analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

sample.html.htm

Full analysis: https://app.any.run/tasks/3df757b4-0f29-457d-b7e6-938335ef62fa
Verdict: Malicious activity
Analysis date: August 12, 2022, 20:06:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/html
File info: HTML document, ASCII text, with very long lines, with CRLF line terminators
MD5:

0908C7F29E57FF82BBC541B130B68C76

SHA1:

E8A11DFC838CD556E094E3D4F9AAA6F986EA95EE

SHA256:

CCE1B81255E0144EC24640E199ECB13E6D7EF7C0AF686A49EB000ACAD8C52139

SSDEEP:

192:tA+hY4T/OxZ7VWgMLwAQxPKdvEFJwwwwbkAIxVNvsqECEPPPKFTdiG9QPL5HVV+x:PS4rOP7VjKelqzGHI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3408)
      • iexplore.exe (PID: 2044)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 2984)
      • iexplore.exe (PID: 3408)
      • iexplore.exe (PID: 2044)
      • iexplore.exe (PID: 2084)

    • Checks supported languages

      • iexplore.exe (PID: 2984)
      • iexplore.exe (PID: 2044)
      • iexplore.exe (PID: 3408)
      • iexplore.exe (PID: 2084)

    • Application launched itself

      • iexplore.exe (PID: 2984)
      • iexplore.exe (PID: 3408)

    • Changes internet zones settings

      • iexplore.exe (PID: 2984)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3408)
      • iexplore.exe (PID: 2044)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3408)
      • iexplore.exe (PID: 2044)
      • iexplore.exe (PID: 2984)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3408)
      • iexplore.exe (PID: 2044)
      • iexplore.exe (PID: 2984)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2044)
      • iexplore.exe (PID: 3408)
      • iexplore.exe (PID: 2984)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3408)
      • iexplore.exe (PID: 2984)
      • iexplore.exe (PID: 2044)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

EXIF

HTML

Robots: none
LocLC: en-US
ReqLC: 1033
SiteID: -
PageID: ConvergedSignIn
HTTPEquivXDnsPrefetchControl: on
Expires: -1
Pragma: no-cache
viewport: width=device-width, initial-scale=1.0, maximum-scale=2.0, user-scalable=yes
Title: Sign in to your account
ContentType: text/html; charset=UTF-8
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iexplore.exe iexplore.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2984"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\admin\AppData\Local\Temp\sample.html.htm"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3408"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2984 CREDAT:144385 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2044"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2984 CREDAT:144390 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2084"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2984 CREDAT:398593 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\version.dll
Total events
26 969
Read events
26 721
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
17
Text files
28
Unknown types
11

Dropped files

PID
Process
Filename
Type
3408iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:FC4A5A9D19C073BF2FCB2090CE0F8D1E
SHA256:33DEFDCBE87BC5E257D30F2FA45683F7898FF0FF1327D1E6753BD51A657A3DA2
3408iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_45E3C223BCF135987E4038FB6B0DBA13binary
MD5:474BFB72AC802C2304DB490870453E14
SHA256:9BDFBACAB44A389F43489B26817139EAEE85430040B0D0A8173D793ADED9BD56
3408iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_45E3C223BCF135987E4038FB6B0DBA13der
MD5:37D9737D87E736F32071BC84631A152D
SHA256:55961D82ABE79DE45FBDA7F4E7B4EC02F37A53D0617DF5A69C6FCC95D18C0258
2984iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:290A85BD3E7285CDEDA1602A9E12A7DF
SHA256:17AE86541BE373B2DB8A4B77D7E7626966637E5A6052F290A3B598A56F5123C9
3408iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:5E0AB6EFF4CD788EDEA1107E647FF5D1
SHA256:B6EBFCB066DD1A055E25E6BD6835EFD8A2E858246C9CAE2610168B13FC23DF36
2984iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:79AF60936F791F4CBDFCAEA95508A049
SHA256:82D70CE4D378A7B7EE8B022112698B2A67025EA0DC9345B588D89986B07AC877
2984iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:EE87BB11E233C12009CC11725035DBDC
SHA256:D82930A5B051B3C3F1639C24E83BDDF41D5AA66E467A0944D1AC3D59AE6330C5
3408iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_AD319D6DA1A11BC83AC8B4E4D3638231binary
MD5:F7F54ECFD72D54BA0C31A85DBCAA0D35
SHA256:C8B54E8293D5F2DBDBB4333A105BB7CCC4900DD1EA3BE92A3811958BBB047CA2
3408iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_AD319D6DA1A11BC83AC8B4E4D3638231der
MD5:ACD4DC3668A70FF7B1C46DFFFA5A516E
SHA256:29C73BA7FBE1FE66F967B8C2CFA5CC9CC8FB1E063461D968EC13FB04183A1949
3408iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:A5C8378D5CA4ED34D04987BB22A09D7E
SHA256:109D20BE2EC3096AA289F3FAD324E2091C15D7269665E041DFEBBAFB5F108EBF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
51
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2984
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3408
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
2984
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3408
iexplore.exe
GET
200
67.27.235.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?d02b06dc21238e47
US
compressed
60.2 Kb
whitelisted
3408
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIAjrICMzZli2TN25s%3D
US
der
724 b
whitelisted
3408
iexplore.exe
GET
200
8.253.95.121:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?8436e33ef87e3f06
US
compressed
60.2 Kb
whitelisted
3408
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA9bw6F2y3ieICDHiTyBZ7Q%3D
US
der
1.47 Kb
whitelisted
2984
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
der
471 b
whitelisted
3408
iexplore.exe
GET
200
67.27.235.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6eafe87802a5f092
US
compressed
4.70 Kb
whitelisted
3408
iexplore.exe
GET
200
8.253.95.121:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f8f76d34389e17f8
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2984
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2984
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3408
iexplore.exe
142.250.185.131:80
ocsp.pki.goog
Google Inc.
US
whitelisted
3408
iexplore.exe
67.27.235.126:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
3408
iexplore.exe
199.36.158.100:443
js-82wha8sw738.web.app
—
US
malicious
2044
iexplore.exe
67.27.235.126:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
3408
iexplore.exe
8.253.95.121:80
ctldl.windowsupdate.com
Global Crossing
US
suspicious
2044
iexplore.exe
199.36.158.100:443
js-82wha8sw738.web.app
—
US
malicious
2984
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3408
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
js-82wha8sw738.web.app
  • 199.36.158.100
suspicious
ctldl.windowsupdate.com
  • 67.27.235.126
  • 8.253.95.120
  • 67.26.139.254
  • 8.241.121.126
  • 8.253.204.249
  • 8.253.95.121
  • 67.27.157.126
  • 67.27.159.254
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.pki.goog
  • 142.250.185.131
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
aadcdn.msauth.net
  • 13.107.246.45
  • 13.107.213.45
whitelisted
career-cc.net
  • 183.90.232.64
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
sample.html.htm