Malware analysis url Malicious activity | ANY.RUN

Add for printing

download:	url
Full analysis:	https://app.any.run/tasks/8a72461b-e8a1-4364-9536-c694b9f43e6d
Verdict:	Malicious activity
Analysis date:	March 14, 2019, 10:39:19
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME:	text/html
File info:	HTML document, ASCII text, with very long lines, with no line terminators
MD5:	736FAB892C3F3738906CA5184CFD31B1
SHA1:	0A8A88426E0C85C913D6B7A46886DCA4254939D3
SHA256:	D12AD2E8E6A645CC6B4293D8BB4D95B80BDDFAFA93B02BA50834BFE94B5EB37C
SSDEEP:	24:cMDy8RRva1uFVuRRRvsXZRRYHWtRRv0RRvdkRRvOzwx6eUM5qzvKm9e8cH/fhKj4:cH8IGVuRwJ2WtoBkYwx6e/5qjfe5/ZKU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (68.0.3440.106)
Google Update Helper (1.3.33.17)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
Mozilla Firefox 61.0.2 (x86 en-US) (61.0.2)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
No suspicious indicators.
INFO
- Changes internet zones settings
  - iexplore.exe (PID: 3492)
- Reads internet explorer settings
  - iexplore.exe (PID: 3876)
  - iexplore.exe (PID: 3324)
- Application launched itself
  - iexplore.exe (PID: 3492)
- Reads Internet Cache Settings
  - iexplore.exe (PID: 3324)
- Creates files in the user directory
  - iexplore.exe (PID: 3324)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.html	\|	HyperText Markup Language (100)

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

3492

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\url.html

C:\Program Files\Internet Explorer\iexplore.exe

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Internet Explorer

Version:

8.00.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

3876

"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3492 CREDAT:79873

C:\Program Files\Internet Explorer\iexplore.exe

—

iexplore.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Internet Explorer

Version:

8.00.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

3324

"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3492 CREDAT:137473

C:\Program Files\Internet Explorer\iexplore.exe

iexplore.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Internet Explorer

Version:

8.00.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

Add for printing

Total events

581

Read events

497

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
3492	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\favicon[1].ico		—
		MD5:—	SHA256:—
3492	iexplore.exe	C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico		—
		MD5:—	SHA256:—
3492	iexplore.exe	C:\Users\admin\AppData\Local\Temp\~DF84B8FF531829C40B.TMP		—
		MD5:—	SHA256:—
3324	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\saudi-investments-in-india-threatens-nigerias-oil-export[1].txt		—
		MD5:—	SHA256:—
3324	iexplore.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@venturesafrica[1].txt		—
		MD5:—	SHA256:—
3876	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019031420190315\index.dat		dat
		MD5:362BC6949072B06F94D479D7BD82BFF5	SHA256:6A0A264C0EF1CAA517F44F74C5FFAAB6B841C18FE43C5459C4C0D9DC74F6C59B
3324	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\saudi-investments-in-india-threatens-nigerias-oil-export[1].htm		html
		MD5:D3DDF38E38A1339AFF1D0D0234A2917A	SHA256:025C346AE3A129CF870C0CDC2BD8206A008748BC496A11F215D7BABBB29101BB
3324	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\magnifier[1].png		image
		MD5:C24117D5004BD57A55D215F92D45354D	SHA256:D40F055A187BD694FC968CF1873C26CFFD3E8414E42DD307715B2A5E85F445DF
3492	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{8A387D6A-4646-11E9-BEEC-5254004A04AF}.dat		binary
		MD5:873B94FF85C1485852B1EB703D186A86	SHA256:665B924D5AD4F84B9CB12FFA838E3337128F1217D35D11780D194D542837021C
3324	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\tablets[1].css		text
		MD5:7CCCA4BECC81812F99547C47E13665E5	SHA256:B748F558C0189248C1E77BA5425BBA3D664C7B579D36568E574F7F4482B0A96A

