analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://ecom.wix.com

Full analysis: https://app.any.run/tasks/24ba187f-3a34-4e58-b6d9-1ac9ea6eccc5
Verdict: Malicious activity
Analysis date: December 14, 2018, 04:49:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

CFD0112C7D79505C16F67B1E4EB07011

SHA1:

94A2DB131178DDD43A77B119F6E7390E312E88BE

SHA256:

F51BDE7AD12F0E867D53A4BE2BF4FC791F4EC7BCA3E243EB6944AFD20564F6C3

SSDEEP:

3:N1KbdQGKIn:CpGIn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2820)
      • chrome.exe (PID: 3724)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 3108)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3108)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3108)

    • Changes internet zones settings

      • iexplore.exe (PID: 2820)

    • Reads settings of System Certificates

      • chrome.exe (PID: 3724)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
13
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2820"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3108"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2820 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3724"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
68.0.3440.106
2560"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=68.0.3440.106 --initial-client-data=0x78,0x7c,0x80,0x74,0x84,0x6d6800b0,0x6d6800c0,0x6d6800ccC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
68.0.3440.106
3960"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3720 --on-initialized-event-handle=304 --parent-handle=308 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
68.0.3440.106
3216"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1016,10223456036928154460,1778625805881381990,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=5E1002EC39C2EDF819785055D719BD0C --mojo-platform-channel-handle=1024 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Version:
68.0.3440.106
1420"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1016,10223456036928154460,1778625805881381990,131072 --enable-features=PasswordImport --service-pipe-token=438071F1211EF29EA33D10A3B30D98FC --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=438071F1211EF29EA33D10A3B30D98FC --renderer-client-id=5 --mojo-platform-channel-handle=1916 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
2612"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1016,10223456036928154460,1778625805881381990,131072 --enable-features=PasswordImport --service-pipe-token=9F4CBBE52CFA12922550556C8DDD0371 --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=9F4CBBE52CFA12922550556C8DDD0371 --renderer-client-id=3 --mojo-platform-channel-handle=2100 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
2572"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1016,10223456036928154460,1778625805881381990,131072 --enable-features=PasswordImport --disable-gpu-compositing --service-pipe-token=53DD9A316E508E6AD6FDAC08FBEF8D12 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=53DD9A316E508E6AD6FDAC08FBEF8D12 --renderer-client-id=6 --mojo-platform-channel-handle=3296 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
2404"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1016,10223456036928154460,1778625805881381990,131072 --enable-features=PasswordImport --disable-gpu-sandbox --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=067B42D76745971A34AAD10370DA68B5 --mojo-platform-channel-handle=3512 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Total events
854
Read events
759
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
50
Text files
83
Unknown types
28

