URL:

https://disk.yandex.ru/d/kBhePOoG3KeqrW

Full analysis: https://app.any.run/tasks/38522ee2-ebac-4c6c-8450-f6a7733ec143
Verdict: Malicious activity
Analysis date: July 11, 2021, 13:16:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

FA99C6E493A2E3EF2DD64948ECE88686

SHA1:

319F7A30511F6166D77C015B3A99C1974C098E6E

SHA256:

D27329EEB4CE78B05C3BD9C9CC70F3E464DF3EFF45D7A26EDA84D0163F089A00

SSDEEP:

3:N8U2fnePUin:2U2fGn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe (PID: 604)
      • 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe (PID: 3968)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 2396)
      • WinRAR.exe (PID: 3540)
      • 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe (PID: 3968)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 1660)
      • iexplore.exe (PID: 1832)

    • Reads the computer name

      • WinRAR.exe (PID: 2396)
      • WinRAR.exe (PID: 3540)
      • 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe (PID: 3968)

    • Application launched itself

      • WinRAR.exe (PID: 2396)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 3540)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3540)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 1832)
      • iexplore.exe (PID: 1660)

    • Reads the computer name

      • iexplore.exe (PID: 1832)
      • iexplore.exe (PID: 1660)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1660)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1832)
      • iexplore.exe (PID: 1660)

    • Creates files in the user directory

      • iexplore.exe (PID: 1832)

    • Manual execution by user

      • WinRAR.exe (PID: 2396)
      • 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe (PID: 3968)
      • 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe (PID: 604)

    • Changes internet zones settings

      • iexplore.exe (PID: 1660)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 1832)
      • iexplore.exe (PID: 1660)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1660)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1832)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 1660)

    • Application launched itself

      • iexplore.exe (PID: 1660)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
6
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe no specs winrar.exe 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe no specs 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe

Process information

PID
CMD
Path
Indicators
Parent process
1660"C:\Program Files\Internet Explorer\iexplore.exe" "https://disk.yandex.ru/d/kBhePOoG3KeqrW"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1832"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1660 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2396"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\Petya (?????? 2016123456000).rar"C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3540"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIb2396.25659\???? (??????12345).rar"C:\Program Files\WinRAR\WinRAR.exe
WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\comdlg32.dll
604"C:\Users\admin\Desktop\26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe" C:\Users\admin\Desktop\26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe
c:\windows\system32\ntdll.dll
3968"C:\Users\admin\Desktop\26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe" C:\Users\admin\Desktop\26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
15 679
Read events
15 505
Write events
170
Delete events
4

Modification events

(PID) Process:(1660) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(1660) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
12438704
(PID) Process:(1660) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30897751
(PID) Process:(1660) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
312440657
(PID) Process:(1660) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30897751
(PID) Process:(1660) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1660) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1660) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1660) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1660) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
1
Suspicious files
18
Text files
16
Unknown types
10

