analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://tiothralad.duckdns.org/

Full analysis: https://app.any.run/tasks/b1c97e8b-3ae1-45a0-a5c1-1b264ed59bdf
Verdict: Malicious activity
Analysis date: October 20, 2020, 07:34:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

491113D445B308AF8B0F61B9A4CE9F18

SHA1:

2BE00F4AAC6C1DB77C3AD3F1E8B25E61215E8B6C

SHA256:

F314870B8659C9A90789DD6F25C0E90F25CCABCE5CA5310085EF111DBAFA1507

SSDEEP:

3:N1KKMKFEKsGEWin:CKHBsGEWi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3264)
      • iexplore.exe (PID: 2192)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3264)
      • iexplore.exe (PID: 2192)
    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2192)
    • Creates files in the user directory

      • iexplore.exe (PID: 2192)
      • iexplore.exe (PID: 3264)
    • Changes internet zones settings

      • iexplore.exe (PID: 2192)
    • Application launched itself

      • iexplore.exe (PID: 2192)
    • Changes settings of System certificates

      • iexplore.exe (PID: 2192)
    • Reads internet explorer settings

      • iexplore.exe (PID: 3264)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2192"C:\Program Files\Internet Explorer\iexplore.exe" http://tiothralad.duckdns.org/C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3264"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2192 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Total events
584
Read events
487
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
36
Text files
28
Unknown types
22

Dropped files

PID
Process
Filename
Type
3264iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\GE5EE42T.txt
MD5:
SHA256:
3264iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZQWLXT97.txt
MD5:
SHA256:
3264iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab448F.tmp
MD5:
SHA256:
3264iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar4490.tmp
MD5:
SHA256:
3264iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZLWSX7CB.txttext
MD5:96A953B6B4FE85BD1A29DD1DF0161788
SHA256:F39097BD0D7663BACCD9D4CD1B31D034504DC3A6C2D9B65D15FB14364102C3DB
3264iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:D401FAB144198BD29F2FBF44B3F41E31
SHA256:1E56552C1CA31DFB91BA6D4E28631B7768FA360FD93978DCF2DE84FFD5BA4E40
3264iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_97B2E19124E9521136C1F687A1B92685binary
MD5:437E1177BDFE40764989E72F47416836
SHA256:C1D9D8FF8300670C5B6117DF02852636FD2D3AC3D769F9D9CE6C4BB654D677CD
3264iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\doc[1].htmhtml
MD5:C248E880503CCE702C1028CB7112C0E1
SHA256:B5E431A38E6324695BF5D50BB1C661832B36E4F76A3721ADDD633A0A79F2D8C9
3264iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\stars[1].pngimage
MD5:A3EBD3BB90BFB5BDEB9A1A6136183E5B
SHA256:9DD44DDBBFBF68FB1D2B9745950EE3B7AAB13A0D826AD8DA8005FBE41502C5DE
3264iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:3723741C1AA80B2A2A7B00DD6B287332
SHA256:813E1EB25265A8393B42848323A14C17C233E7DCA9C5E6996C95734F2498969C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
37
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3264
iexplore.exe
GET
302
185.162.9.176:80
http://tiothralad.duckdns.org/
NL
malicious
3264
iexplore.exe
GET
200
216.58.207.67:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDs6m8Yj1axcgIAAAAAfDUL
US
der
472 b
whitelisted
3264
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
3264
iexplore.exe
GET
200
216.58.207.67:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDs6m8Yj1axcgIAAAAAfDUL
US
der
472 b
whitelisted
3264
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEASN0yBwImska04MqUNKUKI%3D
US
der
279 b
whitelisted
3264
iexplore.exe
GET
200
216.58.207.67:80
http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCECiWpPQxRDpPAgAAAAB8NWE%3D
US
der
471 b
whitelisted
3264
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEASN0yBwImska04MqUNKUKI%3D
US
der
279 b
whitelisted
2192
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
3264
iexplore.exe
GET
200
216.58.207.67:80
http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCECiWpPQxRDpPAgAAAAB8NWE%3D
US
der
471 b
whitelisted
3264
iexplore.exe
GET
200
216.58.207.67:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCvuXQzBHNtKAgAAAAAWy1S
US
der
472 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2192
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3264
iexplore.exe
172.217.23.174:443
s.ytimg.com
Google Inc.
US
whitelisted
3264
iexplore.exe
185.162.9.176:80
tiothralad.duckdns.org
WorldStream B.V.
NL
malicious
3264
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3264
iexplore.exe
216.58.206.14:443
www.youtube-nocookie.com
Google Inc.
US
whitelisted
3264
iexplore.exe
104.28.15.209:443
findsqa.online
Cloudflare Inc
US
shared
3264
iexplore.exe
216.58.207.67:80
ocsp.pki.goog
Google Inc.
US
whitelisted
2192
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3264
iexplore.exe
172.217.16.195:443
fonts.gstatic.com
Google Inc.
US
whitelisted
2192
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
tiothralad.duckdns.org
  • 185.162.9.176
malicious
findsqa.online
  • 104.28.15.209
  • 104.28.14.209
  • 172.67.168.68
suspicious
ocsp.digicert.com
  • 93.184.220.29
whitelisted
www.youtube-nocookie.com
  • 216.58.206.14
  • 216.58.208.46
  • 172.217.18.14
  • 172.217.18.174
  • 216.58.207.78
  • 216.58.212.174
  • 216.58.212.142
  • 172.217.16.142
  • 172.217.18.110
  • 172.217.16.206
  • 172.217.23.110
  • 172.217.22.46
  • 172.217.22.78
  • 172.217.22.110
  • 142.250.74.206
  • 216.58.205.238
whitelisted
api.bing.com
  • 13.107.13.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.pki.goog
  • 216.58.207.67
whitelisted
s.ytimg.com
  • 172.217.23.174
whitelisted
fonts.gstatic.com
  • 172.217.16.195
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted

Threats

PID
Process
Class
Message
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
No debug info