URL:

myexternalip.com

Full analysis: https://app.any.run/tasks/f03267b8-2b2e-4305-8707-16814ded6d53
Verdict: Malicious activity
Analysis date: October 05, 2023, 14:16:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
Indicators:
MD5:

B1F9D2006C24ABAE933B547F8900DA03

SHA1:

F9C23239311538F4D6490FC7BB164B7585B81899

SHA256:

F79838292D2A6DCA3EF71B612C5B66F5290938FCDB04B87CA0B830D060E2F3F7

SSDEEP:

3:hxXwCg:LW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2980)

    • Checks supported languages

      • wmpnscfg.exe (PID: 2980)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 2980)

    • Reads the computer name

      • wmpnscfg.exe (PID: 2980)

    • Application launched itself

      • iexplore.exe (PID: 3640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2980"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3232"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3640 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3640"C:\Program Files\Internet Explorer\iexplore.exe" "myexternalip.com"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
Total events
15 543
Read events
15 459
Write events
81
Delete events
3

Modification events

(PID) Process:(3640) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3640) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3640) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3640) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3640) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3640) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3640) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3640) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3640) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3640) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
20
Text files
24
Unknown types
0

Dropped files

PID
Process
Filename
Type
3232iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\X3TFM2MP.htmhtml
MD5:877790A7C86B080019CDE643B5234E81
SHA256:A7275389B243B0D7112850AA7570486A3D4667B5B4137F963F1F14CB6BFCA244
3640iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
3232iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\style[1].csstext
MD5:C05FB6DB75BAFEB266C3CBA45FD62C17
SHA256:3884806B7988E6E19CCA89D8081F5436D3389BBDEEC830BE53C1ACA67F167F3D
3640iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:CE0B46526AB7714DA3AC3FD91CA108D8
SHA256:7E55A0F960F6F6A64E30E5C607D650EC0889019E4DE83A93AACC2F3D477867BF
3640iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
3232iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:869FBD9F9310DFB4791EBE6467BABF55
SHA256:D1A1B45BE497D2F53EEF36B70F6D68D082013FE18606DECE9C2BC7A0F9C14B4E
3640iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:1D92604D955D7C5FDD1E4D2AC2764AD3
SHA256:229A45B71DB601A50BED6DED82C17D25458866F48760ED8A4E2C9A949AB5473C
3640iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:6E0C90A66A5B5269A1A87927462A2686
SHA256:0792D0B29F677CFA366A48163F03449F1EB549F15D7B3734C487AAA3F79D582C
3232iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_ECD931CC6FBF9F061BE09F2505FD40C3binary
MD5:B6B3FB47DE3C484FB5D790BA4F7EC2FA
SHA256:53B34F9B572CD70D83F016A4FE463F600773CFA0D0442A08982934A98E2189CC
3640iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
26
DNS requests
19
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3640
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
unknown
binary
1.47 Kb
—
3232
iexplore.exe
GET
200
172.217.169.99:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDLYsQ7yv2LMwmxOu34tlfG
unknown
binary
472 b
—
3640
iexplore.exe
GET
404
34.160.111.145:80
http://myexternalip.com/favicon.ico
unknown
text
9 b
—
3232
iexplore.exe
GET
200
172.217.169.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
—
3640
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
binary
471 b
—
3640
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
—
3640
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
unknown
binary
471 b
—
3232
iexplore.exe
GET
200
172.217.169.99:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBM9NSid4pOvCr35n90pfXk%3D
unknown
binary
471 b
—
3232
iexplore.exe
GET
200
34.160.111.145:80
http://myexternalip.com/
unknown
html
46.8 Kb
—
3640
iexplore.exe
GET
404
34.160.111.145:80
http://myexternalip.com/favicon.ico
unknown
text
9 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
3232
iexplore.exe
34.160.111.145:80
myexternalip.com
GOOGLE
US
unknown
2656
svchost.exe
239.255.255.250:1900
—
—
—
unknown
3640
iexplore.exe
104.126.37.186:443
www.bing.com
Akamai International B.V.
DE
unknown
3640
iexplore.exe
67.26.81.254:80
ctldl.windowsupdate.com
LEVEL3
US
unknown
3232
iexplore.exe
172.217.17.138:443
fonts.googleapis.com
GOOGLE
US
unknown
3640
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
unknown
3232
iexplore.exe
172.217.169.99:80
ocsp.pki.goog
GOOGLE
US
unknown
3232
iexplore.exe
142.251.140.67:443
fonts.gstatic.com
GOOGLE
US
unknown
3640
iexplore.exe
34.160.111.145:80
myexternalip.com
GOOGLE
US
unknown

DNS requests

Domain
IP
Reputation
myexternalip.com
  • 34.160.111.145
unknown
api.bing.com
  • 13.107.5.80
unknown
www.bing.com
  • 104.126.37.186
  • 104.126.37.123
  • 104.126.37.177
  • 104.126.37.176
  • 104.126.37.161
  • 104.126.37.128
  • 104.126.37.130
  • 104.126.37.160
  • 104.126.37.162
  • 13.107.21.200
  • 204.79.197.200
unknown
ctldl.windowsupdate.com
  • 67.26.81.254
  • 67.27.233.254
  • 67.27.158.126
  • 8.253.95.249
  • 8.253.95.120
unknown
fonts.googleapis.com
  • 172.217.17.138
unknown
ocsp.digicert.com
  • 192.229.221.95
unknown
ocsp.pki.goog
  • 172.217.169.99
unknown
fonts.gstatic.com
  • 142.251.140.67
unknown
iecvlist.microsoft.com
  • 152.199.19.161
unknown
r20swj13mr.microsoft.com
  • 152.199.19.161
unknown

Threats

PID
Process
Class
Message
—
—
Device Retrieving External IP Address Detected
ET POLICY External IP Check myexternalip.com
—
—
Device Retrieving External IP Address Detected
ET POLICY External IP Check myexternalip.com
—
—
Device Retrieving External IP Address Detected
ET POLICY External IP Check myexternalip.com
—
—
Device Retrieving External IP Address Detected
ET POLICY External IP Check myexternalip.com
—
—
Device Retrieving External IP Address Detected
ET POLICY External IP Check myexternalip.com
—
—
Device Retrieving External IP Address Detected
ET POLICY External IP Check myexternalip.com
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
myexternalip.com