analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://camservices.lt.acemlnc.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZ3d3cuY29nbml0b2Zvcm1zLmNvbSUyRlNBUmVjeWNsaW5nTExDJTJGXzIwMjJFbXBsb3llZUV2YWx1YXRpb25SZXBvcnQ=&sig=9TkdA8zq2NekAT4VXjmei23Kj8CJe4pkREjoGz1cucev&iat=1664900766&a=%7C%7C27821780%7C%7C&account=camservices%2Eactivehosted%2Ecom&email=TFCX2OAPjT%2F1xXdkZ1MlnoCTZvMIhDhAqtxiruTgG28%3D&s=825c42095abf396db9419084f1a6f1fb&i=15A35A5A55

Full analysis: https://app.any.run/tasks/39caf14a-5a27-4249-9235-b6d3688158e4
Verdict: Malicious activity
Analysis date: October 04, 2022, 22:45:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

07118EE81EBE446E0B1274EFDCFD8971

SHA1:

957688BA12D9364FF242714DF18DCE3E344614CD

SHA256:

D06F800A8FA89758051380FCA03475A342B3C99714B7A4580DD18FD44B2C1686

SSDEEP:

6:22wGjV6lA3WUHWLUJWdPCbBp5WH+Y9hZ1PHR8qQEr53wUmcL56GpSXtW9LOc4vVg:2Sn3WU2kW8Ps9hjv2qJhFtwdW9N4r8+A

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3640)
  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 3640)
      • iexplore.exe (PID: 3152)
    • Checks supported languages

      • iexplore.exe (PID: 3152)
      • iexplore.exe (PID: 3640)
    • Changes internet zones settings

      • iexplore.exe (PID: 3152)
    • Application launched itself

      • iexplore.exe (PID: 3152)
    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3640)
      • iexplore.exe (PID: 3152)
    • Reads settings of System Certificates

      • iexplore.exe (PID: 3152)
      • iexplore.exe (PID: 3640)
    • Reads internet explorer settings

      • iexplore.exe (PID: 3640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3152"C:\Program Files\Internet Explorer\iexplore.exe" "https://camservices.lt.acemlnc.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZ3d3cuY29nbml0b2Zvcm1zLmNvbSUyRlNBUmVjeWNsaW5nTExDJTJGXzIwMjJFbXBsb3llZUV2YWx1YXRpb25SZXBvcnQ=&sig=9TkdA8zq2NekAT4VXjmei23Kj8CJe4pkREjoGz1cucev&iat=1664900766&a=%7C%7C27821780%7C%7C&account=camservices%2Eactivehosted%2Ecom&email=TFCX2OAPjT%2F1xXdkZ1MlnoCTZvMIhDhAqtxiruTgG28%3D&s=825c42095abf396db9419084f1a6f1fb&i=15A35A5A55"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3640"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3152 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\iertutil.dll
Total events
12 617
Read events
12 506
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
13
Text files
15
Unknown types
8

