URL:

https://bs.yandex.ru

Full analysis: https://app.any.run/tasks/7c8511b8-483b-410a-b809-ec594c8819a1
Verdict: Malicious activity
Analysis date: October 19, 2023, 14:53:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

D9B9A5E5CE4EF2614EFDEF5FE2A12702

SHA1:

522D0A2FE3F8FCD8A297CD3CD122B6D78A1769BB

SHA256:

DAC224B1E025C4239F92A3F9026973BF51A2E366E2149B83B28911FB85D4E176

SSDEEP:

3:N8LEn:2m

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Yandex.exe (PID: 1432)
      • Yandex.exe (PID: 1928)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Yandex.exe (PID: 1432)

    • Reads the Internet Settings

      • Yandex.exe (PID: 1432)

    • Application launched itself

      • Yandex.exe (PID: 1432)

    • Reads settings of System Certificates

      • Yandex.exe (PID: 1432)

    • Checks Windows Trust Settings

      • Yandex.exe (PID: 1432)

  • INFO

    • Checks supported languages

      • Yandex.exe (PID: 1432)
      • Yandex.exe (PID: 1928)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 556)
      • iexplore.exe (PID: 3716)

    • Application launched itself

      • iexplore.exe (PID: 556)

    • The process uses the downloaded file

      • iexplore.exe (PID: 556)
      • Yandex.exe (PID: 1432)

    • Checks proxy server information

      • Yandex.exe (PID: 1432)

    • Reads the computer name

      • Yandex.exe (PID: 1432)

    • Create files in a temporary directory

      • Yandex.exe (PID: 1432)

    • Reads the machine GUID from the registry

      • Yandex.exe (PID: 1432)

    • Creates files or folders in the user directory

      • Yandex.exe (PID: 1432)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
5
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iexplore.exe yandex.exe yandex.exe

Process information

PID
CMD
Path
Indicators
Parent process
556"C:\Program Files\Internet Explorer\iexplore.exe" "https://bs.yandex.ru"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\iertutil.dll
1432"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\Yandex.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\Yandex.exe
iexplore.exe
User:
admin
Company:
YANDEX LLC
Integrity Level:
MEDIUM
Description:
Yandex
Exit code:
0
Version:
23.9.3.936
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
1928"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\Yandex.exe" --parent-installer-process-id=1432 --run-as-admin --setup-cmd-line="fake_browser_arc --abt-config-resource-file=\"C:\Users\admin\AppData\Local\Temp\abt_config_resource\" --abt-update-path=\"C:\Users\admin\AppData\Local\Temp\cd350826-8e01-4018-8011-0238f00ddd3c.tmp\" --brand-name=yandex --distr-info-file=\"C:\Users\admin\AppData\Local\Temp\distrib_info\" --make-browser-default-after-import --ok-button-pressed-time=2134653320 --progress-window=131904 --send-statistics --variations-update-path=\"C:\Users\admin\AppData\Local\Temp\66f801de-f283-4117-a022-0e57a718daf4.tmp\" --verbose-logging"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\Yandex.exe
Yandex.exe
User:
admin
Company:
YANDEX LLC
Integrity Level:
HIGH
Description:
Yandex
Exit code:
0
Version:
23.9.3.936
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\78rfyb7z\yandex.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3248"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:556 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\version.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\rpcrt4.dll
3716"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:556 CREDAT:1054000 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
Total events
35 716
Read events
35 510
Write events
198
Delete events
8

Modification events

(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000056010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(556) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
5
Suspicious files
72
Text files
132
Unknown types
0

