URL:

https://waaw.to

Full analysis: https://app.any.run/tasks/98533674-3bce-46ee-ac89-b53e26033998
Verdict: Malicious activity
Analysis date: November 20, 2023, 11:40:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
SHA1:

BEC8CE19A16FBD2E892D9D632302174144B0A9E3

SHA256:

D95666F42172762064CA0C2166B84C066041ADE2B9E2D2326007877825E55811

SSDEEP:

3:N8V7Ls:2Js

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads the computer name

      • wmpnscfg.exe (PID: 3488)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3488)

    • Application launched itself

      • iexplore.exe (PID: 3156)

    • Checks supported languages

      • wmpnscfg.exe (PID: 3488)

    • The process uses the downloaded file

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 756)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3488)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
5
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wmpnscfg.exe no specs flashutil32_32_0_0_453_activex.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
148"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3156 CREDAT:202020 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
756C:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe -EmbeddingC:\Windows\System32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 32.0 r0
Exit code:
0
Version:
32,0,0,453
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_32_0_0_453_activex.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2928"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3156 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3156"C:\Program Files\Internet Explorer\iexplore.exe" "https://waaw.to"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3488"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
Total events
34 474
Read events
34 378
Write events
89
Delete events
7

Modification events

(PID) Process:(3156) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3156) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3156) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3156) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3156) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3156) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3156) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3156) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000059010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3156) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3156) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
0
Suspicious files
152
Text files
487
Unknown types
0

Dropped files

PID
Process
Filename
Type
2928iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:13478DFB63522ABD5969ADD38A71398A
SHA256:B3F1D6F6D8494598C706676F53B55F05C563937A525B2D2A9A0FE6525E2AF3AC
2928iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
2928iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8F8712BCE78D28F9C5E3E950CD93EADA_65D3F18F78AEAA18B0E58242F7706360binary
MD5:AB6193E433BB802395B76881B6F41F89
SHA256:E9FD3AEE42B480BCE73D758207D2E26E107AA42B9B672875040C25FEBFAD45E6
2928iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FA0A17BC17FF10008872A7205D0D43E2_608DEF97DFACECDA8E97C6F270153A4Fbinary
MD5:F327DCA5DECDFB31BDC8BFE64D3306A9
SHA256:8B2622183E352C56EFCD06AD90F40650B9187D14B60A6085F92F014F93774C89
2928iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8F8712BCE78D28F9C5E3E950CD93EADA_7A3CFFC47DEA5CADAB91C1F578106443binary
MD5:73B1C000C0A8F832503491859452CAA1
SHA256:D2F04E61AB146C2054802454D08940823559B820CFF159448B2397CAF6A2FB6F
2928iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\N3VQPIOG.htmhtml
MD5:955594F8E4773821DB4D311F01BC15F8
SHA256:AAAEC65CD43BB8F67F7E8D3CF9E7DD2B8196C6CC6152CFC0CFDCA2FE6B5B90B4
2928iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\MTAwMTE0XzE1ODY5MTc4NjE4NjNfMTg5MzgzOTc5X3VnY3ZjdXQ=[1].jpgimage
MD5:7FC7AD2B6591EF1EE499D40C276A32B2
SHA256:BA0F9BAC31F8BBC8FDA0C72522F8B92036D10134B844449E3AA4B82AC2F8BC91
2928iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\MTAwMTA2XzE2OTgyNzg3MjQ1Mzc=[1].jpgimage
MD5:20C65E35F3D23B6E90443BC04F39CCD2
SHA256:EBB9C756929A6878CC83EC4349DF3512C312A711CA0EF38C1329EB454B097F35
2928iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8F8712BCE78D28F9C5E3E950CD93EADA_65D3F18F78AEAA18B0E58242F7706360binary
MD5:0B16B4409B9AA6A56B9274A25AA1FF0D
SHA256:BDBCB1334AB68A3C30CAA268F2604866E16D8A53102F2EADB302992CAB9DC3D3
2928iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8F8712BCE78D28F9C5E3E950CD93EADA_7A3CFFC47DEA5CADAB91C1F578106443binary
MD5:A1BB53C2AFFEFF558A1DC23AF66F23F9
SHA256:68B43F686840010B75EBD2CF1E8A66E1143C30CCCE817B5098F691D71E338114
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
110
TCP/UDP connections
245
DNS requests
79
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2928
iexplore.exe
GET
—
163.171.130.132:80
http://i3.itc.cn/20150824/34b0_5d2abeab_e780_9619_9848_f536757fed74_1.jpg
unknown
—
—
unknown
2928
iexplore.exe
GET
—
43.152.44.160:80
http://i0.itc.cn/20151009/34b0_dca9af64_6242_1edd_4d43_ed75804abef5_1.jpg
unknown
—
—
unknown
2928
iexplore.exe
GET
—
43.152.44.160:80
http://i0.itc.cn/20151009/34b0_2c773446_2512_b763_5269_d146d3fb5e2b_1.jpg
unknown
—
—
unknown
2928
iexplore.exe
GET
200
163.181.56.209:80
http://ocsp.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEAVt7wEUQFzBMi%2F4ulOwW3A%3D
unknown
binary
471 b
unknown
2928
iexplore.exe
GET
200
163.181.56.209:80
http://ocsp.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEAVt7wEUQFzBMi%2F4ulOwW3A%3D
unknown
binary
471 b
unknown
2928
iexplore.exe
GET
200
23.53.40.51:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a1f744e7e9e1d6c2
unknown
compressed
4.66 Kb
unknown
2928
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
binary
979 b
unknown
2928
iexplore.exe
GET
200
163.181.56.209:80
http://ocsp.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoEcNCWvIoSyJCm34Ju7Es%3D
unknown
binary
471 b
unknown
2928
iexplore.exe
GET
200
23.53.40.51:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d6bb2ad0af14907d
unknown
compressed
4.66 Kb
unknown
2928
iexplore.exe
GET
200
163.181.56.209:80
http://ocsp.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEARG1gQtWCJqly6jHNwHlBA%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2928
iexplore.exe
190.115.19.71:443
waaw.to
DDOS-GUARD CORP.
BZ
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2928
iexplore.exe
23.53.40.51:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
2928
iexplore.exe
172.64.149.23:80
ocsp.usertrust.com
CLOUDFLARENET
US
unknown
2928
iexplore.exe
13.75.75.123:443
www.56.com
MICROSOFT-CORP-MSN-AS-BLOCK
HK
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2928
iexplore.exe
163.181.56.209:80
ocsp.dcocsp.cn
Zhejiang Taobao Network Co.,Ltd
DE
unknown
2928
iexplore.exe
163.181.92.232:443
photocdn.tv.sohu.com
Zhejiang Taobao Network Co.,Ltd
DE
unknown

