analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

index.html

Full analysis: https://app.any.run/tasks/8309a0bc-2033-4a27-bd9c-78bdcb1971a0
Verdict: Malicious activity
Analysis date: June 19, 2019, 14:56:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/html
File info: HTML document, UTF-8 Unicode text, with very long lines
MD5:

153425F864559DFA6F95FF32C4ADEABF

SHA1:

842CF06C231C4E551A57A1351C9BBC6D7BAB0DC7

SHA256:

DF1D10E8943FA500996FD239B60EEFA7FA4178638EBA2F8057B84DB06BE80284

SSDEEP:

192:e9nJA5dieIxSz+MhRhf9RK8728xUg4braXv9OraX2xCzM:tdvIxYlhX9IP8xsMkMVM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 1740)
      • iexplore.exe (PID: 2868)

    • Application launched itself

      • iexplore.exe (PID: 1740)

    • Changes internet zones settings

      • iexplore.exe (PID: 1740)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2868)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

EXIF

HTML

Title: The Girl with the Silver Eyes | Read Books Online
viewport: width=device-width, initial-scale=1.0
Description: -
Author: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1740"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\index.htmlC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2868"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1740 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
358
Read events
293
Write events
64
Delete events
1

Modification events

(PID) Process:(1740) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1740) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1740) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1740) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(1740) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1740) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000071000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(1740) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{7FDA4421-92A2-11E9-A370-5254004A04AF}
Value:
0
(PID) Process:(1740) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(1740) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
1
(PID) Process:(1740) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E3070600030013000E0039000500E101
Executable files
0
Suspicious files
0
Text files
7
Unknown types
1

Dropped files

PID
Process
Filename
Type
1740iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico —
MD5:—
SHA256:—
1740iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2868iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\515Wk2hT8bL[1].jpgimage
MD5:613D5F9B5FE2364C74F576FFCA6548DD
SHA256:F8F6212F82E7C2205025F911A67E915F6F873394BC3ACCEE43D658C7DA486B2E
1740iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].pngimage
MD5:9FB559A691078558E77D6848202F6541
SHA256:6D8A01DC7647BC218D003B58FE04049E24A9359900B7E0CEBAE76EDF85B8B914
2868iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\0[2].gifimage
MD5:07FFF40B5DD495ACA2AC4E1C3FBC60AA
SHA256:A065920DF8CC4016D67C3A464BE90099C9D28FFE7C9E6EE3A18F257EFC58CBD7
2868iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\bootstrap-responsive[1].csstext
MD5:702E8485242B3AE5B4CE75A5EDE13ACB
SHA256:F90709A6FB4D9012FEB84B6D9350277C003DBD8849CAF086DF83CE7FAF531F6F
2868iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019061920190620\index.datdat
MD5:2BBF75A0B3FD56682E3B6E084DFFEC60
SHA256:C4D119BADD385B1784A1D898244324E94B67D20AA654F38ECE42C208B6D4680B
1740iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Feeds Cache\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
2868iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\bootstrap.min[1].jstext
MD5:AABE25CA085001CCE9FBAF5AB575807D
SHA256:51908D4844F98FE69F3488867B02FD9605C6F5AB205C451369A9A9A07A3EFD63
2868iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\0[1].gifimage
MD5:07FFF40B5DD495ACA2AC4E1C3FBC60AA
SHA256:A065920DF8CC4016D67C3A464BE90099C9D28FFE7C9E6EE3A18F257EFC58CBD7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
10
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2868
iexplore.exe
GET
—
185.199.109.153:80
http://twitter.github.com/bootstrap/1.4.0/bootstrap-popover.js
NL
—
—
malicious
1740
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
2868
iexplore.exe
GET
200
52.85.182.106:80
http://ecx.images-amazon.com/images/I/515Wk2hT8bL.jpg
US
image
33.4 Kb
whitelisted
2868
iexplore.exe
GET
200
158.69.252.241:80
http://sstatic1.histats.com/0.gif?3170533&101
CA
image
43 b
whitelisted
2868
iexplore.exe
GET
200
209.197.3.15:80
http://netdna.bootstrapcdn.com/twitter-bootstrap/2.0.4/css/bootstrap-responsive.css
US
text
2.75 Kb
whitelisted
2868
iexplore.exe
GET
200
209.197.3.15:80
http://netdna.bootstrapcdn.com/twitter-bootstrap/2.0.4/js/bootstrap.min.js
US
text
5.80 Kb
whitelisted
2868
iexplore.exe
GET
200
158.69.252.241:80
http://sstatic1.histats.com/0.gif?3157822&101
CA
image
43 b
whitelisted
2868
iexplore.exe
GET
404
64.233.166.82:80
http://html5shim.googlecode.com/svn/trunk/html5.js
US
html
1.54 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1740
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
4
System
151.101.36.84:445
assets.pinterest.com
Fastly
US
unknown
4
System
151.101.36.84:139
assets.pinterest.com
Fastly
US
unknown
2868
iexplore.exe
172.217.16.138:443
ajax.googleapis.com
Google Inc.
US
whitelisted
2868
iexplore.exe
64.233.166.82:80
html5shim.googlecode.com
Google Inc.
US
whitelisted
2868
iexplore.exe
209.197.3.15:80
netdna.bootstrapcdn.com
Highwinds Network Group, Inc.
US
whitelisted
2868
iexplore.exe
185.199.109.153:80
twitter.github.com
GitHub, Inc.
NL
shared
—
—
52.85.182.106:80
ecx.images-amazon.com
Amazon.com, Inc.
US
whitelisted
2868
iexplore.exe
158.69.252.241:80
sstatic1.histats.com
OVH SAS
CA
suspicious

DNS requests

Domain
IP
Reputation
netdna.bootstrapcdn.com
  • 209.197.3.15
whitelisted
assets.pinterest.com
  • 151.101.36.84
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
html5shim.googlecode.com
  • 64.233.166.82
whitelisted
ecx.images-amazon.com
  • 52.85.182.106
  • 52.85.182.144
  • 52.85.182.148
  • 52.85.182.224
whitelisted
ajax.googleapis.com
  • 172.217.16.138
  • 172.217.22.42
  • 172.217.22.106
  • 172.217.18.106
  • 216.58.205.234
  • 172.217.21.234
  • 172.217.22.10
  • 172.217.18.10
  • 172.217.18.170
  • 216.58.207.42
  • 216.58.207.74
  • 172.217.16.170
whitelisted
twitter.github.com
  • 185.199.109.153
  • 185.199.110.153
  • 185.199.108.153
  • 185.199.111.153
malicious
sstatic1.histats.com
  • 158.69.252.241
  • 192.99.5.78
  • 198.27.80.143
  • 192.99.33.165
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
index.html