URL:

http://186.2.175.5/search

Full analysis: https://app.any.run/tasks/8c1fe890-8ae6-4550-b5b1-22d580c62240
Verdict: Malicious activity
Analysis date: March 02, 2024, 12:04:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

5A9313D4C44B8A533F654F0D54C4DF55

SHA1:

1F0B09B948A4B67EE8B4AE424090D7EBEF5BCB12

SHA256:

F3CB56DD8B1CA90291C7E8A677D5E8F91D224EE6F89A67AAC83350B0E6B11AEF

SSDEEP:

3:N1KlHbUSeQNA+a:C5UuBa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3656)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3656"C:\Program Files\Internet Explorer\iexplore.exe" "http://186.2.175.5/search"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3664"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3656 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
27 173
Read events
27 026
Write events
114
Delete events
33

Modification events

(PID) Process:(3656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31091865
(PID) Process:(3656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31091865
(PID) Process:(3656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3656) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
22
Text files
35
Unknown types
8

Dropped files

PID
Process
Filename
Type
3664iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\main.dark.min[1].csstext
MD5:D7C015E0898061E193E74EACE060A584
SHA256:F7C581854B06788BF3C0EBC2640429558F09DEDA6E9A8532537F317CE4DA9D96
3664iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\sto-twitter-logo[1].svgimage
MD5:D00CE21957E1BC4C45F9E3CA57C14826
SHA256:B3A768E0A44935669EB6F3800705564DD3E874B4267BC196FC6C9BE3163B91AC
3664iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\modernizr.custom.min[1].jstext
MD5:9E16031782FDFDCA9C9D14FCA9FADFF5
SHA256:85B704DD7EEB2745EF7B171FAD15F94660760C254576BCC47DE5A4433002511A
3664iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\main.min[1].csstext
MD5:11E4214C9C8F89630761F24F10FA9CA6
SHA256:706E9185D63FD90EDD8EA82AA108D38C32BE01C4D5E88A4C615527053FC4960C
3664iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\sto-whatsapp-logo-2[1].svgimage
MD5:ACF51BC4AB6C739A031226D42640515F
SHA256:344987A88871769752318DC28F52112207EEDC226AAD34B852C1EC432D045613
3664iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\logo-sto-serienstream-sx-to-serien-online-streaming-vod[1].svgimage
MD5:D05E4C2D140046397B9F383DAEA8A249
SHA256:CADE4ABDD22065BDB2E20FE76D9B986BB68CAEAC0F0E4D409D70B0E6EA148CE5
3664iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\sto-tiktok-logo-2[1].svgimage
MD5:79B245EA30D65B3A90C329E4D2CF0771
SHA256:028075C799B51D928467DA3DDF154209A8C53591AA4B2618B19B433CEA3E8C65
3664iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\jquery-ui.min[1].jstext
MD5:539F1AA266D9951306E34C5F454BC197
SHA256:7FCB3B4DAC42C7629E3E3146314ACA6B08321C667C6BFD0F76AE970DDB9616BB
3664iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\main.min[1].jstext
MD5:B1C8367B4775A4860075DBABF9D63F39
SHA256:62A95FA5925CF6F82F5950EF2B664277ABFC23EF1368B6053C50E6168469A919
3664iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\jquery.min[1].jstext
MD5:2BC74C12384570F76770BB06CAEADA33
SHA256:3EEF7A115D4C3AF5521231F1766D6EB1A270154E358E5A468B040B3E73DD7527
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
35
TCP/UDP connections
45
DNS requests
23
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3664
iexplore.exe
GET
200
186.2.175.5:80
http://186.2.175.5/public/css/main.min.css?version=f9c530c99bd34f8fd6c09b94eb021194
