analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www81.zippyshare.com/v/xTiZ7be4/file.html

Full analysis: https://app.any.run/tasks/1b385bd4-bb4b-431b-84b0-7a90c1ae0777
Verdict: Malicious activity
Analysis date: December 12, 2020, 11:39:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

A6600310A693489B7B79104910369E16

SHA1:

2C26B87653F18B173840143CAB5FEC69C6B44D70

SHA256:

D3CF5F0334DBF49F469B3C8D8CB439CD1B11D44392A21BA6021A7E1729E87A7A

SSDEEP:

3:N8DSdSc3GKjKztgmwJ:2OdSc3GjzKmwJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executed via COM

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2472)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 272)

  • INFO

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2332)
      • iexplore.exe (PID: 2596)

    • Manual execution by user

      • chrome.exe (PID: 272)
      • cmd.exe (PID: 4024)
      • cmd.exe (PID: 960)

    • Creates files in the user directory

      • iexplore.exe (PID: 2332)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2472)

    • Application launched itself

      • iexplore.exe (PID: 2596)
      • chrome.exe (PID: 272)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2332)

    • Changes internet zones settings

      • iexplore.exe (PID: 2596)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2596)

    • Reads the hosts file

      • chrome.exe (PID: 272)
      • chrome.exe (PID: 1868)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2596)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
89
Monitored processes
46
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs cmd.exe net.exe no specs net1.exe no specs cmd.exe no specs net.exe no specs net1.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2596"C:\Program Files\Internet Explorer\iexplore.exe" https://www81.zippyshare.com/v/xTiZ7be4/file.htmlC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2332"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2596 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2472C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Exit code:
0
Version:
26,0,0,131
272"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3512"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6cc4a9d0,0x6cc4a9e0,0x6cc4a9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
936"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=1576 --on-initialized-event-handle=324 --parent-handle=328 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
1332"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1008,6954797307039841593,17095056644310079681,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=16799172807387640493 --mojo-platform-channel-handle=1028 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
1868"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1008,6954797307039841593,17095056644310079681,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=4563382684598970881 --mojo-platform-channel-handle=1632 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
1728"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,6954797307039841593,17095056644310079681,131072 --enable-features=PasswordImport --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=13548321878872024674 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2172 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
2884"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,6954797307039841593,17095056644310079681,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=17776841595357644747 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2492 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
Total events
1 963
Read events
1 717
Write events
238
Delete events
8

Modification events

(PID) Process:(2596) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
2146694364
(PID) Process:(2596) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30855291
(PID) Process:(2596) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2596) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2596) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2596) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2596) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2596) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A5000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2596) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2596) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
0
Suspicious files
190
Text files
286
Unknown types
83

