File name:

2019-09-19-Ursnif-retreived-by-JavaScript-file.exe

Full analysis: https://app.any.run/tasks/f1e1879d-7b59-4b45-861b-a07fc4a666ba
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 07:50:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
gozi
ursnif
dreambot
banker
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

1043752ED8EDC1981CE6B518E01453EF

SHA1:

DA6F59899010CE80ECBD22AD689A31784574D473

SHA256:

E579BDDB599E3C5E0030BEB0A3C7F5015C068273CC252A8423B6B5060D375744

SSDEEP:

49152:QwObKetjeqnVSM8unZzvMuaE2sG22Z2+F0IWBnmv6gyj3xK85waxe7rgJBGaWtj5:KmeP89uNvEpZ2+F0IWBS/yjxK85wax2/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • URSNIF has been detected (SURICATA)

      • iexplore.exe (PID: 8084)
      • iexplore.exe (PID: 4784)
      • iexplore.exe (PID: 5956)
      • iexplore.exe (PID: 2152)
      • iexplore.exe (PID: 7752)
      • iexplore.exe (PID: 7232)
      • iexplore.exe (PID: 6384)

    • Connects to the CnC server

      • iexplore.exe (PID: 8084)
      • iexplore.exe (PID: 4784)
      • iexplore.exe (PID: 7752)
      • iexplore.exe (PID: 5956)
      • iexplore.exe (PID: 2152)
      • iexplore.exe (PID: 7232)
      • iexplore.exe (PID: 6384)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • iexplore.exe (PID: 8084)
      • iexplore.exe (PID: 4784)
      • iexplore.exe (PID: 7752)
      • iexplore.exe (PID: 5956)
      • iexplore.exe (PID: 2152)
      • iexplore.exe (PID: 7232)
      • iexplore.exe (PID: 6384)

  • INFO

    • Reads the software policy settings

      • SIHClient.exe (PID: 5156)
      • slui.exe (PID: 7632)
      • slui.exe (PID: 7828)

    • Reads the computer name

      • 2019-09-19-Ursnif-retreived-by-JavaScript-file.exe (PID: 7560)
      • ielowutil.exe (PID: 1180)

    • The sample compiled with english language support

      • 2019-09-19-Ursnif-retreived-by-JavaScript-file.exe (PID: 7560)

    • Checks supported languages

      • 2019-09-19-Ursnif-retreived-by-JavaScript-file.exe (PID: 7560)
      • ielowutil.exe (PID: 1180)

    • Local mutex for internet shortcut management

      • iexplore.exe (PID: 5728)

    • Checks proxy server information

      • slui.exe (PID: 7828)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:09:19 13:36:45+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 1393152
InitializedDataSize: 366592
UninitializedDataSize: -
EntryPoint: 0x12fdfc
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 14.4.68.12
ProductVersionNumber: 14.4.68.12
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Badgarden Genesis
FileDescription: Operaterest
FileVersion: 14.4.68.12 Tiedrive
InternalName: devenv.exe
LegalCopyright: © Badgarden Genesis.All rights reserved.
OriginalFileName: heav.exe
ProductName: Operaterest
ProductVersion: 14.4.68.12
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
168
Monitored processes
30
Malicious processes
9
Suspicious processes
4

Behavior graph

Click at the process to see the details
start 2019-09-19-ursnif-retreived-by-javascript-file.exe no specs sppextcomobj.exe no specs slui.exe sihclient.exe ielowutil.exe no specs iexplore.exe iexplore.exe slui.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1180"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -EmbeddingC:\Program Files (x86)\Internet Explorer\ielowutil.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Low-Mic Utility Tool
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\ielowutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1512"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1812"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2104"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2136"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2152"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3240 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3240"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3968"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4696"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5728 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4784"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7364 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
50 750
Read events
50 448
Write events
252
Delete events
50

