URL:

www.safra.com.br/defensor/install/defensorsafra.exe

Full analysis: https://app.any.run/tasks/ca8981c2-18f8-4f61-ba68-3e8f0a5d63b5
Verdict: Malicious activity
Analysis date: March 05, 2024, 17:38:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

F5F4FDC5081D1821B9B92CF99B45C13B

SHA1:

DBB7A92B705079C0403959E168ED3207E593A9C2

SHA256:

BD7EE4E07C5B0AE8C95EF3A0CEFB0AD77AB25AB0D438690395B0B9BF83B7F4F4

SSDEEP:

3:Etq3UKDJEFZXiN:ggUkEFQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the Internet Settings

      • defensorsafra.exe (PID: 3500)

    • Reads security settings of Internet Explorer

      • defensorsafra.exe (PID: 3500)

    • Application launched itself

      • defensorsafra.exe (PID: 3500)

    • Executes as Windows Service

      • defensorsafra.exe (PID: 956)

    • Checks Windows Trust Settings

      • defensorsafra.exe (PID: 3500)

    • Reads settings of System Certificates

      • defensorsafra.exe (PID: 3500)

  • INFO

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 3952)
      • iexplore.exe (PID: 3700)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3952)
      • iexplore.exe (PID: 3700)

    • The process uses the downloaded file

      • defensorsafra.exe (PID: 3500)
      • iexplore.exe (PID: 3700)

    • Reads the machine GUID from the registry

      • defensorsafra.exe (PID: 2756)
      • defensorsafra.exe (PID: 3500)
      • defensorsafra.exe (PID: 956)

    • Checks supported languages

      • defensorsafra.exe (PID: 2756)
      • defensorsafra.exe (PID: 956)
      • defensorsafra.exe (PID: 3500)

    • Creates files in the program directory

      • defensorsafra.exe (PID: 3500)

    • Reads the computer name

      • defensorsafra.exe (PID: 2756)
      • defensorsafra.exe (PID: 956)
      • defensorsafra.exe (PID: 3500)

    • Application launched itself

      • iexplore.exe (PID: 3700)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3700)

    • Reads the software policy settings

      • defensorsafra.exe (PID: 3500)

    • Process checks whether UAC notifications are on

      • defensorsafra.exe (PID: 3500)

    • Creates files or folders in the user directory

      • defensorsafra.exe (PID: 3500)

    • Checks proxy server information

      • defensorsafra.exe (PID: 3500)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe defensorsafra.exe defensorsafra.exe defensorsafra.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
956"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\defensorsafra.exe" service_serviceC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\defensorsafra.exe—services.exe
User:
SYSTEM
Company:
Banco Safra
Integrity Level:
SYSTEM
Description:
Defensor Safra
Exit code:
0
Version:
2,12,0,1
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\defensorsafra.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
2756"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\defensorsafra.exe" admin_serviceC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\defensorsafra.exe
defensorsafra.exe
User:
admin
Company:
Banco Safra
Integrity Level:
HIGH
Description:
Defensor Safra
Exit code:
0
Version:
2,12,0,1
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\defensorsafra.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
3500"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\defensorsafra.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\defensorsafra.exe
iexplore.exe
User:
admin
Company:
Banco Safra
Integrity Level:
MEDIUM
Description:
Defensor Safra
Exit code:
0
Version:
2,12,0,1
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\defensorsafra.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
3700"C:\Program Files\Internet Explorer\iexplore.exe" "www.safra.com.br/defensor/install/defensorsafra.exe"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3952"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3700 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
19 549
Read events
19 383
Write events
137
Delete events
29

Modification events

(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
98593264
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31092516
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
398595764
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31092516
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
3
Suspicious files
15
Text files
12
Unknown types
7

