File name:

2019-07-05-Ursnif-EXE-retreived-by-Word-macro.exe

Full analysis: https://app.any.run/tasks/135dd720-114b-4cd9-91f7-736cfdbe4a60
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 03:29:06
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
gozi
ursnif
dreambot
banker
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

A5E5C5469CD26F297E1DA739FF45D1E3

SHA1:

04610601C745336A54DAD0B2D4700BA38689E173

SHA256:

E0C30A4833C93403DAF5E5CFDE9D76C23F1FAD411D75F6BE65B461B42CEB82AA

SSDEEP:

12288:eYsvsMtn4gtYJyzandrrjM7tA07NX2labKDoK:Bsvr4gtYJyzandrrjM7tA07Nmlac

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • URSNIF has been detected (SURICATA)

      • iexplore.exe (PID: 7180)
      • iexplore.exe (PID: 6972)
      • iexplore.exe (PID: 7420)
      • iexplore.exe (PID: 4000)
      • iexplore.exe (PID: 6960)
      • iexplore.exe (PID: 7572)
      • iexplore.exe (PID: 6708)
      • iexplore.exe (PID: 8112)
      • iexplore.exe (PID: 2780)

    • Connects to the CnC server

      • iexplore.exe (PID: 7180)
      • iexplore.exe (PID: 6972)
      • iexplore.exe (PID: 7420)
      • iexplore.exe (PID: 4000)
      • iexplore.exe (PID: 6960)
      • iexplore.exe (PID: 7572)
      • iexplore.exe (PID: 6708)
      • iexplore.exe (PID: 8112)
      • iexplore.exe (PID: 2780)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • iexplore.exe (PID: 7180)
      • iexplore.exe (PID: 6972)
      • iexplore.exe (PID: 7420)
      • iexplore.exe (PID: 4000)
      • iexplore.exe (PID: 6960)
      • iexplore.exe (PID: 7572)
      • iexplore.exe (PID: 6708)
      • iexplore.exe (PID: 8112)
      • iexplore.exe (PID: 2780)

  • INFO

    • The sample compiled with english language support

      • 2019-07-05-Ursnif-EXE-retreived-by-Word-macro.exe (PID: 7428)

    • Checks supported languages

      • 2019-07-05-Ursnif-EXE-retreived-by-Word-macro.exe (PID: 7428)
      • ielowutil.exe (PID: 1132)

    • Reads the computer name

      • 2019-07-05-Ursnif-EXE-retreived-by-Word-macro.exe (PID: 7428)
      • ielowutil.exe (PID: 1132)

    • Reads the software policy settings

      • SIHClient.exe (PID: 1764)
      • slui.exe (PID: 7484)
      • slui.exe (PID: 7720)

    • Local mutex for internet shortcut management

      • iexplore.exe (PID: 6272)

    • Checks proxy server information

      • slui.exe (PID: 7720)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:07:05 09:25:22+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 279040
InitializedDataSize: 346624
UninitializedDataSize: -
EntryPoint: 0x119e0
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 10.3.57.90
ProductVersionNumber: 10.3.57.90
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Unknown (0x4004)
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: Sight
CompanyName: Triangleplace Laughsuffix
FileDescription: Sugar
FileVersion: 10.3.57.90
LegalCopyright: SurveyMonkey Shapeduring
ProductName: Sugar
ProductVersion: 10.3.57.90
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
172
Monitored processes
31
Malicious processes
10
Suspicious processes
8

Behavior graph

Click at the process to see the details
start 2019-07-05-ursnif-exe-retreived-by-word-macro.exe no specs sppextcomobj.exe no specs slui.exe sihclient.exe ielowutil.exe no specs iexplore.exe #URSNIF iexplore.exe svchost.exe slui.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
660"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1132"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -EmbeddingC:\Program Files (x86)\Internet Explorer\ielowutil.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Low-Mic Utility Tool
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\ielowutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1760"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1760"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1764C:\WINDOWS\System32\sihclient.exe /cv 905ciNJUMkyT8t6AvKnINA.0.2C:\Windows\System32\SIHClient.exe
upfc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
SIH Client
Exit code:
2379777
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sihclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\combase.dll
c:\windows\system32\oleaut32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2616"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2780"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7104 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3180"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4000"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7540 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
44 852
Read events
44 550
Write events
252
Delete events
50