Modification events

(PID) Process:(5156) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}\/SLS/{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:Expires
Value:
2024-07-20 10:38:27
(PID) Process:(5156) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}\/SLS/{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:LastModified
Value:
2001-01-01 00:00:00
(PID) Process:(5156) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}\/SLS/{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:PotentialFailover
Value:
0
(PID) Process:(5156) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}\/SLS/{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:Data
Value:
<?xml version="1.0" encoding="utf-8"?><ServiceEnvironment ServiceID="522D76A4-93E1-47F8-B8CE-07C937AD1A1E" ID="DNSResiliency-CloudFlare-Live" Revision="1"><DNSConfigData><DNSconfigs elementVersion="1"><DNSconfig hostname="slscr.update.microsoft.com" pingtest="/sls/ping" domain=".update.microsoft.com" dnsserver="162.159.36.2"></DNSconfig><DNSconfig hostname="fe3cr.delivery.mp.microsoft.com" pingtest="/clientwebservice/ping" domain=".delivery.mp.microsoft.com" dnsserver="162.159.36.2"></DNSconfig></DNSconfigs><Flags elementVersion="1"><FeatureSwitchOn>1</FeatureSwitchOn><EnforceNRPTRule>0</EnforceNRPTRule><EnforceDomain>0</EnforceDomain><SkipDefaultDNSResolver>0</SkipDefaultDNSResolver></Flags></DNSConfigData></ServiceEnvironment>
(PID) Process:(5156) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}\/SLS/{522D76A4-93E1-47F8-B8CE-07C937AD1A1E}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:ETag
Value:
"XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"
(PID) Process:(5156) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\dns
Operation:writeName:Data
Value:
<?xml version="1.0" encoding="utf-8"?><ServiceEnvironment ServiceID="522D76A4-93E1-47F8-B8CE-07C937AD1A1E" ID="DNSResiliency-CloudFlare-Live" Revision="1"><DNSConfigData><DNSconfigs elementVersion="1"><DNSconfig hostname="slscr.update.microsoft.com" pingtest="/sls/ping" domain=".update.microsoft.com" dnsserver="162.159.36.2"></DNSconfig><DNSconfig hostname="fe3cr.delivery.mp.microsoft.com" pingtest="/clientwebservice/ping" domain=".delivery.mp.microsoft.com" dnsserver="162.159.36.2"></DNSconfig></DNSconfigs><Flags elementVersion="1"><FeatureSwitchOn>1</FeatureSwitchOn><EnforceNRPTRule>0</EnforceNRPTRule><EnforceDomain>0</EnforceDomain><SkipDefaultDNSResolver>0</SkipDefaultDNSResolver></Flags></DNSConfigData></ServiceEnvironment>
(PID) Process:(5156) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{E7A50285-D08D-499D-9FF8-180FDC2332BC}\/SLS/{E7A50285-D08D-499D-9FF8-180FDC2332BC}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:Expires
Value:
2024-07-19 22:38:28
(PID) Process:(5156) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{E7A50285-D08D-499D-9FF8-180FDC2332BC}\/SLS/{E7A50285-D08D-499D-9FF8-180FDC2332BC}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:LastModified
Value:
2001-01-01 00:00:00
(PID) Process:(5156) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{E7A50285-D08D-499D-9FF8-180FDC2332BC}\/SLS/{E7A50285-D08D-499D-9FF8-180FDC2332BC}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:PotentialFailover
Value:
0
