analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| URL: | http://www.xsq.hk |
| Full analysis: | https://app.any.run/tasks/fab05f63-6082-4c1f-ad92-706b09589912 |
| Verdict: | Malicious activity |
| Analysis date: | November 15, 2018, 15:14:57 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | D519571FF073694974294B9128E6D81C |
| SHA1: | 61C213BEBF6542BE48BD668092A517A50AE4CC55 |
| SHA256: | CBDC315F6F9DB87CE7A65916E73E234F71F6CF39E1F1C1776BC66B40EA47C068 |
| SSDEEP: | 3:N1KJS4Zc:Cc4i |
MALICIOUS
No malicious indicators.SUSPICIOUS
Loads DLL from Mozilla Firefox
- plugin-container.exe (PID: 2944)
INFO
Changes internet zones settings
- iexplore.exe (PID: 2948)
Creates files in the user directory
- iexplore.exe (PID: 2948)
- iexplore.exe (PID: 3356)
- FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3532)
- firefox.exe (PID: 3036)
Reads CPU info
- firefox.exe (PID: 3036)
- firefox.exe (PID: 3976)
- firefox.exe (PID: 2784)
- firefox.exe (PID: 2708)
Application launched itself
- iexplore.exe (PID: 2948)
- firefox.exe (PID: 3036)
Reads internet explorer settings
- iexplore.exe (PID: 3356)
Reads Internet Cache Settings
- iexplore.exe (PID: 3356)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
42
Monitored processes
10
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2948 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 3356 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2948 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 3532 | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe | — | svchost.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Version: 26,0,0,131 | ||||
| 3036 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | explorer.exe | |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 61.0.2 | ||||
| 3976 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3036.0.1291526102\1429973268" -childID 1 -isForBrowser -prefsHandle 1336 -prefsLen 8309 -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3036 "\\.\pipe\gecko-crash-server-pipe.3036" 1480 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 61.0.2 | ||||
| 2784 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3036.6.1335973344\1076705481" -childID 2 -isForBrowser -prefsHandle 1876 -prefsLen 11442 -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3036 "\\.\pipe\gecko-crash-server-pipe.3036" 2416 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 61.0.2 | ||||
| 2708 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3036.12.320907438\2006789490" -childID 3 -isForBrowser -prefsHandle 3036 -prefsLen 11808 -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3036 "\\.\pipe\gecko-crash-server-pipe.3036" 3048 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | |
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 61.0.2 | ||||
| 2944 | "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel="3036.18.1556056397\56201188" "C:\Windows\system32\Macromed\Flash\NPSWF32_26_0_0_131.dll" -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" 308046B0AF4A39CB 3036 "\\.\pipe\gecko-crash-server-pipe.3036" 3420 plugin | C:\Program Files\Mozilla Firefox\plugin-container.exe | — | firefox.exe |
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Plugin Container for Firefox Version: 61.0.2 | ||||
| 4016 | "C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_26_0_0_131.exe" --proxy-stub-channel=Flash2944.677C0D30.23394 --host-broker-channel=Flash2944.677C0D30.4650 --host-pid=2944 --host-npapi-version=29 --plugin-path="C:\Windows\system32\Macromed\Flash\NPSWF32_26_0_0_131.dll" | C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_26_0_0_131.exe | — | plugin-container.exe |
User: admin Company: Adobe Systems, Inc. Integrity Level: MEDIUM Description: Adobe Flash Player 26.0 r0 Version: 26,0,0,131 | ||||
| 2460 | "C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_26_0_0_131.exe" --channel=4016.005EF6D8.1581542825 --proxy-stub-channel=Flash2944.677C0D30.23394 --plugin-path="C:\Windows\system32\Macromed\Flash\NPSWF32_26_0_0_131.dll" --host-npapi-version=29 --type=renderer | C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_26_0_0_131.exe | — | FlashPlayerPlugin_26_0_0_131.exe |
User: admin Company: Adobe Systems, Inc. Integrity Level: LOW Description: Adobe Flash Player 26.0 r0 Version: 26,0,0,131 | ||||
Total events
968
Read events
915
Write events
53
Delete events
0
Modification events
| (PID) Process: | (2948) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
| (PID) Process: | (2948) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2948) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (2948) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones |
| Operation: | write | Name: | SecuritySafe |
Value: 1 | |||
| (PID) Process: | (2948) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (2948) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2948) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active |
| Operation: | write | Name: | {3C0EF0DD-E8E9-11E8-A505-5254004AAD11} |
Value: 0 | |||
| (PID) Process: | (2948) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
