analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://A6ZH0.COM/eRguYpqBb

Full analysis: https://app.any.run/tasks/02fcf86f-0387-4ef7-9a07-e5531c36c62e
Verdict: Malicious activity
Analysis date: October 04, 2022, 19:44:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

A8CAC7741CE9EF4725B10F3FAED807C0

SHA1:

428A8E718E7DBF9516A06517612ED5DDE6412C3A

SHA256:

F34CEBC1E91982A38694619534CA8E8CCE71AA12FF14F69C50C7E6084FFC9E81

SSDEEP:

3:N1KJvxpqn:CJxpqn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 1016)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 1016)
      • iexplore.exe (PID: 660)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 660)
      • iexplore.exe (PID: 1016)

    • Reads the computer name

      • iexplore.exe (PID: 1016)
      • iexplore.exe (PID: 660)

    • Application launched itself

      • iexplore.exe (PID: 660)

    • Changes internet zones settings

      • iexplore.exe (PID: 660)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 1016)
      • iexplore.exe (PID: 660)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1016)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
660"C:\Program Files\Internet Explorer\iexplore.exe" "http://A6ZH0.COM/eRguYpqBb"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
1016"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:660 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Total events
10 433
Read events
10 318
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
6
Text files
6
Unknown types
3

Dropped files

PID
Process
Filename
Type
660iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442der
MD5:B8BDA0B382A7D056A4241B388338B778
SHA256:7BAA967F6686CCE471826B20FFA5CB7FEB4BF3C5C0BF43F51F08E84EB5850DD2
660iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:A3C00581E3FA169BD13AD4AF3FD169A8
SHA256:00860FD58E1BB7B7C9805F711C19BAF6BBB28378B8D72B04756F6019BEE47647
1016iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:CCAB42ECBA750BBE763A5EE451B9655A
SHA256:B9401D5666EDB245D645CC9F9E81041928BCA6CA7161857FC309EFB5873E4BF7
660iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:AFC3E2584B32E1E7C23C33E9534089A5
SHA256:61597F5F937DA250A5ED7B4B82867BEBC546A5A35C0029982A003B1E9CBD2E7E
1016iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A37B8BA80004D3266CB4D93B2052DC10_9930CFFA1A8DC7DD2E91B8BAFFAF726Dbinary
MD5:37B33615E35EC387C73E80A821D61986
SHA256:4577FD2B4AD28A640FF22DCFDDDAE1A6738BF27A66DC8F88B581217B78715533
660iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442binary
MD5:B8FA458A882497FF13AE35897F5B9BB6
SHA256:60E7728B93054A4FEFA36FB77AA49B11E6C7A5A1F3BC382D2EABACDD9D11D5B5
1016iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A37B8BA80004D3266CB4D93B2052DC10_9930CFFA1A8DC7DD2E91B8BAFFAF726Dder
MD5:99200F420B2F95F1CFC82E51618B1462
SHA256:33DFE0C0649BEB524805141E86ABDC641156579FEAD902CE5118269C39A565D6
1016iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\1NGJHI91.htmhtml
MD5:822E683220D581184C70A9F6A4DF6501
SHA256:C11F4A9AA64E7F53F29D85BA943C716FFE9924755048FF70DF40ADD4F050D648
1016iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
660iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\urlblockindex[1].binbinary
MD5:FA518E3DFAE8CA3A0E495460FD60C791
SHA256:775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
30
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1016
iexplore.exe
GET
302
188.114.96.3:80
http://a6zh0.com/eRguYpqBb
US
—
—
malicious
1016
iexplore.exe
GET
200
96.16.142.215:80
http://ocsp.entrust.net/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBTLXNCzDvBhHecWjg70iJhBW0InywQUanImetAe733nO2lR1GyNn5ASZqsCDA7pTMMAAAAAUdN3hQ%3D%3D
US
der
1.55 Kb
whitelisted
660
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
1016
iexplore.exe
GET
301
54.201.94.116:80
http://tmobile.com/
US
html
148 b
malicious
660
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
660
iexplore.exe
GET
200
23.216.77.80:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5c722eb23531e57e
US
compressed
4.70 Kb
whitelisted
1016
iexplore.exe
GET
200
23.216.77.80:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6a01f46f272dd38f
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
660
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1016
iexplore.exe
188.114.96.3:80
a6zh0.com
CLOUDFLARENET
NL
malicious
1016
iexplore.exe
23.216.77.80:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
suspicious
1016
iexplore.exe
45.60.155.103:443
www.t-mobile.com
INCAPSULA
US
suspicious
1016
iexplore.exe
54.201.94.116:80
tmobile.com
AMAZON-02
US
malicious
660
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
660
iexplore.exe
23.216.77.80:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
suspicious
1016
iexplore.exe
23.36.163.244:443
unsupported.t-mobile.com
Akamai International B.V.
DE
malicious
1016
iexplore.exe
96.16.142.215:80
ocsp.entrust.net
AKAMAI-AS
DE
unknown
—
—
23.36.163.244:443
unsupported.t-mobile.com
Akamai International B.V.
DE
malicious

DNS requests

Domain
IP
Reputation
a6zh0.com
  • 188.114.96.3
  • 188.114.97.3
malicious
tmobile.com
  • 54.201.94.116
unknown
www.t-mobile.com
  • 45.60.155.103
suspicious
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ctldl.windowsupdate.com
  • 23.216.77.80
  • 23.216.77.69
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ocsp.entrust.net
  • 96.16.142.215
whitelisted
unsupported.t-mobile.com
  • 23.36.163.244
  • 23.36.163.247
malicious
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

PID
Process
Class
Message
1016
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1016
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1016
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://A6ZH0.COM/eRguYpqBb