Dropped files

PID
Process
Filename
Type
3952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:423A7D328E86BB83B67CE134CE0167B1
SHA256:2F78AD940A42B9E7F0FFAEBA72218A14A34AD97FA32F0439C23D399BF32742D8
3700iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF3C0ECB6EBA7AF0C3.TMPbinary
MD5:E01628EB3A0916164E94BB42A87D362B
SHA256:5C766A63D1DBAF7EDC8F2F37F5287B82031F080DD67B33ED7385554C979E41A1
3700iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\defensorsafra.exeexecutable
MD5:126F69E22A8334192B717A91D9233F5C
SHA256:24C5F74AC9B5EB1D0975CC1315F51DDD44E15752985A65F30B7C56AEB9CFB843
3700iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{4385D883-DB17-11EE-AE0A-12A9866C77DE}.datbinary
MD5:F665E2371B4CEE1EB30BACB42B5D96D0
SHA256:71B3392C2AC12C352044D64FF58FCBDD4E0DD763A8410383751A2300F1D0D9FB
3952iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\defensorsafra[1].exeexecutable
MD5:B8268182ACADBC8EFA3FBF4FF1E92E92
SHA256:AE9249EA316A9B64EB86A35483BC9BA213D38947FC042094BF9E2CA55D68FD1E
3700iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\defensorsafra.exe.v3k9p51.partial:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
3952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04der
MD5:A9D0B8D174F36C721E8D832ACE5929F3
SHA256:1BD1BF26A8BDAF848857B7C746158D33277C5FD46CF27F2503F932B700FFEAB8
3952iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\defensorsafra.exe.v3k9p51.partialexecutable
MD5:126F69E22A8334192B717A91D9233F5C
SHA256:24C5F74AC9B5EB1D0975CC1315F51DDD44E15752985A65F30B7C56AEB9CFB843
3952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:B3C8DFBE27E97798E62E557654F1B8F1
SHA256:42BDB63DAF4C6C63E3EBA5350F96CD0F2A04616E04058A129BF2B4CD0D9B201B
956defensorsafra.exeC:\Windows\system32\config\systemprofile\NTUSER.DAThiv
MD5:A7A8AFE2F906821BAC41AB945FF6C4E6
SHA256:6C1E97D4711E5BD0E43CC6A9A18DB90E727836F26CF48AF3DBF4150F98BC7FDE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
24
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3952
iexplore.exe
GET
301
95.101.198.137:80
http://www.safra.com.br/defensor/install/defensorsafra.exe
unknown
—
—
unknown
3952
iexplore.exe
GET
304
2.19.126.163:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f78d505714a595e3
unknown
—
—
unknown
3952
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
binary
471 b
unknown
1080
svchost.exe
GET
304
2.22.242.90:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e90c163b6659448e
unknown
compressed
67.5 Kb
unknown
1080
svchost.exe
GET
200
2.22.242.90:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1b8fee253118cbef
unknown
compressed
67.5 Kb
unknown
3700
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
unknown
binary
471 b
unknown
3700
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
binary
471 b
unknown
3700
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
unknown
binary
471 b
unknown
3700
iexplore.exe
GET
200
192.229.221.95:80
http://crl3.digicert.com/DigiCertGlobalRootG2.crl
unknown
binary
1.14 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3952
iexplore.exe
95.101.198.137:80
www.safra.com.br
Akamai International B.V.
NL
unknown
3952
iexplore.exe
95.101.198.137:443
www.safra.com.br
Akamai International B.V.
NL
unknown
3952
iexplore.exe
2.19.126.163:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3952
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3500
defensorsafra.exe
18.65.39.100:443
dn.gastecnologia.com.br
AMAZON-02
US
unknown
3700
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
1080
svchost.exe
2.22.242.90:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
www.safra.com.br
  • 95.101.198.137
unknown
ctldl.windowsupdate.com
  • 2.19.126.163
  • 2.19.126.137
  • 2.22.242.90
  • 2.22.242.138
  • 2.22.242.83
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
dn.gastecnologia.com.br
  • 18.65.39.100
  • 18.65.39.68
  • 18.65.39.2
  • 18.65.39.129
shared
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
go.microsoft.com
  • 2.19.246.123
whitelisted
www.msn.com
  • 204.79.197.203
whitelisted
crl3.digicert.com
  • 192.229.221.95
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
www.safra.com.br/defensor/install/defensorsafra.exe