DNS requests

Domain
IP
Reputation
waaw.to
  • 190.115.19.71
unknown
ctldl.windowsupdate.com
  • 23.53.40.51
  • 23.53.40.41
  • 23.53.40.57
  • 23.53.40.18
  • 23.53.40.40
  • 23.53.40.16
  • 23.53.40.11
  • 23.53.40.49
  • 23.53.40.19
  • 23.53.40.27
  • 23.53.40.10
  • 23.53.40.9
  • 23.53.40.58
  • 23.53.40.25
  • 23.53.40.26
whitelisted
ocsp.usertrust.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
www.56.com
  • 13.75.75.123
  • 52.175.9.163
unknown
ocsp.dcocsp.cn
  • 163.181.56.209
  • 163.181.56.210
  • 163.181.56.211
  • 163.181.56.212
  • 163.181.56.213
  • 163.181.56.214
  • 163.181.56.215
  • 163.181.56.216
whitelisted
s2.56img.com
  • 138.113.101.21
whitelisted
css.tv.itc.cn
  • 43.152.26.142
  • 43.152.26.154
  • 43.152.44.160
  • 43.152.26.221
  • 43.152.26.58
  • 43.152.26.104
  • 43.152.26.197
  • 43.152.26.151
whitelisted
js.tv.itc.cn
  • 163.171.130.132
unknown
s1.56img.com
  • 138.113.101.21
whitelisted
tv.sohu.com
  • 13.75.75.123
  • 52.175.9.163
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .to TLD
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://waaw.to