analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://mega.nz/folder/mHJWzZDS#o0yOModu4PuRUjXDvUTOHA

Full analysis: https://app.any.run/tasks/c1ae35de-d2d6-43f0-a364-2464b094f9df
Verdict: Malicious activity
Analysis date: October 19, 2020, 20:47:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

4B3EEDE49A506F72AA08B489AE46CB54

SHA1:

484033A515B1464B5773C19BFEB60B77198F2C83

SHA256:

C2FEDC711BE112AF8640E08C8582CFAB105BF074642851674190ACED01E49918

SSDEEP:

3:N8X/iuyK6esEaGhgj:26EXa/j

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • GoogleUpdate.exe (PID: 992)
      • GoogleUpdateSetup.exe (PID: 2204)
      • ChromeSetup.exe (PID: 656)
      • GoogleUpdate.exe (PID: 2444)

    • Loads dropped or rewritten executable

      • GoogleUpdate.exe (PID: 992)
      • GoogleUpdate.exe (PID: 2444)
      • GoogleUpdate.exe (PID: 1416)
      • GoogleUpdate.exe (PID: 2216)
      • GoogleUpdate.exe (PID: 3220)
      • GoogleUpdate.exe (PID: 2868)
      • GoogleUpdate.exe (PID: 1964)
      • GoogleUpdate.exe (PID: 868)

    • Loads the Task Scheduler COM API

      • GoogleUpdate.exe (PID: 2444)

    • Changes settings of System certificates

      • GoogleUpdate.exe (PID: 2868)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2464)
      • iexplore.exe (PID: 2552)
      • ChromeSetup.exe (PID: 656)
      • GoogleUpdateSetup.exe (PID: 2204)
      • GoogleUpdate.exe (PID: 2444)

    • Creates files in the program directory

      • GoogleUpdate.exe (PID: 2444)
      • GoogleUpdateSetup.exe (PID: 2204)

    • Disables SEHOP

      • GoogleUpdate.exe (PID: 2444)

    • Creates COM task schedule object

      • GoogleUpdate.exe (PID: 2216)

    • Executed as Windows Service

      • GoogleUpdate.exe (PID: 868)

    • Adds / modifies Windows certificates

      • GoogleUpdate.exe (PID: 2868)

    • Application launched itself

      • GoogleUpdate.exe (PID: 868)

    • Executed via COM

      • DllHost.exe (PID: 2728)

  • INFO

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1496)
      • iexplore.exe (PID: 2464)
      • iexplore.exe (PID: 2552)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2464)
      • iexplore.exe (PID: 1496)
      • iexplore.exe (PID: 2552)

    • Changes internet zones settings

      • iexplore.exe (PID: 2464)

    • Application launched itself

      • iexplore.exe (PID: 2464)
      • chrome.exe (PID: 3912)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1496)
      • iexplore.exe (PID: 2552)

    • Creates files in the user directory

      • iexplore.exe (PID: 2552)
      • iexplore.exe (PID: 2464)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2464)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2464)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2464)

    • Manual execution by user

      • chrome.exe (PID: 3912)

    • Reads the hosts file

      • chrome.exe (PID: 3912)
      • chrome.exe (PID: 272)

    • Modifies the open verb of a shell class

      • chrome.exe (PID: 3912)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
71
Monitored processes
30
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start iexplore.exe iexplore.exe iexplore.exe chromesetup.exe googleupdate.exe no specs googleupdatesetup.exe googleupdate.exe googleupdate.exe no specs googleupdate.exe no specs googleupdate.exe googleupdate.exe no specs googleupdate.exe googleupdate.exe PhotoViewer.dll no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2464"C:\Program Files\Internet Explorer\iexplore.exe" https://mega.nz/folder/mHJWzZDS#o0yOModu4PuRUjXDvUTOHAC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
1496"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2464 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2552"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2464 CREDAT:791814 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
656"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\ChromeSetup.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\ChromeSetup.exe
iexplore.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Update Setup
Exit code:
2147747856
Version:
1.3.36.32
992C:\Users\admin\AppData\Local\Temp\GUM9497.tmp\GoogleUpdate.exe /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={2145529A-CD46-93C8-954D-0D1482C70233}&lang=en&browser=2&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=stable-arch_x86-statsdef_1&installdataindex=defaultbrowser"C:\Users\admin\AppData\Local\Temp\GUM9497.tmp\GoogleUpdate.exe—ChromeSetup.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Installer
Exit code:
2147747856
Version:
1.3.36.31
2204"C:\Users\admin\AppData\Local\Temp\GUM9497.tmp\GoogleUpdateSetup.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={2145529A-CD46-93C8-954D-0D1482C70233}&lang=en&browser=2&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=stable-arch_x86-statsdef_1&installdataindex=defaultbrowser" /installelevated /nomitagC:\Users\admin\AppData\Local\Temp\GUM9497.tmp\GoogleUpdateSetup.exe
GoogleUpdate.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Update Setup
Exit code:
2147747856
Version:
1.3.36.32
2444"C:\Program Files\Google\Temp\GUM9D23.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={2145529A-CD46-93C8-954D-0D1482C70233}&lang=en&browser=2&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=stable-arch_x86-statsdef_1&installdataindex=defaultbrowser" /installelevatedC:\Program Files\Google\Temp\GUM9D23.tmp\GoogleUpdate.exe
GoogleUpdateSetup.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Installer
Exit code:
2147747856
Version:
1.3.36.31
1416"C:\Program Files\Google\Update\GoogleUpdate.exe" /regsvcC:\Program Files\Google\Update\GoogleUpdate.exe—GoogleUpdate.exe
User:
admin
Company:
Google Inc.
Integrity Level:
HIGH
Description:
Google Installer
Exit code:
0
Version:
1.3.33.23
2216"C:\Program Files\Google\Update\GoogleUpdate.exe" /regserverC:\Program Files\Google\Update\GoogleUpdate.exe—GoogleUpdate.exe
User:
admin
Company:
Google Inc.
Integrity Level:
HIGH
Description:
Google Installer
Exit code:
0
Version:
1.3.33.23
2868"C:\Program Files\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zMiIgc2hlbGxfdmVyc2lvbj0iMS4zLjMzLjIzIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0UzREM1RkJCLUJFRkQtNDU1RS1CNDc0LTBDMEZENEQzQjVEQ30iIHVzZXJpZD0iezRBQjYyMTFDLTU2MTUtNDMwNC1BMkMyLUNGRTIxRTIzMzY0NX0iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9IntBOTUyRkVFNC0xMEJFLTQ1MjAtOTVEQy1CMzQ3RTNCM0RFMUJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjMiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjYuMS43NjAxLjAiIHNwPSJTZXJ2aWNlIFBhY2sgMSIgYXJjaD0ieDg2Ii8-PGFwcCBhcHBpZD0iezQzMEZENEQwLUI3MjktNEY2MS1BQTM0LTkxNTI2NDgxNzk5RH0iIHZlcnNpb249IjEuMy4zNC4xMSIgbmV4dHZlcnNpb249IjEuMy4zNi4zMiIgbGFuZz0iZW4iIGJyYW5kPSIiIGNsaWVudD0iIiBpaWQ9InsyMTQ1NTI5QS1DRDQ2LTkzQzgtOTU0RC0wRDE0ODJDNzAyMzN9Ij48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBpbnN0YWxsX3RpbWVfbXM9IjI3MTQiLz48L2FwcD48L3JlcXVlc3Q-C:\Program Files\Google\Update\GoogleUpdate.exe
GoogleUpdate.exe
User:
admin
Company:
Google Inc.
Integrity Level:
HIGH
Description:
Google Installer
Exit code:
0
Version:
1.3.33.23
Total events
3 611
Read events
2 394
Write events
0
Delete events
0

Modification events

No data
Executable files
210
Suspicious files
110
Text files
157
Unknown types
41