Modification events

(PID) Process:(1764) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}\/SLS/{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:Expires
Value:
2024-07-20 10:38:27
(PID) Process:(1764) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}\/SLS/{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:LastModified
Value:
2001-01-01 00:00:00
(PID) Process:(1764) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}\/SLS/{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:PotentialFailover
Value:
0
(PID) Process:(1764) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}\/SLS/{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:Data
Value:
<?xml version="1.0" encoding="utf-8"?><ServiceEnvironment ServiceID="522D76A4-93E1-47F8-B8CE-07C937AD1A1E" ID="DNSResiliency-CloudFlare-Live" Revision="1"><DNSConfigData><DNSconfigs elementVersion="1"><DNSconfig hostname="slscr.update.microsoft.com" pingtest="/sls/ping" domain=".update.microsoft.com" dnsserver="162.159.36.2"></DNSconfig><DNSconfig hostname="fe3cr.delivery.mp.microsoft.com" pingtest="/clientwebservice/ping" domain=".delivery.mp.microsoft.com" dnsserver="162.159.36.2"></DNSconfig></DNSconfigs><Flags elementVersion="1"><FeatureSwitchOn>1</FeatureSwitchOn><EnforceNRPTRule>0</EnforceNRPTRule><EnforceDomain>0</EnforceDomain><SkipDefaultDNSResolver>0</SkipDefaultDNSResolver></Flags></DNSConfigData></ServiceEnvironment>
(PID) Process:(1764) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}\/SLS/{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:ETag
Value:
"XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"
(PID) Process:(1764) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\dns
Operation:writeName:Data
Value:
<?xml version="1.0" encoding="utf-8"?><ServiceEnvironment ServiceID="522D76A4-93E1-47F8-B8CE-07C937AD1A1E" ID="DNSResiliency-CloudFlare-Live" Revision="1"><DNSConfigData><DNSconfigs elementVersion="1"><DNSconfig hostname="slscr.update.microsoft.com" pingtest="/sls/ping" domain=".update.microsoft.com" dnsserver="162.159.36.2"></DNSconfig><DNSconfig hostname="fe3cr.delivery.mp.microsoft.com" pingtest="/clientwebservice/ping" domain=".delivery.mp.microsoft.com" dnsserver="162.159.36.2"></DNSconfig></DNSconfigs><Flags elementVersion="1"><FeatureSwitchOn>1</FeatureSwitchOn><EnforceNRPTRule>0</EnforceNRPTRule><EnforceDomain>0</EnforceDomain><SkipDefaultDNSResolver>0</SkipDefaultDNSResolver></Flags></DNSConfigData></ServiceEnvironment>
(PID) Process:(1764) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{E7A50285-D08D-499D-9FF8-180FDC2332BC}\/SLS/{E7A50285-D08D-499D-9FF8-180FDC2332BC}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:Expires
Value:
2024-07-19 22:38:28
(PID) Process:(1764) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{E7A50285-D08D-499D-9FF8-180FDC2332BC}\/SLS/{E7A50285-D08D-499D-9FF8-180FDC2332BC}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:LastModified
Value:
2001-01-01 00:00:00
(PID) Process:(1764) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{E7A50285-D08D-499D-9FF8-180FDC2332BC}\/SLS/{E7A50285-D08D-499D-9FF8-180FDC2332BC}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:PotentialFailover
Value:
0
