analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

file

Full analysis: https://app.any.run/tasks/5841adf8-752b-48ab-8614-98af6bf1ea61
Verdict: Malicious activity
Analysis date: September 30, 2020, 04:57:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/html
File info: HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
MD5:

1FF4738B61A63E5FDBB0C62E38CA255D

SHA1:

5E8FDEB78683E34504CF55C12771A52559A82BF7

SHA256:

CB93F9385BDFAC9C0125B40BD7BFA832119FD8ED1BE5397051CA45694EE34D5A

SSDEEP:

3072:J1igAkHnjkQ6KSwXNXL4oNF5bYZpHCXvkWvLgsKNkhILAU0OY3giLa:egAkHnjkQBSwXN7v98HiXvNgsUO3giLa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • chrome.exe (PID: 3052)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2536)
      • iexplore.exe (PID: 2132)
      • chrome.exe (PID: 3052)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1748)
      • iexplore.exe (PID: 2536)
      • iexplore.exe (PID: 2132)
      • chrome.exe (PID: 2940)

    • Application launched itself

      • iexplore.exe (PID: 2536)
      • iexplore.exe (PID: 1748)
      • chrome.exe (PID: 3052)

    • Changes internet zones settings

      • iexplore.exe (PID: 2536)

    • Creates files in the user directory

      • iexplore.exe (PID: 1748)
      • iexplore.exe (PID: 2536)
      • iexplore.exe (PID: 2132)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1748)
      • iexplore.exe (PID: 2536)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1748)
      • iexplore.exe (PID: 2536)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1748)
      • iexplore.exe (PID: 2132)

    • Manual execution by user

      • chrome.exe (PID: 3052)

    • Reads the hosts file

      • chrome.exe (PID: 3052)
      • chrome.exe (PID: 2940)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.htm/html | HyperText Markup Language with DOCTYPE (80.6)
.html | HyperText Markup Language (19.3)

EXIF

HTML

twitterDescription: -
twitterImage: https://static.mediafire.com/images/filetype/download/web.jpg
twitterTitle: ssfn_gfnRUN2
twitterUrl: http://www.mediafire.com/file/i0hl83myi4z7sdy/ssfn_gfnRUN2.bat/file
twitterSite: @MediaFire
twitterCard: summary_large_image
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
89
Monitored processes
49
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs cmd.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2536"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\file.htmC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
1748"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2536 CREDAT:144385 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2132"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2536 CREDAT:464129 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3052"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
1600"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6ee2a9d0,0x6ee2a9e0,0x6ee2a9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3120"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3012 --on-initialized-event-handle=324 --parent-handle=328 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3848"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1064,7454031971207988136,8046830832309247114,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=14758560586243509405 --mojo-platform-channel-handle=1048 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
2940"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1064,7454031971207988136,8046830832309247114,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=16697941774284776812 --mojo-platform-channel-handle=1652 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
780"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,7454031971207988136,8046830832309247114,131072 --enable-features=PasswordImport --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=18379148598696130475 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2252 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
3080"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,7454031971207988136,8046830832309247114,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=1036869478808658732 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2448 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
Total events
3 221
Read events
2 890
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
181
Text files
161
Unknown types
39

Dropped files

PID
Process
Filename
Type
2536iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
1748iexplore.exeC:\Users\admin\AppData\Local\Temp\CabC3FD.tmp —
MD5:—
SHA256:—
1748iexplore.exeC:\Users\admin\AppData\Local\Temp\TarC3FE.tmp —
MD5:—
SHA256:—
1748iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\ns[1].htm —
MD5:—
SHA256:—
1748iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288Bder
MD5:1C400D233070530C717A810D7F9BC99E
SHA256:58B407B0DDF17FBF78FCB2E2DAD4FABAADA9BD88641F19941480951A200AE4E0
1748iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\js[1].jstext
MD5:97285DB106FFF68BB03283ABAB92C952
SHA256:893C81648CC0285EDABA061819477CE5AEBBECB98794F18D72B355D6C0C812F5
1748iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_65D8C47CB675C70272C50C4C3BC2CC03der
MD5:2EA3F318E3D7F314082555D94031A14B
SHA256:5CDF5F5AF9951553EE5A018D8FAD9AA58C51749C21A512CAA97AAC779BB13891
1748iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\gtm[1].jstext
MD5:A2898C88C3ACF21ADCA42E4C25370359
SHA256:FB93000F3D07082CD8AF9336AD3F2D1092F514ADEC7BAEB77B36FA30D1754332
1748iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CC197601BE0898B7B0FCC91FA15D8A69_F77E93D3799E633E2032BE8305A3BF08binary
MD5:EDCF1EDC9D9485DE24C91A73B7D3BE8E
SHA256:05BA7136AE9E78218C79D6D817FE4D528BF2980AED15EBBF1FFF28B7C38625F6
1748iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288Bbinary
MD5:147D3BEC56ED0F39ECC7F5DE9460468B
SHA256:EE43F45950384F8408C0E420EA0E7838C6186CD7CC4A750B435D12CBD80E1DFD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
107
TCP/UDP connections
215
DNS requests
134
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1748
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
1748
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
1748
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEAesusUTtVSRAgAAAAB6SwU%3D
US
der
471 b
whitelisted
1748
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEAWRAacF5BksN9S2vaFyNWQ%3D
US
der
280 b
whitelisted
1748
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEAesusUTtVSRAgAAAAB6SwU%3D
US
der
471 b
whitelisted
1748
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEAWRAacF5BksN9S2vaFyNWQ%3D
US
der
280 b
whitelisted
1748
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDOs%2FDKHsIMiAIAAAAAeksR
US
der
472 b
whitelisted
1748
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDOs%2FDKHsIMiAIAAAAAeksR
US
der
472 b
whitelisted
1748
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEBN9U5yqfDGppDNwGWiEeo0%3D
US
der
727 b
whitelisted
1748
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEBN9U5yqfDGppDNwGWiEeo0%3D
US
der
727 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
172.217.18.174:445
translate.google.com
Google Inc.
US
whitelisted
1748
iexplore.exe
172.217.21.200:443
www.googletagmanager.com
Google Inc.
US
whitelisted
2536
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
1748
iexplore.exe
216.58.212.130:443
securepubads.g.doubleclick.net
Google Inc.
US
whitelisted
1748
iexplore.exe
172.217.18.174:443
translate.google.com
Google Inc.
US
whitelisted
1748
iexplore.exe
142.250.74.195:80
ocsp.pki.goog
Google Inc.
US
whitelisted
1748
iexplore.exe
104.111.245.249:443
c.aaxads.com
Akamai International B.V.
NL
whitelisted
4
System
172.217.18.174:139
translate.google.com
Google Inc.
US
whitelisted
1748
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1748
iexplore.exe
104.19.214.37:443
cdn.otnolatrnup.com
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
www.googletagmanager.com
  • 172.217.21.200
whitelisted
translate.google.com
  • 172.217.18.174
  • 34.98.64.218
  • 35.244.159.8
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.pki.goog
  • 142.250.74.195
whitelisted
fundingchoicesmessages.google.com
  • 172.217.18.174
whitelisted
securepubads.g.doubleclick.net
  • 216.58.212.130
whitelisted
c.aaxads.com
  • 104.111.245.249
whitelisted
cdn.otnolatrnup.com
  • 104.19.214.37
  • 104.19.215.37
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

PID
Process
Class
Message
2132
iexplore.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
2940
chrome.exe
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Response)
2940
chrome.exe
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Response)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Response)
2940
chrome.exe
A Network Trojan was detected
AV MALWARE Observed AuXML EK Redirect
2940
chrome.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
file