Malware analysis https://adpop.xyz/UN3HO Malicious activity

Add for printing

URL:	https://adpop.xyz/UN3HO
Full analysis:	https://app.any.run/tasks/10267052-90bd-40d1-a121-ae093f5a2596
Verdict:	Malicious activity
Threats:	Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email. Malware Trends Tracker >>>
Analysis date:	June 12, 2019, 11:52:30
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:	trojan exploit underminer
Indicators:
MD5:	F30BF54A14FDC0F14CF848A9308CA783
SHA1:	A7628E1A29E5BF795A0724FB8EBC24A7EC490D6F
SHA256:	DDF6E475A994648BF6EC94FD6E625CF619A5E852121E836BAC8163AEE0D0B68B
SSDEEP:	3:N8+OLefKwl:2+keiwl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (73.0.3683.75)
Google Update Helper (1.3.33.23)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
Mozilla Firefox 65.0.2 (x86 en-US) (65.0.2)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
- Connects to CnC server
  - rundll32.exe (PID: 3740)
SUSPICIOUS
- Executed via COM
  - FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3932)
- Uses RUNDLL32.EXE to load library
  - dllhost.exe (PID: 1724)
  - rundll32.exe (PID: 3740)
- Reads Internet Cache Settings
  - dllhost.exe (PID: 1724)
- Low-level read access rights to disk partition
  - rundll32.exe (PID: 3740)
- Creates files in the program directory
  - rundll32.exe (PID: 272)
- Creates COM task schedule object
  - rundll32.exe (PID: 272)
- Executable content was dropped or overwritten
  - rundll32.exe (PID: 272)
- Application launched itself
  - rundll32.exe (PID: 3740)
INFO
- Application launched itself
  - iexplore.exe (PID: 2976)
- Reads internet explorer settings
  - iexplore.exe (PID: 3416)
- Changes internet zones settings
  - iexplore.exe (PID: 2976)
- Creates files in the user directory
  - iexplore.exe (PID: 3416)
  - FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3932)
- Reads Internet Cache Settings
  - iexplore.exe (PID: 3416)
  - iexplore.exe (PID: 2976)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
2976	"C:\Program Files\Internet Explorer\iexplore.exe" -nohome	C:\Program Files\Internet Explorer\iexplore.exe		explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)
3416	"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2976 CREDAT:71937	C:\Program Files\Internet Explorer\iexplore.exe		iexplore.exe
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)
3932	C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding	C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe	—	svchost.exe
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Version: 26,0,0,131
1724	"C:\Windows\system32\dllhost.exe"	C:\Windows\system32\dllhost.exe		iexplore.exe
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255)
3740	InetCpl.cpl,ClearMyTracksByProcess 8	C:\Windows\system32\rundll32.exe		dllhost.exe
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255)
272	/Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D6}	C:\Windows\system32\rundll32.exe		rundll32.exe
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows host process (Rundll32) Exit code: 4294967294 Version: 6.1.7600.16385 (win7_rtm.090713-1255)
2884	/Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D6}	C:\Windows\system32\dllhost.exe	—	rundll32.exe
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: COM Surrogate Version: 6.1.7600.16385 (win7_rtm.090713-1255)
2108	"C:\Windows\system32\msdtc.exe"	C:\Windows\system32\msdtc.exe		dllhost.exe
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Distributed Transaction Coordinator Service Version: 2001.12.8530.16385 (win7_rtm.090713-1255)
2816	"C:\Windows\system32\wbem\WmiPrvSE.exe"	C:\Windows\system32\wbem\WmiPrvSE.exe		msdtc.exe
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: WMI Provider Host Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
3688	"C:\Windows\system32\dllhost.exe"	C:\Windows\system32\dllhost.exe	—	msdtc.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Version: 6.1.7600.16385 (win7_rtm.090713-1255)

