analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://thepiratebay.org/browse.php

Full analysis: https://app.any.run/tasks/811cb3fe-944d-4f29-aaee-1d709c5135df
Verdict: Malicious activity
Analysis date: August 18, 2021, 12:48:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

6B3467B7268780974A31CD9F5D37CC3C

SHA1:

32BFBB67E2F7A0DEC6B8F7882DD4FBC7B4892F39

SHA256:

D0A4B75DF6E8D02B528508496AAAA3C753B8261CED15C40383D99C170BB55A8C

SSDEEP:

3:N8FAV0MZKSWuVn:27sWCn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2012)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 2012)
      • iexplore.exe (PID: 496)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2012)
      • iexplore.exe (PID: 496)

    • Reads the computer name

      • iexplore.exe (PID: 496)
      • iexplore.exe (PID: 2012)

    • Changes internet zones settings

      • iexplore.exe (PID: 496)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 496)
      • iexplore.exe (PID: 2012)

    • Application launched itself

      • iexplore.exe (PID: 496)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2012)

    • Creates files in the user directory

      • iexplore.exe (PID: 2012)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
496"C:\Program Files\Internet Explorer\iexplore.exe" "https://thepiratebay.org/browse.php"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2012"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:496 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
14 060
Read events
13 911
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
20
Text files
48
Unknown types
17

Dropped files

PID
Process
Filename
Type
2012iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\browse[1].htmhtml
MD5:1076E95426F2126947FD2217ED2F8390
SHA256:5D574F479B7E2F185088681E3E270D2C000EE9AD70EAB85E53D281EAB00E4752
2012iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62binary
MD5:BAE45D6B9B8E7C7B61392C1233ACC3C8
SHA256:D4002F2E716A91159F3F4F07B4FACC435FD56752174DB50FA7343DC7F808545F
2012iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4binary
MD5:0259713ADFA2BBA31C555426994EE482
SHA256:8DC714472F453D8BA508E3FA9030C84EDB26A00B70E55EB95B92AC0ED357AFCD
2012iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\main[1].jshtml
MD5:F36455BB00E0F5BED12766391C570B5B
SHA256:FE9A1BAE2F18ED2697242DD5FCC345655B8F3773B3D36B5CFD10A6F865F13E19
2012iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751der
MD5:54E9306F95F32E50CCD58AF19753D929
SHA256:45F94DCEB18A8F738A26DA09CE4558995A4FE02B971882E8116FC9B59813BB72
2012iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4der
MD5:452010DF5190805ECCE2E9F404D43048
SHA256:B5A129DC56EA03AF0880964265B4537CF70FE00212AB46D2FFB0931434D3CC90
2012iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:0A1207E62AD04E2C8DCB9E800A718C94
SHA256:3BC756ACCF34415750CCB733E5A33EF644CDA61D9B8A943632F337D859B68C46
2012iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:8F37AC601B48978EABBD62C7E9E537A9
SHA256:EFE6F3E1AD57A052458AD998C4FE1FDC7943CAEB4A2EEC1ED12CBBDBC77EC7EF
2012iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62der
MD5:F4071DE88F72C3A232408940EE909DEF
SHA256:84753B8021473E8D9311E5260F891EA46339E0FD3A0A86EBE189485967EE086B
2012iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:B0AAE39B3F82372B8D105A08972173CC
SHA256:224DEEB06A14E2DC83AE42C78C1E984F6B532A49B50D17BBF76B2BCE9F741810
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
72
DNS requests
34
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
496
iexplore.exe
GET
304
205.185.216.42:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?161ece0b70517f48
US
—
—
whitelisted
2012
iexplore.exe
GET
200
13.225.84.13:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D
US
der
1.39 Kb
shared
2012
iexplore.exe
GET
200
13.225.84.49:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
2012
iexplore.exe
GET
200
23.45.105.185:80
http://x1.c.lencr.org/
NL
der
717 b
whitelisted
2012
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
496
iexplore.exe
GET
304
205.185.216.42:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8d52f63768919161
US
—
—
whitelisted
496
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2012
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRyyuDOSqb8BtprWZSAvBT9kFoYdwQU%2BftQxItnu2dk%2FoMhpqnOP1WEk5kCEQD6Ax%2Be57Z05w8gxQFVSLlJ
US
der
472 b
whitelisted
2012
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
2012
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEQCrtlwvlTWIWiXUsXkGJuoO
US
der
472 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2012
iexplore.exe
13.225.84.49:80
ocsp.rootg2.amazontrust.com
—
US
whitelisted
2012
iexplore.exe
2.16.186.27:80
crl.identrust.com
Akamai International B.V.
—
whitelisted
2012
iexplore.exe
205.185.216.42:443
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
—
—
205.185.216.42:443
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
—
—
172.67.223.70:443
torrindex.net
—
US
unknown
2012
iexplore.exe
13.225.84.209:443
d1f05vr3sjsuy7.cloudfront.net
—
US
suspicious
—
—
205.185.216.42:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
2012
iexplore.exe
109.206.162.83:443
ilyf4amifh.com
Serverel Inc.
NL
suspicious
2012
iexplore.exe
172.67.223.70:443
torrindex.net
—
US
unknown
2012
iexplore.exe
162.159.137.6:443
thepiratebay.org
Cloudflare Inc
—
malicious

DNS requests

Domain
IP
Reputation
thepiratebay.org
  • 162.159.137.6
  • 162.159.136.6
whitelisted
ctldl.windowsupdate.com
  • 205.185.216.42
  • 205.185.216.10
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
torrindex.net
  • 172.67.223.70
  • 104.21.94.121
suspicious
ilyf4amifh.com
  • 109.206.162.83
suspicious
d1f05vr3sjsuy7.cloudfront.net
  • 13.225.84.209
  • 13.225.84.61
  • 13.225.84.131
  • 13.225.84.154
whitelisted
a.exdynsrv.com
  • 205.185.216.42
  • 205.185.216.10
suspicious
crl.identrust.com
  • 2.16.186.27
  • 2.16.186.10
whitelisted
o.ss2.us
  • 13.225.84.66
  • 13.225.84.97
  • 13.225.84.68
  • 13.225.84.42
whitelisted
x1.c.lencr.org
  • 23.45.105.185
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://thepiratebay.org/browse.php