URL:

https://us06web.zoom.us/j/84886807313?pwd=bF70nbxZomTQqyLsI4vXbGrzm5D8bp.1

Full analysis: https://app.any.run/tasks/95eec6c9-befb-4d75-b0bc-251533357849
Verdict: Malicious activity
Analysis date: February 16, 2024, 09:28:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

3C6F5B08D4CAFE06ED124184AEF3ADEB

SHA1:

81EC3AB87ABC63DC97D67FEB7A91D92B06A63C86

SHA256:

D2F0A5FC6F707D8A5508E2C51DBF797555D7C29DBDF807972A68CE6C109B4C5C

SSDEEP:

3:N8CAHVILQN+fT8k019Ccn:2CA19+78kwZn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Zoom_cm_fo42pnktZ9vvrZo4_mRrZby7nPrRoLQwQE80bzA7Uv8xaqoQLrxVib@td2wE6w8ftW+6hqg_kf878d3298088fb43_.exe (PID: 3392)
      • Installer.exe (PID: 2152)
      • Zoom.exe (PID: 2484)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Zoom_cm_fo42pnktZ9vvrZo4_mRrZby7nPrRoLQwQE80bzA7Uv8xaqoQLrxVib@td2wE6w8ftW+6hqg_kf878d3298088fb43_.exe (PID: 3392)
      • Installer.exe (PID: 2152)
      • Zoom.exe (PID: 2484)
      • Zoom.exe (PID: 924)

    • Reads security settings of Internet Explorer

      • Zoom_cm_fo42pnktZ9vvrZo4_mRrZby7nPrRoLQwQE80bzA7Uv8xaqoQLrxVib@td2wE6w8ftW+6hqg_kf878d3298088fb43_.exe (PID: 3392)
      • Installer.exe (PID: 2152)
      • Zoom.exe (PID: 2484)
      • Zoom.exe (PID: 924)
      • Zoom.exe (PID: 4092)

    • Reads settings of System Certificates

      • Zoom_cm_fo42pnktZ9vvrZo4_mRrZby7nPrRoLQwQE80bzA7Uv8xaqoQLrxVib@td2wE6w8ftW+6hqg_kf878d3298088fb43_.exe (PID: 3392)
      • Installer.exe (PID: 2152)
      • Zoom.exe (PID: 2484)
      • Zoom.exe (PID: 924)
      • Zoom.exe (PID: 4092)

    • Checks Windows Trust Settings

      • Zoom_cm_fo42pnktZ9vvrZo4_mRrZby7nPrRoLQwQE80bzA7Uv8xaqoQLrxVib@td2wE6w8ftW+6hqg_kf878d3298088fb43_.exe (PID: 3392)
      • Zoom.exe (PID: 2484)
      • Installer.exe (PID: 2152)
      • Zoom.exe (PID: 924)
      • Zoom.exe (PID: 4092)

    • Executable content was dropped or overwritten

      • Zoom_cm_fo42pnktZ9vvrZo4_mRrZby7nPrRoLQwQE80bzA7Uv8xaqoQLrxVib@td2wE6w8ftW+6hqg_kf878d3298088fb43_.exe (PID: 3392)
      • Installer.exe (PID: 2152)
      • Zoom.exe (PID: 2484)

    • Process drops legitimate windows executable

      • Installer.exe (PID: 2152)

    • Application launched itself

      • Installer.exe (PID: 2152)
      • Zoom.exe (PID: 2484)

    • The process drops C-runtime libraries

      • Installer.exe (PID: 2152)

    • The process creates files with name similar to system file names

      • Installer.exe (PID: 2152)

    • Starts itself from another location

      • Zoom_cm_fo42pnktZ9vvrZo4_mRrZby7nPrRoLQwQE80bzA7Uv8xaqoQLrxVib@td2wE6w8ftW+6hqg_kf878d3298088fb43_.exe (PID: 3392)