Add for printing

Total events

580

Read events

476

Write events

102

Delete events

Modification events


(PID) Process:	(2976) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:	write	Name:	CompatibilityFlags
Value: 0
(PID) Process:	(2976) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 0
(PID) Process:	(2976) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 1
(PID) Process:	(2976) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:	write	Name:	SecuritySafe
Value: 1
(PID) Process:	(2976) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:	write	Name:	ProxyEnable
Value: 0
(PID) Process:	(2976) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:	write	Name:	SavedLegacySettings
Value: 4600000071000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:	(2976) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:	write	Name:	{9E176481-8D08-11E9-A09E-5254004A04AF}
Value: 0
(PID) Process:	(2976) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:	write	Name:	Type
Value: 4
(PID) Process:	(2976) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:	write	Name:	Count
Value: 1
(PID) Process:	(2976) iexplore.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:	write	Name:	Time
Value: E307060003000C000B0034003900A603

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
2976	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico		—
		MD5:—	SHA256:—
2976	iexplore.exe	C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico		—
		MD5:—	SHA256:—
3416	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\D8J3YUYU\5AwPwgG3vs0U0shuvnI5p2MI5oKiZd8c[1].php		—
		MD5:—	SHA256:—
3416	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat		dat
		MD5:7AFE506547BF5857DB67A6EF681CF694	SHA256:2A21CE1F076E1ACD6A0A1C839631A13A2101C8EBAB7BF579DC5B11276A9396DB
3416	iexplore.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt		text
		MD5:E9FB8C22A8C282CCE536F72AD73F61ED	SHA256:845AB9BE5091FB92DB47490DE2F055B3773FB5F380120DBDC5DF959A0F939192
3416	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\49M1T1G6\desktop.ini		ini
		MD5:4A3DEB274BB5F0212C2419D3D8D08612	SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
3416	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\JSF1IQCF\index[1].php		—
		MD5:—	SHA256:—
3416	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BTUHXNOD\ninjamediascript_devdojo_com[1].txt		—
		MD5:—	SHA256:—
3416	iexplore.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@adpop[1].txt		text
		MD5:C0D579F7E4DAF0310BE130862EC57DC5	SHA256:FE13656030FF66FA556BB1561117EC2E893A852AC7905F8089B327631F1D46DE
3416	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat		dat
		MD5:ABC8C92ED866E3B55E5F1BFFDDB549AB	SHA256:255CD5BDEA6E7AD0A91E5970EAEBFFA91A8B92040E15D50474D17E1B051A05FD

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
3416	iexplore.exe	GET	302	67.198.185.101:80	http://67.198.185.101/Xa137b375cc3881a70e186ce2172c8TT.php	US	—	—	unknown
3416	iexplore.exe	GET	200	38.75.136.186:9081	http://38.75.136.186:9081/index.php?ad_id=PnRO6kbP34r-R5GHhnXpMg&re=PnRO6kbP34r-R5GHhnXpMg&rt=PnRO6kbP34r-R5GHhnXpMg&id=9081&zone=PnRO6kbP34r-R5GHhnXpMg&prod=PnRO6kbP34r-R5GHhnXpMg&lp=Type&st=PnRO6kbP34r-R5GHhnXpMg&e=1560340470&y=203380532409	US	html	967 b	suspicious
3416	iexplore.exe	GET	200	38.75.136.186:9081	http://38.75.136.186:9081/js/5oji6nr7150jad27ld9a6lb3pg.js	US	text	3.20 Kb	suspicious
3416	iexplore.exe	GET	200	104.25.141.116:80	http://ninjamediascript.devdojo.com/?pop	US	html	3.03 Kb	shared
3416	iexplore.exe	GET	200	104.25.141.116:80	http://ninjamediascript.devdojo.com/storage/posts/February2014/highlight-anything-stupid.jpg	US	image	57.5 Kb	shared
3416	iexplore.exe	GET	200	67.198.185.100:80	http://67.198.185.100/5AwPwgG3vs0U0shuvnI5p2MI5oKiZd8c.php	US	html	1.68 Kb	unknown
3416	iexplore.exe	GET	200	104.25.141.116:80	http://ninjamediascript.devdojo.com/storage/posts/February2014/nintendo-bed.jpg	US	image	56.8 Kb	shared
3416	iexplore.exe	GET	200	104.25.141.116:80	http://ninjamediascript.devdojo.com/themes/simple/assets/js/jquery.fitvid.js	US	html	1.00 Kb	shared
3416	iexplore.exe	GET	200	104.25.141.116:80	http://ninjamediascript.devdojo.com/storage/posts/January2014/raphael-is-real.jpg	US	image	82.2 Kb	shared
3416	iexplore.exe	GET	200	104.25.141.116:80	http://ninjamediascript.devdojo.com/themes/simple/assets/css/font-awesome.min.css	US	text	4.80 Kb	shared

