |
| Operation: | write | Name: | SecuritySafe |
Value: 1 | |||
| (PID) Process: | (3960) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (3960) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 4600000071000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000 | |||
| (PID) Process: | (3960) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active |
| Operation: | write | Name: | {ABB92CAF-8F92-11E9-A370-5254004A04AF} |
Value: 0 | |||
| (PID) Process: | (2872) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore |
| Operation: | write | Name: | Type |
Value: 3 | |||
| (PID) Process: | (2872) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore |
| Operation: | write | Name: | Count |
Value: 1 | |||
| (PID) Process: | (2872) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore |
| Operation: | write | Name: | Time |
Value: E307060006000F0011001A000D00CD01 | |||
Executable files
0
Suspicious files
0
Text files
53
Unknown types
6
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3960 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 3960 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 2872 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\generated-header[1].css | text | |
MD5:145A29BBEECCA5E4EBA8B0738C0F81AD | SHA256:CA4AF52C460C07E56E4A45190BFEFA4B349E1172FD21C73B2B5685787F1F7400 | |||
| 2872 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\smpop-stable[1].js | text | |
MD5:E0A81A722C411EC59023DF88BB8F1D50 | SHA256:752ED8682AADB11912CAF9A23B454F7679ADE698FB886F85E2D5FCD35DBD08A5 | |||
| 2872 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\premium-modals[1].css | text | |
MD5:7E8F518F05A072FB55DA3796B5D1BCB1 | SHA256:AFC4B10BFFEC642AC089AA55A618817030477B716B2D441539E18222D29A61FA | |||
| 2872 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\ph-tracking[1].js | text | |
MD5:4B8296FB5F8C4EDB3BB10CDCB8FDF8D7 | SHA256:0EFDB7573776D190A2B35E2D51199F214AB58F959F4523430B4FD41AA829483D | |||
| 2872 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\css[1].txt | text | |
MD5:4A2AEBA0E4E9F2DA2C5FCADAA38F4E11 | SHA256:99F50A5A84F296001C9BDD4F910DEA3C0A0D7CF4D7D0AF3DD67239D04F600640 | |||
| 2872 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\ph-functions[1].js | html | |
MD5:31EF8AD660F63A97EE3F50EDF6D6CB64 | SHA256:F536E232D1046C022E3EF434AF5381F91B1407CAE26579233C08C3DDE8F76330 | |||
| 2872 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\test[1].js | text | |
MD5:D043175ED68BC51A1B5D83F2A6F4781D | SHA256:9616E717259244952A7ABBAEC9A26569EABB69ACBE8920D8EE6AF3B666550729 | |||
| 2872 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\(m=qQ0K2TUbecuKGgaaaa)(mh=PoczEnT8c6K3nBKM)0[1].jpg | image | |
MD5:B2DE11EC445F7D71570D1F7AE167AFAB | SHA256:439B30641C0AB8ACA467C5D59F7CB5CF33F26F797AF66897C7E06D1C213A3967 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
21
DNS requests
10
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2872 | iexplore.exe | 152.195.34.118:443 | ci.phncdn.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
— | — | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2872 | iexplore.exe | 172.217.22.42:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
2872 | iexplore.exe | 172.217.16.131:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
2872 | iexplore.exe | 205.185.208.142:443 | cdn1d-static-shared.phncdn.com | Highwinds Network Group, Inc. | US | suspicious |
2872 | iexplore.exe | 205.185.208.85:443 | media.trafficjunky.net | Highwinds Network Group, Inc. | US | unknown |
2872 | iexplore.exe | 66.254.114.38:443 | ads.trafficjunky.net | Reflected Networks, Inc. | US | unknown |
2872 | iexplore.exe | 69.16.175.42:443 | smpop.icfcdn.com | Highwinds Network Group, Inc. | US | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
smpop.icfcdn.com |
| malicious |
ci.phncdn.com |
| whitelisted |
www.bing.com |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
cdn1d-static-shared.phncdn.com |
| whitelisted |
media.trafficjunky.net |
| whitelisted |
di.phncdn.com |
| whitelisted |
ads.trafficjunky.net |
| whitelisted |
hw-cdn.trafficjunky.net |
| whitelisted |