    • Starts application with an unusual extension

      • Zoom_cm_fo42pnktZ9vvrZo4_mRrZby7nPrRoLQwQE80bzA7Uv8xaqoQLrxVib@td2wE6w8ftW+6hqg_kf878d3298088fb43_.exe (PID: 3392)

    • Changes Internet Explorer settings (feature browser emulation)

      • Installer.exe (PID: 2152)

    • Creates a software uninstall entry

      • Installer.exe (PID: 2152)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3668)

    • Checks supported languages

      • Zoom_cm_fo42pnktZ9vvrZo4_mRrZby7nPrRoLQwQE80bzA7Uv8xaqoQLrxVib@td2wE6w8ftW+6hqg_kf878d3298088fb43_.exe (PID: 3392)
      • Installer.exe (PID: 2152)
      • Installer.exe (PID: 1336)
      • zmE8B5.tmp (PID: 2244)
      • Zoom.exe (PID: 2484)
      • Zoom.exe (PID: 924)
      • Zoom.exe (PID: 4092)

    • Reads the computer name

      • Zoom_cm_fo42pnktZ9vvrZo4_mRrZby7nPrRoLQwQE80bzA7Uv8xaqoQLrxVib@td2wE6w8ftW+6hqg_kf878d3298088fb43_.exe (PID: 3392)
      • Installer.exe (PID: 1336)
      • Installer.exe (PID: 2152)
      • Zoom.exe (PID: 2484)
      • Zoom.exe (PID: 4092)
      • Zoom.exe (PID: 924)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3668)
      • iexplore.exe (PID: 3972)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3668)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 3668)
      • iexplore.exe (PID: 3972)

    • Checks proxy server information

      • Zoom_cm_fo42pnktZ9vvrZo4_mRrZby7nPrRoLQwQE80bzA7Uv8xaqoQLrxVib@td2wE6w8ftW+6hqg_kf878d3298088fb43_.exe (PID: 3392)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3668)
      • Zoom_cm_fo42pnktZ9vvrZo4_mRrZby7nPrRoLQwQE80bzA7Uv8xaqoQLrxVib@td2wE6w8ftW+6hqg_kf878d3298088fb43_.exe (PID: 3392)

    • Reads the machine GUID from the registry

      • Zoom_cm_fo42pnktZ9vvrZo4_mRrZby7nPrRoLQwQE80bzA7Uv8xaqoQLrxVib@td2wE6w8ftW+6hqg_kf878d3298088fb43_.exe (PID: 3392)
      • Installer.exe (PID: 2152)
      • Zoom.exe (PID: 2484)
      • Zoom.exe (PID: 924)
      • Zoom.exe (PID: 4092)

    • Reads the software policy settings

      • Zoom_cm_fo42pnktZ9vvrZo4_mRrZby7nPrRoLQwQE80bzA7Uv8xaqoQLrxVib@td2wE6w8ftW+6hqg_kf878d3298088fb43_.exe (PID: 3392)
      • Installer.exe (PID: 2152)
      • Zoom.exe (PID: 2484)
      • Zoom.exe (PID: 924)
      • Zoom.exe (PID: 4092)

    • Creates files or folders in the user directory

      • Zoom_cm_fo42pnktZ9vvrZo4_mRrZby7nPrRoLQwQE80bzA7Uv8xaqoQLrxVib@td2wE6w8ftW+6hqg_kf878d3298088fb43_.exe (PID: 3392)
      • Installer.exe (PID: 2152)
      • Zoom.exe (PID: 2484)
      • Zoom.exe (PID: 924)

    • Dropped object may contain TOR URL's

      • Installer.exe (PID: 2152)

    • Create files in a temporary directory

      • Zoom_cm_fo42pnktZ9vvrZo4_mRrZby7nPrRoLQwQE80bzA7Uv8xaqoQLrxVib@td2wE6w8ftW+6hqg_kf878d3298088fb43_.exe (PID: 3392)
      • Zoom.exe (PID: 2484)

