URL:

http://chrome.haifti.com

Full analysis: https://app.any.run/tasks/4387c5cd-dc20-493b-8d43-0d70aa1f3bbf
Verdict: Malicious activity
Analysis date: July 11, 2023, 01:00:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

7C21D23503B89E963B98C60A6DDB22B0

SHA1:

CC3615C8753FF9935CDE4760992FAE1BEF2B0784

SHA256:

C694EF9D19EF256B4E0D751D9D06237A2B2B059946E27AC5504D058352602D19

SSDEEP:

3:N1KdNXK9aCqLKn:CvK9a+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2548"C:\Program Files\Internet Explorer\iexplore.exe" "http://chrome.haifti.com"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2984"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2548 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
14 702
Read events
14 581
Write events
121
Delete events
0

Modification events

(PID) Process:(2548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
26
Text files
49
Unknown types
0

Dropped files

PID
Process
Filename
Type
2548iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:53B6CC2DAC71E482DDCE7015EB1F39AE
SHA256:13BCB84C80A94EC5CDB7AAB09395D05C8E872806C21B334939267CDEEE2C483E
2548iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:9864ECED5B98AE77A952E732840EB838
SHA256:ACD476B682C3D30B8CDF10BC3844C0AAD1E5E82FD79D0F70CDC5FE4B78F08F42
2984iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96Cbinary
MD5:BC93C0BD5A69FF485F84D8626882DBB4
SHA256:B7BBCD167FABAC1751A689C1880A505B6D3629433EC5E6D33C6317C68D421F53
2548iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:E0C8B027E7A2CEEDB8CD5729A8B3C0E7
SHA256:0CD801C38705AC8F8C3253CECD6C2FCAC70E68D3207B34374D47F2A1638D10EA
2984iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\alww[1].htmhtml
MD5:C872BBF1F563D3C3BB34CA1AE0276CE5
SHA256:9332CC7E5E547F285F9A43C800522AA99D2646972FDF7C21224FDAC2CB5B4F12
2984iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96Cbinary
MD5:AC9EFBECA7578CC70F0452F5E42D42F7
SHA256:1176D4CC9FF600FFD61E5D1B1C0829F102B9BE3A46E82BD9621BF959D34A7E54
2984iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A053CFB63FC8E6507871752236B5CCD5_3514B5AB133BD3CBCDE8073D08A60F15binary
MD5:9AB54FA260F9F5312CC56315C05103E7
SHA256:8B581414C32017EB67B5B5598DFD84BF1189EA028C575AAB8FF59B29F3A805AD
2548iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
2548iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
2984iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A053CFB63FC8E6507871752236B5CCD5_3514B5AB133BD3CBCDE8073D08A60F15binary
MD5:BB9C4FE3FBF12E018D38CE572700B147
SHA256:E2955B98AD7A311A51A5C3A9165AEBD9D36BC5BBC5E2DC28C3DDD4525E44032A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
52
DNS requests
31
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2984
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDApF3uCVWl8vRXf3Tg%3D%3D
US
der
1.42 Kb
whitelisted
2984
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/gsorganizationvalsha2g3/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSVLM6m9XSaK2pXyc357yFJVjgNwQQUaIa4fXrZbUlrhy8YixU0bNe0eg4CDGVJsoaQPJtGemBbhw%3D%3D
US
der
1.43 Kb
whitelisted
2984
iexplore.exe
GET
403
121.199.50.121:80
http://chrome.haifti.com/
CN
html
635 b
suspicious
2984
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCCwQAAAAAAURO8EJH
US
der
1.41 Kb
whitelisted
2984
iexplore.exe
GET
200
106.11.249.99:80
http://batit.aliyun.com/alww.html?id=00000000003614379673
CN
html
434 b
suspicious
2984
iexplore.exe
GET
200
95.140.236.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0fc55c9a1b3df56f
GB
compressed
4.70 Kb
whitelisted
2984
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDEcTfiQheoN0LZw7cg%3D%3D
US
binary
1.42 Kb
whitelisted
2984
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/ME8wTTBLMEkwRzAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDkcHsQGaDFetObPhfan5
US
binary
1.41 Kb
whitelisted
2548
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2984
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/gsorganizationvalsha2g3/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSVLM6m9XSaK2pXyc357yFJVjgNwQQUaIa4fXrZbUlrhy8YixU0bNe0eg4CDENMm82iF3g7S%2BUNmQ%3D%3D
US
binary
1.43 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1076
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2984
iexplore.exe
121.199.50.121:80
chrome.haifti.com
Hangzhou Alibaba Advertising Co.,Ltd.
CN
suspicious
2984
iexplore.exe
106.11.249.99:80
batit.aliyun.com
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
2984
iexplore.exe
47.88.198.69:443
www.aliyun.com
Alibaba US Technology Co., Ltd.
SG
unknown
—
—
239.255.255.250:1900
—
—
—
whitelisted
2548
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2984
iexplore.exe
95.140.236.128:80
ctldl.windowsupdate.com
LLNW
US
malicious
2548
iexplore.exe
95.140.236.128:80
ctldl.windowsupdate.com
LLNW
US
malicious

DNS requests

Domain
IP
Reputation
chrome.haifti.com
  • 121.199.50.121
suspicious
batit.aliyun.com
  • 106.11.249.99
suspicious
www.aliyun.com
  • 47.88.198.69
  • 47.88.251.189
  • 47.74.138.66
  • 47.88.128.4
  • 47.88.198.68
suspicious
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.145
  • 104.126.37.131
whitelisted
ctldl.windowsupdate.com
  • 95.140.236.0
  • 95.140.236.128
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
ocsp.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
ocsp2.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
cn.aliyun.com
  • 163.181.92.231
  • 163.181.92.225
  • 163.181.92.232
  • 163.181.92.227
  • 163.181.92.228
  • 163.181.92.230
  • 163.181.92.226
  • 163.181.92.229
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://chrome.haifti.com