analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://rischyo.cf

Full analysis: https://app.any.run/tasks/cf33855d-0a6c-4195-bd30-ec03554f7e44
Verdict: Malicious activity
Analysis date: October 04, 2022, 23:15:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

36DCBA563E23AC671978A3698CD2C0D9

SHA1:

B3551AF928083BA2E490C592C7ED38638F422913

SHA256:

DFD9412E2B4097E2CD4F9312E578C2BDFD3A8BAA0F0C378C7A26A380F7C093A4

SSDEEP:

3:N1KMK+D:CMK+D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3956)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 3232)
      • iexplore.exe (PID: 3956)

    • Checks supported languages

      • iexplore.exe (PID: 3232)
      • iexplore.exe (PID: 3956)

    • Changes internet zones settings

      • iexplore.exe (PID: 3232)

    • Application launched itself

      • iexplore.exe (PID: 3232)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3956)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3956)
      • iexplore.exe (PID: 3232)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 3956)

    • Creates files in the user directory

      • iexplore.exe (PID: 3956)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3232)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3956)
      • iexplore.exe (PID: 3232)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3232)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3232"C:\Program Files\Internet Explorer\iexplore.exe" "http://rischyo.cf"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3956"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3232 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
Total events
17 252
Read events
17 096
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
14
Text files
73
Unknown types
13

Dropped files

PID
Process
Filename
Type
3232iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:B4CED41DD21C3C906125DBA361F8BA77
SHA256:6509444A267B01F088BCABAC4A7A9B7184C65B25D580BB6AFA08642E311D12A7
3956iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\CWBP02P4.txttext
MD5:2957E884D4F0305D103A68F8473F3685
SHA256:1182AE1A697C159E08AC2127A5A98CE0172CDE5F4D6AE0E4210B228F9A84A373
3232iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442binary
MD5:50DDE51C97B6395F32FA0C209803E115
SHA256:2A0CD29D320BD4E5196C9C65861C0EBDB60CF93F9E57C150AA356926D5E985EB
3956iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\451025123A22EB28E59EC89C0BD4D0AC_9B7EC2A7658032C5E257DD7F9C9949C5binary
MD5:4D5816C6701FADBFB266C58DA4FE6B83
SHA256:78FC783BEF752F3500251DB19822075ECAD69FCD6C84A14F032C3BFB29AE93D0
3956iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\rc4-cipher-is-no-longer-supported-in-internet-explorer-11-or-microsoft-edge-f8687bc1-1f88-9abe-5c81-b00c26290f36[1].htmhtml
MD5:00013BF2F00CAD55EB78EADEA779A7A5
SHA256:1E1679E4D1F5C3D39FF14D52CE4A4F3A65ACF9B5896B8AA0201A1C93D5D4325B
3956iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:C4F48170939190D31D574ECD5293C145
SHA256:61B260B04486AC2CA88BA8F077390CFB261BEEBBF6A18295C42C776AC64875BE
3232iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\favicon[3].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
3232iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver50FF.tmpxml
MD5:CBD0581678FA40F0EDCBC7C59E0CAD10
SHA256:159BD4343F344A08F6AF3B716B6FA679859C1BD1D7030D26FF5EF0255B86E1D9
3232iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xmlxml
MD5:CBD0581678FA40F0EDCBC7C59E0CAD10
SHA256:159BD4343F344A08F6AF3B716B6FA679859C1BD1D7030D26FF5EF0255B86E1D9
3956iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\articleCss[1].csstext
MD5:94A8583DE8712A80BE362867E4C73BFE
SHA256:50207905302B5B9BEECD1C25436E7CDD55BBBCB77080A1C17BE46C2B3808423E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
76
DNS requests
32
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3956
iexplore.exe
GET
—
5.199.143.110:80
http://rischyo.cf/
DE
—
—
suspicious
3956
iexplore.exe
GET
—
5.199.143.110:80
http://rischyo.cf/
DE
—
—
suspicious
3956
iexplore.exe
GET
—
5.199.143.110:80
http://rischyo.cf/
DE
—
—
suspicious
3956
iexplore.exe
GET
—
5.199.143.110:80
http://rischyo.cf/
DE
—
—
suspicious
3956
iexplore.exe
GET
—
5.199.143.110:80
http://rischyo.cf/
DE
—
—
suspicious
3956
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D
US
der
471 b
whitelisted
3232
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6c6eb969260ca870
US
compressed
4.70 Kb
whitelisted
3232
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3956
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
der
471 b
whitelisted
3956
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA9bw6F2y3ieICDHiTyBZ7Q%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3232
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
3232
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
3956
iexplore.exe
5.199.143.110:80
rischyo.cf
myLoc managed IT AG
DE
suspicious
3232
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3232
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
3956
iexplore.exe
5.199.143.110:443
rischyo.cf
myLoc managed IT AG
DE
suspicious
3956
iexplore.exe
104.125.30.92:443
go.microsoft.com
AKAMAI-AS
DE
unknown
3956
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
3956
iexplore.exe
152.199.19.160:443
ajax.aspnetcdn.com
EDGECAST
US
whitelisted
3956
iexplore.exe
2.18.233.62:443
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
rischyo.cf
  • 5.199.143.110
suspicious
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
go.microsoft.com
  • 104.125.30.92
whitelisted
support.microsoft.com
  • 2.18.233.31
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .cf Domain
3956
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
3956
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://rischyo.cf