    • Process checks computer location settings

      • Zoom.exe (PID: 2484)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
9
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe zoom_cm_fo42pnktz9vvrzo4_mrrzby7nprrolqwqe80bza7uv8xaqoqlrxvib@td2we6w8ftw+6hqg_kf878d3298088fb43_.exe installer.exe installer.exe zoom.exe zme8b5.tmp no specs zoom.exe zoom.exe

Process information

PID
CMD
Path
Indicators
Parent process
924"C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe" --action=join --runaszvideo=TRUE C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe
Zoom.exe
User:
admin
Company:
Zoom Video Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Meetings
Exit code:
0
Version:
5,17,7,31859
Modules
Images
c:\users\admin\appdata\roaming\zoom\bin\zoom.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\users\admin\appdata\roaming\zoom\bin\cmmlib.dll
c:\users\admin\appdata\roaming\zoom\bin\libcrypto-3-zm.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
1336"C:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Installer.exe" /addfwexception --bin_home="C:\Users\admin\AppData\Roaming\Zoom\bin"C:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Installer.exe
Installer.exe
User:
admin
Company:
Zoom Video Communications, Inc.
Integrity Level:
HIGH
Description:
Zoom Installer
Exit code:
0
Version:
5,17,7,31859
Modules
Images
c:\users\admin\appdata\roaming\zoom\zoomdownload\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2152"C:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Installer.exe" ZInstaller --conf.mode=silent --ipc_wnd=328192C:\Users\admin\AppData\Roaming\Zoom\ZoomDownload\Installer.exe
Zoom_cm_fo42pnktZ9vvrZo4_mRrZby7nPrRoLQwQE80bzA7Uv8xaqoQLrxVib@td2wE6w8ftW+6hqg_kf878d3298088fb43_.exe
User:
admin
Company:
Zoom Video Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Installer
Exit code:
0
Version:
5,17,7,31859
Modules
Images
c:\users\admin\appdata\roaming\zoom\zoomdownload\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2244"C:\Users\admin\AppData\Local\Temp\zmE8B5.tmp" -DAF8C715436E44649F1312698287E6A5=C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Zoom_cm_fo42pnktZ9vvrZo4_mRrZby7nPrRoLQwQE80bzA7Uv8xaqoQLrxVib@td2wE6w8ftW+6hqg_kf878d3298088fb43_.exeC:\Users\admin\AppData\Local\Temp\zmE8B5.tmp—Zoom_cm_fo42pnktZ9vvrZo4_mRrZby7nPrRoLQwQE80bzA7Uv8xaqoQLrxVib@td2wE6w8ftW+6hqg_kf878d3298088fb43_.exe
User:
admin
Company:
Zoom Video Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Opener
Exit code:
0
Version:
5,17,0,25
Modules
Images
c:\users\admin\appdata\local\temp\zme8b5.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2484"C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe" "--url=zoommtg://win.launch?h.domain=us06web.zoom.us&h.path=join&confid=dXNzPXl5cjBEaFBDX0dfLVFKSmJXYXo4dXRIOVBQcGNONTM5WHZ5cU5WeXBNOGwzV0FjT19sRTZGM1hJMWVNczVEUHlIME9zZEJGMUtJZXhTVlN3MEdKamZfU3ZHLWJ6SXpRLlNKZ21iZmlneGJzS1V3ZE0mdGlkPTEyNTk0ZWJmNjhmMDQ4OTA5NzgyN2MxMzA0Mzk1YWIy&mcv=0.92.11227.0929&stype=0&zc=0&browser=msie&action=join&confno=84886807313&pwd=bF70nbxZomTQqyLsI4vXbGrzm5D8bp.1"C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe
Zoom_cm_fo42pnktZ9vvrZo4_mRrZby7nPrRoLQwQE80bzA7Uv8xaqoQLrxVib@td2wE6w8ftW+6hqg_kf878d3298088fb43_.exe
User:
admin
Company:
Zoom Video Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Meetings
Exit code:
0
Version:
5,17,7,31859
Modules
Images
c:\users\admin\appdata\roaming\zoom\bin\zoom.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\users\admin\appdata\roaming\zoom\bin\cmmlib.dll
c:\users\admin\appdata\roaming\zoom\bin\libcrypto-3-zm.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
3392"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Zoom_cm_fo42pnktZ9vvrZo4_mRrZby7nPrRoLQwQE80bzA7Uv8xaqoQLrxVib@td2wE6w8ftW+6hqg_kf878d3298088fb43_.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Zoom_cm_fo42pnktZ9vvrZo4_mRrZby7nPrRoLQwQE80bzA7Uv8xaqoQLrxVib@td2wE6w8ftW+6hqg_kf878d3298088fb43_.exe
iexplore.exe
User:
admin
Company:
Zoom Video Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Opener
Exit code:
0
Version:
5,17,0,25
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\zoom_cm_fo42pnktz9vvrzo4_mrrzby7nprrolqwqe80bza7uv8xaqoqlrxvib@td2we6w8ftw+6hqg_kf878d3298088fb43_.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3668"C:\Program Files\Internet Explorer\iexplore.exe" "https://us06web.zoom.us/j/84886807313?pwd=bF70nbxZomTQqyLsI4vXbGrzm5D8bp.1"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3972"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3668 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
4092"C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe" --action=preload --runaszvideo=TRUE C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe
Zoom.exe
User:
admin
Company:
Zoom Video Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom Meetings
Exit code:
0
Version:
5,17,7,31859
Modules
Images
c:\users\admin\appdata\roaming\zoom\bin\zoom.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\users\admin\appdata\roaming\zoom\bin\cmmlib.dll
c:\users\admin\appdata\roaming\zoom\bin\libcrypto-3-zm.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
Total events
66 252
Read events
65 938
Write events
253
Delete events
61

