URL:

https://runthegauntlet.org/

Full analysis: https://app.any.run/tasks/fbbf9adf-f3f2-4215-8743-00a3529fe7bd
Verdict: Malicious activity
Analysis date: March 25, 2022, 02:26:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
covid19
Indicators:
MD5:

D59BA50DAAD26330B9FF06798EA94CC8

SHA1:

726659C6B7BC7B34C8ABC8F6468AD3054FD477AB

SHA256:

F67BAF20B7DD637E3F1924C6E7BDA116C257C0239204D96AF7C8C180F8B92FED

SSDEEP:

3:N8YNAwlJyMJ:2YSw9J

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 4020)
      • iexplore.exe (PID: 1212)

    • Executed via COM

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 2904)

    • Checks supported languages

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 2904)

    • Reads the computer name

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 2904)

    • Creates files in the user directory

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 2904)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 3672)
      • iexplore.exe (PID: 4020)
      • iexplore.exe (PID: 1212)

    • Changes internet zones settings

      • iexplore.exe (PID: 3672)

    • Application launched itself

      • iexplore.exe (PID: 3672)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 4020)
      • iexplore.exe (PID: 3672)
      • iexplore.exe (PID: 1212)

    • Drops Coronavirus (possible) decoy

      • iexplore.exe (PID: 4020)

    • Reads the computer name

      • iexplore.exe (PID: 3672)
      • iexplore.exe (PID: 4020)
      • iexplore.exe (PID: 1212)

    • Reads internet explorer settings

      • iexplore.exe (PID: 4020)
      • iexplore.exe (PID: 1212)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 4020)
      • iexplore.exe (PID: 3672)
      • iexplore.exe (PID: 1212)

    • Creates files in the user directory

      • iexplore.exe (PID: 4020)
      • iexplore.exe (PID: 1212)
      • iexplore.exe (PID: 3672)

    • Reads CPU info

      • iexplore.exe (PID: 1212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
4
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iexplore.exe flashutil32_32_0_0_453_activex.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1212"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3672 CREDAT:4068636 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2904C:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe
Integrity Level:
MEDIUM
Description:
Adobe� Flash� Player Installer/Uninstaller 32.0 r0
Exit code:
0
Version:
32,0,0,453
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_32_0_0_453_activex.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
3672"C:\Program Files\Internet Explorer\iexplore.exe" "https://runthegauntlet.org/"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
4020"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3672 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\version.dll
Total events
25 976
Read events
25 813
Write events
163
Delete events
0

Modification events

(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30949359
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30949359
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
28
Text files
265
Unknown types
26