Dropped files

PID
Process
Filename
Type
1832iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1F4BA66CDBFEC85A20E11BF729AF23_AA85F8F9DAFF33153B5AEC2E983B94B6der
MD5:75B57B9B992C37D6BB3DFB1B21F8599C
SHA256:D0B0A57191657FB14D2A8A5833CC46140B04812A6E1C4B2A7BEA5B5373DAA6CF
1832iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E887E036775F4159E2816B7B9E527E5F_F3455D1DF1215B0D5EC783AC0152643Eder
MD5:8A3F53804722E416E23A142F8EAA6173
SHA256:FE1CCC2C5623B671F35E557FF8E192FE6410BD9488011BDBFD8FEB8ABEECC356
1832iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\S0MAWDM1.txttext
MD5:A471C75A3BF73824B8D2CFFCC883137B
SHA256:C1F1A989510269C21B2DC14F6545B3620C5F1F5D6474030E381C45CB186D8F39
1832iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\68FAF71AF355126BCA00CE2E73CC7374_77B682CF3AAC7B00161DFFF7DEA4CC8Cder
MD5:4472B9F948DA1764A569CBD29E0707A6
SHA256:411E9D4BC6D73D3D78C80C5F49223C990F01F0B7A4A764DBEF69162FCCFAADD1
1832iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E887E036775F4159E2816B7B9E527E5F_759E91EA549A31D17CF4D7FE309177F9der
MD5:AD0658CBAD943D0B32BA9AB3074FDE2C
SHA256:3D47FFEEA9483BF198AFF504E3E5548987CEB6F2457BCAC26332D9A8BC0B932C
1832iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E887E036775F4159E2816B7B9E527E5F_81A9EAEF491877F5AE96F9A03F4042E4der
MD5:4FC2D06F6DCBB84F47C265DD5BF4F516
SHA256:480EA09E66AC6C81D3344397AA86014CCA30BFDB330E56465A1F4D33E35227B7
1832iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\SL126R09.txttext
MD5:82456953F92BE1D64A92C53488B2521A
SHA256:F970BD0D4C589737DC92E9844DC26D355AE8E15587D5E7F10CCF5D3EAF6D04C1
1832iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\I8OZ9IXI.txttext
MD5:F40B894D4ED3EEBFE96FD4B0446951D2
SHA256:7A85EF2068D70BAFDC9DDF3B1AC15A99DC8304F1A44A4DB7456E0FAEB46F38FC
1832iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\watch[1].jstext
MD5:D3C08DDF7FD7D616E42E08BE73E16786
SHA256:21E27D3097ACACC2EC7AC4036CADDE17309E9F85D50D8A296105B2E066682BA3
1832iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\kBhePOoG3KeqrW[1].htmhtml
MD5:6098A24E2FB26FDE58F0EDADD1739AAC
SHA256:E137FA8566EB966B53BEEEAC069B6B88C17A6078855F6A68621EBA85A35DE988
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
21
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1832
iexplore.exe
GET
200
5.45.205.244:80
http://yandex.ocsp-responder.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEFjVURl8vAlh6dEYrJMUMng%3D
RU
der
1.48 Kb
whitelisted
1832
iexplore.exe
GET
200
5.45.205.244:80
http://yandex.ocsp-responder.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEFcAp3OG3HlvO0Q7Ft5KH%2F8%3D
RU
der
1.48 Kb
whitelisted
1832
iexplore.exe
GET
200
2.16.186.232:80
http://subca.ocsp-certum.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf%2FJPbFze27kLzihDdGdfcCEQDkBUeDDgxkUpdvejVJwN1I
unknown
der
1.63 Kb
whitelisted
1660
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
1832
iexplore.exe
GET
200
5.45.205.244:80
http://yandex.ocsp-responder.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEFZmQLn1X2nsT8%2FuNzo5n6w%3D
RU
der
1.48 Kb
whitelisted
1832
iexplore.exe
GET
200
5.45.205.244:80
http://yandex.ocsp-responder.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEFIn0TfHy7SBwk%2BiWUR4QnM%3D
RU
der
1.48 Kb
whitelisted
1832
iexplore.exe
GET
200
5.45.205.244:80
http://yandex.ocsp-responder.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEDbEISBuJVGq0KdX46enAhA%3D
RU
der
1.48 Kb
whitelisted
1660
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
1832
iexplore.exe
GET
200
2.16.186.232:80
http://subca.ocsp-certum.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR5iK7tYk9tqQEoeQhZNkKcAol9bgQUjEPEy22YwaechGnr30oNYJY6w%2FsCEQCTkoVAAWVxX5R%2FKI%2FvyZso
unknown
der
1.58 Kb
whitelisted
1832
iexplore.exe
GET
200
2.16.186.41:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a431d6cf719e59cf
unknown
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1832
iexplore.exe
2.16.186.232:80
subca.ocsp-certum.com
Akamai International B.V.
—
whitelisted
1832
iexplore.exe
2.16.186.41:80
ctldl.windowsupdate.com
Akamai International B.V.
—
whitelisted
1832
iexplore.exe
77.88.21.119:443
mc.yandex.ru
YANDEX LLC
RU
whitelisted
1832
iexplore.exe
77.88.21.127:443
downloader.disk.yandex.ru
YANDEX LLC
RU
unknown
1832
iexplore.exe
5.45.205.244:80
yandex.ocsp-responder.com
YANDEX LLC
RU
whitelisted
1660
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
1832
iexplore.exe
178.154.131.216:443
yastatic.net
YANDEX LLC
RU
whitelisted
—
—
77.88.21.119:443
mc.yandex.ru
YANDEX LLC
RU
whitelisted
1660
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1660
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
disk.yandex.ru
  • 87.250.250.50
shared
ctldl.windowsupdate.com
  • 2.16.186.41
  • 2.16.186.25
whitelisted
subca.ocsp-certum.com
  • 2.16.186.232
  • 2.16.186.163
whitelisted
yandex.ocsp-responder.com
  • 5.45.205.244
  • 5.45.205.243
  • 5.45.205.241
  • 5.45.205.245
  • 5.45.205.242
whitelisted
mc.yandex.ru
  • 77.88.21.119
  • 87.250.250.119
  • 87.250.251.119
  • 93.158.134.119
whitelisted
yastatic.net
  • 178.154.131.216
  • 178.154.131.215
  • 178.154.131.217
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
downloader.disk.yandex.ru
  • 77.88.21.127
shared
s474sas.storage.yandex.net
  • 213.180.206.192
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://disk.yandex.ru/d/kBhePOoG3KeqrW