analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

index.html

Full analysis: https://app.any.run/tasks/85e5957b-050b-48e7-b139-97bf941be060
Verdict: Malicious activity
Analysis date: August 17, 2019, 22:56:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/html
File info: HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
MD5:

4F0AFDEE5D76B09288FCFD8168329487

SHA1:

0379AAD65FF379F981B498AE12083C2D5C6CC459

SHA256:

D682B05C19D96C99EB442D32B4686E8CEB6C88052C89F1ECC72B6822D9600CB8

SSDEEP:

1536:xph1P+y/n9L4ulrrb8UbCBqb8OqXGqXhqXrqXqqXpqXob8bqXBqXSqX3qXKb80Ad:Hh1P+Wnl4ulAjr3XPXsXuXzX0XXeXMXO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads the Task Scheduler COM API

      • CCleaner.exe (PID: 1844)
      • CCleaner.exe (PID: 848)

    • Changes the autorun value in the registry

      • CCleaner.exe (PID: 848)

    • Actions looks like stealing of personal data

      • CCleaner.exe (PID: 2768)
      • CCleaner.exe (PID: 848)

  • SUSPICIOUS

    • Creates files in the user directory

      • CCleaner.exe (PID: 2768)

    • Executed via Task Scheduler

      • CCleaner.exe (PID: 2768)

    • Application launched itself

      • CCleaner.exe (PID: 2768)

    • Reads the cookies of Mozilla Firefox

      • CCleaner.exe (PID: 2768)

    • Reads internet explorer settings

      • CCleaner.exe (PID: 2768)
      • CCleaner.exe (PID: 848)

    • Reads the cookies of Google Chrome

      • CCleaner.exe (PID: 2768)

    • Low-level read access rights to disk partition

      • CCleaner.exe (PID: 2768)

    • Starts Internet Explorer

      • CCleaner.exe (PID: 2768)

  • INFO

    • Reads internet explorer settings

      • iexplore.exe (PID: 2812)
      • iexplore.exe (PID: 3480)
      • iexplore.exe (PID: 2052)
      • iexplore.exe (PID: 2396)
      • iexplore.exe (PID: 3948)
      • iexplore.exe (PID: 2948)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2812)
      • iexplore.exe (PID: 3480)
      • iexplore.exe (PID: 2756)
      • iexplore.exe (PID: 2052)
      • iexplore.exe (PID: 2396)
      • iexplore.exe (PID: 2948)
      • iexplore.exe (PID: 3672)

    • Changes internet zones settings

      • iexplore.exe (PID: 2756)
      • iexplore.exe (PID: 3672)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2812)
      • iexplore.exe (PID: 3480)
      • CCleaner.exe (PID: 2768)

    • Application launched itself

      • iexplore.exe (PID: 2756)
      • iexplore.exe (PID: 3672)

    • Creates files in the user directory

      • iexplore.exe (PID: 2812)
      • iexplore.exe (PID: 2756)
      • iexplore.exe (PID: 2052)
      • iexplore.exe (PID: 3948)
      • iexplore.exe (PID: 2396)
      • iexplore.exe (PID: 2948)

    • Manual execution by user

      • CCleaner.exe (PID: 1844)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 2052)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2396)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2396)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.htm/html | HyperText Markup Language with DOCTYPE (80.6)
.html | HyperText Markup Language (19.3)

EXIF

HTML

Generator: EDD DP v1.4.8
HTTPEquivXClacksOverhead: GNU Terry Pratchett
yandexVerification: 94b93249c2b2d365
msvalidate01: 11AA582CA73B81677B7BC2E7500B72DF
twitterCreator: @SpybotSD
twitterImage: https://www.safer-networking.org/wp-content/uploads/2018/08/SpybotHome01.jpg
twitterSite: @SpybotSD
twitterTitle: Home - Spybot Anti-Malware and Antivirus
twitterDescription: Spybot offers a unique technology for your security. Far beyond antivirus Spybot searches and destroys unwanted software and protects your privacy.
twitterCard: summary_large_image
Description: Spybot offers a unique technology for your security. Far beyond antivirus Spybot searches and destroys unwanted software and protects your privacy.
viewport: width=device-width, initial-scale=1.0
HTTPEquivXUACompatible: IE=edge,chrome=1
Title: Home - Spybot Anti-Malware and Antivirus : Spybot Anti-Malware and Antivirus
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
11
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iexplore.exe iexplore.exe ccleaner.exe no specs ccleaner.exe ccleaner.exe iexplore.exe no specs iexplore.exe iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2756"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\index.htmlC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3480"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2756 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2812"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2756 CREDAT:14339C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2052"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2756 CREDAT:268545C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
1844"C:\Program Files\CCleaner\CCleaner.exe" C:\Program Files\CCleaner\CCleaner.exe—explorer.exe
User:
admin
Company:
Piriform Ltd
Integrity Level:
MEDIUM
Description:
CCleaner
Exit code:
0
Version:
5, 35, 0, 6210
2768"C:\Program Files\CCleaner\CCleaner.exe" /uacC:\Program Files\CCleaner\CCleaner.exe
taskeng.exe
User:
admin
Company:
Piriform Ltd
Integrity Level:
HIGH
Description:
CCleaner
Version:
5, 35, 0, 6210
848"C:\Program Files\CCleaner\CCleaner.exe" /monitorC:\Program Files\CCleaner\CCleaner.exe
CCleaner.exe
User:
admin
Company:
Piriform Ltd
Integrity Level:
HIGH
Description:
CCleaner
Version:
5, 35, 0, 6210
3672"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe—CCleaner.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3948"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3672 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2396"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3672 CREDAT:79874C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
2 275
Read events
1 761
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
12
Text files
117
Unknown types
21