(PID) Process:(5156) SIHClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\sih\sls\{E7A50285-D08D-499D-9FF8-180FDC2332BC}\/SLS/{E7A50285-D08D-499D-9FF8-180FDC2332BC}/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
Operation:writeName:Data
Value:
<?xml version="1.0" encoding="UTF-8"?><ServiceEnvironment ServiceID="E7A50285-D08D-499D-9FF8-180FDC2332BC" ID="SIHProd" Revision="1"><WUClientData /><StoreClientData /><SIHClientData><Engine elementVersion="1" /><Actions elementVersion="1" /></SIHClientData></ServiceEnvironment>
Executable files
0
Suspicious files
51
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5728iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF639E7AF8522FC0E4.TMPbinary
MD5:755BBCF54611CB590797190286E8F3CE
SHA256:6F87AFC0546BF6B57A9AE22D1B8D136D9D97CF660F41697B53ADC2AFEB516EB9
5156SIHClient.exeC:\Windows\Logs\SIH\SIH.20250325.075039.748.1.etlbinary
MD5:2F6A57A1EC2ADF29F79F8611097FE994
SHA256:E0A07CF5318BA4CC3D464B23500EABA1820B9C1E98EA5F5A4C372C82BCE05D91
4696iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DATbinary
MD5:0392ADA071EB68355BED625D8F9695F3
SHA256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
5728iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF406E614C8CE89915.TMPbinary
MD5:A7D7A1AF733CAF8A5DA1ABD67E4E7937
SHA256:90924E021BCE63C3E93C310D5C173FA108E0C4A94507FE90DA7EFF535C8F9135
5728iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{DF609ED4-094D-11F0-B4ED-18F7786F96EE}.datbinary
MD5:52F6FC3CACF3710B0E6B71D2634B6434
SHA256:9604FE728D11EB2CE37E1332FCC1508EABA72CE65339B1DB0E846E1EBB7E549F
7912iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF661489741A750746.TMPbinary
MD5:8CA7E13FE0B565A750FCB57F8DFE8FA2
SHA256:38AD837405117B04A0BC0B55E0F7B7F477E647A424BF8E4820DE695E304A21E2
5728iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{DF609ED6-094D-11F0-B4ED-18F7786F96EE}.datbinary
MD5:22F752932AC05315278B699CD512740E
SHA256:FF1601ADB87E18924DC51C5821C14B74487852E5C7ADC60E741F21D4659FA1BA
4696iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\SmartScreenCache.datbinary
MD5:A64BA9F6E1927998A12C71C570C99872
SHA256:8221FC140EACC7332F3CCD6DDA9E5F14783140B9D65B305F8983C502832B0DC1
7364iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{054F6BDD-094E-11F0-B4ED-18F7786F96EE}.datbinary
MD5:1C41955E2944636B2CF31409ABD8B57D
SHA256:111DE0BA3FD98BC9AB28B66AD53EAC7675036963DD5A68CA725D4BB3524A86B3
7364iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{054F6BDF-094E-11F0-B4ED-18F7786F96EE}.datbinary
MD5:9C66A3C141EA44C08F9086E704D84DF7
SHA256:3471A9304E4647917149DFCAC166445399CE8EB53875E73485BA2EC4BBADA928
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
89
DNS requests
28
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4696
iexplore.exe
GET
404
216.58.206.46:80
http://google.com/images/5Qevhs5HMAjoSmtL9TI/nJjVdOHiJsAQbuAAQoEvhI/lSn8VUvOrUAKg/TJrkmOnH/BLf_2B9yCZwspQQa0HXLAfm/0JzDrdudnf/fjxrJXLXCOzrHPwbC/gIKkULtk4AeU/A4zN9zn2VMc/B7GIwcqhcg/n8MmtVs.avi
unknown
—
—
whitelisted
8084
iexplore.exe
GET
404
49.13.77.253:80
http://c54aavse.com/images/BRdSqhPgzO2Umz8y/hAGEZHwYVCpT1qF/_2BF_2BC4W9sNqXCcr/uiVBKlIwg/VATlIpuEHepvcVH_2BJX/jSCrPDeSEt8fgTsG6uT/9H4Hf6lcAsL4F603XAf0Le/qRPz5E1kCKNkS/m5V2l5H9/oR8Y7sK9lR7Q_/2BYSw.avi
unknown
—
—
malicious
4784
iexplore.exe
GET
404
49.13.77.253:80
