analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| URL: | http://tyannmeans.info/excel_document_file/z |
| Full analysis: | https://app.any.run/tasks/8cd8f0c6-5723-4518-8fe5-6df1e77bab1f |
| Verdict: | Malicious activity |
| Analysis date: | April 15, 2019, 08:48:38 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 445FCA1CB822FC12CB916F3E96155E3F |
| SHA1: | 0F469FC10E3AA574955EE85C2D53E68617637F6B |
| SHA256: | E36A88F3D313AE0D8A9B18F589234C9DB5410FA6998AA19E9630FC735422402D |
| SSDEEP: | 3:N1KKciRiWLnK0nIuRnf:CK7BnzN |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
Application launched itself
- iexplore.exe (PID: 2684)
Changes internet zones settings
- iexplore.exe (PID: 2684)
Reads settings of System Certificates
- iexplore.exe (PID: 2684)
Reads Internet Cache Settings
- iexplore.exe (PID: 2684)
- iexplore.exe (PID: 2480)
Reads internet explorer settings
- iexplore.exe (PID: 2480)
Creates files in the user directory
- iexplore.exe (PID: 2684)
- iexplore.exe (PID: 2480)
Adds / modifies Windows certificates
- iexplore.exe (PID: 2684)
Changes settings of System certificates
- iexplore.exe (PID: 2684)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
34
Monitored processes
2
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2684 | "C:\Program Files\Internet Explorer\iexplore.exe" http://tyannmeans.info/excel_document_file/z | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 2480 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2684 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
Total events
477
Read events
398
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
55
Unknown types
9
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2480 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CFGM1GYK\vwldmwnuwefvvxqof1rr7i46[1].php | — | |
MD5:— | SHA256:— | |||
| 2684 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 2684 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 2480 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\XFKC6N24\byovw3qpj5426w0qrrh45nyj[1].php | — | |
MD5:— | SHA256:— | |||
| 2480 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:4EF2B1B72C78B142380C7603654339FC | SHA256:0386645E61FE8439C4224A4BE043D9E67020F2E27EA0F2545EBD1F44410E22B5 | |||
| 2480 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\XFKC6N24\byovw3qpj5426w0qrrh45nyj[1].htm | html | |
MD5:A73DD861AAF87E5AAC483C106573381A | SHA256:EB1630FB30D27FD68EF835A31DAFDB56EA8CE937546190373221CE1D78A335C3 | |||
| 2480 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\A5TLOCH7\vwldmwnuwefvvxqof1rr7i46[1].htm | html | |
MD5:288034959E73A899F31822998F790119 | SHA256:C8444F5263A493958863E188CB96CA610C79018F445CABDA9C051BEF0FCF42D8 | |||
| 2480 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019041520190416\index.dat | dat | |
MD5:C57BC9D7B063AF7D88A2890BA37987F3 | SHA256:1EB46714C8364400B1966EE28812AE74CF0E58C5F91772B0BA8CDAD4518A9905 | |||
| 2480 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\A5TLOCH7\3[1].png | image | |
MD5:7D8D125F4DE0AD56D4A12478FC474505 | SHA256:E4DADEFAE9727720D9557F6B28A887528B945D0AF237C6C40E1F80601668C336 | |||
| 2480 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat | dat | |
MD5:027D4326C398DA781AE533E0431448C3 | SHA256:4A074AC41EE69D693F650490A5CAC16E3D6271DCFDE2178FC13B1158BD695118 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
35
DNS requests
17
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2480 | iexplore.exe | GET | — | 34.245.92.45:80 | http://tyannmeans.info/excel_document_file/z/enc/enc.php?email=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1 | IE | — | — | malicious |
— | — | GET | 302 | 52.142.114.176:80 | http://g.live.com/9uxp9en-us/ep_bro1 | IE | — | — | whitelisted |
2480 | iexplore.exe | GET | 200 | 34.245.92.45:80 | http://tyannmeans.info/excel_document_file/z/vwldmwnuwefvvxqof1rr7i46.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 | IE | html | 1.11 Kb | malicious |
2480 | iexplore.exe | GET | 301 | 34.245.92.45:80 | http://tyannmeans.info/excel_document_file/z | IE | html | 253 b | malicious |
2480 | iexplore.exe | GET | 200 | 34.245.92.45:80 | http://tyannmeans.info/excel_document_file/z/enc/byovw3qpj5426w0qrrh45nyj.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 | IE | html | 6.14 Kb | malicious |
2480 | iexplore.exe | GET | 200 | 34.245.92.45:80 | http://tyannmeans.info/excel_document_file/z/enc/ik/3.png | IE | image | 13.7 Kb | malicious |
2480 | iexplore.exe | POST | 302 | 34.245.92.45:80 | http://tyannmeans.info/excel_document_file/z/enc/zeus.php | IE | — | — | malicious |
2480 | iexplore.exe | GET | 301 | 13.107.42.13:80 | http://onedrive.live.com/ayrt/en-us/ | US | html | 154 b | shared |
2480 | iexplore.exe | GET | 302 | 34.245.92.45:80 | http://tyannmeans.info/excel_document_file/z/ | IE | html | 253 b | malicious |
2480 | iexplore.exe | GET | 200 | 34.245.92.45:80 | http://tyannmeans.info/excel_document_file/z/ik/d60da137-271e-492a-b2f8-98d8de6bcc2b.png | IE | image | 2.20 Kb | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2684 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
— | — | 13.107.42.13:80 | onedrive.live.com | Microsoft Corporation | US | malicious |
2684 | iexplore.exe | 13.107.21.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2480 | iexplore.exe | 2.16.186.25:443 | spoprod-a.akamaihd.net | Akamai International B.V. | — | whitelisted |
2684 | iexplore.exe | 34.245.92.45:80 | tyannmeans.info | Amazon.com, Inc. | IE | malicious |
2480 | iexplore.exe | 104.109.78.2:443 | p.sfx.ms | Akamai International B.V. | NL | whitelisted |
2480 | iexplore.exe | 34.245.92.45:80 | tyannmeans.info | Amazon.com, Inc. | IE | malicious |
2480 | iexplore.exe | 13.107.42.13:443 | onedrive.live.com | Microsoft Corporation | US | malicious |
— | — | 52.142.114.176:80 | g.live.com | Microsoft Corporation | IE | whitelisted |
2684 | iexplore.exe | 104.109.78.2:443 | p.sfx.ms | Akamai International B.V. | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
tyannmeans.info |
| malicious |
www.bing.com |
| whitelisted |
onedrive.live.com |
| shared |
spoprod-a.akamaihd.net |
| whitelisted |
p.sfx.ms |
| whitelisted |
g.live.com |
| whitelisted |
c.live.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
windows.microsoft.com |
| whitelisted |
support.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2480 | iexplore.exe | A Network Trojan was detected | MALWARE [PTsecurity] Adobe PDF Phishing Landing |
2480 | iexplore.exe | A Network Trojan was detected | MALWARE [PTsecurity] Adobe PDF Phishing Landing |
2480 | iexplore.exe | A Network Trojan was detected | ET CURRENT_EVENTS Excel/Adobe Online Phishing Landing Nov 25 2015 |
2480 | iexplore.exe | Potentially Bad Traffic | ET CURRENT_EVENTS Possible Excel Online Phishing Landing - Title over non SSL |
2480 | iexplore.exe | A Network Trojan was detected | MALWARE [PTsecurity] Possible Successful Generic Phish |
2480 | iexplore.exe | Generic Protocol Command Decode | SURICATA STREAM excessive retransmissions |
1 ETPRO signatures available at the full report