analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://click.godaddy.com/email/2r5XJeb4g7fCHIsez0xwGQ/?currencyId=BRL&eid=ocp.email.transactional/3108.LayoutSimple/Rebrand/LogoGD.link.click&marketId=pt-BR&redir=https%3A%2F%2Fwww.godaddy.com%3Fisc%3DGDBBA3108%26utm_source%3Dgdocp%26utm_medium%3Demail%26utm_campaign%3Dpt-BR_other_email-nonrevenue_base_gd%26utm_content%3D220812_3108_Engagement_Other_Account_Account-Notification_GDBBA3108_2r5XJeb4g7fCHIsez0xwGQ

Full analysis: https://app.any.run/tasks/f6e29c27-e8da-4c79-85bd-5b1065f71d15
Verdict: Malicious activity
Analysis date: August 12, 2022, 19:09:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

5C0B5AE06FCF1E761B631A123189D748

SHA1:

CBC0C8AA155A160B89DC57B945D69D801905A23A

SHA256:

EA25874216C3EC1C3AF911682788B43CD276C85851BF969A6B079F7F9545AD6A

SSDEEP:

12:2Ub4YwNI36lFF40X0bP6DQRHSN29XTEH8mo2PQ1ofe/Lfc6He:2UbXwNK699Xm6QqCXTEW3+e/LD+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2068)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 2964)
      • iexplore.exe (PID: 2068)

    • Reads the computer name

      • iexplore.exe (PID: 2964)
      • iexplore.exe (PID: 2068)

    • Application launched itself

      • iexplore.exe (PID: 2964)

    • Changes internet zones settings

      • iexplore.exe (PID: 2964)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2964)
      • iexplore.exe (PID: 2068)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2964)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2068)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2068)
      • iexplore.exe (PID: 2964)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2964)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2964"C:\Program Files\Internet Explorer\iexplore.exe" "https://click.godaddy.com/email/2r5XJeb4g7fCHIsez0xwGQ/?currencyId=BRL&eid=ocp.email.transactional/3108.LayoutSimple/Rebrand/LogoGD.link.click&marketId=pt-BR&redir=https%3A%2F%2Fwww.godaddy.com%3Fisc%3DGDBBA3108%26utm_source%3Dgdocp%26utm_medium%3Demail%26utm_campaign%3Dpt-BR_other_email-nonrevenue_base_gd%26utm_content%3D220812_3108_Engagement_Other_Account_Account-Notification_GDBBA3108_2r5XJeb4g7fCHIsez0xwGQ"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2068"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2964 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
9 747
Read events
9 626
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
9
Text files
28
Unknown types
5

Dropped files

PID
Process
Filename
Type
2068iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771der
MD5:20421DBD2D15FA017533740E5EA501ED
SHA256:959525E9ED079352E1F27A556205BCC4E732C1DAA1602A30E80DC46699DF3A5C
2964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:87ABD3D593940CFE2A5AC048D69F694C
SHA256:61B005ECDEA10F1C0AD88DCC21D3D8CBA6ED3C297BD6502F2E98DCBF7A548624
2068iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\PUDEU1PP.txttext
MD5:EECD5D9E4ED800188E8095CFF65D3962
SHA256:F1FD14AA1AFCA58AB7D276AB856BD5850032B699DDF8F0FFC840A3A3FDAE9142
2964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:290A85BD3E7285CDEDA1602A9E12A7DF
SHA256:17AE86541BE373B2DB8A4B77D7E7626966637E5A6052F290A3B598A56F5123C9
2964iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
2068iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771binary
MD5:B63CBCF679700B3118FA1F000345A158
SHA256:DDA937275D3A777A8618F70F7971918B37F74FEAD9228FB6355CDF07FED50339
2068iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\1LZFTLRF.txttext
MD5:555F8593A8FB88B5EAEE5370C1F6BD0C
SHA256:F8117E7AEBE2326B00D83FF3DC15961E6BF622439400306CB6B7820CC428B39C
2964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8Fbinary
MD5:AD4CDB2D161F7069FA1194474E7A669B
SHA256:64B948D77D9B4086FC311B80062CC5C05C0F5213238ADBB8D1C742A94446B905
2964iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8Fder
MD5:58A71F87AF282C6F1BE4382B43CF019A
SHA256:5FFD69796323104DA230E13AC796184F4A4651AC8B943E17D4FBBC680BA3D6FB
2068iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\Q214MB04.txttext
MD5:58BD3B314010AF15DFC17A18899AA693
SHA256:B9BC030F3AFDDAF2C6DEA593AC88CF7D46EBC276EFA58F14BD4550CB0173A535
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
34
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2068
iexplore.exe
GET
200
192.124.249.41:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
US
der
1.69 Kb
whitelisted
2964
iexplore.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/Omniroot2025.crl
US
der
7.78 Kb
whitelisted
2964
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2068
iexplore.exe
GET
200
192.124.249.36:80
http://ocsp.starfieldtech.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCAzkUhA%3D%3D
US
der
1.70 Kb
whitelisted
2068
iexplore.exe
GET
200
192.124.249.36:80
http://ocsp.starfieldtech.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQUwPiEZQ6%2FsVZNPaFToNfxx8ZwqAQUfAwyH6fZMH%2FEfWijYqihzqsHWycCAQc%3D
US
der
1.74 Kb
whitelisted
2964
iexplore.exe
GET
200
23.216.77.80:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b28a749bdd6b43ab
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2964
iexplore.exe
13.107.21.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2964
iexplore.exe
23.216.77.80:80
ctldl.windowsupdate.com
NTT DOCOMO, INC.
US
suspicious
—
—
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2964
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2068
iexplore.exe
96.16.141.100:443
click.godaddy.com
Akamai International B.V.
US
unknown
2068
iexplore.exe
192.124.249.41:80
ocsp.godaddy.com
Sucuri
US
suspicious
2964
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2068
iexplore.exe
192.124.249.36:80
ocsp.godaddy.com
Sucuri
US
suspicious
2964
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2068
iexplore.exe
23.36.163.225:443
img6.wsimg.com
CW Vodafone Group PLC
NL
suspicious

DNS requests

Domain
IP
Reputation
click.godaddy.com
  • 96.16.141.100
unknown
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 13.107.21.200
  • 204.79.197.200
whitelisted
ctldl.windowsupdate.com
  • 23.216.77.80
  • 23.216.77.69
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
crl3.digicert.com
  • 93.184.220.29
whitelisted
ocsp.godaddy.com
  • 192.124.249.41
  • 192.124.249.36
  • 192.124.249.22
  • 192.124.249.24
  • 192.124.249.23
whitelisted
www.godaddy.com
  • 96.16.141.100
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://click.godaddy.com/email/2r5XJeb4g7fCHIsez0xwGQ/?currencyId=BRL&eid=ocp.email.transactional/3108.LayoutSimple/Rebrand/LogoGD.link.click&marketId=pt-BR&redir=https%3A%2F%2Fwww.godaddy.com%3Fisc%3DGDBBA3108%26utm_source%3Dgdocp%26utm_medium%3Demail%26utm_campaign%3Dpt-BR_other_email-nonrevenue_base_gd%26utm_content%3D220812_3108_Engagement_Other_Account_Account-Notification_GDBBA3108_2r5XJeb4g7fCHIsez0xwGQ