analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://beckman.me.greythr.com/uas/portal/auth/reset?domain=YmVja21hbi5tZS5ncmV5dGhyLmNvbQ&guid=a2f10a30-4f31-4e5a-91d0-774b8c8686a1

Full analysis: https://app.any.run/tasks/2aed1b74-eacb-4dcd-834e-4a1d89cb2cfa
Verdict: Malicious activity
Analysis date: May 20, 2022, 17:16:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

73A82663D75F85A770CB54D52C0E0956

SHA1:

EC6C84A1CB5761D242C45BDABC13A49033571F6B

SHA256:

E20CCE5F4947B1226A4095FE755449E5C186978A04D053CCE311FA6D03B45777

SSDEEP:

3:N8AVUxGfKVKBEJKEEYgadIzPSE+ZsUkWV/yPEcYihhmpn:2AVUxTKBEJfEYghzPSMLmgYihhmp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 756)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 952)
      • iexplore.exe (PID: 756)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 756)
      • iexplore.exe (PID: 952)

    • Reads the computer name

      • iexplore.exe (PID: 756)
      • iexplore.exe (PID: 952)

    • Application launched itself

      • iexplore.exe (PID: 952)

    • Changes internet zones settings

      • iexplore.exe (PID: 952)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 756)
      • iexplore.exe (PID: 952)

    • Reads internet explorer settings

      • iexplore.exe (PID: 756)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
952"C:\Program Files\Internet Explorer\iexplore.exe" "https://beckman.me.greythr.com/uas/portal/auth/reset?domain=YmVja21hbi5tZS5ncmV5dGhyLmNvbQ&guid=a2f10a30-4f31-4e5a-91d0-774b8c8686a1"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
756"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:952 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
15 340
Read events
15 229
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
13
Text files
15
Unknown types
10

Dropped files

PID
Process
Filename
Type
756iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\572BF21E454637C9F000BE1AF9B1E1A9binary
MD5:C555CB34297574BC99DDD3ED839CB902
SHA256:579B237EBF660C4B6B66DFDDA853ED8510739D0B4EEB8DFAB3004CC5CB686C4E
756iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:060A2AA39F2C88FA30A36DA9AFDC71B9
SHA256:F659F11EEC2D360623AEE8A041E3102B094BBAB3DCFB542B75DDD5CE606F6AD4
756iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:0D907E172FBD05B60EF5AC407A2BFA6F
SHA256:81B270B25D91956D36416981542E9BE2B8B1C74E8A27093E18914393A314453F
756iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894der
MD5:EA14882BC25E3D89D7705A3E8B311D7E
SHA256:F348DA10BEF4F6AAC2AF202A368C4032B53447643B6FBEB62030BA083FA96A62
756iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D6243C18F0F8F9AEC6638DD210F1984_F0AB9CA41908629F82A537772C09854Cder
MD5:5559F1C049642954F1475483EEA3684F
SHA256:03FC9165B25BFB92D6ABB351CC1DBA904ED2543F64A49F5354FA1E74696D2C77
756iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0605C8271B1DA61544686BC717F1543Ebinary
MD5:9857A4B4F4914EAB568A9B48FF5C1A71
SHA256:37B94BD61220721EDB3DEBF4C68AF15FAF29CFE953FFC23B9D31E8178BD6F4C9
756iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\styles[1].csstext
MD5:152AB14568F8171F97A8D53AA8A36D3F
SHA256:5BB1916F6B41061F6627DBE7ACCF6901B58E75E23C8671C0E1D22C0B763C443B
756iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D6243C18F0F8F9AEC6638DD210F1984_F0AB9CA41908629F82A537772C09854Cbinary
MD5:9C38ED359229C17511C8F3DEADCC46E9
SHA256:0155DB2750223FE35C8C3046C6C9938F04C275C3E59803CA372B13C8CFBC4A8F
756iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62der
MD5:8854111B42F2C0664C424A8ED1CD6A0C
SHA256:D0AEC11AD9A9DD999CD1ED1163802E48C158BC414DB463B21AA217C2E83F4648
756iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4Fder
MD5:60937BA0E67EE3E021378614EDC8B41C
SHA256:3B339514CB3BDFCA941E2E1F215C9A28143E940D9D060471123E1217E24F22E4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
36
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
756
iexplore.exe
GET
200
104.18.32.68:80
http://crl.comodoca.com/AAACertificateServices.crl
US
der
506 b
whitelisted
756
iexplore.exe
GET
200
104.18.32.68:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
756
iexplore.exe
GET
200
18.66.242.155:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
756
iexplore.exe
GET
200
18.66.242.62:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D
US
der
1.39 Kb
shared
756
iexplore.exe
GET
200
104.18.32.68:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQDw3sKpLEbhcIgRfPUbRQgc
US
der
472 b
whitelisted
756
iexplore.exe
GET
200
18.66.242.81:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
756
iexplore.exe
GET
200
104.18.32.68:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
756
iexplore.exe
GET
200
108.156.253.92:80
http://ocsp.sca1b.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEA1SN%2F12JGTh%2Fc8ho4gtdLo%3D
US
der
471 b
whitelisted
756
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?86383142bcc27851
US
compressed
4.70 Kb
whitelisted
952
iexplore.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/DigiCertGlobalRootCA.crl
US
der
631 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
952
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
756
iexplore.exe
172.64.155.188:80
ocsp.comodoca.com
—
US
suspicious
756
iexplore.exe
104.18.32.68:80
ocsp.comodoca.com
Cloudflare Inc
US
suspicious
756
iexplore.exe
3.72.243.198:443
beckman.me.greythr.com
—
US
unknown
952
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
756
iexplore.exe
52.84.119.76:443
uas-ui3.cdn.greytip.com
Amazon.com, Inc.
US
unknown
—
—
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
—
—
108.156.253.92:80
ocsp.sca1b.amazontrust.com
—
US
whitelisted
952
iexplore.exe
52.84.119.76:443
uas-ui3.cdn.greytip.com
Amazon.com, Inc.
US
unknown
—
—
104.18.32.68:80
ocsp.comodoca.com
Cloudflare Inc
US
suspicious

DNS requests

Domain
IP
Reputation
beckman.me.greythr.com
  • 3.72.243.198
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.comodoca.com
  • 172.64.155.188
  • 104.18.32.68
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
crl.comodoca.com
  • 104.18.32.68
  • 172.64.155.188
whitelisted
ocsp.usertrust.com
  • 104.18.32.68
  • 172.64.155.188
whitelisted
ocsp.sectigo.com
  • 104.18.32.68
  • 172.64.155.188
whitelisted
uas-ui3.cdn.greytip.com
  • 52.84.119.76
  • 52.84.119.125
  • 52.84.119.58
  • 52.84.119.22
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://beckman.me.greythr.com/uas/portal/auth/reset?domain=YmVja21hbi5tZS5ncmV5dGhyLmNvbQ&guid=a2f10a30-4f31-4e5a-91d0-774b8c8686a1