analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www.futemax.app

Full analysis: https://app.any.run/tasks/50093c74-90b7-4a2e-8599-ffe7407a5425
Verdict: Malicious activity
Analysis date: August 12, 2022, 20:00:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

095507F1DC6A58A655FBB14BC964FF4C

SHA1:

9569C676FA76F1319B803D3A868C0A20B20D6B8F

SHA256:

BD184642122BEC7492937F352969FB7DA800A82895EB019AE6EBFF8BA6457632

SSDEEP:

3:N8DSLMv/:2OLMv/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2068)

    • Checks supported languages

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 3052)

    • Reads the computer name

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 3052)

    • Executed via COM

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 3052)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 2960)
      • iexplore.exe (PID: 2068)

    • Checks supported languages

      • iexplore.exe (PID: 2068)
      • iexplore.exe (PID: 2960)

    • Changes internet zones settings

      • iexplore.exe (PID: 2960)

    • Application launched itself

      • iexplore.exe (PID: 2960)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2068)
      • iexplore.exe (PID: 2960)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2960)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2960)
      • iexplore.exe (PID: 2068)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2068)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2960)

    • Reads CPU info

      • iexplore.exe (PID: 2068)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe flashutil32_32_0_0_453_activex.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2960"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.futemax.app"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2068"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2960 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\iertutil.dll
3052C:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 32.0 r0
Version:
32,0,0,453
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_32_0_0_453_activex.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
21 436
Read events
21 307
Write events
127
Delete events
2

Modification events

(PID) Process:(2960) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2960) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
571199680
(PID) Process:(2960) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30977670
(PID) Process:(2960) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
871357180
(PID) Process:(2960) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30977670
(PID) Process:(2960) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2960) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2960) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2960) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2960) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
27
Text files
98
Unknown types
23

Dropped files

PID
Process
Filename
Type
2068iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\TarA4B0.tmpcat
MD5:7EE994C83F2744D702CBA18693ED1758
SHA256:5DB917AB6DC8A42A43617850DFBE2C7F26A7F810B229B349E9DD2A2D615671D2
2068iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\TarA46F.tmpcat
MD5:7EE994C83F2744D702CBA18693ED1758
SHA256:5DB917AB6DC8A42A43617850DFBE2C7F26A7F810B229B349E9DD2A2D615671D2
2068iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabA46E.tmpcompressed
MD5:589C442FC7A0C70DCA927115A700D41E
SHA256:2E5CB72E9EB43BAAFB6C6BFCC573AAC92F49A8064C483F9D378A9E8E781A526A
2068iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:CC28D6D6CEB9443BF5BDF6242C9AAB8E
SHA256:D746CD795FA2E4CEC321D348A1C6B1DD5825E4E2E2EF6C310CA35D07F2671430
2068iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:E077D24C0CB8F4F36E89255A3F5A4EA3
SHA256:B5B35B4BFBE1F6B0B7350E12E5BA99CC748911ED42B8336453AA61389BF436AB
2068iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\W6N2G3Z7.htmhtml
MD5:9FF4A69A98D6FFB5DD65D64130564F76
SHA256:76361C0DEE856D11A4B343DE5662FCCF4E2F5A4606BD779814C7E697C5AFA72F
2068iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabA4AF.tmpcompressed
MD5:589C442FC7A0C70DCA927115A700D41E
SHA256:2E5CB72E9EB43BAAFB6C6BFCC573AAC92F49A8064C483F9D378A9E8E781A526A
2068iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:589C442FC7A0C70DCA927115A700D41E
SHA256:2E5CB72E9EB43BAAFB6C6BFCC573AAC92F49A8064C483F9D378A9E8E781A526A
2068iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
2068iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:76C157A62648DC61F377E1A37EBEBBB4
SHA256:6FA1492D8B5F840B20D2AF71EE6EF76BAD5475ECD22D979E4462F1BB2B8DB18E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
81
DNS requests
34
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2068
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?f8f76d34389e17f8
US
compressed
60.2 Kb
whitelisted
2068
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?b0fd2108a0137530
US
compressed
60.2 Kb
whitelisted
2068
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
2068
iexplore.exe
GET
200
192.124.249.22:80
http://ocsp.starfieldtech.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQUwPiEZQ6%2FsVZNPaFToNfxx8ZwqAQUfAwyH6fZMH%2FEfWijYqihzqsHWycCAQc%3D
US
der
1.74 Kb
whitelisted
2068
iexplore.exe
GET
200
104.83.4.208:80
http://e1.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTvkAFw3ViPKmUeIVEf3NC7b1ErqwQUWvPtK%2Fw2wjd5uVIw6lRvz1XLLqwCEgP4%2F6%2BskTG4hWtdyBj2sU7A8g%3D%3D
NL
der
345 b
whitelisted
2068
iexplore.exe
GET
200
142.250.181.227:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDyjRAUcVc1IArKByftf8KS
US
der
472 b
whitelisted
2068
iexplore.exe
GET
200
192.124.249.22:80
http://ocsp.starfieldtech.com//MEowSDBGMEQwQjAJBgUrDgMCGgUABBT1ZqtwV0O1KcYi0gdzcFkHM%2BuArAQUJUWBaFAmOD07LSy%2BzWrZtj2zZmMCCQDLsv01iaKxdw%3D%3D
US
der
1.80 Kb
whitelisted
2068
iexplore.exe
GET
200
142.250.181.227:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
2068
iexplore.exe
GET
200
104.83.4.154:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgMTydEQcywpElXEBegdygeDcg%3D%3D
NL
der
503 b
shared
2068
iexplore.exe
GET
200
104.83.4.154:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgOEP9dVZrJgYo2vAgKHv9OkOQ%3D%3D
NL
der
503 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2068
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
2068
iexplore.exe
104.27.194.88:443
www.futemax.app
Cloudflare Inc
US
shared
2068
iexplore.exe
172.67.169.247:443
use.fontawesome.com
—
US
suspicious
2068
iexplore.exe
104.96.143.115:80
x1.c.lencr.org
Akamai Technologies, Inc.
NL
unknown
2068
iexplore.exe
142.250.185.136:443
www.googletagmanager.com
Google Inc.
US
suspicious
2068
iexplore.exe
192.124.249.182:443
static.futemax.app
Sucuri
US
unknown
2068
iexplore.exe
104.83.4.208:80
e1.o.lencr.org
Akamai International B.V.
NL
unknown
2068
iexplore.exe
142.250.181.227:80
ocsp.pki.goog
Google Inc.
US
whitelisted
2068
iexplore.exe
142.250.186.42:443
ajax.googleapis.com
Google Inc.
US
whitelisted
2068
iexplore.exe
172.217.23.99:443
fonts.gstatic.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.futemax.app
  • 104.27.194.88
  • 104.27.195.88
unknown
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
x1.c.lencr.org
  • 104.96.143.115
whitelisted
x2.c.lencr.org
  • 104.96.143.115
whitelisted
e1.o.lencr.org
  • 104.83.4.208
  • 104.83.4.154
whitelisted
static.futemax.app
  • 192.124.249.182
unknown
use.fontawesome.com
  • 172.67.169.247
  • 104.21.63.54
whitelisted
futemax.app
  • 104.27.194.88
  • 104.27.195.88
unknown
ajax.googleapis.com
  • 142.250.186.42
whitelisted
www.googletagmanager.com
  • 142.250.185.136
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.futemax.app