Dropped files

PID
Process
Filename
Type
2820iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
2820iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3108iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\88fcd49a-13c7-4d0c-86b1-ad1e258bd75d[1].eoteot
MD5:9376DACDE003E1A98E9688B5CF617688
SHA256:0E943B8B94E52CAABA37EB5D09E21B2A177C17BAB8DF1C859CA6BF7CD6B57F5B
3108iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\56be84de-9d60-4089-8df0-0ea6ec786b84[1].eoteot
MD5:301347FD6432E7A617A09891EF8975D0
SHA256:11850D5A61482FCFD84B5461D011DC9A644B93DACB9680832FC3EDE741001593
3108iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\db853e0e-929b-4272-b420-c946c954cf3a[1].eoteot
MD5:DBD0124099C663C8A617B971C804D72D
SHA256:DED04BE7C13BCBCDB87741B960BB787111DB91000D655649DCD712014A461CCB
3108iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\ae1656aa-5f8f-4905-aed0-93e667bd6e4a[1].eoteot
MD5:DC24DBB621561BADCC001A82DBADD02F
SHA256:5FB8A4FC793923AA6FEE23B4E96743C3858CAD3ACEB64BCD32FB8D56F0409862
3108iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\41774233-b9da-44be-b252-6a7b612fb1c7[1].eoteot
MD5:BA0B6CDB3F229928600AA46A9FE3432B
SHA256:3BA0E63379987E0835689EB60E60A375590E933893693B7EAE4CE53E9B70ED4F
3108iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\07fe0fec-b63f-4963-8ee1-535528b67fdb[1].eoteot
MD5:D4820EB00D7F44435676403105C5D877
SHA256:0E5D20118C0F283AFA97F350D3CEF05EEB4575E33E123015B61EF6E47F7E35D4
3108iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\30b6ffc3-3b64-40dd-9ff8-a3a850daf535[1].eoteot
MD5:11FE9CA1903EC5E34ADA6D4A750305FA
SHA256:C04B68111C86762602769E8CB2CD4C92A9F2A60FB2E4918746888F5F7522AF67
3108iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\fontFace[1].csstext
MD5:338855569759CA44A0734EC4435BCBD0
SHA256:9CD04D1A84368FA539B48CC09D3721091127B9EB2858FF5E4863D6C127CCEDAE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
56
TCP/UDP connections
45
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3108
iexplore.exe
GET
200
52.222.149.139:80
http://static.parastorage.com/services/third-party/fonts/Helvetica/Fonts/072d8516-5d40-44bc-b694-65b3c8bd8fa5.eot?
US
eot
88.8 Kb
shared
3108
iexplore.exe
GET
200
52.222.149.139:80
http://static.parastorage.com/services/third-party/fonts/Helvetica/Fonts/88fcd49a-13c7-4d0c-86b1-ad1e258bd75d.eot?
US
eot
159 Kb
shared
3108
iexplore.exe
GET
200
52.222.149.139:80
http://static.parastorage.com/services/third-party/fonts/Helvetica/Fonts/c8ec8ade-129c-47df-86b4-f9f1cd69ac15.eot?
US
eot
93.4 Kb
shared
3108
iexplore.exe
GET
200
52.222.149.139:80
http://static.parastorage.com/services/third-party/fonts/Helvetica/Fonts/db853e0e-929b-4272-b420-c946c954cf3a.eot?
US
eot
101 Kb
shared
3108
iexplore.exe
GET
200
52.222.149.139:80
http://static.parastorage.com/services/third-party/fonts/Helvetica/Fonts/58a5cbff-d570-4c18-a5e3-60868dc07ae8.eot?
US
eot
98.6 Kb
shared
3108
iexplore.exe
GET
200
52.222.149.139:80
http://static.parastorage.com/services/third-party/fonts/Helvetica/Fonts/07fe0fec-b63f-4963-8ee1-535528b67fdb.eot??
US
eot
90.3 Kb
shared
3108
iexplore.exe
GET
200
52.222.149.139:80
http://static.parastorage.com/services/third-party/fonts/Helvetica/fontFace.css
US
text
3.11 Kb
shared
3108
iexplore.exe
GET
200
52.222.149.139:80
http://static.parastorage.com/services/third-party/fonts/Helvetica/Fonts/56be84de-9d60-4089-8df0-0ea6ec786b84.eot?
US
eot
138 Kb
shared
3108
iexplore.exe
GET
200
52.222.149.139:80
http://static.parastorage.com/services/wix-public/1.245.0/styles/error-pages/styles.css
US
text
3.10 Kb
shared
3108
iexplore.exe
GET
404
35.170.136.255:80
http://ecom.wix.com/
US
html
1.02 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2820
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3108
iexplore.exe
52.222.149.139:80
static.parastorage.com
Amazon.com, Inc.
US
suspicious
3108
iexplore.exe
172.217.168.10:80
ajax.googleapis.com
Google Inc.
US
whitelisted
3108
iexplore.exe
185.230.60.179:80
www.wix.com
—
—
suspicious
3108
iexplore.exe
35.170.136.255:80
ecom.wix.com
Amazon.com, Inc.
US
unknown
3724
chrome.exe
172.217.17.35:443
www.google.de
Google Inc.
US
whitelisted
3724
chrome.exe
216.58.215.227:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
3724
chrome.exe
172.217.168.10:443
ajax.googleapis.com
Google Inc.
US
whitelisted
3724
chrome.exe
50.16.162.232:80
ecom.wix.com
Amazon.com, Inc.
US
unknown
3724
chrome.exe
172.217.20.100:443
www.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ecom.wix.com
  • 35.170.136.255
  • 54.236.159.210
  • 52.7.220.27
  • 50.16.162.232
whitelisted
static.parastorage.com
  • 52.222.149.139
  • 52.222.149.68
  • 52.222.149.95
  • 52.222.149.174
shared
ajax.googleapis.com
  • 172.217.168.10
  • 172.217.168.42
  • 216.58.215.234
whitelisted
www.wix.com
  • 185.230.60.179
whitelisted
clientservices.googleapis.com
  • 216.58.215.227
whitelisted
www.gstatic.com
  • 216.58.215.227
whitelisted
www.google.de
  • 172.217.17.35
whitelisted
safebrowsing.googleapis.com
  • 172.217.168.10
whitelisted
accounts.google.com
  • 172.217.168.45
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://ecom.wix.com