analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://developer.box.com/guides/tooling/postman/quick-start/install-postman/

Full analysis: https://app.any.run/tasks/eb056855-9b38-4e30-97e5-1d325549172a
Verdict: Malicious activity
Analysis date: June 27, 2022, 13:50:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

7EE5876F9181C8421F47F69CF2143835

SHA1:

AF146915AA4825FE5648A72E58FB8A798950F17D

SHA256:

F4B5A81EB7B5348A282F47F0BDEF968D080529F6FCDCB2D7B50589F1ABF22225

SSDEEP:

3:N8YIv2dZyQMMs/td5+UQ2opGVDIpn:2YIv2ieOd+UQFpGVDIpn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3376)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 3376)
      • iexplore.exe (PID: 2908)

    • Reads the computer name

      • iexplore.exe (PID: 2908)
      • iexplore.exe (PID: 3376)

    • Application launched itself

      • iexplore.exe (PID: 2908)

    • Changes internet zones settings

      • iexplore.exe (PID: 2908)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3376)
      • iexplore.exe (PID: 2908)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2908)
      • iexplore.exe (PID: 3376)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2908)

    • Creates files in the user directory

      • iexplore.exe (PID: 3376)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2908)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3376)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2908"C:\Program Files\Internet Explorer\iexplore.exe" "https://developer.box.com/guides/tooling/postman/quick-start/install-postman/"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3376"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2908 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
19 292
Read events
19 168
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
32
Text files
652
Unknown types
17

Dropped files

PID
Process
Filename
Type
3376iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:308336E7F515478969B24C13DED11EDE
SHA256:889B832323726A9F10AD03F85562048FDCFE20C9FF6F9D37412CF477B4E92FF9
3376iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabE362.tmpcompressed
MD5:308336E7F515478969B24C13DED11EDE
SHA256:889B832323726A9F10AD03F85562048FDCFE20C9FF6F9D37412CF477B4E92FF9
3376iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\TarE363.tmpcat
MD5:2D8A5090656DE9FB55DD0F3BA20F9299
SHA256:44AE1E61A4E6305C15AAA52FD1B29DDB060E69233703CBA611F5E781D766442E
3376iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:65700353915877F24A0666C0739E2561
SHA256:733D24796E1EC37CACE3D4904A36287FD3FB09F309A41796C0F657837F2E4F01
3376iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\windows[1].pngimage
MD5:0D99C4582A422BAD5ACE8385739CF036
SHA256:39A5E65D3D6523CBEE7246BF6D9CA773E31E2BE6E4808C100A4C837E04E33B16
2908iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:28CC3D4B0DA8A29A9DCD6D4755C84342
SHA256:A4CA2DD1D4545838F7A9102623442BC76BDEB2185E9991A294BCB0B6456DDA0E
3376iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C949162BBEF692A95EB9BCEDD40FC45Cbinary
MD5:E911996F1A5AAB668B2DDEB030B2A308
SHA256:4FC89B52ACA0855CC5ED405DEABB557F3A00A78A4E5DF2B3D0AB0AECE300447E
3376iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\polyfill-d5927e1c3815579cd5f3[1].jstext
MD5:BD62B772A3DBA751AA2DE4A8F2F5A909
SHA256:6916F9EE7A83A17C3B8C57153C491C50DDECA1AFC19A7AA5864F94FCBCB6211A
3376iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:B5B354219DCBFC3E48579BC9993E6965
SHA256:E3F2CF6022C87B8F26CFD3A8F3684015D38E8B96134CE554B17E713D4696F2AF
2908iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:BF5420F20790693DE0CB0D8533590F59
SHA256:AFF0BD6962929CB081DBC80666D7D00A2A3523C7E4B46948974348600686A0DC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
50
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3376
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEHI38lcJsEGCEqKcAE57JnQ%3D
US
der
471 b
whitelisted
3376
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEAT%2FrubUb6nOEpcsoEFY3SI%3D
US
der
471 b
whitelisted
3376
iexplore.exe
GET
200
67.26.163.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?0d968b90b26f608f
US
compressed
60.0 Kb
whitelisted
3376
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCqm%2FLZVwk%2FcRLv5CtSZANu
US
der
472 b
whitelisted
3376
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEESz3%2FmlG2yGCtBzjzp1dVc%3D
US
der
471 b
whitelisted
3376
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
2908
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3376
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
3376
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCfB0sRdF8W%2FBIjdfpYeZPw
US
der
472 b
whitelisted
3376
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEG8ah82mu6j%2FCizjSGtvLoA%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2908
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2908
iexplore.exe
131.253.33.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3376
iexplore.exe
142.250.185.67:80
ocsp.pki.goog
Google Inc.
US
whitelisted
3376
iexplore.exe
96.16.145.230:80
x1.c.lencr.org
Akamai Technologies, Inc.
US
suspicious
3376
iexplore.exe
184.24.77.61:80
r3.o.lencr.org
Time Warner Cable Internet LLC
US
unknown
3376
iexplore.exe
67.26.163.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
unknown
3376
iexplore.exe
142.250.185.72:443
www.googletagmanager.com
Google Inc.
US
suspicious
3376
iexplore.exe
142.250.185.106:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3376
iexplore.exe
142.250.184.195:443
fonts.gstatic.com
Google Inc.
US
whitelisted
3376
iexplore.exe
3.67.153.12:443
developer.box.com
—
US
malicious

DNS requests

Domain
IP
Reputation
developer.box.com
  • 3.67.153.12
  • 164.90.232.210
malicious
ctldl.windowsupdate.com
  • 67.26.163.254
  • 8.249.11.254
  • 8.247.116.126
  • 8.250.203.254
  • 8.250.188.126
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 131.253.33.200
  • 13.107.22.200
whitelisted
x1.c.lencr.org
  • 96.16.145.230
whitelisted
r3.o.lencr.org
  • 184.24.77.61
  • 184.24.77.45
  • 184.24.77.46
  • 184.24.77.48
  • 184.24.77.47
  • 184.24.77.76
  • 184.24.77.81
  • 184.24.77.62
  • 184.24.77.56
shared
ocsp.digicert.com
  • 93.184.220.29
whitelisted
www.googletagmanager.com
  • 142.250.185.72
whitelisted
ocsp.pki.goog
  • 142.250.185.67
whitelisted
fonts.googleapis.com
  • 142.250.185.106
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://developer.box.com/guides/tooling/postman/quick-start/install-postman/