(PID) Process:(1764) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{E7A50285-D08D-499D-9FF8-180FDC2332BC}\/SLS/{E7A50285-D08D-499D-9FF8-180FDC2332BC}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:Data
Value:
<?xml version="1.0" encoding="UTF-8"?><ServiceEnvironment ServiceID="E7A50285-D08D-499D-9FF8-180FDC2332BC" ID="SIHProd" Revision="1"><WUClientData /><StoreClientData /><SIHClientData><Engine elementVersion="1" /><Actions elementVersion="1" /></SIHClientData></ServiceEnvironment>
Executable files
0
Suspicious files
50
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
7180iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DATbinary
MD5:0392ADA071EB68355BED625D8F9695F3
SHA256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
6272iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF6171158D4296F563.TMPbinary
MD5:C16BDCE4C189012658B948DDAA7C896B
SHA256:91BF21A17EDA7E40EDFBCE7869E41C7D254B36BC06D3AF0302BF166E719300A8
1764SIHClient.exeC:\Windows\Logs\SIH\SIH.20250325.032940.850.1.etlbinary
MD5:BDEE57EAEE7C94E213EF5A781826334B
SHA256:A07D1C57E77A5891E6BE0583DAB9F6554914123FBBFD420E597CF474E4ADD9F9
7180iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\SmartScreenCache.datbinary
MD5:0F7FF44657D1AAC60CFBE1C9B5447909
SHA256:60988329DB69CC7A4CA3EF8D64587AF0F5F31E36E64AD1B81325ADEC09962468
6272iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFBAF9087EF0F32FA7.TMPbinary
MD5:D05D225956D56499FCA5E3BC67AB9F6B
SHA256:CB627C8010E36778EA2369B3C97B6E6EE24BF238A500C4065657EF3FABD94825
7656iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF7C8D73A07BD88309.TMPbinary
MD5:B1DE5A4EBE45E22D87CB754BAAB6E9DA
SHA256:3DB20B4418A41EB8C7DC7609E398A59E50FF73E3A88376ED0336A180F7E746F2
6272iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{65F85276-0929-11F0-B4ED-18F7786F96EE}.datbinary
MD5:9AE0E506BF500F0A1607EBA055D57D7A
SHA256:E097A6B54CE1E5CC9937828BDA77162E919B4E5191415022BBAE67D57A740521
7656iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF138EFB2B423BC186.TMPbinary
MD5:8F72507F0DF1E862BE3A21734F8BDE94
SHA256:4712358E47521A23647585833AD76E786EEE05800F828A8DDD73A1B1550F2C90
7656iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{7F1564A6-0929-11F0-B4ED-18F7786F96EE}.datbinary
MD5:7EB33A6CA834A4F7BDE6CF335C8B4120
SHA256:0B5DFE8F12F200D379BCD3694CBE267C898CFF91012EDC1DA010DB926BFB3607
2616iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{98C9C228-0929-11F0-B4ED-18F7786F96EE}.datbinary
MD5:659B1A76D36559A4D597765F9C903994
SHA256:D87290B4F2D2E9A1C64729A310495B8B9F7D4925379B3B0FF2CE20BDDF93F374
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
85
DNS requests
28
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7572
iexplore.exe
GET
404
49.13.77.253:80
http://jraytjacynthe.com/images/djozqflldvh50E6UNIBEa/Nl63HtHCMjITEe9H/c8_2F4CXk0ghk6y/0_2FAjvIYEz53xaNTS/iX935PUZc/eup6nbiG0XjN2RPI6Pdm/MrCfWLkmS0DP7BWW8NT/zZLexo1BEi86YYvgaVsv7u/QnfsgVll_2FTt/Ebj.avi
unknown
—
—
malicious
8112
iexplore.exe
GET
404
49.13.77.253:80
http://cclaudeq19.top/images/RApAsdtumz/FKE9eFcmSuBeW23_2/FigdKDRy1fNq/uHuQS4_2B8d/eYqDiqt8f4_2Bd/sBJVq6IuFp_2BPlAlTcat/C94wWeIutwUbOO_2/FYz1EgJQK6nt9xi/jDABo7ZMRIUVtJUHeW/f5AOfQqmu/m3M0DjYn/2gfgolJz/o.avi
unknown
—
—
malicious
6960
iexplore.exe
GET
404
49.13.77.253:80
http://cclaudeq19.top/images/AdmHe_2B/wFqIbVAhKiNJfn1c_2FR69P/bV2EHxFuSg/SgUV2MSPbYSVFtqSk/VvMPMDIDMV4y/5RzOS49qZ_2/BIBnywR0XMfjSv/jpe1iF7db0_2BaBvEa0q1/VmKwPdgn84b0vyNb/OkjXzzeTrPFE79j/6UU_2BWSU/odA0.avi