Dropped files

PID
Process
Filename
Type
4020iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:F9446F027C73D9196809E6443B1C0F34
SHA256:6C798670F09AACCF271211EA972D00AABCDCC955CEEB5033BF8E3A339FF34007
4020iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\ULCAWSBV.htmhtml
MD5:858EBDBD98017EAEA669CE1297662A54
SHA256:88FD9191C880D56462712105CF27210A712937E6ADED010687AFBEB8C0729098
4020iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:EFADD12EA6190354379F09F195FCD4FE
SHA256:8EE24253A730E08A963BD9F829AF98C30C177FE9B1236430221D3D17D3E34EB4
4020iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:95C2C7A7104019DE7DCB155E0836CD04
SHA256:12F55F34DF65AD549C847B0FAC90966E769A15BA0882D5D9B6A15B6E3EC0BD0E
4020iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\ic_event_darkgrey_24px[1].svgimage
MD5:0B16E4052224336074227B0DFCD44D38
SHA256:7C1BA276AA0C5A22CDE2CB2E4BF2DC2DDB29447ECC0B8F340FBD4DC372678F38
4020iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\ic_tv_darkgrey_24px[1].svgimage
MD5:1AB0E0AE4C4FDBD61731C90A3151802D
SHA256:713AE955F3122148FD01C3320330AE732A35BD6CB8086DB1DC6051B49C8F30B1
4020iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\ic_access_time_darkgrey_24px[1].svgimage
MD5:ECB61A6816DDFBAA249486375B95CAEA
SHA256:5E29E387772375CF641D37BA71C5898ECAD80E4ACE481435D2ECEC7E3E019FBF
4020iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\ic_search_white_24px[1].svgimage
MD5:951624B696FB4357D5E69CA99ED91107
SHA256:5A99B8E8063501D676E36AD8442207A30B2BBA9B4DABCA8E877771FE0DE06EB1
4020iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\ic_folder_open_darkgrey_24px[1].svgimage
MD5:CDDF2180AD29DC2D61E180BC8A296CCA
SHA256:A41B1B02443DFB4E7476916FF04294A3BC075E3B26A786615FF24B35BDD2E7F5
4020iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\lexus_suv_runs_over_motorcyclist[1].jpgimage
MD5:BDF159B30D577BEE1D9C9FA30F26A80F
SHA256:18FB1F1C364AF54A6D21A19B9E540736FBDE06329FC973A4BE9BFF3CB538907B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
58
TCP/UDP connections
180
DNS requests
37
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4020
iexplore.exe
GET
200
142.250.184.227:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
4020
iexplore.exe
GET
301
172.67.206.66:80
http://tubefilter.net/i/5e8/5e88b7e671a08-0.jpg
US
html
336 b
shared
4020
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
4020
iexplore.exe
GET
200
92.123.195.57:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6870b50d7d20fc33
unknown
compressed
4.70 Kb
whitelisted
4020
iexplore.exe
GET
200
142.250.184.227:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
4020
iexplore.exe
GET
301
172.67.206.66:80
http://tubefilter.net/i/5e8/5e822235d509a-0.jpg
US
html
336 b
shared
4020
iexplore.exe
GET
301
172.67.206.66:80
http://tubefilter.net/i/5e8/5e88d035b7bc0-0.jpg
US
html
336 b
shared
4020
iexplore.exe
GET
301
172.67.206.66:80
http://tubefilter.net/i/623/623c5f7895213-0.jpg
US
html
336 b
shared
4020
iexplore.exe
GET
200
92.123.195.57:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b086c06aba71882d
unknown
compressed
4.70 Kb
whitelisted
3672
iexplore.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/Omniroot2025.crl
US
der
7.68 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4020
iexplore.exe
92.123.195.57:80
ctldl.windowsupdate.com
Akamai International B.V.
—
whitelisted
4020
iexplore.exe
142.250.184.200:443
www.googletagmanager.com
Google Inc.
US
suspicious
4020
iexplore.exe
104.21.70.7:443
runthegauntlet.org
Cloudflare Inc
US
unknown
4020
iexplore.exe
142.250.181.234:443
fonts.googleapis.com
Google Inc.
US
whitelisted
4020
iexplore.exe
142.250.184.227:80
ocsp.pki.goog
Google Inc.
US
whitelisted
4020
iexplore.exe
142.250.185.110:443
www.google-analytics.com
Google Inc.
US
whitelisted
3672
iexplore.exe
13.107.21.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3672
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3672
iexplore.exe
104.21.70.7:443
runthegauntlet.org
Cloudflare Inc
US
unknown
4020
iexplore.exe
172.67.206.66:443
tubefilter.net
—
US
unknown

DNS requests

Domain
IP
Reputation
runthegauntlet.org
  • 104.21.70.7
  • 172.67.217.127
malicious
ctldl.windowsupdate.com
  • 92.123.195.57
  • 92.123.195.41
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 13.107.21.200
  • 204.79.197.200
whitelisted
fonts.googleapis.com
  • 142.250.181.234
whitelisted
www.googletagmanager.com
  • 142.250.184.200
whitelisted
ocsp.pki.goog
  • 142.250.184.227
whitelisted
fonts.gstatic.com
  • 216.58.212.163
whitelisted
www.google-analytics.com
  • 142.250.185.110
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://runthegauntlet.org/