URL:

https://www.yourluckyoffer.com/c/7ae48a9f405b7a42?s5=mmywb5f31f102867f9957141448&s1={ior_web_ro}&s2={s2}

Full analysis: https://app.any.run/tasks/b20cacc4-18d6-4754-aa44-c8514624255c
Verdict: Malicious activity
Analysis date: August 14, 2020, 08:24:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

4A88F12D2E620AA99576C19E312A5F60

SHA1:

38941F591066ABABD134EB5BD6D3AF8F1E284FBC

SHA256:

DB52B5BB589619FB44D978FA74E78B29F8051CDAE34613A97A87F1F8F50E16E9

SSDEEP:

3:N8DSLUuGOcKz7qNIIaWXqRHsKX6zaXDZm:2OLUuGOccqNIrDRMM6zcQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 2764)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2764)
      • iexplore.exe (PID: 2284)

    • Application launched itself

      • iexplore.exe (PID: 2764)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2764)
      • iexplore.exe (PID: 2284)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2284)

    • Creates files in the user directory

      • iexplore.exe (PID: 2284)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2764)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2764)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2284"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2764 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2764"C:\Program Files\Internet Explorer\iexplore.exe" https://www.yourluckyoffer.com/c/7ae48a9f405b7a42?s5=mmywb5f31f102867f9957141448&s1={ior_web_ro}&s2={s2}C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
555
Read events
469
Write events
83
Delete events
3

Modification events

(PID) Process:(2764) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
1859834296
(PID) Process:(2764) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30831124
(PID) Process:(2764) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2764) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2764) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2764) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2764) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2764) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A3000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2764) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2764) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
0
Suspicious files
30
Text files
51
Unknown types
14

Dropped files

PID
Process
Filename
Type
2284iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab47E2.tmp —
MD5:—
SHA256:—
2284iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar47E3.tmp —
MD5:—
SHA256:—
2284iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\5KFVVU45.txt —
MD5:—
SHA256:—
2284iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\F41SV42T.txt —
MD5:—
SHA256:—
2764iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2284iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08der
MD5:A207734E4252AA2422DF75B7120325E6
SHA256:3182AB9BF19DAEAADB03D8C90BE485F3A287D9F7D262AF8DCAE365EF187331DD
2284iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08binary
MD5:B551F4D44D580A29F676223BF683F789
SHA256:E323165FE977A8375EAF0DA830C36C25080FF6304569108731AD5A3F5B66CEF7
2284iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6A4859E588D67439AF1050D52EC63D99der
MD5:2D0B0607ED791766E0D6B94F3600BB55
SHA256:9F8D8C04CCBEDF1467E0F485252A982AC30A3FC660A5A782BF9047A7E476E01C
2284iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\CFK2VV9E.txttext
MD5:BD620DD561C3B8A56018C56B96E65B99
SHA256:180FF060D3F7A36EE4CE3FA122BE376786E6AAC149C91CCF088F4A27BF33AC97
2284iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\61916327EF9631AEA99D0CD9B8DA38BEder
MD5:55842278C44F544476DEFD05DC20FE8F
SHA256:BC2171477722607909CB6164B7CB9CE8E2843470061CB475FAFC721B90528885
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
36
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2284
iexplore.exe
GET
200
195.138.255.16:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
DE
der
1.37 Kb
whitelisted
2284
iexplore.exe
GET
200
195.138.255.24:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
DE
der
1.37 Kb
whitelisted
2284
iexplore.exe
GET
200
216.58.210.3:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCEs0cc0pt0BwIAAAAAc8zc
US
der
472 b
whitelisted
2764
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
2284
iexplore.exe
GET
200
216.58.210.3:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
2764
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
2284
iexplore.exe
GET
200
216.58.210.3:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
2284
iexplore.exe
GET
200
216.58.210.3:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCEs0cc0pt0BwIAAAAAc8zc
US
der
472 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2764
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
—
—
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2764
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2284
iexplore.exe
34.251.244.248:443
www.yourluckyoffer.com
Amazon.com, Inc.
IE
suspicious
—
—
195.138.255.16:80
isrg.trustid.ocsp.identrust.com
AS33891 Netzbetrieb GmbH
DE
suspicious
—
—
195.138.255.24:80
isrg.trustid.ocsp.identrust.com
AS33891 Netzbetrieb GmbH
DE
whitelisted
2284
iexplore.exe
195.138.255.24:80
isrg.trustid.ocsp.identrust.com
AS33891 Netzbetrieb GmbH
DE
whitelisted
2764
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2284
iexplore.exe
156.67.36.11:443
o-2587.prodtraff.com
CQ International B.V.
DE
unknown
2284
iexplore.exe
156.67.36.15:443
bl.flirthits.com
CQ International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
www.yourluckyoffer.com
  • 34.251.244.248
suspicious
isrg.trustid.ocsp.identrust.com
  • 195.138.255.24
  • 195.138.255.16
whitelisted
ocsp.int-x3.letsencrypt.org
  • 195.138.255.24
  • 195.138.255.9
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.volumtrk4.com
  • 34.251.244.248
suspicious
o-2587.prodtraff.com
  • 156.67.36.11
suspicious
bl.flirthits.com
  • 156.67.36.15
unknown
lpmedia.justservingfiles.net
  • 69.16.175.42
  • 69.16.175.10
malicious
imedia.justservingfiles.net
  • 69.16.175.42
  • 69.16.175.10
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.yourluckyoffer.com/c/7ae48a9f405b7a42?s5=mmywb5f31f102867f9957141448&s1={ior_web_ro}&s2={s2}