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
3416	iexplore.exe	67.198.185.101:80	—	Krypt Technologies	US	unknown
3416	iexplore.exe	67.198.185.100:80	—	Krypt Technologies	US	unknown
2976	iexplore.exe	204.79.197.200:80	www.bing.com	Microsoft Corporation	US	whitelisted
3416	iexplore.exe	23.111.8.154:443	oss.maxcdn.com	netDNA	US	unknown
3416	iexplore.exe	38.75.136.186:9081	—	Cogent Communications	US	suspicious
3416	iexplore.exe	67.198.185.98:443	adpop.xyz	Krypt Technologies	US	suspicious
2976	iexplore.exe	67.198.185.100:80	—	Krypt Technologies	US	unknown
3740	rundll32.exe	38.75.136.186:9081	—	Cogent Communications	US	suspicious
3416	iexplore.exe	104.25.141.116:80	ninjamediascript.devdojo.com	Cloudflare Inc	US	shared
3740	rundll32.exe	38.75.136.174:1108	bbs.favcom.space	Cogent Communications	US	malicious

DNS requests

Domain	IP	Reputation
www.bing.com	204.79.197.200 13.107.21.200	whitelisted
adpop.xyz	67.198.185.98	malicious
oss.maxcdn.com	23.111.8.154	whitelisted
ninjamediascript.devdojo.com	104.25.141.116 104.25.142.116	unknown
bbs.favcom.space	38.75.136.174 38.75.137.200	malicious
news.onetouchauthentication.club	23.244.62.48 23.244.62.52 23.244.62.51	malicious
r.twotouchauthentication.online	23.244.33.47	unknown

Threats

PID	Process	Class	Message
3416	iexplore.exe	Potentially Bad Traffic	ET INFO Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
3416	iexplore.exe	A Network Trojan was detected	ET CURRENT_EVENTS Possible Underminer EK Landing
3416	iexplore.exe	Potential Corporate Privacy Violation	ET POLICY Outdated Flash Version M1
3416	iexplore.exe	A Network Trojan was detected	ET CURRENT_EVENTS Underminer EK IE Exploit
3740	rundll32.exe	A Network Trojan was detected	MALWARE [PTsecurity] Encrypted Hidden Bee binary payload
3740	rundll32.exe	A Network Trojan was detected	MALWARE [PTsecurity] Encrypted Hidden Bee binary payload

1 ETPRO signatures available at the full report

Add for printing

No debug info

General Info

https://adpop.xyz/UN3HO

F30BF54A14FDC0F14CF848A9308CA783

A7628E1A29E5BF795A0724FB8EBC24A7EC490D6F

DDF6E475A994648BF6EC94FD6E625CF619A5E852121E836BAC8163AEE0D0B68B

3:N8+OLefKwl:2+keiwl

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Connects to CnC server

SUSPICIOUS

Executed via COM

Uses RUNDLL32.EXE to load library

Reads Internet Cache Settings

Low-level read access rights to disk partition

Creates files in the program directory

Creates COM task schedule object

Executable content was dropped or overwritten

Application launched itself

INFO

Application launched itself

Reads internet explorer settings

Changes internet zones settings

Creates files in the user directory

Reads Internet Cache Settings

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings