analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://www.friendlyduck.com/AF_TA/rel/index.cfm?RST=UNF&TAD=435828&fn=Gu%C3%ADa+Conversaci%C3%B3n+Espa%C3%B1ol-Polaco+%28GU%C3%8DAS+DE+CONVERSACI%C3%93N%29

Full analysis: https://app.any.run/tasks/dd9321c4-c472-4f00-b621-4d9660272e04
Verdict: Malicious activity
Analysis date: October 16, 2019, 08:13:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
Indicators:
MD5:

DA178CF37D9E86562495B43A8A61B3AA

SHA1:

19A529E34CF33150F64BEFC684B0CEB017A2948F

SHA256:

C6699580BAD92E6E8E2DCE9B8C31717A6457CFBB8F2951C2139C51F0333B7B28

SSDEEP:

3:N1KJS4L9/w7KUAsKKB4yUaGPDblUzKUEnAXWvMAhCiAmzETHpwhs:Cc4Z/uAmfG7beZ1QgawTJwm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to CnC server

      • iexplore.exe (PID: 2848)

  • SUSPICIOUS

    • Executed via COM

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 784)

  • INFO

    • Changes settings of System certificates

      • iexplore.exe (PID: 2064)

    • Creates files in the user directory

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 784)
      • iexplore.exe (PID: 2064)
      • iexplore.exe (PID: 2848)

    • Changes internet zones settings

      • iexplore.exe (PID: 2064)

    • Application launched itself

      • iexplore.exe (PID: 2064)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2064)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2064)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2848)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2848)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
3
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2064"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2848"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2064 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
784C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Version:
26,0,0,131
Total events
504
Read events
413
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
56
Unknown types
15

Dropped files

PID
Process
Filename
Type
2064iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
2064iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2848iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt —
MD5:—
SHA256:—
2848iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\IHP21X5A\index[1].cfm —
MD5:—
SHA256:—
2848iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.datdat
MD5:931A900BB77898C801FB52B2C258AA37
SHA256:171BC451D0D742B3AA8EBA78F504AB57176EC92EC47BD5E00735D275907D80B1
2848iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\NFNEULGG\css[1].txttext
MD5:57A1996B99FBA1905B15391817BBE285
SHA256:4B8215F47CA864EF8AC25944CB6A6AF41DB8D3B5B5C3ACA3A4FCA72C59F54E62
2848iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\IHP21X5A\index[1].htmhtml
MD5:B16975436848E60C2AFC67B96E31DC7C
SHA256:6CC1312922D8A03180CD4818992B5DB04803ABAC56F5E94C204A9EE155CEA4B2
2848iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:BAD4DBE2A9F9A6AB330B0D00852BA86D
SHA256:31601A26367918231D1169BA5F549BE8071916BA6AF8179650FB7975F048F5E2
2848iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:5C9C7E8440FC2405B972C8E06FFC41BB
SHA256:9C6F40935424A347951545647E1BA5381A9BF06D9036878FB3F264DA85EF1EC0
2848iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@donkeyfun[1].txttext
MD5:04618EF11AD6CC8BC87E1C185683EB22
SHA256:C21E4F7645EB49AD5F453B2A37B430A4EC38214EB6C0D872024F61D02DD8C001
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
35
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2848
iexplore.exe
GET
302
104.27.152.42:80
http://www.donkeyfun.net/LP_TA/index.cfm?CTP=AF%5FTA%2CTSYqLzdTL1MtUFglIFEoJzUsT1QuM1otWiE6R0I%2BKlYlSCgyNEdMSTsmSz45MiheKE4gR0dGUTU4USs1SQpNSCktQ1IqUjI4LlxTTDBQNF9LOzJIWkAqLjs6IUc%2BLEpDOlg2QyhOI0lQVVBeSlY1XFBNTzdQV0EtOldMCk1dTEkmWFxFMEYtNyc6WFNYWFxUQVJPUyJUVkVTQklFMDRIKk4ySUs9VSAvJ11ePTZHJUomKC9bVlIwTioKJDNVQi9WUCAgCg%3D%3D&FN=Gu%C3%ADa%20Conversaci%C3%B3n%20Espa%C3%B1ol%2DPolaco%20%28GU%C3%8DAS%20DE%20CONVERSACI%C3%93N%29
US
—
—
suspicious
2848
iexplore.exe
GET
302
104.20.219.106:80
http://www.friendlyduck.com/AF_TA/rel/index.cfm?RST=UNF&TAD=435828&fn=Gu%C3%ADa+Conversaci%C3%B3n+Espa%C3%B1ol-Polaco+%28GU%C3%8DAS+DE+CONVERSACI%C3%93N%29
US
text
138 b
whitelisted
2064
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2848
iexplore.exe
216.58.205.227:443
fonts.gstatic.com
Google Inc.
US
whitelisted
2848
iexplore.exe
172.217.23.106:443
fonts.googleapis.com
Google Inc.
US
whitelisted
2848
iexplore.exe
104.20.220.106:80
www.friendlyduck.com
Cloudflare Inc
US
shared
2848
iexplore.exe
216.58.207.67:443
www.google.co.uk
Google Inc.
US
whitelisted
2848
iexplore.exe
104.20.81.179:443
www.usenet.nl
Cloudflare Inc
US
shared
2848
iexplore.exe
104.20.219.106:80
www.friendlyduck.com
Cloudflare Inc
US
shared
2848
iexplore.exe
64.233.184.154:443
stats.g.doubleclick.net
Google Inc.
US
whitelisted
2848
iexplore.exe
104.27.152.42:443
www.donkeyfun.net
Cloudflare Inc
US
shared
—
—
104.20.81.179:443
www.usenet.nl
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.friendlyduck.com
  • 104.20.220.106
  • 104.20.219.106
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared
www.donkeyfun.net
  • 104.27.152.42
  • 104.27.153.42
suspicious
fonts.googleapis.com
  • 172.217.23.106
whitelisted
fonts.gstatic.com
  • 216.58.205.227
whitelisted
stats.g.doubleclick.net
  • 64.233.184.154
  • 64.233.184.157
  • 64.233.184.156
  • 64.233.184.155
whitelisted
www.google.com
  • 172.217.18.164
whitelisted
www.google.co.uk
  • 216.58.207.67
whitelisted
www.usenet.nl
  • 104.20.81.179
  • 104.20.82.179
unknown

Threats

PID
Process
Class
Message
2848
iexplore.exe
Misc activity
ADWARE [PTsecurity] PUP Win32/InstallMonstr.QJ checkin
2848
iexplore.exe
Misc activity
ADWARE [PTsecurity] InstallMonstr
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://www.friendlyduck.com/AF_TA/rel/index.cfm?RST=UNF&TAD=435828&fn=Gu%C3%ADa+Conversaci%C3%B3n+Espa%C3%B1ol-Polaco+%28GU%C3%8DAS+DE+CONVERSACI%C3%93N%29