Dropped files

PID
Process
Filename
Type
3640iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62binary
MD5:A8A2D3D16D1EFB9A90A5632A0CBB16F1
SHA256:7D09D08FD238B28B7FF61E1BA88129BC699C5ADF8D4A8FD25F7CCE7610396AA3
3640iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62der
MD5:EA255872E73FB697BC8D09DAB5BBF5D4
SHA256:B5AE1C08ACCCB952335F77ED4058FEE54D5F5929CCAC1612F41C5F064C21D51A
3640iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\_2022EmployeeEvaluationReport[1].htmhtml
MD5:6BF6AC786267F55DCBC1886CE42B9417
SHA256:3E747BED9A0D46D1924CCC6604D65AF8374C82CA94A352085C2711739E4E4D7C
3640iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771der
MD5:AA6C1B3D503B045E9918EAC50C2859E2
SHA256:73E09C0D82004EDBB527F9767BB02481AD1D2814E0B913229084F6A5DF775B06
3152iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442der
MD5:B8BDA0B382A7D056A4241B388338B778
SHA256:7BAA967F6686CCE471826B20FFA5CB7FEB4BF3C5C0BF43F51F08E84EB5850DD2
3152iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442binary
MD5:C488C9FB2C57B28C9DE374FD4C80EF83
SHA256:0E9D0FB9116971D3345D8B1D091FE60E52A6A15CECCB44521AB6E0D2D32BB222
3640iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4Fder
MD5:FCCDD7010386F27BC94A82BBA6081813
SHA256:D8B3AB356EBBA0C37A2A6ED07119C722EADCC78F5EB7B0938665F239F3243499
3640iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4Fbinary
MD5:B7FED081C848BAFFF787767F74BC0A2B
SHA256:388A8B2F9F8F164161A0ABA9958A2275949A1CA58E6B96ED08AF9577D3ECC697
3640iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894binary
MD5:83ABD1640B036F6CCDDFEF43D7AE155B
SHA256:C86B6B69187CD4BA171FF66D0409B8893DBDA63F3781EF981414419D8CAC6BE1
3640iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D6243C18F0F8F9AEC6638DD210F1984_287F6E329F386936235B5AE0B8860EC0der
MD5:C365BB477957FD6663D92EDDFB7A62EB
SHA256:AABCA7106B4AA4D9129C556C6E787D76F61F3A7FE49721935EBB71FFC515C654
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
27
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3640
iexplore.exe
GET
200
192.124.249.23:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
US
der
1.69 Kb
whitelisted
3640
iexplore.exe
GET
200
192.124.249.23:80
http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D
US
der
1.66 Kb
whitelisted
3640
iexplore.exe
GET
200
13.225.84.175:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D
US
der
1.39 Kb
shared
3640
iexplore.exe
GET
200
13.225.84.145:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
3640
iexplore.exe
GET
200
13.225.84.42:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
3152
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3640
iexplore.exe
GET
200
95.140.236.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5c16999ce9307de6
GB
compressed
4.70 Kb
whitelisted
3640
iexplore.exe
GET
200
95.140.236.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a1c973555dc92fea
GB
compressed
4.70 Kb
whitelisted
3640
iexplore.exe
GET
200
13.225.84.104:80
http://ocsp.sca1b.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEAeQxQ%2FcV2ujnVGETKlby%2B4%3D
US
der
471 b
whitelisted
3152
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3152
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
3152
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3640
iexplore.exe
192.124.249.23:80
ocsp.godaddy.com
SUCURI-SEC
US
suspicious
3640
iexplore.exe
13.225.84.175:80
ocsp.rootg2.amazontrust.com
AMAZON-02
US
whitelisted
3640
iexplore.exe
3.234.42.120:443
camservices.lt.acemlnc.com
AMAZON-AES
US
unknown
3640
iexplore.exe
13.225.84.145:80
ocsp.rootg2.amazontrust.com
AMAZON-02
US
whitelisted
3152
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
3640
iexplore.exe
13.107.246.44:443
static.cognitoforms.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
suspicious
3640
iexplore.exe
23.96.4.241:443
www.cognitoforms.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3640
iexplore.exe
13.225.84.104:80
ocsp.sca1b.amazontrust.com
AMAZON-02
US
whitelisted

DNS requests

Domain
IP
Reputation
camservices.lt.acemlnc.com
  • 3.234.42.120
  • 34.203.93.197
  • 3.215.241.232
unknown
ctldl.windowsupdate.com
  • 95.140.236.0
  • 178.79.242.0
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
o.ss2.us
  • 13.225.84.42
  • 13.225.84.68
  • 13.225.84.66
  • 13.225.84.97
whitelisted
ocsp.rootg2.amazontrust.com
  • 13.225.84.145
  • 13.225.84.49
  • 13.225.84.13
  • 13.225.84.175
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ocsp.rootca1.amazontrust.com
  • 13.225.84.175
  • 13.225.84.49
  • 13.225.84.13
  • 13.225.84.145
shared
ocsp.sca1b.amazontrust.com
  • 13.225.84.104
  • 13.225.84.88
  • 13.225.84.142
  • 13.225.84.107
whitelisted
www.cognitoforms.com
  • 23.96.4.241
suspicious

Threats

No threats detected
No debug info