Dropped files

PID
Process
Filename
Type
3248iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_50E6DADAC585E5443F9B15D324CEF70Bbinary
MD5:C3E240006F40B3BFB13CDE16F8CB9C83
SHA256:2ABAB56420A0A30E70E33AA5366730FE96B70C74FCC63F2DF20C096A9DC7BF12
3248iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046binary
MD5:E76FCCFF3DAB1B5FF83FA66F2FED70BF
SHA256:DAB47D6F709BD3FF31944BE45B3393DF1AFFCCCED868B008C4E1470688A8245A
3248iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\BIR8XOXX.txttext
MD5:8C3F832E4C5EAFAB8491105EE1764CA7
SHA256:F769041D1843D04C5CAEDF40D8AD3507602FB5A2E47ECB1CC05FF0C1FD7A26F5
3248iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046binary
MD5:5B895CD51E8130795FCBC628C84729C0
SHA256:6F3F0B424C47AF87817A8728DB073BEF0B169304DDB80227670393E7567D2928
3248iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\GTW3XCAI.txttext
MD5:679624A7B8F249D73511501006405D07
SHA256:2E5E300922A7C19534B20DC43C8E49CD70B361E0FFEB47EE6CB87FF6F4A7ED35
3248iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:4D1A8D93E4368E23742623105B4F2476
SHA256:F99F9767FE1AAA9ABA2105C664EE3B0BB468120289B9CC3090F720C6434912AB
3248iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_29FE8CD43EAA1639E5932AC185712964binary
MD5:59C06CB36E6D1F1E54BC2F4371692878
SHA256:5A871D2F3F5675A32C35EB0658D8066B7EE89B32084FDDAC9033FDEFD52EC93A
3248iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\CSPKHAXR.txttext
MD5:06B6A9AD9532AF174FA69DA49D05C27A
SHA256:5879D53AAC8B4C5999439A4179CB45099F3DCA43AF85034BF87CE1BD6FA96EC6
3248iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_50E6DADAC585E5443F9B15D324CEF70Bbinary
MD5:58D2392ADEB618A4793639CECDEBA596
SHA256:4B0D7E204ACE98E41D2A134FD09AF747AC2A2CB93694ADEF6A3D81AC9F377951
556iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[2].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
98
DNS requests
39
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3248
iexplore.exe
GET
200
146.75.122.133:80
http://ocsp2.globalsign.com/rootr5/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQiD0S5cIHyfrLTJ1fvAkJWflH%2B2QQUPeYpSJvqB8ohREom3m7e0oPQn1kCDQHuXyKVQkkF%2BQGRqNw%3D
unknown
binary
1.25 Kb
unknown
3248
iexplore.exe
GET
200
72.21.81.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8f869686e34b7eef
unknown
compressed
4.66 Kb
unknown
3248
iexplore.exe
GET
200
146.75.122.133:80
http://ocsp.globalsign.com/rootr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHUeP1PjGFkz6V8I7O6tApc%3D
unknown
binary
1.41 Kb
unknown
3248
iexplore.exe
GET
200
146.75.122.133:80
http://ocsp.globalsign.com/gseccovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSTMjK03nNiYoQYvu4Izyfn9OJNdAQUWHuOdSr%2BYYCqkEABrtboB0ZuP0gCDENqNL2NzdqQCxTmkQ%3D%3D
unknown
binary
938 b
unknown
556
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
313 b
unknown
3248
iexplore.exe
GET
200
146.75.122.133:80
http://ocsp.globalsign.com/gseccovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSTMjK03nNiYoQYvu4Izyfn9OJNdAQUWHuOdSr%2BYYCqkEABrtboB0ZuP0gCDDeQwBkGHaRwgVLWqQ%3D%3D
unknown
binary
939 b
unknown
3248
iexplore.exe
GET
200
146.75.122.133:80
http://ocsp.globalsign.com/gseccovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSTMjK03nNiYoQYvu4Izyfn9OJNdAQUWHuOdSr%2BYYCqkEABrtboB0ZuP0gCDEHsohnj8sQ7zjdN1w%3D%3D
unknown
binary
939 b
unknown
3248
iexplore.exe
GET
200
146.75.122.133:80
http://ocsp.globalsign.com/gsrsaovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBRrcGT%2BanRD3C1tW3nsrKeuXC7DPwQU%2BO9%2F8s14Z6jeb48kjYjxhwMCs%2BsCDGRXYw0qv%2BdJBvJ6dg%3D%3D
unknown
binary
1.40 Kb
unknown
3716
iexplore.exe
GET
200
151.101.2.133:80
http://ocsp.globalsign.com/gsrsaovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBRrcGT%2BanRD3C1tW3nsrKeuXC7DPwQU%2BO9%2F8s14Z6jeb48kjYjxhwMCs%2BsCDBikMoZ5F8vF67dKdA%3D%3D
unknown
binary
1.40 Kb
unknown
3248
iexplore.exe
GET
200
146.75.122.133:80
http://ocsp.globalsign.com/gseccovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSTMjK03nNiYoQYvu4Izyfn9OJNdAQUWHuOdSr%2BYYCqkEABrtboB0ZuP0gCDDeQwBkGHaRwgVLWqQ%3D%3D
unknown
binary
939 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3248
iexplore.exe
77.88.21.90:443
—
YANDEX LLC
RU
whitelisted
3248
iexplore.exe
72.21.81.240:80
ctldl.windowsupdate.com
EDGECAST
US
whitelisted
3248
iexplore.exe
146.75.122.133:80
ocsp.globalsign.com
FASTLY
US
unknown
556
iexplore.exe
23.53.43.176:443
www.bing.com
Akamai International B.V.
DE
unknown
556
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
556
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
3248
iexplore.exe
5.255.255.70:443
yandex.ru
YANDEX LLC
RU
whitelisted
3248
iexplore.exe
5.255.255.242:443
ya.ru
YANDEX LLC
RU
unknown

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 72.21.81.240
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 23.53.43.176
  • 23.53.43.170
  • 23.53.43.168
  • 23.53.43.162
  • 23.53.43.152
  • 23.53.43.153
  • 23.53.43.154
  • 23.53.43.122
  • 23.53.43.161
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.globalsign.com
  • 146.75.122.133
  • 151.101.2.133
  • 151.101.66.133
  • 151.101.130.133
  • 151.101.194.133
whitelisted
ocsp2.globalsign.com
  • 146.75.122.133
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
yandex.ru
  • 5.255.255.70
  • 77.88.55.88
  • 77.88.55.60
  • 5.255.255.77
whitelisted
ya.ru
  • 5.255.255.242
  • 77.88.55.242
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://bs.yandex.ru