URL:

cachewebspace.com

Full analysis: https://app.any.run/tasks/fa2120e6-cd71-41d9-84a0-45c10335e41a
Verdict: Malicious activity
Analysis date: February 05, 2024, 22:21:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

5EFD4671112DB800AD7BDF88B51F5DAC

SHA1:

A713818CDE214346CAF92C8EBD9053B1E976BAC3

SHA256:

DEED41500D977B00F4B4E0444CC4A11E180DBD7894B972E8E6BA368C3564401C

SSDEEP:

3:KN3uGTn:fKn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 1380)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1380"C:\Program Files\Internet Explorer\iexplore.exe" "cachewebspace.com"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3468"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1380 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
7 596
Read events
7 526
Write events
64
Delete events
6

Modification events

(PID) Process:(1380) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(1380) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(1380) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(1380) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1380) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1380) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1380) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1380) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1380) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1380) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
5
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
3468iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\suspendedpage[1].htmhtml
MD5:CE1BF3088202F084A5EB964684D54717
SHA256:10D02096528CA2AB47613062CEBD88F53BA572AB96AB3ADC251B785B0A6376FB
1380iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\suspendedpage[1].htmhtml
MD5:CE1BF3088202F084A5EB964684D54717
SHA256:10D02096528CA2AB47613062CEBD88F53BA572AB96AB3ADC251B785B0A6376FB
1380iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\favicon[2].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
1380iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:44925E00ADA03BA90D82DB00D163241F
SHA256:D30AA03E03C32C170C10770C5A18F116D49EE37F86953FF97A3D4FBDE3742BBC
3468iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\all[1].csstext
MD5:42EAA52604673B64D6B356C2FD7F87E3
SHA256:ED0F122470C4D13D86BBABDC38046D743D0228204A56D786D2E17BD83FD358CE
1380iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Ader
MD5:A1E0D07666D36FB36727F60DC0B3095C
SHA256:7230890A5BF83B5878B2D9AB6D94A234979D14D8D4F1DC57BB75B6498101D8EC
3468iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\fa-regular-400[1].eotbinary
MD5:D7DE79CAE74B02F2D377786656F1D816
SHA256:E73D73F67B277568AB01D56322D1A01D66409A8F947735DD738FE2DCB6BB0C58
1380iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Abinary
MD5:C58D1A03AA3CCBE72D38A3BAA019618A
SHA256:49E25ACC803AB76916C87B1265C97DB4827E94CF16C6F170960275B2C4C40D29
1380iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
3468iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\fa-solid-900[1].eotbinary
MD5:10C304F14CD2F6B6BED2AE7F574F03AF
SHA256:F5D00BFD4457C03601F28E200ED5DB6E5BF58B332164A1E630FA6AAFCFAB6BCB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
15
DNS requests
10
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3468
iexplore.exe
GET
302
46.4.107.174:80
http://cachewebspace.com/
unknown
html
234 b
—
3468
iexplore.exe
GET
200
46.4.107.174:80
http://cachewebspace.com/cgi-sys/suspendedpage.cgi
unknown
html
4.02 Kb
—
3468
iexplore.exe
GET
200
172.64.207.38:80
http://use.fontawesome.com/releases/v5.0.6/css/all.css
unknown
text
7.36 Kb
—
3468
iexplore.exe
GET
200
172.64.207.38:80
http://use.fontawesome.com/releases/v5.0.6/webfonts/fa-regular-400.eot?
unknown
binary
14.7 Kb
—
3468
iexplore.exe
GET
200
172.64.207.38:80
http://use.fontawesome.com/releases/v5.0.6/webfonts/fa-solid-900.eot?
unknown
binary
48.8 Kb
—
1380
iexplore.exe
GET
302
46.4.107.174:80
http://cachewebspace.com/favicon.ico
unknown
html
234 b
—
1380
iexplore.exe
GET
200
46.4.107.174:80
http://cachewebspace.com/cgi-sys/suspendedpage.cgi
unknown
html
4.02 Kb
—
1380
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?95d95b669c097e41
unknown
—
—
—
1380
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4c4bae6a1643aa04
unknown
—
—
—
1380
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
313 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3468
iexplore.exe
46.4.107.174:80
cachewebspace.com
Hetzner Online GmbH
DE
unknown
3468
iexplore.exe
172.64.207.38:80
use.fontawesome.com
CLOUDFLARENET
US
unknown
1380
iexplore.exe
46.4.107.174:80
cachewebspace.com
Hetzner Online GmbH
DE
unknown
1380
iexplore.exe
104.126.37.130:443
www.bing.com
Akamai International B.V.
DE
unknown
1380
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
1380
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
cachewebspace.com
  • 46.4.107.174
unknown
use.fontawesome.com
  • 172.64.207.38
  • 172.64.206.38
unknown
api.bing.com
  • 13.107.5.80
unknown
www.bing.com
  • 104.126.37.170
  • 104.126.37.171
  • 104.126.37.130
  • 104.126.37.123
  • 104.126.37.168
  • 104.126.37.179
  • 104.126.37.128
  • 104.126.37.186
  • 104.126.37.185
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
unknown
ocsp.digicert.com
  • 192.229.221.95
unknown

Threats

PID
Process
Class
Message
—
—
Exploit Kit Activity Detected
ET EXPLOIT_KIT Parrot TDS Domain in DNS Lookup (cachewebspace .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
cachewebspace.com