analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://expensicon.com/

Full analysis: https://app.any.run/tasks/d3c25c58-d399-4b2c-b943-69d5ca397fe0
Verdict: Malicious activity
Analysis date: October 04, 2022, 22:15:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

F7BE3B7488480382DF9C839B2F50F971

SHA1:

8EF0A028E47AAF89DFDE6D684922043323DEE748

SHA256:

C622324B550EFDC641B2FB83C5E0565A3F101DB632DBF2B9F93BE81D7752D600

SSDEEP:

3:N87BR:2D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 628)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 1292)

    • Changes internet zones settings

      • iexplore.exe (PID: 1292)

    • Checks supported languages

      • iexplore.exe (PID: 628)
      • iexplore.exe (PID: 1292)

    • Reads the computer name

      • iexplore.exe (PID: 1292)
      • iexplore.exe (PID: 628)

    • Reads internet explorer settings

      • iexplore.exe (PID: 628)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 1292)
      • iexplore.exe (PID: 628)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 628)
      • iexplore.exe (PID: 1292)

    • Creates files in the user directory

      • iexplore.exe (PID: 628)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1292)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1292)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1292"C:\Program Files\Internet Explorer\iexplore.exe" "https://expensicon.com/"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
628"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1292 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
20 750
Read events
20 626
Write events
122
Delete events
2

Modification events

(PID) Process:(1292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(1292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(1292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30988350
(PID) Process:(1292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(1292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30988350
(PID) Process:(1292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
17
Text files
35
Unknown types
16

Dropped files

PID
Process
Filename
Type
628iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab9F0F.tmpcompressed
MD5:D15AAA7C9BE910A9898260767E2490E1
SHA256:F8EBAAF487CBA0C81A17C8CD680BDD2DD8E90D2114ECC54844CFFC0CC647848E
628iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:D4BE667E417DC866CFF3AAA95778E8CC
SHA256:E024B3A9395DF97F7FF137A615465CC27368EEC3E2779FD7A932740F72D23393
628iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar9F10.tmpcat
MD5:C75C82DE5128C3E55D72A4FF9C73F5E4
SHA256:379E2F7218F036D70E2C474BF6A09364C5623C1C5F8D5A1A16F1B9B1EC243B55
628iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar9F12.tmpcat
MD5:C75C82DE5128C3E55D72A4FF9C73F5E4
SHA256:379E2F7218F036D70E2C474BF6A09364C5623C1C5F8D5A1A16F1B9B1EC243B55
628iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\GXV3ZNEX.htmhtml
MD5:AFCF4576712A85B7B92AB1142A51F413
SHA256:7D3B0D5430A9C8277DE86027BD1BDC18A0A534C6F81E8B825CF12C55FF6B9D7C
628iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\common-vendors-6f5bde26f95b0d6d5e036-min.en-US[1].jstext
MD5:707D5B449706D980BA2AC8D2AA374AF0
SHA256:7A24374DDA0E68073822682D992C34E0323557EF02848E6FB4226C36636F0CD5
628iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:9A13D251698E61F5B0CD2DFC3E89EF14
SHA256:F56F34648CE17ED1FD32818BBF7424148F0724677ABD93E6E29F8C32CF5DCC34
628iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\expensify-logo[1].svgimage
MD5:8FD60D4C273FA54402000DB63CA26FFF
SHA256:7B0F803FB83C02E8F3EF4FE4AE083B64AD5972ABEC3ABB27D4063D65FE2D3DFD
628iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab9F11.tmpcompressed
MD5:D15AAA7C9BE910A9898260767E2490E1
SHA256:F8EBAAF487CBA0C81A17C8CD680BDD2DD8E90D2114ECC54844CFFC0CC647848E
628iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\common-c7f07a66234b5236599b3-min.en-US[1].jsbinary
MD5:13741059FF26874E467DD30ED99E3CBA
SHA256:6A56A1A3F7F7C841F3E30CD4671051125F7191327ED2B5B5142E9DC04D9AD64D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
50
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
628
iexplore.exe
GET
200
13.107.4.50:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?324763103124cedb
US
compressed
4.70 Kb
whitelisted
628
iexplore.exe
GET
200
13.107.4.50:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?472ad9bca4dc9a86
US
compressed
60.9 Kb
whitelisted
628
iexplore.exe
GET
200
104.18.32.68:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
2.18 Kb
whitelisted
628
iexplore.exe
GET
200
13.107.4.50:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?2ad426d40445cd63
US
compressed
60.9 Kb
whitelisted
628
iexplore.exe
GET
200
96.16.145.230:80
http://x1.c.lencr.org/
US
der
717 b
whitelisted
628
iexplore.exe
GET
200
172.64.155.188:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
1.42 Kb
whitelisted
628
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
628
iexplore.exe
GET
200
104.18.32.68:80
http://crl.comodoca.com/AAACertificateServices.crl
US
der
506 b
whitelisted
1292
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
628
iexplore.exe
GET
200
13.107.4.50:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?39d2d4bbd71fb2f9
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
628
iexplore.exe
198.185.159.145:443
expensicon.com
SQUARESPACE
US
malicious
628
iexplore.exe
96.16.145.230:80
x1.c.lencr.org
AKAMAI-AS
DE
suspicious
628
iexplore.exe
23.205.251.248:443
assets.squarespace.com
AKAMAI-AS
DE
unknown
628
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
628
iexplore.exe
151.101.0.238:443
static1.squarespace.com
FASTLY
US
malicious
628
iexplore.exe
13.107.4.50:80
ctldl.windowsupdate.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
628
iexplore.exe
69.16.175.10:443
code.jquery.com
STACKPATH-CDN
US
malicious
1292
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
172.64.155.188:80
ocsp.comodoca.com
CLOUDFLARENET
US
suspicious
628
iexplore.exe
104.18.32.68:80
ocsp.comodoca.com
CLOUDFLARENET
—
suspicious

DNS requests

Domain
IP
Reputation
expensicon.com
  • 198.185.159.145
  • 198.49.23.144
  • 198.49.23.145
  • 198.185.159.144
malicious
ctldl.windowsupdate.com
  • 13.107.4.50
whitelisted
x1.c.lencr.org
  • 96.16.145.230
whitelisted
assets.squarespace.com
  • 23.205.251.248
whitelisted
static1.squarespace.com
  • 151.101.0.238
  • 151.101.64.238
  • 151.101.128.238
  • 151.101.192.238
whitelisted
code.jquery.com
  • 69.16.175.10
  • 69.16.175.42
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ocsp.comodoca.com
  • 104.18.32.68
  • 172.64.155.188
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://expensicon.com/