URL:

https://k-storage.com/krnl_console_bootstrapper.exe

Full analysis: https://app.any.run/tasks/315d61f4-0f5f-4c9e-b8b7-5abe56a1c94a
Verdict: Malicious activity
Analysis date: July 05, 2021, 20:36:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

F7CEBB00B0CDE2288CBF2276F0E8F803

SHA1:

CA6A985BD5620F87019C6C024FBC47C7C0D0072E

SHA256:

D1E54509F59C494355FCC5DB97C087C82D7AA6166BCC7A001D540D0B5FB1C1B2

SSDEEP:

3:N8EsXA3OXL0JNJPWXEw4A:2EsXDXbEw4A

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • krnl_console_bootstrapper.exe (PID: 2852)
      • krnlss.exe (PID: 2676)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3068)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 1860)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 1860)
      • iexplore.exe (PID: 2084)
      • krnl_console_bootstrapper.exe (PID: 2852)

    • Reads the computer name

      • krnl_console_bootstrapper.exe (PID: 2852)
      • krnlss.exe (PID: 2676)

    • Checks supported languages

      • krnl_console_bootstrapper.exe (PID: 2852)
      • krnlss.exe (PID: 2676)

    • Reads Environment values

      • krnl_console_bootstrapper.exe (PID: 2852)
      • krnlss.exe (PID: 2676)

    • Drops a file that was compiled in debug mode

      • krnl_console_bootstrapper.exe (PID: 2852)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 1860)
      • iexplore.exe (PID: 2084)
      • SearchProtocolHost.exe (PID: 3068)

    • Checks supported languages

      • iexplore.exe (PID: 1860)
      • iexplore.exe (PID: 2084)
      • SearchProtocolHost.exe (PID: 3068)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1860)
      • iexplore.exe (PID: 2084)
      • krnl_console_bootstrapper.exe (PID: 2852)

    • Changes internet zones settings

      • iexplore.exe (PID: 2084)

    • Application launched itself

      • iexplore.exe (PID: 2084)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 1860)
      • iexplore.exe (PID: 2084)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 2084)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1860)

    • Creates files in the user directory

      • iexplore.exe (PID: 2084)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2084)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2084)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2084)

    • Manual execution by user

      • krnlss.exe (PID: 2676)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start iexplore.exe iexplore.exe krnl_console_bootstrapper.exe searchprotocolhost.exe no specs krnlss.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2084"C:\Program Files\Internet Explorer\iexplore.exe" "https://k-storage.com/krnl_console_bootstrapper.exe"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1860"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2084 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2852"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\krnl_console_bootstrapper.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\krnl_console_bootstrapper.exe
iexplore.exe
User:
admin
Integrity Level:
MEDIUM
Description:
krnl_console_bootstrapper
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\krnl_console_bootstrapper.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3068"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2676"C:\Users\admin\Desktop\krnl\krnlss.exe" C:\Users\admin\Desktop\krnl\krnlss.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
krnlss
Exit code:
1
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\krnl\krnlss.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
14 274
Read events
14 122
Write events
150
Delete events
2

Modification events

(PID) Process:(2084) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2084) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2084) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30896605
(PID) Process:(2084) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(2084) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30896605
(PID) Process:(2084) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2084) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2084) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2084) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2084) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
7
Suspicious files
14
Text files
11
Unknown types
7

Dropped files

PID
Process
Filename
Type
2084iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:4F94395D18E1920FEFA958F5831A2166
SHA256:EFD3C799478F3E81335A0FF5142584702E87F42C7CFD75B8071ECDB1F77ABE97
1860iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:A892F6FE81586D82CDA0D88083CC70F7
SHA256:22D5061121DC4B71E9A7B4ECC75747B3A5B54B74D33A6E14DF67A58D2B1E1EDF
2084iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:F48BC372D552952C47F75184C96B626D
SHA256:3943E381A2BDAD6F3D892A82A0727C1B25233E9CFC251034BCA65B76862DBEE0
1860iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:F8EF3EEA4DCFFE1767D201FAC92B01E7
SHA256:ADEC2903209F7D5C4B99357F0B84FD47EB88958E61D22F72BE1DC3296E175616
2084iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:91D3D1885338BAC9694F0CF0F977AA81
SHA256:27F5ED885CEA343E3E27787039731777D00863289A7E607585856AF335805E0E
1860iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:718B5BD9BC615E096CCC42C0428542EE
SHA256:887D629E8220AEDA0DD303DDDDCE62753A454CF88A14E16F39A1AC156950003C
2084iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:13EF058A527A8B3D4724B9B8C6B35542
SHA256:DF0625AF16A71FBAEFF7BDB02586EA9D85CF73257F215A676B999346FF85FB90
2084iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{CA7CAA05-DDD0-11EB-97B3-12A9866C77DE}.datbinary
MD5:BBE659731A8141ADE0DAE1392E0328FD
SHA256:E717F7C38661431B133E245B05C4C4198414074186E82CAD77D8808980011103
1860iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\krnl_console_bootstrapper[1].exeexecutable
MD5:3403D958314AE95B23D0728686F2EC37
SHA256:9F17AF9928B7EEC725403496584621CADDA64B8133C151B44604A6D143FC226C
2084iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5MXDB0CZ3G0KVE94ZS7W.tempbinary
MD5:523AACF58A601C150259007FAE819133
SHA256:360C028477C67E160B236B8BDE5F591ECAA7A7FCF67FB5E00734CFE701662218
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
30
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1860
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
2084
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2084
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
2084
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
US
der
471 b
whitelisted
2084
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
1860
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f56e5a1990292d87
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2084
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2084
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
1860
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1860
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1860
iexplore.exe
172.67.208.22:443
k-storage.com
—
US
unknown
2084
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2084
iexplore.exe
204.79.197.203:443
www.msn.com
Microsoft Corporation
US
whitelisted
2084
iexplore.exe
13.107.21.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
1860
iexplore.exe
104.21.42.186:443
k-storage.com
Cloudflare Inc
US
unknown
2084
iexplore.exe
104.109.93.180:443
go.microsoft.com
Akamai International B.V.
NL
malicious

DNS requests

Domain
IP
Reputation
k-storage.com
  • 172.67.208.22
  • 104.21.42.186
malicious
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
go.microsoft.com
  • 104.109.93.180
whitelisted
www.msn.com
  • 204.79.197.203
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://k-storage.com/krnl_console_bootstrapper.exe