analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| URL: | http://www.vertice360./compania-2 |
| Full analysis: | https://app.any.run/tasks/dfedbd6f-16ca-4c0e-a53b-419f97a1e240 |
| Verdict: | Malicious activity |
| Analysis date: | January 17, 2019, 16:24:54 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 0E099578562E7F945DA6B6B8B83C2211 |
| SHA1: | 0207584EE415E00F01799AF3F3521E55C7305383 |
| SHA256: | D75FC1F3D8072D790EB0316AE910BEBB5EEA52AB322A9EE30927BA92AD41D36B |
| SSDEEP: | 3:N1KJS4MXRgUVzJ:Cc4MBgG |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
Application launched itself
- iexplore.exe (PID: 2940)
- chrome.exe (PID: 1792)
Reads Internet Cache Settings
- iexplore.exe (PID: 3208)
Reads settings of System Certificates
- iexplore.exe (PID: 3208)
- chrome.exe (PID: 1792)
Changes internet zones settings
- iexplore.exe (PID: 2940)
Creates files in the user directory
- iexplore.exe (PID: 3208)
- FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3236)
- opera.exe (PID: 3588)
- iexplore.exe (PID: 2940)
Reads internet explorer settings
- iexplore.exe (PID: 3208)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
47
Monitored processes
16
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2940 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 3208 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2940 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 3236 | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe | — | svchost.exe |
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Exit code: 0 Version: 26,0,0,131 | ||||
| 3588 | "C:\Program Files\Opera\opera.exe" | C:\Program Files\Opera\opera.exe | explorer.exe | |
User: admin Company: Opera Software Integrity Level: MEDIUM Description: Opera Internet Browser Version: 1748 | ||||
| 1792 | "C:\Program Files\Google\Chrome\Application\chrome.exe" | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | |
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Version: 68.0.3440.106 | ||||
| 3544 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=68.0.3440.106 --initial-client-data=0x78,0x7c,0x80,0x74,0x84,0x6f6000b0,0x6f6000c0,0x6f6000cc | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Version: 68.0.3440.106 | ||||
| 3124 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=1688 --on-initialized-event-handle=304 --parent-handle=308 /prefetch:6 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Version: 68.0.3440.106 | ||||
| 3912 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=860,4361484908201063521,3689172358953829998,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=E557C44F89E38760C1C45DA320E99D8D --mojo-platform-channel-handle=972 --ignored=" --type=renderer " /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Version: 68.0.3440.106 | ||||
| 2500 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=860,4361484908201063521,3689172358953829998,131072 --enable-features=PasswordImport --service-pipe-token=7D29C69E6E9D74BC59A0B7240B445401 --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=7D29C69E6E9D74BC59A0B7240B445401 --renderer-client-id=5 --mojo-platform-channel-handle=1904 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 | ||||
| 2968 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=860,4361484908201063521,3689172358953829998,131072 --enable-features=PasswordImport --service-pipe-token=F296F3F17F696D9901BB74F0F1D902C1 --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=F296F3F17F696D9901BB74F0F1D902C1 --renderer-client-id=3 --mojo-platform-channel-handle=2092 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 | ||||
Total events
1 240
Read events
1 027
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
117
Text files
185
Unknown types
70
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2940 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 2940 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 3208 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\compania-2[1].txt | — | |
MD5:— | SHA256:— | |||
| 3208 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\style[1].css | text | |
MD5:531E36E3826EE96E3691F67487802AA1 | SHA256:A241984BDCE2E0B411FBDE77E78693D1E894BB1C37A0C904C884536693AC5F53 | |||
| 3208 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\compania-2[1].htm | html | |
MD5:FE5AB0880A7A28AD5DF3AA46EC9124BF | SHA256:D36B1234D205BF3C5D282B9D9DABDC7A7C2926001D7B79F7DADB1087C9C383FA | |||
