URL:

http://reddit.games/rising

Full analysis: https://app.any.run/tasks/a535483c-1469-4bfb-adec-197cb87f39ce
Verdict: No threats detected
Analysis date: April 19, 2019, 00:20:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

8C11906DE9690E46BA9697E0BDD26DFC

SHA1:

6F9DB55DCB7ABC726C9AFAA4EF02D997073FBBD2

SHA256:

D33FA4DBED0C60C6AB01AC7326BD2D7E616F92494637886D1E306E4B6A7E93D7

SSDEEP:

3:N1KMXLGC:CMXLGC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 2308)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 3820)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3820)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3820)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2308)

    • Application launched itself

      • iexplore.exe (PID: 2308)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2308)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2308)

    • Creates files in the user directory

      • iexplore.exe (PID: 3820)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2308"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3820"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2308 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
467
Read events
385
Write events
77
Delete events
5

Modification events

(PID) Process:(2308) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2308) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2308) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2308) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2308) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2308) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000071000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2308) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{F7B604A7-6238-11E9-A09E-5254004A04AF}
Value:
0
(PID) Process:(2308) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(2308) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
1
(PID) Process:(2308) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E307040005001300000014002C000A00
Executable files
0
Suspicious files
6
Text files
97
Unknown types
13

Dropped files

PID
Process
Filename
Type
2308iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico —
MD5:—
SHA256:—
2308iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3820iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@reddit[1].txt —
MD5:—
SHA256:—
3820iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\FWIMV6P4\over18[1].txt —
MD5:—
SHA256:—
3820iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:—
SHA256:—
3820iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\FWIMV6P4\over18[1].htmhtml
MD5:—
SHA256:—
3820iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.datdat
MD5:—
SHA256:—
3820iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:—
SHA256:—
3820iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@reddit[2].txttext
MD5:—
SHA256:—
3820iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PL6I6815\reddit.K4BTwPxKCqA[1].csstext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
39
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3820
iexplore.exe
GET
301
104.27.180.83:80
http://reddit.games/rising
US
—
—
shared
3820
iexplore.exe
GET
302
104.28.23.206:80
http://bestgames2018.site/rule
US
—
—
shared
3820
iexplore.exe
GET
302
54.218.44.28:80
http://wcrgl.adultgames.fun/hit.php?s=836&p=1&a=103221&t=0
US
—
—
suspicious
3820
iexplore.exe
GET
301
54.218.44.28:80
http://wcrgl.adultgames.fun/newhit.php?s=836&p=1&a=103221&t=0
US
—
—
suspicious
3820
iexplore.exe
GET
200
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
55.6 Kb
whitelisted
3820
iexplore.exe
GET
200
13.32.222.158:80
http://x.ss2.us/x.cer
US
der
1.27 Kb
whitelisted
2308
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2308
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3820
iexplore.exe
151.101.1.140:443
old.reddit.com
Fastly
US
suspicious
3820
iexplore.exe
104.27.180.83:80
reddit.games
Cloudflare Inc
US
shared
3820
iexplore.exe
216.58.205.226:443
www.googletagservices.com
Google Inc.
US
whitelisted
3820
iexplore.exe
23.77.211.238:443
c.aaxads.com
Akamai International B.V.
NL
whitelisted
3820
iexplore.exe
13.32.221.6:443
c.amazon-adsystem.com
Amazon.com, Inc.
US
unknown
2308
iexplore.exe
151.101.1.140:443
old.reddit.com
Fastly
US
suspicious
3820
iexplore.exe
13.32.222.158:80
x.ss2.us
Amazon.com, Inc.
US
malicious
3820
iexplore.exe
93.184.221.240:80
www.download.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
—
—
104.28.23.206:80
bestgames2018.site
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
reddit.games
  • 104.27.180.83
  • 104.27.181.83
unknown
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
old.reddit.com
  • 151.101.1.140
  • 151.101.65.140
  • 151.101.129.140
  • 151.101.193.140
whitelisted
www.redditstatic.com
  • 151.101.1.140
  • 151.101.65.140
  • 151.101.129.140
  • 151.101.193.140
whitelisted
reddit.com
  • 151.101.1.140
  • 151.101.129.140
  • 151.101.193.140
  • 151.101.65.140
whitelisted
www.googletagservices.com
  • 216.58.205.226
whitelisted
c.amazon-adsystem.com
  • 13.32.221.6
whitelisted
c.aaxads.com
  • 23.77.211.238
whitelisted
x.ss2.us
  • 13.32.222.158
  • 13.32.222.200
  • 13.32.222.77
  • 13.32.222.21
whitelisted
l.aaxads.com
  • 23.77.211.238
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://reddit.games/rising