unknown
—
—
malicious
6708
iexplore.exe
GET
404
49.13.77.253:80
http://kleorad93wk.com/images/6U4B9EkogDN4lvS/xCVbxUzvGL3bI_2B2R/A3QARjElp/NYZQr_2F_2BMQZAd7lWF/g_2FGFLIvqdeH5voYsq/o8RKs1FeI6xwvH84XS7DL4/m8wgj8S1yzYKZ/FkmZzPWF/CwjfXSehieTASf_2BCbDcQx/zgh7Kz9JU5/27k.avi
unknown
—
—
malicious
4000
iexplore.exe
GET
404
49.13.77.253:80
http://kleorad93wk.com/images/uLPLphar6He/cml9ObmYx5KKjp/dB4Dc1DyL_2FtBHeVdke2/A3i5D5cnZ1uzcSNA/FeEJ4_2Bkqyypx2/stJfk9cWYlf1gi9_2F/mpfjvW1p6/pPBgjgfa_2B7kbkJSDqM/hfSaYAeUBiXawwYNDLQ/8QrP3Ylhm_2FNS/qf9.avi
unknown
—
—
malicious
7324
iexplore.exe
GET
404
49.13.77.253:80
http://cclaudeq19.top/images/sz8WBuiZeU5/xIYn6iJf4IrTTg/GCRfOwatPSvW5I1NZGRgx/v4Us0PPEdGovdv5w/QqgvqlhCZLDffVH/AOx6253oJGgkayYW3g/Mit5DKwHE/RQIn2GCdEbIf1yBiFO0q/QUI7knNavmpE3CLBeQZ/JAQ5LBg.avi
unknown
—
—
unknown
7420
iexplore.exe
GET
404
49.13.77.253:80
http://jraytjacynthe.com/images/lXxIee_2B1S0Saq46otz6G/YfIwieRlPwJvB/YRsbPBkk/0_2FiczTsH8GjF9FNq8Vhqx/xiYWKZov9l/FgRxQcDSBmI9liap9/mH5n_2F5lt_2/FR3tW_2BCv4/iKVdKrvhJ9URaB/SfOSRSLeF0EQpq0pXjQQM/BcFWg_2B/iAw.avi
unknown
—
—
malicious
6972
iexplore.exe
GET
404
49.13.77.253:80
http://kleorad93wk.com/images/cFCX5tL1/xxigpAwRgLmJPjjnSg7HwAD/nv72RQO3Xp/f3MsGS_2BQnloMGzo/4T8gL73Qe6As/TRKpbXbEtOR/SlcaW7m77HoJcy/VGfcO8RzwzVGfKdEOGueJ/SmXbESLAm8C_2BVM/MH8q3_2BL5jvWm3/EFh5l5Bu/1.avi
unknown
—
—
malicious
7180
iexplore.exe
GET
404
49.13.77.253:80
http://cclaudeq19.top/images/Cm3osn23Pc/Ptuuw9vGjXdvr9BIx/Dfl1RGwt88Ys/B59d5kJXc0L/4zJYZK4AKNoX99/mTx3BTSJXw4mWR54h1nfI/utnzCPVURmP1XIeR/x_2F6Qjq_2BS2nm/loTfVfuUHPQ38bZm4T/HfMTYWd_2Bs2dAd/EQ6zkiq.avi
unknown
—
—
malicious
2780
iexplore.exe
GET
404
49.13.77.253:80
http://jraytjacynthe.com/images/cC_2Bt2ZyyNeQfLeybn28mV/1YinExZnbu/rVEnZTNieXo8iec_2/FkcrWzEZhaNM/mhR65sTrAPT/H_2BPOZ21VhZyL/ddsnGegm_2BZo4eUBOGhL/iH8ciiFuS7MNtXoi/iENCMOfs10B80U_/2FWpfvY6B4EnY84XhS/8pOrCjgC0/UCBhNNpEQCQ/x3Z8.avi
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7616
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1764
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 142.250.184.238
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.159.71
  • 20.190.159.23
  • 20.190.159.131
  • 20.190.159.130
  • 40.126.31.71
  • 40.126.31.131
  • 20.190.159.68
  • 40.126.31.69
whitelisted
arc.msn.com
  • 20.223.35.26
  • 20.223.36.55
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
  • 2603:1030:800:5::bfee:a08d
whitelisted
241.42.69.40.in-addr.arpa
  • —
unknown
d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown
cclaudeq19.top
  • 49.13.77.253
malicious

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
7180
iexplore.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
7180
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
6972
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
7324
iexplore.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
7420
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
4000
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
4000
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
6960
iexplore.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
6960
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2019-07-05-Ursnif-EXE-retreived-by-Word-macro.exe