| 3208 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\sharethis[1].js | text | |
MD5:3881A48E6216E205A89282EC9BE16730 | SHA256:F64EDF13FEA09CAE00CB5F99805F8796866AE4E1E5E08017A52B7439A9D2836F | |||
| 3208 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\responsive[1].css | text | |
MD5:C91C0C0BE37B4831B2ACAE4EF61E82FE | SHA256:A5FD7A1CA1AA2F94210E448BFF0B8C9D733E4EC3A6F551D580E91387B0084499 | |||
| 3208 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\css[1].txt | text | |
MD5:5EEBB59F9A81BA400F56BA46434580CF | SHA256:F6B743B6FB27A49AFBF079312A8472D43285353AD9C90D1366A3F2C1E06DB36B | |||
| 3208 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\tools[1] | image | |
MD5:6F20BA58551E13CFD87EC059327EFFD0 | SHA256:62A7038CC42C1482D70465192318F21FC1CE0F0C737CB8804137F38A1F9D680B | |||
| 3208 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\down[1] | image | |
MD5:555E83CE7F5D280D7454AF334571FB25 | SHA256:70F316A5492848BB8242D49539468830B353DDAA850964DB4E60A6D2D7DB4880 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
197
TCP/UDP connections
93
DNS requests
52
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3208 | iexplore.exe | GET | 301 | 52.211.167.226:80 | http://www.vertice360.com/compania-2 | IE | — | — | unknown |
3208 | iexplore.exe | GET | 200 | 52.211.167.226:80 | http://www.vertice360.com/wp-content/themes/joyn-child/style.css | IE | text | 779 b | unknown |
3208 | iexplore.exe | GET | 200 | 52.211.167.226:80 | http://www.vertice360.com/wp-content/plugins/swift-framework/includes/page-builder/frontend-assets/css/spb-styles.css | IE | text | 255 Kb | unknown |
3208 | iexplore.exe | GET | 200 | 172.217.23.138:80 | http://fonts.googleapis.com/css?family=Lato%3A100%2C300%2C400%2C700%2C900%2C100italic%2C300italic%2C400italic%2C700italic%2C900italic%7COpen+Sans%3A300%2C400%2C600%2C700%2C800%2C300italic%2C400italic%2C600italic%2C700italic%2C800italic%7CMontserrat%3A100%2C200%2C300%2C400%2C500%2C600%2C700%2C800%2C900%2C100italic%2C200italic%2C300italic%2C400italic%2C500italic%2C600italic%2C700italic%2C800italic%2C900italic&subset=latin&ver=1525948833 | US | text | 247 b | whitelisted |
3208 | iexplore.exe | GET | 200 | 52.211.167.226:80 | http://www.vertice360.com/wp-content/plugins/swift-framework/includes/swift-slider/assets/css/swift-slider.css | IE | text | 18.9 Kb | unknown |
3208 | iexplore.exe | GET | 200 | 2.19.43.118:80 | http://platform-api.sharethis.com/js/sharethis.js | unknown | text | 27.2 Kb | whitelisted |
3208 | iexplore.exe | GET | 200 | 52.211.167.226:80 | http://www.vertice360.com/wp-content/themes/joyn/css/bootstrap.min.css | IE | text | 88.5 Kb | unknown |
3208 | iexplore.exe | GET | 200 | 52.211.167.226:80 | http://www.vertice360.com/wp-content/themes/joyn/style.css?ver=5.0.3 | IE | html | 312 Kb | unknown |
3208 | iexplore.exe | GET | 200 | 52.211.167.226:80 | http://www.vertice360.com/wp-content/themes/joyn/css/responsive.css | IE | text | 29.4 Kb | unknown |
3208 | iexplore.exe | GET | 200 | 52.211.167.226:80 | http://www.vertice360.com/compania-2/ | IE | html | 92.4 Kb | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2940 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3208 | iexplore.exe | 172.217.16.142:443 | www.google-analytics.com | Google Inc. | US | whitelisted |
3208 | iexplore.exe | 216.58.205.227:80 | fonts.gstatic.com | Google Inc. | US | whitelisted |
3208 | iexplore.exe | 52.211.167.226:80 | www.vertice360.com | Amazon.com, Inc. | IE | unknown |
3208 | iexplore.exe | 216.58.206.14:80 | maps.google.com | Google Inc. | US | whitelisted |
3208 | iexplore.exe | 172.217.23.138:80 | fonts.googleapis.com | Google Inc. | US | whitelisted |
2940 | iexplore.exe | 52.211.167.226:80 | www.vertice360.com | Amazon.com, Inc. | IE | unknown |
3208 | iexplore.exe | 82.98.134.11:80 | wpvertice360.hl16.dinaserver.com | DinaHosting S.L. | ES | unknown |
3208 | iexplore.exe | 2.19.43.118:80 | platform-api.sharethis.com | Akamai International B.V. | — | whitelisted |
3208 | iexplore.exe | 108.177.126.155:443 | stats.g.doubleclick.net | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.bing.com |
| whitelisted |
www.vertice360 |
| unknown |
www.vertice360.com |
| unknown |
fonts.googleapis.com |
| whitelisted |
platform-api.sharethis.com |
| whitelisted |
www.google-analytics.com |
| whitelisted |
stats.g.doubleclick.net |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
maps.google.com |
| whitelisted |
wpvertice360.hl16.dinaserver.com |
| unknown |