analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://maps.crisis24.com/2022/06-Jun/5c114a4cad26c7aada80fd5de5f067e709f03673.html__;!!KEc8uF_xo8-al5zF!BitRBcHfvymn9ttXA7YnmDyYKZwbpjWq7Z6p2Te1fsxx4Bskb2PErd0EB7BBO_IP$

Full analysis: https://app.any.run/tasks/3f441cc4-ab12-4275-9fb5-35bbb28eeb72
Verdict: Malicious activity
Analysis date: June 27, 2022, 05:59:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

BD9CC149C677CD245E85BCCC62FA1DFE

SHA1:

54828391AC1362474EB77A2F49D423E458A78CC7

SHA256:

C2335EDF80C8AECCE91DBA33C8E0782111CE1E3C5CBC4F7CD88976C3973FAADE

SSDEEP:

3:N89MlKIKlsLGUIERGEXVTqcDLCRKddN4MRXO5M3DhdFGWaWfgOcVqr:2B3l7ER75DlfCd5M9paWEqr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 964)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 964)
      • iexplore.exe (PID: 2604)

    • Reads the computer name

      • iexplore.exe (PID: 2604)
      • iexplore.exe (PID: 964)

    • Changes internet zones settings

      • iexplore.exe (PID: 2604)

    • Application launched itself

      • iexplore.exe (PID: 2604)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 964)
      • iexplore.exe (PID: 2604)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2604)
      • iexplore.exe (PID: 964)

    • Reads internet explorer settings

      • iexplore.exe (PID: 964)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2604"C:\Program Files\Internet Explorer\iexplore.exe" "https://maps.crisis24.com/2022/06-Jun/5c114a4cad26c7aada80fd5de5f067e709f03673.html__;!!KEc8uF_xo8-al5zF!BitRBcHfvymn9ttXA7YnmDyYKZwbpjWq7Z6p2Te1fsxx4Bskb2PErd0EB7BBO_IPf7f81a39-5f63-5b42-9efd-1f13b5431005quot;C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
964"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2604 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
14 510
Read events
14 405
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
7
Text files
3
Unknown types
5

Dropped files

PID
Process
Filename
Type
964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894der
MD5:70D95E3307DD1636981EB98F22320529
SHA256:4292EEE1FA677D4D2137F894A62ED35695C3FB8D66B080DEB5292C0B6B8A4783
964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FC5A820A001B41D68902E051F36A5282_AEFD2E88773B7138A092B315D301F8DFbinary
MD5:CB5430C1D5B7BDD76832F8E6AF718BD1
SHA256:7EDE5FDF4203AA18CF0F1B7BDDB41743453A541F5CC27B5FE921E943F15171E4
964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894binary
MD5:BD28549DA983750387533240F8FC821F
SHA256:712802F1E7D0F7B45D77DD54F3405DA7F7D51A9E41F3E784DBDE9377009B05C6
964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FC5A820A001B41D68902E051F36A5282_AEFD2E88773B7138A092B315D301F8DFder
MD5:2532D0B9564B378E62C14D78759E86F3
SHA256:BE90B978E6FE63F8890A8799D408EEBDA444BB3C845283382BCCEB450B2FEFFA
964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:9A2B560B322253E98813502643BF8B98
SHA256:E8D66A4B51D1C3A8E6AFE522618B89CA9ED60A03B585DE4E2605CC0C372AB9B5
964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62binary
MD5:753453AB54EC3D176652C817B58B20CA
SHA256:D6DBF552B25B4D7D2C5203AD21E49128BAB784D6B514FA0519F7FD775A3A32A0
964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4Fbinary
MD5:98EDFD1B0976ACFE48C370292697DEA1
SHA256:31E8A1824F592CEFB637401F6CEB3200228D56C9398D4F6AC6F60459F30BF3E5
964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62der
MD5:C7B33A5171B37E83B2AC6D3473E63BE3
SHA256:334F918A1C31E0077473B071BD772E41E445988FD3237E99DE91576DD604E0C1
964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4Fder
MD5:8352A68E577A4F7AA01A568BA9110CF9
SHA256:0F7F8E22508EFC9EAF167F51ED956BC7703C69B0B848A0B94A5D988AEAA369A0
2604iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
12
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
964
iexplore.exe
GET
200
13.32.118.27:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
964
iexplore.exe
GET
200
23.216.77.69:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5d7b03af8a3f6997
US
compressed
4.70 Kb
whitelisted
964
iexplore.exe
GET
200
108.138.24.138:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
964
iexplore.exe
GET
200
108.138.24.72:80
http://ocsp.sca1b.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEAi6WzqNU%2FV%2B3sjxhSWsIRI%3D
US
der
471 b
whitelisted
964
iexplore.exe
GET
200
108.138.24.168:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D
US
der
1.39 Kb
shared
964
iexplore.exe
GET
200
23.216.77.80:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?84e65fa95d72fa7a
US
compressed
4.70 Kb
whitelisted
2604
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
964
iexplore.exe
23.216.77.80:80
ctldl.windowsupdate.com
NTT DOCOMO, INC.
US
suspicious
964
iexplore.exe
23.216.77.69:80
ctldl.windowsupdate.com
NTT DOCOMO, INC.
US
suspicious
964
iexplore.exe
108.138.17.4:443
maps.crisis24.com
BellSouth.net Inc.
US
unknown
964
iexplore.exe
13.32.118.27:80
o.ss2.us
Amazon.com, Inc.
US
unknown
2604
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
964
iexplore.exe
108.138.24.138:80
ocsp.rootg2.amazontrust.com
BellSouth.net Inc.
US
whitelisted
2604
iexplore.exe
131.253.33.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
964
iexplore.exe
108.138.24.72:80
ocsp.sca1b.amazontrust.com
BellSouth.net Inc.
US
whitelisted
964
iexplore.exe
108.138.24.168:80
ocsp.rootg2.amazontrust.com
BellSouth.net Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
maps.crisis24.com
  • 108.138.17.4
  • 108.138.17.59
  • 108.138.17.84
  • 108.138.17.53
malicious
ctldl.windowsupdate.com
  • 23.216.77.69
  • 23.216.77.80
whitelisted
o.ss2.us
  • 13.32.118.27
  • 13.32.118.5
  • 13.32.118.154
  • 13.32.118.55
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 131.253.33.200
  • 13.107.22.200
whitelisted
ocsp.rootg2.amazontrust.com
  • 108.138.24.138
  • 108.138.24.99
  • 108.138.24.168
  • 108.138.24.32
whitelisted
ocsp.rootca1.amazontrust.com
  • 108.138.24.168
  • 108.138.24.99
  • 108.138.24.32
  • 108.138.24.138
shared
ocsp.sca1b.amazontrust.com
  • 108.138.24.72
  • 108.138.24.169
  • 108.138.24.78
  • 108.138.24.186
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://maps.crisis24.com/2022/06-Jun/5c114a4cad26c7aada80fd5de5f067e709f03673.html__;!!KEc8uF_xo8-al5zF!BitRBcHfvymn9ttXA7YnmDyYKZwbpjWq7Z6p2Te1fsxx4Bskb2PErd0EB7BBO_IP$