analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

sample.html.htm

Full analysis: https://app.any.run/tasks/f2695686-2517-4582-bfc3-ee2a7d13ac56
Verdict: Malicious activity
Analysis date: August 12, 2022, 20:12:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/html
File info: HTML document, ASCII text, with very long lines, with CRLF line terminators
MD5:

0908C7F29E57FF82BBC541B130B68C76

SHA1:

E8A11DFC838CD556E094E3D4F9AAA6F986EA95EE

SHA256:

CCE1B81255E0144EC24640E199ECB13E6D7EF7C0AF686A49EB000ACAD8C52139

SSDEEP:

192:tA+hY4T/OxZ7VWgMLwAQxPKdvEFJwwwwbkAIxVNvsqECEPPPKFTdiG9QPL5HVV+x:PS4rOP7VjKelqzGHI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3036)
      • iexplore.exe (PID: 268)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 3036)
      • iexplore.exe (PID: 2380)
      • iexplore.exe (PID: 268)
      • iexplore.exe (PID: 1864)

    • Checks supported languages

      • iexplore.exe (PID: 2380)
      • iexplore.exe (PID: 3036)
      • iexplore.exe (PID: 268)
      • iexplore.exe (PID: 1864)

    • Changes internet zones settings

      • iexplore.exe (PID: 2380)

    • Application launched itself

      • iexplore.exe (PID: 2380)
      • iexplore.exe (PID: 268)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3036)
      • iexplore.exe (PID: 268)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 268)
      • iexplore.exe (PID: 2380)
      • iexplore.exe (PID: 3036)

    • Changes settings of System certificates

      • iexplore.exe (PID: 268)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 268)
      • iexplore.exe (PID: 2380)
      • iexplore.exe (PID: 3036)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

EXIF

HTML

Robots: none
LocLC: en-US
ReqLC: 1033
SiteID: -
PageID: ConvergedSignIn
HTTPEquivXDnsPrefetchControl: on
Expires: -1
Pragma: no-cache
viewport: width=device-width, initial-scale=1.0, maximum-scale=2.0, user-scalable=yes
Title: Sign in to your account
ContentType: text/html; charset=UTF-8
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
4
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iexplore.exe iexplore.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2380"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\admin\AppData\Local\Temp\sample.html.htm"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3036"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2380 CREDAT:144385 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
268"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2380 CREDAT:78857 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1864"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2380 CREDAT:398593 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
Total events
14 826
Read events
14 613
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
12
Text files
15
Unknown types
7

Dropped files

PID
Process
Filename
Type
268iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_45E3C223BCF135987E4038FB6B0DBA13binary
MD5:1B849382996EC4AA3D57D2D729EA953E
SHA256:0D902EFE4CA068D8C4CFA7A7E04BA31BFC468A543005F8AB07176F7FC833C382
268iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_45E3C223BCF135987E4038FB6B0DBA13der
MD5:37D9737D87E736F32071BC84631A152D
SHA256:55961D82ABE79DE45FBDA7F4E7B4EC02F37A53D0617DF5A69C6FCC95D18C0258
268iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_AD319D6DA1A11BC83AC8B4E4D3638231der
MD5:ACD4DC3668A70FF7B1C46DFFFA5A516E
SHA256:29C73BA7FBE1FE66F967B8C2CFA5CC9CC8FB1E063461D968EC13FB04183A1949
268iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:C557E379D1E71557E57E869D15DB9541
SHA256:356AEEEFA98BD8E59A52B36D9C5E6BA9B25DE4A05516D62BACB8AF8CCB8F7C2E
268iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_AD319D6DA1A11BC83AC8B4E4D3638231binary
MD5:B25EC24C2025BA75E02A629BA9FD5696
SHA256:FB4F55409E7AB4DB2F99627F4E02D2FC918FB055E0A7A23CEE327E96ED1AD5EA
268iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:093E7884B061B9EF29A71F02AAE0250C
SHA256:BC3F41A9101281AB29D06175EDD51C9251E24B09B6E3A36215E920D0170D6281
268iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\646C991C2A28825F3CC56E0A1D1E3FA9binary
MD5:8416F037D49A6765B36FD6E0CF4C24A8
SHA256:CD46E843FDE98CB0F69BB97003AB092E226C226F19E1FCB4C78E6EDC63AAC2F8
268iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\646C991C2A28825F3CC56E0A1D1E3FA9der
MD5:041486C633C4E159097998F1C4446A38
SHA256:643D2FE5AA60A2E688F4D81245C0A30D3F44208EFAA063BC9A714DF40E5339E6
268iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:290A85BD3E7285CDEDA1602A9E12A7DF
SHA256:17AE86541BE373B2DB8A4B77D7E7626966637E5A6052F290A3B598A56F5123C9
268iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:28F80483E0BCD1AF5B04D1D3722EF4C3
SHA256:CF03F81AE5FA46A1768B969486D0BDD06D027EAF76CB2BF0EF2CB8F18C945671
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
38
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
268
iexplore.exe
GET
200
142.250.185.131:80
http://crl.pki.goog/gsr1/gsr1.crl
US
der
1.70 Kb
whitelisted
268
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIAjrICMzZli2TN25s%3D
US
der
724 b
whitelisted
268
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA9bw6F2y3ieICDHiTyBZ7Q%3D
US
der
1.47 Kb
whitelisted
268
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?27024df8eed06227
US
compressed
60.2 Kb
whitelisted
268
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
268
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?9f9c2505406501b6
US
compressed
4.70 Kb
whitelisted
2380
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
268
iexplore.exe
GET
200
96.16.145.230:80
http://x1.c.lencr.org/
US
der
717 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
268
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
268
iexplore.exe
142.250.185.131:80
ocsp.pki.goog
Google Inc.
US
whitelisted
268
iexplore.exe
199.36.158.100:443
js-82wha8sw738.web.app
—
US
malicious
2380
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
268
iexplore.exe
13.107.246.45:443
aadcdn.msauth.net
Microsoft Corporation
US
suspicious
3036
iexplore.exe
199.36.158.100:443
js-82wha8sw738.web.app
—
US
malicious
268
iexplore.exe
152.199.23.37:443
aadcdn.msftauth.net
MCI Communications Services, Inc. d/b/a Verizon Business
US
suspicious
268
iexplore.exe
96.16.145.230:80
x1.c.lencr.org
Akamai Technologies, Inc.
US
suspicious
2380
iexplore.exe
152.199.19.161:443
r20swj13mr.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2380
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
js-82wha8sw738.web.app
  • 199.36.158.100
suspicious
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.pki.goog
  • 142.250.185.131
whitelisted
crl.pki.goog
  • 142.250.185.131
whitelisted
aadcdn.msauth.net
  • 13.107.246.45
  • 13.107.213.45
whitelisted
career-cc.net
  • 183.90.232.64
unknown
aadcdn.msftauth.net
  • 152.199.23.37
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
sample.html.htm