analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://wwwoffice.vmonlineservice.xyz/[email protected]

Full analysis: https://app.any.run/tasks/daca425d-f6a0-4697-b23f-2a1228ff5f4d
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: June 27, 2022, 08:28:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MD5:

7719448AE7E17412F0DADCA000FDA9BC

SHA1:

C9E93C04A0C0C7650662A363B8D2ECD681A60066

SHA256:

D42F599098A4D5C56FFFF97FE3ACFA46721F4DFE8BEBCB2EF5E4441B98A8C492

SSDEEP:

3:N8DSYMIKLJ3McmWAXLE9YEL9oJ4Rn:2OYMIK93MPXw9YEL9o2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to CnC server

      • iexplore.exe (PID: 1232)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 1232)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 2220)
      • iexplore.exe (PID: 1232)

    • Checks supported languages

      • iexplore.exe (PID: 1232)
      • iexplore.exe (PID: 2220)

    • Changes internet zones settings

      • iexplore.exe (PID: 2220)

    • Application launched itself

      • iexplore.exe (PID: 2220)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1232)
      • iexplore.exe (PID: 2220)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 1232)
      • iexplore.exe (PID: 2220)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1232)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 2220)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
2
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2220"C:\Program Files\Internet Explorer\iexplore.exe" "https://wwwoffice.vmonlineservice.xyz/[email protected]"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
1232"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2220 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Total events
15 742
Read events
15 633
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
11
Text files
5
Unknown types
6

Dropped files

PID
Process
Filename
Type
1232iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabA781.tmpcompressed
MD5:308336E7F515478969B24C13DED11EDE
SHA256:889B832323726A9F10AD03F85562048FDCFE20C9FF6F9D37412CF477B4E92FF9
1232iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\TarA782.tmpcat
MD5:2D8A5090656DE9FB55DD0F3BA20F9299
SHA256:44AE1E61A4E6305C15AAA52FD1B29DDB060E69233703CBA611F5E781D766442E
2220iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF3689FDBB0DC5BCBA.TMPgmc
MD5:C224D037C9585E372CDCA13DDF994D6C
SHA256:A17A2B1143ECC6FB171DD18333F2AA6240DF585928CDFC0A53493A179082A475
2220iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{162D6BBD-F5F3-11EC-B490-18C4897E77EE}.datbinary
MD5:77E9D9C2E1105F1659D3A1CB3E650027
SHA256:6DEED5189A18A10539CB2DC1F85212FED4DF717A6E1A319E3C9D316796D002F2
1232iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:8E6E013A1135A795CC3FE4CFEFE69C81
SHA256:497FC71DC2E26CF2A630B3CD244597030CBCC751745D5D140F66D95635B91301
2220iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8Fder
MD5:DF6DEECBA36F8D0AF53EAFA9C51AB1F7
SHA256:60D1053BDE5FBCA23ED8976F1EABAEE9C4BB459D9C997E5A76BB2182EE916D98
1232iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
1232iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:308336E7F515478969B24C13DED11EDE
SHA256:889B832323726A9F10AD03F85562048FDCFE20C9FF6F9D37412CF477B4E92FF9
2220iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF92D54DA421DE736D.TMPgmc
MD5:3638590484ECF5771231BEB61A9BE94E
SHA256:FF4DADB3509B0B756A2DDDA9C4A0EAFE0B871C593B493CBADB2461C7C6CCB17F
2220iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{1DEAADE0-F5F3-11EC-B490-18C4897E77EE}.datbinary
MD5:885EDB19C312C1FCF28DFF4F785AC8CD
SHA256:6E641240FD31B0FF36E4F3BEF17B1CC6A8C7759BD427507F560825225FE3C86E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
15
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1232
iexplore.exe
GET
200
67.27.213.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e4425510b7c8ff5f
US
compressed
60.0 Kb
whitelisted
2220
iexplore.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/Omniroot2025.crl
US
der
7.78 Kb
whitelisted
2220
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
1232
iexplore.exe
GET
200
67.27.213.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?990b70dac08a19f7
US
compressed
4.70 Kb
whitelisted
1232
iexplore.exe
GET
200
67.27.213.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?572c7d76fd7c2d54
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2220
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2220
iexplore.exe
131.253.33.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2220
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1232
iexplore.exe
194.76.224.73:443
wwwoffice.vmonlineservice.xyz
—
—
malicious
1232
iexplore.exe
67.27.213.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
wwwoffice.vmonlineservice.xyz
  • 194.76.224.73
malicious
ctldl.windowsupdate.com
  • 67.27.213.254
  • 8.238.159.126
  • 8.247.185.126
  • 8.253.145.120
  • 8.238.155.126
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 131.253.33.200
  • 13.107.22.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
crl3.digicert.com
  • 93.184.220.29
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

PID
Process
Class
Message
1232
iexplore.exe
A Network Trojan was detected
ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)
1232
iexplore.exe
A Network Trojan was detected
ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)
No debug info