http://zb6harold.com/images/Zs_2BY87vhL/jsXjS4H2EXytx_/2BQnHuUBEMoAFbxtG3YSo/jHaQ8K4aCEfCyfqM/CUGi9RSnBuaU8VM/V5ml_2FkV1Cbmu0464/MzUkM1Itt/88GnKbDHKC4QFt9oHa6N/LZ_2FE824Z0sM9D_2Fk/Ws6ziPStJ7eKkp_2FBXNpS/k_2B9BGXUTd3tj6Ae/SSU.avi
unknown
—
—
malicious
2152
iexplore.exe
GET
404
49.13.77.253:80
http://rzettajuliannee.com/images/BPv_2BIjR2vbwcCNdThb6c/OKwoLZrMtp18f/bNJ9Js9_/2FbH7m1CcOQz_2F0AHrfib6/x0WKsDFPxs/4pMBw5kK8YhqyS1tS/TFTIwaj04QaR/QLv3U8DosZ_/2BzwC_2FlIz3oK/Dy_2F7d2VVB1q3U0RLf65/oDpUoKa2/8Oa.avi
unknown
—
—
malicious
6392
iexplore.exe
GET
404
216.58.206.46:80
http://google.com/images/kSr46_2FSFFpK0ux4yg2L/UVTxFaUvpiy5oPL7/sbJoFBoNTl3unWW/fhwYtXk7m6RHhxXpuW/kg_2FTqoQ/dsZr36dxM4mCOc1PYOlS/Okg7FhKxVzDaImSqVBv/2wWiD1sLKgWWhIX0W5YpuC/h13QFCx2uw6dE/w.avi
unknown
—
—
whitelisted
6488
iexplore.exe
GET
404
49.13.77.253:80
http://rzettajuliannee.com/images/JmN9ijPwhPuWQlY/HmaAZCZb6BWOraeojw/ts3rccOMX/AHin2Hj1cR2XCmJpufBN/kFMKktVdk98Wr90WTvg/qoxZFLHUF63pAG6kdOoOqz/1_2FExyFmLfb2/1XlXzWMH/grLlHnKb4vwhoRoHMExTa3Q/rbrX7.avi
unknown
—
—
unknown
5956
iexplore.exe
GET
404
49.13.77.253:80
http://zb6harold.com/images/fzWc6Te4E_2Fg/NwNO9XTQ/DxYv363dQRIFMQK761o3Bm_/2FJUn0Fb4_/2Biyz70PAdNNJ_2Bu/SB1jpB9V2eHU/6ykaJD9sDdp/q_2BPDRFMi1Hyz/3_2FiaUVujWanc5s8o6Ky/DKTmrsmSfgUlqQxW/RnIwvUMTU626/nF1LH.avi
unknown
—
—
malicious
7232
iexplore.exe
GET
404
142.250.184.238:80
http://google.com/images/KqaTW_2BqvrMoc_2BZTy/gmTXFYKidhYKuE1M91W/9eJn2L3E56O8UztgZEuGnj/FQcVAJnUWbi_2/BV23fXGs/Ic027mQ939F1u7b8uuE3YvF/dIKZ_2BZXh/Q1Fv_2FUiEr3NzFcz/yRVFZB6eLN05/5iJWw1uxC7G/vZNYP.avi
unknown
—
—
whitelisted
7752
iexplore.exe
GET
404
49.13.77.253:80
http://c54aavse.com/images/StG_2FjQIBU/d_2F7vsovxyA9e/qQ_2FRtWdzAWdDI1PKoRS/K6rBUqQhnkZxQt1r/ZvmJwEXp8vX6_2B/a0EWeOKVaQX9YBySTh/yTLZGnnv6/2bslIbb0vuq8dA7c8OuD/N3yoVxDKm0YmcgY8QGG/wwIDxju3LXcYA0KhYkSd4m/Fq0ilpkgw1sFR/9.avi
unknown
—
—
malicious
6384
iexplore.exe
GET
404
49.13.77.253:80
http://c54aavse.com/images/ND_2B9t9/yMShjgMhv_2Frc171iRJtqM/wCluWdxUpB/w70xTPMkxdhSjJQSP/TbuLMtMBkXPB/eDLx_2BFlf3/_2FDl5xP8xo4f0/HCsGF_2BEai9pQZRwgNu3/pwWy_2B8nA4iQGqP/JvoEsxbPoQt5PgT/_2FQrKLUGmHsvOkaOb/y8EWzTreU/oumSKJO_2/Fel_2B.avi
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7900
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 216.58.206.46
  • 142.250.184.238
whitelisted
client.wns.windows.com
  • 40.113.103.199
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.32.140
  • 20.190.160.17
  • 40.126.32.74
  • 20.190.160.3
  • 20.190.160.130
  • 20.190.160.67
  • 20.190.160.131
  • 40.126.32.138
whitelisted
arc.msn.com
  • 20.223.35.26
  • 20.103.156.88
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
  • 2603:1030:800:5::bfee:a08d
whitelisted
241.42.69.40.in-addr.arpa
  • —
unknown
d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa
  • —
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
8084
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
4784
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
4784
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
2152
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
7752
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
5956
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
7232
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
6384
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
6384
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2019-09-19-Ursnif-retreived-by-JavaScript-file.exe