Modification events

(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31088826
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31088826
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
215
Suspicious files
198
Text files
65
Unknown types
58

Dropped files

PID
Process
Filename
Type
3972iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:025C933DAB38465B353396BD60C5E515
SHA256:7AD8D678843938BE4D36C9B102A9BB72C21F8E0C675C65AEBD440F87383AFF25
3972iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\SY9LYX2R.txttext
MD5:2E478B8EAD6948774750307C9B923A67
SHA256:4A45545DE4FF60F2B391DE4C942DC5A872028A83738B58BA06ABAA8F97A1F222
3972iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419binary
MD5:E710CB9BD4DF9EA1404A9225294BB8A3
SHA256:314ADD6209D6D56682E63484EA28574BBB048175A02E124FABEE440E8B9E9870
3972iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:CAB6225B861674F37BA35D7241B4D9D6
SHA256:07AA9F1727174FFF61ED1F695EB071AD1113190CF02A7FEBC878E38B8C38941A
3972iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\7JONOM7H.txttext
MD5:6D953FE9BC3D0CF4AE5D03D0915240A9
SHA256:C6960FBCCDBF04FA05D5078C6108F8C95CBDFB55EF5B3B088E56EF0996A621A0
3972iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\NY0CYG1G.txttext
MD5:A634555A384EA084D5C6A1A650D12AE3
SHA256:05F3A66FB6326DC33F3913A524F58F1A6FE12957D2E1C7E8A96237F715A968AE
3972iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\OY2KE1LF.txttext
MD5:B1AF88A0BA5F2E8A1E30EAF99B9A940D
SHA256:D071761D1F383A94299993CB3E3CDE2CD695E86A59999671CC9576C7CE83AFA9
3972iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\84886807313[1].htmhtml
MD5:FB2E90EB8B8705FD072D69FA89D4FD96
SHA256:FEE8BEC73A6E337DC904ACEDCA9B1CB822D681E8DC3A1CE6DC6C9E257AF3D1EE
3972iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419binary
MD5:29D22382BDA813D6F4D925DB8B455A23
SHA256:FAFB5D9A50F3368A62570DB45E48F34E1E57C53C3098EF11E642976D15925E94
3972iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\lazy-solvvy[1].jstext
MD5:69E8703B732EDC94FF429DC71CA1F9EC
SHA256:4C1A0938733F72097A14BC09DCE2B036828A6A899B2630CD68F9E52F3EFDB841
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
52
DNS requests
26
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3972
iexplore.exe
GET
304
23.32.238.218:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8a21c6ad756e8dd9
unknown
—
—
unknown
3972
iexplore.exe
GET
304
23.32.238.218:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c9f2b763ba05a2db
unknown
—
—
unknown
3972
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
binary
471 b
unknown
3972
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
binary
471 b
unknown
3972