unknown
text
33.0 Kb
unknown
3664
iexplore.exe
GET
200
186.2.175.5:80
http://186.2.175.5/public/css/main.dark.min.css?version=c207e850a8ddd1f466f3624c8da4e4dd
unknown
text
2.13 Kb
unknown
3664
iexplore.exe
GET
200
186.2.175.5:80
http://186.2.175.5/search
unknown
html
6.72 Kb
unknown
3664
iexplore.exe
GET
200
186.2.175.5:80
http://186.2.175.5/public/js/jquery.min.js?version=15
unknown
text
33.1 Kb
unknown
3664
iexplore.exe
GET
200
186.2.175.5:80
http://186.2.175.5/public/js/jquery-ui.min.js?version=15
unknown
text
27.5 Kb
unknown
3664
iexplore.exe
GET
200
186.2.175.5:80
http://186.2.175.5/public/img/logo-sto-serienstream-sx-to-serien-online-streaming-vod.svg
unknown
image
1.66 Kb
unknown
3664
iexplore.exe
GET
200
186.2.175.5:80
http://186.2.175.5/public/svg/sto-tiktok-logo-2.svg
unknown
image
1.20 Kb
unknown
3664
iexplore.exe
GET
200
186.2.175.5:80
http://186.2.175.5/public/js/main.min.js?cache-version=f9c530c99bd34f8fd6c09b94eb021194
unknown
text
20.7 Kb
unknown
3664
iexplore.exe
GET
200
186.2.175.5:80
http://186.2.175.5/public/js/modernizr.custom.min.js?cache-version=15
unknown
text
952 b
unknown
3664
iexplore.exe
GET
200
186.2.175.5:80
http://186.2.175.5/public/svg/sto-twitter-logo.svg
unknown
image
513 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3664
iexplore.exe
186.2.175.5:80
—
DDOS-GUARD CORP.
BZ
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3664
iexplore.exe
186.2.163.237:443
s.to
DDOS-GUARD CORP.
NL
unknown
3664
iexplore.exe
104.17.25.14:443
cdnjs.cloudflare.com
CLOUDFLARENET
—
unknown
3664
iexplore.exe
192.243.59.20:443
arrangeaffectedtables.com
DataWeb Global Group B.V.
US
unknown
3664
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
3664
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3664
iexplore.exe
142.250.184.234:80
fonts.googleapis.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
cdnjs.cloudflare.com
  • 104.17.25.14
  • 104.17.24.14
whitelisted
s.to
  • 186.2.163.237
whitelisted
arrangeaffectedtables.com
  • 192.243.59.20
  • 172.240.108.68
  • 172.240.253.132
  • 172.240.108.76
  • 172.240.108.84
  • 192.243.59.12
  • 192.243.59.13
  • 192.243.61.227
  • 192.243.61.225
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
x1.c.lencr.org
  • 2.23.197.184
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 2.19.96.129
  • 2.19.96.128
  • 2.19.96.66
  • 2.19.96.83
  • 2.19.96.90
whitelisted
fonts.googleapis.com
  • 142.250.184.234
whitelisted
r3.o.lencr.org
  • 95.101.54.123
  • 95.101.54.112
  • 95.101.54.131
  • 95.101.54.145
  • 95.101.54.202
  • 95.101.54.99
  • 95.101.54.216
  • 95.101.54.137
  • 95.101.54.200
shared

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .to TLD
3664
iexplore.exe
Potentially Bad Traffic
ET HUNTING DDoS-Guard Hosted Content
3664
iexplore.exe
Potentially Bad Traffic
ET HUNTING DDoS-Guard Hosted Content
3664
iexplore.exe
Potentially Bad Traffic
ET HUNTING DDoS-Guard Hosted Content
3664
iexplore.exe
Potentially Bad Traffic
ET HUNTING DDoS-Guard Hosted Content
3664
iexplore.exe
Potentially Bad Traffic
ET HUNTING DDoS-Guard Hosted Content
3664
iexplore.exe
Potentially Bad Traffic
ET HUNTING DDoS-Guard Hosted Content
3664
iexplore.exe
Potentially Bad Traffic
ET HUNTING DDoS-Guard Hosted Content
3664
iexplore.exe
Potentially Bad Traffic
ET HUNTING DDoS-Guard Hosted Content
3664
iexplore.exe
Potentially Bad Traffic
ET HUNTING DDoS-Guard Hosted Content
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://186.2.175.5/search