analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| download: | index.html |
| Full analysis: | https://app.any.run/tasks/15df9d19-aaf2-4097-9a91-20ad53e9bdbb |
| Verdict: | Malicious activity |
| Analysis date: | September 19, 2019, 00:58:45 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text, with no line terminators |
| MD5: | 0CAF8BC479EE919BF4365EEE8ACEBB5F |
| SHA1: | 65961E91365EC55BE8E83D47F33001AFDE8EE83E |
| SHA256: | C25DA95D3C8F5F8A9CB4B39FEE0ED5D3D019349382514865E13F3C8DCD00ED3D |
| SSDEEP: | 3:nmNjJMzVJu+1zWNVYz2LEb:GMRJVCNOdb |
MALICIOUS
OneDrive phishing page detected
- iexplore.exe (PID: 2944)
SUSPICIOUS
No suspicious indicators.INFO
Changes internet zones settings
- iexplore.exe (PID: 2752)
Application launched itself
- iexplore.exe (PID: 2752)
Reads Internet Cache Settings
- iexplore.exe (PID: 2944)
Reads internet explorer settings
- iexplore.exe (PID: 3460)
- iexplore.exe (PID: 2944)
Adds / modifies Windows certificates
- iexplore.exe (PID: 2752)
Changes settings of System certificates
- iexplore.exe (PID: 2752)
Reads settings of System Certificates
- iexplore.exe (PID: 2752)
Creates files in the user directory
- iexplore.exe (PID: 2752)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
38
Monitored processes
3
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2752 | "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\index.html | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 3460 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2752 CREDAT:79873 | C:\Program Files\Internet Explorer\iexplore.exe | — | iexplore.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 2944 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2752 CREDAT:137473 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
Total events
609
Read events
510
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
3
Text files
31
Unknown types
7
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2752 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 2752 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 2752 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF33CC20091AA01EB4.TMP | — | |
MD5:— | SHA256:— | |||
| 2752 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{AB01DCF0-DA78-11E9-B86F-5254004A04AF}.dat | binary | |
MD5:90A6CAAFA09F7EA972B3AA0E8B7C9918 | SHA256:D1C1F140D8602DF49B7BD63A5E9776027A823882FF4F55BE591BDA946169FE4C | |||
| 3460 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019091920190920\index.dat | dat | |
MD5:A784F888D9DE3335D9914A73A5D19559 | SHA256:FACF1DAEA603F2092F86F112A6DB46FAAB0D24988443B523E1E3D8E0B0125300 | |||
| 3460 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\JavaDeployReg.log | text | |
MD5:128CB3A183B57622BB992A3037BF5CC7 | SHA256:3C8AE98C4A12376481DC5C03DE0145A31DA5EF07B249450E04850FB4B80BB50C | |||
| 2944 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat | dat | |
MD5:122B33550F9BF2521FA6C63C3BC88963 | SHA256:1FD7C14CD47D500675C7264EA843ADA0C102ED45AFEB037199CAF237A87DE3F3 | |||
| 2944 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\G5DB53EX\style[1].css | text | |
MD5:FB32F05CD594DD7C0DCFA5E2E97F0B95 | SHA256:667942DB88E2022DEE361B2F1114F6AD152EDE3BF081A7282DE291133D79EA70 | |||
| 2944 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5SSUMJJQ\oneDrive[1].png | image | |
MD5:ADE9075E4DFC7C0079F0C909015FFFED | SHA256:8BAE3513A390892DF78A7F70567B80A4FDB0CA94B984F2CF7F8339E678BC5221 | |||
| 2944 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:05FF0893F66B5755E0A695199C0F071D | SHA256:E1E994C988E9C7701C5C0974E12736D00EC945AADA5ACEB98D397161D91F061F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
18
DNS requests
6
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2752 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2752 | iexplore.exe | 35.224.70.28:443 | owoeyopaid.hopto.org | — | US | unknown |
2944 | iexplore.exe | 216.58.207.42:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
2752 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2944 | iexplore.exe | 35.224.70.28:443 | owoeyopaid.hopto.org | — | US | unknown |
2944 | iexplore.exe | 172.217.16.131:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.bing.com |
| whitelisted |
owoeyopaid.hopto.org |
| unknown |
fonts.googleapis.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
dns.msftncsi.com |
| shared |