Dropped files

PID
Process
Filename
Type
2756iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
2756iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2812iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\style.1553000490[1].css —
MD5:—
SHA256:—
2812iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\frontend.1529135204[1].csstext
MD5:0E161E16D789BF14DDA632172D231FDD
SHA256:7E57269BDD2CE18D1CFF1A6D1B8F64411DE43D165B66FE33BB3C1E72C350D0BC
3480iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\style.1553000490[1].csstext
MD5:513064AB57FC81ED2C9AE3AC8B51C412
SHA256:9186DAF4ED10EDB01AA2CEE10E9C1EF8BEDC62FBCC6F7C0FA9183351BAAED171
3480iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\frontend.1529135204[1].csstext
MD5:0E161E16D789BF14DDA632172D231FDD
SHA256:7E57269BDD2CE18D1CFF1A6D1B8F64411DE43D165B66FE33BB3C1E72C350D0BC
2812iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\navigation.1533725172[1].csstext
MD5:44247B28C35BCFB9E60932D233040484
SHA256:6685541811ABACE8E7524222F880147341FEF012889D909919823204227A21F1
2812iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\work-sans-v3-latin-ext_latin-600[1].eoteot
MD5:96905AF82A818795A3BB885216B22826
SHA256:660EDED19C3433A2795C3D1B918248E6C28C4B128DB1D705DD0788ABE3D0CE47
2812iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\work-sans-v3-latin-ext_latin-300[1].eoteot
MD5:26CEF1DC826B717F6837D7F70BDC9209
SHA256:7A97D9CB507AE69C01B0A04A0001319BD14586B05B26EA6502FF05A7DA7E4D08
2812iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\work-sans-v3-latin-ext_latin-regular[1].eoteot
MD5:99C316A4EFACDC90977BF703D2E2DFDE
SHA256:49DED7B5713EA89A3143D9C26FECD007500D997DE3CAC612EDD11453F55681A7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
27
TCP/UDP connections
102
DNS requests
29
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2052
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rs/6n/53/cj,nj/dd882357/b8881a70.js
US
text
1.77 Kb
whitelisted
2052
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/search?q=non-necessary++&src=IE-SearchBox&FORM=IE8SRC
US
html
32.2 Kb
whitelisted
2052
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/fd/ls/l?IG=176FFA7675534AFCB58660D126A9861B&CID=3B45C4823B83621F3EBBC9393AAB63E5&Type=Event.ClientInst&DATA=[{"T":"CI.GetError","FID":"CI","Name":"JSGetError","Text":"%27SVGElement%27%20is%20undefined","Meta":"http%3A//www.bing.com/search%3Fq%3Dnon-necessary++%26src%3DIE-SearchBox%26FORM%3DIE8SRC","Line":9668927,"Char":%20undefined}]
US
compressed
773 b
whitelisted
2052
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/fd/ls/l?IG=176FFA7675534AFCB58660D126A9861B&CID=3B45C4823B83621F3EBBC9393AAB63E5&Type=Event.CPT&DATA={"pp":{"S":"L","FC":47,"BC":125,"SE":-1,"TC":-1,"H":156,"BP":219,"CT":234,"IL":3},"ad":[-1,-1,772,444,1089,498,0]}&P=SERP&DA=DUB02
US
image
5.73 Kb
whitelisted
2052
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rs/30/2R/cj,nj/3f1e2270/f8c6dd44.js
US
text
773 b
whitelisted
2052
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rb/5k/cj,nj/c44ec255/9a358300.js?bu=EqsfzB_vHvoe3QSGH4gf5B-KH5Ufmx-_H7kfxR-fHrYdvB2qHg
US
text
4.95 Kb
whitelisted
2756
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
2052
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rs/5b/2r/cj,nj/08abbb2f/e177b199.js
US
text
2.86 Kb
whitelisted
2052
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/sa/simg/SharedSpriteDesktopRewards_022118.png
US
image
5.73 Kb
whitelisted
2052
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rs/30/1V/cj,nj/4c7364c5/40e1b425.js
US
text
816 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2756
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
4
System
23.210.248.226:445
www.paypalobjects.com
Akamai International B.V.
NL
whitelisted
3480
iexplore.exe
167.114.117.64:443
www.safer-networking.org
OVH SAS
CA
unknown
2812
iexplore.exe
167.114.117.64:443
www.safer-networking.org
OVH SAS
CA
unknown
2052
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2812
iexplore.exe
192.0.77.48:443
s.w.org
Automattic, Inc
US
suspicious
4
System
23.210.248.226:139
www.paypalobjects.com
Akamai International B.V.
NL
whitelisted
2052
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2052
iexplore.exe
204.79.197.222:80
fp.msedge.net
Microsoft Corporation
US
whitelisted
2768
CCleaner.exe
151.101.0.64:443
www.piriform.com
Fastly
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.safer-networking.org
  • 167.114.117.64
whitelisted
www.paypalobjects.com
  • 23.210.248.226
whitelisted
s.w.org
  • 192.0.77.48
whitelisted
login.live.com
  • 40.90.23.208
  • 40.90.137.126
  • 40.90.23.206
whitelisted
890c8bb8358b6ebe48b6dfb9d4d24b6f.clo.footprintdns.com
  • 104.211.224.23
unknown
06f5f949bcf61466d3c4974e31958e39.clo.footprintdns.com
  • 13.107.3.254
suspicious
100413694e62feb2b2d01d8332d14faf.clo.footprintdns.com
  • 52.231.32.10
unknown
fp.msedge.net
  • 204.79.197.222
whitelisted
www.piriform.com
  • 151.101.0.64
  • 151.101.64.64
  • 151.101.128.64
  • 151.101.192.64
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
index.html