Dropped files

PID
Process
Filename
Type
2332iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabCDC6.tmp —
MD5:—
SHA256:—
2332iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\TarCDC7.tmp —
MD5:—
SHA256:—
2332iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\1H8PNB1S.txttext
MD5:92392CE8FD0B9DA9DCB181CAF51F7961
SHA256:0D7805EE75469043D77125CE46583DF9D186718434ACA474EF81EA160B8BC4E4
2332iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\viewjs-9c29d4e653e865831dc028fdac7e7dfff3be049e[1].csstext
MD5:888A26F04004D6F52FD5BBB5CAB8E901
SHA256:A6FF735A4F50CC9779C3B25BE4244744C915E1BFD475238E73D7FB2239150762
2332iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001der
MD5:FE596DFFBD62733F50096C81A821A782
SHA256:C1604E282EB3D91FC61997C2E6904BA21D7ED1DAAE72C034F41FB9205B97690A
2332iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\sw[1].jstext
MD5:D2BBDC37A9EFFB0E85D055AE1BFC5A00
SHA256:4958E1EA3A29551F08C6FFC404AD0DA6EA8B96DE227C30F7211BBA6612EF9166
2332iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001binary
MD5:CA4DF1F8703DCAE5796D1C5E56522B8B
SHA256:6CC7AA04CBB2990D9651031D4A2ACF638D6206C1624B87FA5A1CC162B1719B58
2332iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC570EC0DE58335AFAF92FDC8E3AA330_D21CA3FA19E2494154CA1B3726B54309binary
MD5:0B20F004C5663D36EE856DDB37DDB809
SHA256:63C8A020DE3B5368A81EF3658EA0B45DE490C4FDDACE2B1932040D7C51406B13
2332iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC570EC0DE58335AFAF92FDC8E3AA330_D21CA3FA19E2494154CA1B3726B54309der
MD5:C3125A46D601F9BE3E4B2DFD1103E442
SHA256:E3E078C580EF6964B89D5BE7B1F6293EC4356578D9160CBA862A74B9E95AD175
2332iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08der
MD5:6608272C03BA3F6C697BBFE5CD825DAB
SHA256:10DC1A02BA2B25346BF2107FB529B248E9341FA555FE78A055239BF4BCAF7DCA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
56
TCP/UDP connections
174
DNS requests
105
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2332
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCCwQAAAAAAURO8DYx
US
der
1.49 Kb
whitelisted
2332
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
2332
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
2332
iexplore.exe
GET
200
23.37.43.27:80
http://s.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEGMYDTj7gJd4qdA1oxYY%2BEA%3D
NL
der
1.71 Kb
shared
2332
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
2332
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/gsalphasha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSE1Wv4CYvTB7dm2OHrrWWWqmtnYQQU9c3VPAhQ%2BWpPOreX2laD5mnSaPcCDAQ2J002vedADHR8qQ%3D%3D
US
der
1.49 Kb
whitelisted
2332
iexplore.exe
GET
200
2.16.186.11:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
unknown
der
1.37 Kb
whitelisted
2332
iexplore.exe
GET
200
23.37.43.27:80
http://s.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEGMYDTj7gJd4qdA1oxYY%2BEA%3D
NL
der
1.71 Kb
shared
2332
iexplore.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCCwQAAAAAAURO8DYx
US
der
1.49 Kb
whitelisted
2332
iexplore.exe
GET
200
2.16.186.35:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
unknown
der
1.37 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2332
iexplore.exe
173.192.101.24:443
p232207.clksite.com
SoftLayer Technologies Inc.
US
suspicious
2332
iexplore.exe
104.18.20.226:80
ocsp.globalsign.com
Cloudflare Inc
US
shared
2332
iexplore.exe
104.18.21.226:80
ocsp.globalsign.com
Cloudflare Inc
US
shared
2332
iexplore.exe
46.166.139.215:443
www81.zippyshare.com
NForce Entertainment B.V.
NL
unknown
2332
iexplore.exe
65.9.70.55:443
ds88pc0kw6cvc.cloudfront.net
AT&T Services, Inc.
US
malicious
2332
iexplore.exe
139.45.195.142:443
louchees.net
—
US
malicious
2332
iexplore.exe
35.190.68.123:443
www.maxonclick.com
Google Inc.
US
whitelisted
2332
iexplore.exe
65.9.70.24:443
d10lumateci472.cloudfront.net
AT&T Services, Inc.
US
unknown
2332
iexplore.exe
104.75.88.112:443
s7.addthis.com
Akamai Technologies, Inc.
NL
suspicious
2332
iexplore.exe
151.139.128.14:80
ocsp.comodoca.com
Highwinds Network Group, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
www81.zippyshare.com
  • 46.166.139.215
unknown
ocsp.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
ocsp2.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
d10lumateci472.cloudfront.net
  • 65.9.70.24
  • 65.9.70.111
  • 65.9.70.209
  • 65.9.70.58
whitelisted
ds88pc0kw6cvc.cloudfront.net
  • 65.9.70.55
  • 65.9.70.131
  • 65.9.70.217
  • 65.9.70.190
whitelisted
s7.addthis.com
  • 104.75.88.112
whitelisted
p232207.clksite.com
  • 173.192.101.24
whitelisted
www.maxonclick.com
  • 35.190.68.123
whitelisted
louchees.net
  • 139.45.195.142
  • 139.45.197.9
  • 139.45.195.16
  • 139.45.195.81
  • 139.45.196.3
  • 139.45.196.67
malicious
www.google.com
  • 172.217.16.196
  • 173.194.222.106
  • 173.194.222.99
  • 173.194.222.105
  • 173.194.222.147
  • 173.194.222.104
  • 173.194.222.103
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www81.zippyshare.com/v/xTiZ7be4/file.html