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
binary
1.47 Kb
unknown
3972
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAu5ZUPAbR7%2FZpXMY6k3CQo%3D
unknown
binary
471 b
unknown
3972
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAIcL6umARqJ76Z3iMZH5HA%3D
unknown
binary
471 b
unknown
3668
iexplore.exe
GET
304
23.32.238.218:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?70b4a85d87201c80
unknown
—
—
unknown
3668
iexplore.exe
GET
304
23.32.238.218:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?49cb245571b3d6d6
unknown
—
—
unknown
3668
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
314 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3972
iexplore.exe
170.114.52.6:443
us06web.zoom.us
—
US
unknown
3972
iexplore.exe
23.32.238.218:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3972
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3972
iexplore.exe
34.98.108.207:443
cdn.solvvy.com
GOOGLE
US
unknown
3972
iexplore.exe
52.84.151.63:443
st1.zoom.us
AMAZON-02
US
unknown
3972
iexplore.exe
134.224.0.54:443
log-gateway.zoom.us
AMAZON-02
US
unknown
3972
iexplore.exe
104.18.130.236:443
cdn.cookielaw.org
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
us06web.zoom.us
  • 170.114.52.6
unknown
ctldl.windowsupdate.com
  • 23.32.238.218
  • 23.32.238.227
  • 23.32.238.225
  • 23.32.238.234
  • 23.32.238.233
  • 23.32.238.216
  • 23.32.238.226
  • 23.32.238.217
  • 23.32.238.224
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
st1.zoom.us
  • 52.84.151.63
  • 52.84.151.43
  • 52.84.151.38
  • 52.84.151.56
whitelisted
cdn.solvvy.com
  • 34.98.108.207
shared
log-gateway.zoom.us
  • 134.224.0.54
  • 134.224.0.55
unknown
cdn.cookielaw.org
  • 104.18.130.236
  • 104.18.131.236
whitelisted
geolocation.onetrust.com
  • 172.64.155.119
  • 104.18.32.137
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.170
  • 104.126.37.154
  • 104.126.37.184
  • 104.126.37.155
  • 104.126.37.161
  • 104.126.37.163
  • 104.126.37.179
  • 104.126.37.171
  • 104.126.37.160
whitelisted

Threats

No threats detected
Process
Message
Installer.exe
[ProductPathHelper::RecursiveRemoveDirA] Path is:
Installer.exe
C:\Users\admin\AppData\Roaming\Zoom\zoom_install_src
Installer.exe
Installer.exe
[ProductPathHelper::RecursiveRemoveDirA] Path is:
Installer.exe
C:\Users\admin\AppData\Roaming\Zoom\tmp_uninstall
Installer.exe
Installer.exe
[ProductPathHelper::RecursiveRemoveDirA] Path is:
Installer.exe
C:\Users\admin\AppData\Roaming\Zoom\tmp_bin
Installer.exe
Installer.exe
C:\Users\Public\Desktop\Acrobat Reader DC.lnk
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://us06web.zoom.us/j/84886807313?pwd=bF70nbxZomTQqyLsI4vXbGrzm5D8bp.1