Dropped files

PID
Process
Filename
Type
1496iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab4ADC.tmp —
MD5:—
SHA256:—
1496iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar4ADD.tmp —
MD5:—
SHA256:—
2464iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2464iexplore.exeC:\Users\admin\AppData\Local\Temp\Cab5F10.tmp —
MD5:—
SHA256:—
2464iexplore.exeC:\Users\admin\AppData\Local\Temp\Tar5F11.tmp —
MD5:—
SHA256:—
1496iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\update[1].htmhtml
MD5:28807BED946D668B0DB4D8CEBC754F25
SHA256:A786A3C67D3299276776DC8CC9C843807F2262AE52C9E6759BC50A92B10A981C
1496iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08binary
MD5:45DD00E49D9824931E36390D7120D636
SHA256:F1000435D2B8C0FA4388A5E5C1EA8A8FD49532D140403BF5D767ABEA537D6ACD
1496iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\update[1].jstext
MD5:242C4F8C2F770CE402BE2DFDA199BA3B
SHA256:A027830C1888633E3D2EB67E01D2104F4A4F0F8C9ACE24D4F2FF640A7551609F
1496iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77der
MD5:CFA6069A1576C5F45BE15EDF97174304
SHA256:37A0734A945882B4BC10DE0BCB3C87CDE3084C739395417D2BAFD3B49D32E44A
1496iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\FVP1WNPK\mega[1].xmltext
MD5:660DE47710A1FD340C3CDDCF6F74B8E1
SHA256:65069284CBF68495E2B1E3054D8681F4CA3C220552DD7B54DA8E53D41033F399
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
31
TCP/UDP connections
106
DNS requests
46
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2552
iexplore.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCYiHlVi1YSqAgAAAAAWy82
US
der
472 b
whitelisted
2552
iexplore.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCYiHlVi1YSqAgAAAAAWy82
US
der
472 b
whitelisted
1496
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQLqIKj6Gi5thHaqKC1ECU9aXsCRQQUmvMr2s%2BtT7YvuypISCoStxtCwSQCEFqIMDLoe3Fk8%2BTO2VcKXOA%3D
US
der
471 b
whitelisted
1496
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D
US
der
727 b
whitelisted
2552
iexplore.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
1496
iexplore.exe
GET
200
2.16.177.210:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
unknown
der
1.37 Kb
whitelisted
2552
iexplore.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEB3oRgfjsJWUCAAAAABbLrQ%3D
US
der
471 b
whitelisted
2552
iexplore.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQD6dnW313dJuggAAAAAXcH8
US
der
472 b
whitelisted
2552
iexplore.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQD6dnW313dJuggAAAAAXcH8
US
der
472 b
whitelisted
2552
iexplore.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEB3oRgfjsJWUCAAAAABbLrQ%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1496
iexplore.exe
151.139.128.14:80
ocsp.comodoca.com
Highwinds Network Group, Inc.
US
suspicious
1496
iexplore.exe
66.203.124.37:443
eu.static.mega.co.nz
RealNetworks, Inc.
US
suspicious
2464
iexplore.exe
13.107.21.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
1496
iexplore.exe
89.44.169.135:443
mega.nz
Datacenter Luxembourg S.A.
LU
suspicious
2464
iexplore.exe
89.44.169.135:443
mega.nz
Datacenter Luxembourg S.A.
LU
suspicious
1496
iexplore.exe
2.16.177.210:80
isrg.trustid.ocsp.identrust.com
Akamai International B.V.
—
unknown
1496
iexplore.exe
2.16.177.160:80
ocsp.int-x3.letsencrypt.org
Akamai International B.V.
—
unknown
2552
iexplore.exe
172.217.21.196:443
www.google.com
Google Inc.
US
whitelisted
2552
iexplore.exe
172.217.16.170:443
fonts.googleapis.com
Google Inc.
US
whitelisted
2552
iexplore.exe
216.58.207.78:443
www.google-analytics.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
mega.nz
  • 89.44.169.135
whitelisted
isrg.trustid.ocsp.identrust.com
  • 2.16.177.210
  • 2.16.177.195
whitelisted
ocsp.int-x3.letsencrypt.org
  • 2.16.177.160
  • 2.16.177.138
whitelisted
eu.static.mega.co.nz
  • 66.203.124.37
  • 89.44.169.134
  • 89.44.169.132
  • 66.203.127.11
  • 66.203.127.13
shared
ocsp.comodoca.com
  • 151.139.128.14
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.google.com
  • 172.217.21.196
  • 216.58.212.132
whitelisted
ocsp.pki.goog
  • 172.217.18.99
whitelisted
www.gstatic.com
  • 216.58.212.131
  • 216.58.208.35
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://mega.nz/folder/mHJWzZDS#o0yOModu4PuRUjXDvUTOHA