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
3324	iexplore.exe	GET	200	198.89.125.18:80	http://venturesafrica.com/wp-content/themes/ventures/css/fonts/2DEC85_0_0.eot?	US	eot	66.6 Kb	unknown
3324	iexplore.exe	GET	200	198.89.125.18:80	http://venturesafrica.com/wp-content/themes/ventures/css/desktop.css?ver=4.3.5	US	text	1.13 Kb	unknown
3324	iexplore.exe	GET	302	18.211.9.206:80	http://cdn.mobiopush.com/mobiojs/c6dae0fd065e61af54ce33aaa5ee6c85	US	html	185 b	shared
3324	iexplore.exe	GET	200	198.89.125.18:80	http://venturesafrica.com/wp-content/themes/ventures/css/tablets.css?ver=4.3.5	US	text	6.11 Kb	unknown
3324	iexplore.exe	GET	200	198.89.125.18:80	http://venturesafrica.com/wp-content/uploads/2015/05/INNOVATION_2500-320x201.jpg	US	image	22.8 Kb	unknown
3324	iexplore.exe	GET	200	198.89.125.18:80	http://venturesafrica.com/wp-content/themes/ventures/img/magnifier.png	US	image	824 b	unknown
3324	iexplore.exe	GET	200	198.89.125.18:80	http://venturesafrica.com/wp-content/themes/ventures/img/play-circle.svg	US	image	536 b	unknown
3324	iexplore.exe	GET	200	198.89.125.18:80	http://venturesafrica.com/wp-content/uploads/2015/05/Attachment-1-320x213.jpeg	US	image	28.2 Kb	unknown
3324	iexplore.exe	GET	200	198.89.125.18:80	http://venturesafrica.com/wp-content/themes/ventures/img/neuter.svg	US	image	1.56 Kb	unknown
3324	iexplore.exe	GET	200	198.89.125.18:80	http://venturesafrica.com/wp-includes/js/jquery/jquery.js?ver=1.12.4	US	text	33.4 Kb	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
3492	iexplore.exe	204.79.197.200:80	www.bing.com	Microsoft Corporation	US	whitelisted
3324	iexplore.exe	104.25.38.108:443	www.hugedomains.com	Cloudflare Inc	US	shared
3324	iexplore.exe	18.211.9.206:80	cdn.mobiopush.com	—	US	shared
3324	iexplore.exe	198.89.125.18:80	venturesafrica.com	Colo4, LLC	US	unknown
3324	iexplore.exe	13.32.217.234:80	hello.myfonts.net	Amazon.com, Inc.	US	unknown
3324	iexplore.exe	184.31.90.11:443	cloud.typography.com	Akamai International B.V.	NL	whitelisted
3324	iexplore.exe	52.94.234.174:80	cloudfront-labs.amazonaws.com	Amazon.com, Inc.	US	shared
3324	iexplore.exe	13.32.223.253:443	d31qbv1cthcecs.cloudfront.net	Amazon.com, Inc.	US	suspicious
3324	iexplore.exe	2.16.186.81:80	www.download.windowsupdate.com	Akamai International B.V.	—	whitelisted
3324	iexplore.exe	13.32.222.120:80	x.ss2.us	Amazon.com, Inc.	US	whitelisted

DNS requests

Domain	IP	Reputation
www.bing.com	204.79.197.200 13.107.21.200	whitelisted
venturesafrica.com	198.89.125.18	unknown
cloud.typography.com	184.31.90.11	whitelisted
cdn.mobiopush.com	18.211.9.206	shared
www.hugedomains.com	104.25.38.108 104.25.37.108	whitelisted
hello.myfonts.net	13.32.217.234	whitelisted
d31qbv1cthcecs.cloudfront.net	13.32.223.253 13.32.223.20 13.32.223.251 13.32.223.115	shared
cloudfront-labs.amazonaws.com	52.94.234.174	shared
certify.alexametrics.com	13.32.223.203 13.32.223.99 13.32.223.220 13.32.223.73	shared
a801a0ada3229c523c3d4d8628f6b36af.profile.gig51-c2.cloudfront.net	99.84.25.60 99.84.25.218 99.84.25.19 99.84.25.96	unknown

Threats

No threats detected

Add for printing

No debug info

General Info

url

736FAB892C3F3738906CA5184CFD31B1

0A8A88426E0C85C913D6B7A46886DCA4254939D3

D12AD2E8E6A645CC6B4293D8BB4D95B80BDDFAFA93B02BA50834BFE94B5EB37C

24:cMDy8RRva1uFVuRRRvsXZRRYHWtRRv0RRvdkRRvOzwx6eUM5qzvKm9e8cH/fhKj4:cH8IGVuRwJ2WtoBkYwx6e/5qjfe5/ZKU

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

INFO

Changes internet zones settings

Reads internet explorer settings

Application launched itself

Reads Internet Cache Settings

Creates files in the user directory

Malware configuration

Static information

TRiD

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings