analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://bit.ly/2XI66bx

Full analysis: https://app.any.run/tasks/0ae79495-2ee1-4441-867a-6d26420d8b9d
Verdict: Malicious activity
Analysis date: March 22, 2019, 01:11:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

7A825D11FE2FCE192FF02E5A222190F3

SHA1:

6BCB33BEF87EB974538978C2E99DE3911B9E66A9

SHA256:

BDA1727D4C7639A4F7A59CF1B0C6C474F5CBCBC076785B2CC9C6A96C00FA6486

SSDEEP:

3:N1KcQ9T9sF:CcY9+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Creates files in the user directory

      • iexplore.exe (PID: 1896)
      • iexplore.exe (PID: 2664)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 1308)

    • Changes internet zones settings

      • iexplore.exe (PID: 1896)

    • Application launched itself

      • iexplore.exe (PID: 1896)
      • chrome.exe (PID: 2480)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2664)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2664)

    • Reads settings of System Certificates

      • chrome.exe (PID: 3020)
      • iexplore.exe (PID: 1896)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1896)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
23
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1896"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2664"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1896 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
1308C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Version:
26,0,0,131
2480"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
3221225547
Version:
73.0.3683.75
3244"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=73.0.3683.75 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6cfc0f18,0x6cfc0f28,0x6cfc0f34C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
4024"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2392 --on-initialized-event-handle=308 --parent-handle=312 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
3784"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=964,12684997339045725452,16090892915763788794,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwAAAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=12165372695383122088 --mojo-platform-channel-handle=948 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
3020"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=964,12684997339045725452,16090892915763788794,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=16884201322146598009 --mojo-platform-channel-handle=1520 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
2688"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=964,12684997339045725452,16090892915763788794,131072 --enable-features=PasswordImport --service-pipe-token=1746729419747442317 --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=1746729419747442317 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2092 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
2972"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=964,12684997339045725452,16090892915763788794,131072 --enable-features=PasswordImport --service-pipe-token=17619896008747418884 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=17619896008747418884 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2300 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
Total events
1 657
Read events
1 367
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
90
Text files
187
Unknown types
23

Dropped files

PID
Process
Filename
Type
1896iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico —
MD5:—
SHA256:—
1896iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2664iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TXETDQAZ\DreadSpam_zip[1].txt —
MD5:—
SHA256:—
2664iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\I4I0LHU8\app[1].jstext
MD5:54CFC945293FF769616451BABDCE038C
SHA256:232555C7291EC261A98090DF629D525090376774A511B438074A700D65D92537
2664iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.datdat
MD5:540A5E1A5569F2519AFC4323023AAB42
SHA256:47108AB312C6FE86BC8A1B69ADFA41977C103670AE5B7DDDDF7FFFA613795C52
2664iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@bit[1].txttext
MD5:73E189ACB6732D04BFFC4DB984248F2F
SHA256:FF325ACC33D83A52F7E3F3C5061805A95AF9CA466FEF7EC78B4B544FE337333E
2664iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TXETDQAZ\DreadSpam_zip[1].htmhtml
MD5:B601B9FE2D644FFA72774C852D5470D4
SHA256:47B7758FA1BFBBF0392018993DBF9895EA9452FC15B8D20DB99CB4048D808BE6
2664iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:65CB5D8B49707FC4A1EB0C17C8FD5968
SHA256:912EE1521D39D31198ED1C877F202CACF5033913744950C469C7E9A31483121D
2664iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TXETDQAZ\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
2664iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\I4I0LHU8\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
68
DNS requests
58
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2664
iexplore.exe
GET
301
67.199.248.10:80
http://bit.ly/2XI66bx
US
html
133 b
shared
2664
iexplore.exe
GET
200
205.185.216.42:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
55.2 Kb
whitelisted
3020
chrome.exe
GET
200
173.194.19.183:80
http://r1---sn-5go7yn7z.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvMjJlQUFXRC12Ny1ldUFnMXF3SDlXZDlFZw/7319.128.0.1_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mip=82.102.22.104&mm=28&mn=sn-5go7yn7z&ms=nvh&mt=1553217085&mv=m&pl=24&shardbypass=yes
US
crx
842 Kb
whitelisted
3020
chrome.exe
GET
302
216.58.207.78:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvMjJlQUFXRC12Ny1ldUFnMXF3SDlXZDlFZw/7319.128.0.1_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx
US
html
504 b
whitelisted
2664
iexplore.exe
GET
200
52.85.188.34:80
http://x.ss2.us/x.cer
US
der
1.27 Kb
whitelisted
1896
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1896
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2664
iexplore.exe
67.199.248.10:80
bit.ly
Bitly Inc
US
shared
2664
iexplore.exe
23.111.8.154:443
oss.maxcdn.com
netDNA
US
unknown
2664
iexplore.exe
172.217.18.104:443
www.googletagmanager.com
Google Inc.
US
suspicious
2664
iexplore.exe
151.101.2.217:443
vjs.zencdn.net
Fastly
US
suspicious
2664
iexplore.exe
194.32.146.58:443
anonfiles.com
—
—
unknown
2664
iexplore.exe
172.217.18.110:443
www.google-analytics.com
Google Inc.
US
whitelisted
2664
iexplore.exe
52.85.188.67:443
djv99sxoqpv11.cloudfront.net
Amazon.com, Inc.
US
whitelisted
2664
iexplore.exe
54.230.95.12:443
boudja.com
Amazon.com, Inc.
US
suspicious
2664
iexplore.exe
52.85.188.34:80
x.ss2.us
Amazon.com, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
bit.ly
  • 67.199.248.10
  • 67.199.248.11
shared
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
anonfiles.com
  • 194.32.146.58
  • 194.32.146.59
shared
vjs.zencdn.net
  • 151.101.2.217
  • 151.101.66.217
  • 151.101.130.217
  • 151.101.194.217
whitelisted
oss.maxcdn.com
  • 23.111.8.154
whitelisted
cdn-101.anonfile.com
  • —
suspicious
www.googletagmanager.com
  • 172.217.18.104
whitelisted
djv99sxoqpv11.cloudfront.net
  • 52.85.188.67
  • 52.85.188.3
  • 52.85.188.170
  • 52.85.188.251
shared
www.google-analytics.com
  • 172.217.18.110
whitelisted
boudja.com
  • 54.230.95.12
  • 54.230.95.79
  • 54.230.95.46
  • 54.230.95.153
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://bit.ly/2XI66bx