analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www.ali213.net/

Full analysis: https://app.any.run/tasks/3794c549-83a4-47cb-8d9d-063497783fa6
Verdict: Malicious activity
Analysis date: December 05, 2022, 18:11:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

8895E0B2261F817B0AF511BC47A029D7

SHA1:

65F5CED2EDB0B3E59D0FCFCC0A7EB8161854D2F3

SHA256:

F2C40D3110DC1EF9CEE37A6B07BB8FEB7E2317AF969A0AF56629A9DCA2783CAD

SSDEEP:

3:N8DSLJDLz:2OL5X

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 1580)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1580"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.ali213.net/"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
404"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1580 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Total events
14 255
Read events
14 140
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
14
Text files
50
Unknown types
11

Dropped files

PID
Process
Filename
Type
1580iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442der
MD5:503AD061073A29CEE4CB12D552F6A5B3
SHA256:D2A97423F8B71CA1DAAC39F8A037DCA022303C1ADFBD49995EFF3B36AFFF33F9
1580iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442binary
MD5:F949339A81A2972C82D51910C8A15E8A
SHA256:54B40C69C7FE480C0D8D0685F8982D8B9994503AA7D5161351C9CDEC76BBCD06
404iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_D14B79B440CDC26D7D21C81855E2C04Dbinary
MD5:5A5FC9F514929B47E278F378EEA92635
SHA256:427CF4901B427B3A152F4AAFE1053A83F1A42A00B288B8FCA3180F0779CB43CD
404iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A703EA3C7C94B2431D59916C8740791Dder
MD5:596B115627914DCB30E7A8250A1E2B75
SHA256:7DA426241D6AB43408140EEB889A0B38021EEB071F8DC04F2D4563B02489E3B0
404iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\WAI3GX36.htmhtml
MD5:74A983E8EA037A11BEF71E95AF858D94
SHA256:F5CF49D1402E4051E052BC0F31BE8256A489DF2E98AFEB7260B1AF549138A927
404iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\realtime_hits[1].jstext
MD5:306FC93B6CE30D6130A57630328E60BE
SHA256:D23AE351F48482601013238942FDB2AE3D89D95F27C28DA099F3A4BB67966258
404iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\index[1].jstext
MD5:847E25279302030F7D3EF198FDE3C916
SHA256:E5B23DE74EC465F91E2944F5E20070DC676EB6219AD88E20BED724FBD19F0B78
404iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:9BE6BDA1566BDE75287FE26AE79B7CD6
SHA256:0ACAB911F91C7E3879D141577D82430BD003D2F838C17D31B37424C7CA8819F7
404iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\ali-sso-pc-global-version-1[1].jshtml
MD5:9787100B500543C5AEA02B548C2C81AA
SHA256:A254DC8324D0CF03ABABEFF3DCCC2A7B9351B30EEEACA43527C06CE2EADC6D40
404iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\delayed_load[1].jstext
MD5:E0D3625F00669A8AEFBDCD415B9F7AB3
SHA256:B388B1758397438CEE7C17BAEB858D0CDAC9A6D0519DEB4EEEF51358746CA4B6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
48
DNS requests
22
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSXi0cW5bD2WLrmnasWibg2OuPDpgQUVXRPsnJP9WC6UNHX5lFcmgGHGtcCEAbwcvwdRzLBvyjSLBPpVh0%3D
US
der
471 b
whitelisted
404
iexplore.exe
GET
200
172.64.155.188:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
1.42 Kb
whitelisted
1580
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
404
iexplore.exe
GET
200
172.64.155.188:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEB0IKVQ4TL90r2m5kRab8C0%3D
US
der
2.18 Kb
whitelisted
404
iexplore.exe
GET
200
172.64.155.188:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
2.18 Kb
whitelisted
404
iexplore.exe
GET
200
172.64.155.188:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQCrg2GmcjJBlWFgo9R1F0x3
US
der
472 b
whitelisted
1580
iexplore.exe
GET
200
23.216.77.80:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d2691ac2c2cbac57
US
compressed
4.70 Kb
whitelisted
404
iexplore.exe
GET
200
172.64.155.188:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEQDVbiRslO1jq7FG78GWtk%2Bw
US
der
2.18 Kb
whitelisted
1580
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ5rEWLwbJFq%2FmAU80sm7E%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1580
iexplore.exe
13.107.22.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1580
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
1580
iexplore.exe
131.253.33.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
404
iexplore.exe
45.248.8.106:443
web.ali213.net
CHINATELECOM JiangSu YangZhou IDC networkdescr: YangZhouJiangsu Province, P.R.China.
CN
unknown
1580
iexplore.exe
23.216.77.69:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
suspicious
404
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
1580
iexplore.exe
23.216.77.80:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
suspicious
404
iexplore.exe
168.80.171.96:443
aqyzmedia.yunaq.com
QT Inc.
SC
suspicious
404
iexplore.exe
60.12.147.52:443
static.ali213.net
CHINA UNICOM China169 Backbone
CN
unknown

DNS requests

Domain
IP
Reputation
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 131.253.33.200
  • 13.107.22.200
whitelisted
ctldl.windowsupdate.com
  • 23.216.77.69
  • 23.216.77.80
  • 93.184.221.240
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared
ocsp.digicert.com
  • 93.184.220.29
whitelisted
static.ali213.net
  • 60.12.147.52
unknown
web.ali213.net
  • 45.248.8.106
suspicious
aqyzmedia.yunaq.com
  • 168.80.171.96
  • 38.54.35.168
suspicious
v.trustutn.org
  • 47.103.42.25
unknown
ocsp.usertrust.com
  • 172.64.155.188
  • 104.18.32.68
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.ali213.net/