| Operation: | write | Name: | Type |
Value: 4 | |||
| (PID) Process: | (2948) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
| Operation: | write | Name: | Count |
Value: 3 | |||
| (PID) Process: | (2948) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
| Operation: | write | Name: | Time |
Value: E2070B0004000F000F000F0008004700 | |||
Executable files
0
Suspicious files
76
Text files
47
Unknown types
53
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2948 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 2948 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 3532 | FlashUtil32_26_0_0_131_ActiveX.exe | C:\Users\admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx:Zone.Identifier | — | |
MD5:— | SHA256:— | |||
| 3532 | FlashUtil32_26_0_0_131_ActiveX.exe | C:\Users\admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx | — | |
MD5:— | SHA256:— | |||
| 3356 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\css[1].css | text | |
MD5:2A0256EE8672CD71D8C1226B20F1DD0D | SHA256:C23D2F4BB20E06F7B04BF0A1C2CFF71E75A8E14CFB9236F9FF07D2E93C061BEF | |||
| 3356 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\ad[1].js | html | |
MD5:8452ECDF5B69845DEC22B8F43B636DA0 | SHA256:26E761AEC4C46D035C71A8CF4818145D76FB37BFAACD6C6525268DE2E8E70BAA | |||
| 3532 | FlashUtil32_26_0_0_131_ActiveX.exe | C:\Users\admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol | sol | |
MD5:D349C1E97388B2CF0C25331195AC30E9 | SHA256:2330185ACAE43C25F06BFD3F084C0D66AFF7B9DD82948077706FA584DC5588C7 | |||
| 3356 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\xsq_hk[1].htm | html | |
MD5:43DB93E4618733CB2AD77E6FF95526E9 | SHA256:AE8BCA7FD99454CB1A64DFA1BBFBB74EB530046C30450B460131142C4E65A763 | |||
| 3532 | FlashUtil32_26_0_0_131_ActiveX.exe | C:\Users\admin\AppData\Roaming\Adobe\Flash Player\NativeCache\NativeCache.directory:Zone.Identifier | text | |
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B | SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913 | |||
| 2948 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[3].png | image | |
MD5:9FB559A691078558E77D6848202F6541 | SHA256:6D8A01DC7647BC218D003B58FE04049E24A9359900B7E0CEBAE76EDF85B8B914 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
57
TCP/UDP connections
40
DNS requests
79
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3356 | iexplore.exe | GET | 200 | 47.89.41.211:80 | http://www.xsq.hk/xiazai.jpg | HK | image | 40.8 Kb | suspicious |
3356 | iexplore.exe | GET | 200 | 47.89.41.211:80 | http://www.xsq.hk/jieda.jpg | HK | image | 18.3 Kb | suspicious |
3356 | iexplore.exe | GET | 200 | 47.89.41.211:80 | http://www.xsq.hk/qqkf/ServiceQQ.js | HK | html | 893 b | suspicious |
3356 | iexplore.exe | GET | 200 | 47.89.41.211:80 | http://www.xsq.hk/rjys.jpg | HK | image | 52.6 Kb | suspicious |
3356 | iexplore.exe | GET | 200 | 47.89.41.211:80 | http://www.xsq.hk/duibi.jpg | HK | image | 115 Kb | suspicious |
3356 | iexplore.exe | GET | 200 | 47.89.41.211:80 | http://www.xsq.hk/qqkf/images/service-open.png | HK | image | 5.17 Kb | suspicious |
3356 | iexplore.exe | GET | 200 | 47.89.41.211:80 | http://www.xsq.hk/qqkf/ad.js | HK | html | 1.13 Kb | suspicious |
3356 | iexplore.exe | GET | 200 | 47.89.41.211:80 | http://www.xsq.hk/j-2.jpg | HK | image | 30.3 Kb | suspicious |
3356 | iexplore.exe | GET | — | 121.11.0.233:80 | http://s13.cnzz.com/stat.php?id=5243224&web_id=5243224 | CN | — | — | suspicious |
3356 | iexplore.exe | GET | 200 | 47.89.41.211:80 | http://www.xsq.hk/qqkf/images/ad.swf | HK | swf | 11.2 Kb | suspicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3356 | iexplore.exe | 47.89.41.211:80 | www.xsq.hk | Alibaba (China) Technology Co., Ltd. | HK | suspicious |
2948 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3356 | iexplore.exe | 114.80.130.143:80 | player.56.com | China Telecom (Group) | CN | unknown |
3356 | iexplore.exe | 121.11.0.233:80 | s13.cnzz.com | No.31,Jin-rong Street | CN | unknown |
3356 | iexplore.exe | 175.100.207.206:80 | www.56.com | ISP | HK | malicious |
3036 | firefox.exe | 104.107.216.187:80 | detectportal.firefox.com | Akamai International B.V. | NL | whitelisted |
3036 | firefox.exe | 34.208.206.25:443 | search.services.mozilla.com | Amazon.com, Inc. | US | unknown |
3036 | firefox.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
3036 | firefox.exe | 52.37.207.140:443 | tiles.services.mozilla.com | Amazon.com, Inc. | US | unknown |
3036 | firefox.exe | 54.192.131.157:443 | snippets.cdn.mozilla.net | Amazon.com, Inc. | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.bing.com |
| whitelisted |
www.xsq.hk |
| suspicious |
s13.cnzz.com |
| suspicious |
player.56.com |
| unknown |
www.56.com |
| malicious |
detectportal.firefox.com |
| whitelisted |
a1089.dscd.akamai.net |
| whitelisted |
search.services.mozilla.com |
| whitelisted |
search.r53-2.services.mozilla.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3356 | iexplore.exe | Potential Corporate Privacy Violation | ET POLICY Outdated Flash Version M1 |