analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://bit.ly/3UXpb6T

Full analysis: https://app.any.run/tasks/8e064945-4ca9-4092-bbfe-bf273dd1a49b
Verdict: Malicious activity
Analysis date: October 04, 2022, 20:36:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

3D370F5DA152F811CC5040DF62984469

SHA1:

E3755EEC03B5DDA8A04ACAD1AAEF9B75A8EB8BDD

SHA256:

F876F62CF8444B7D8CE455323DBA580520FB102D9BDABEAFFF274C7FB11CC473

SSDEEP:

3:N8kSw3H9:28N

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3780)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 3664)
      • iexplore.exe (PID: 3780)

    • Checks supported languages

      • iexplore.exe (PID: 3780)
      • iexplore.exe (PID: 3664)

    • Application launched itself

      • iexplore.exe (PID: 3664)

    • Changes internet zones settings

      • iexplore.exe (PID: 3664)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3780)
      • iexplore.exe (PID: 3664)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3780)
      • iexplore.exe (PID: 3664)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3664)

    • Creates files in the user directory

      • iexplore.exe (PID: 3664)
      • iexplore.exe (PID: 3780)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3664)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3780)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3664"C:\Program Files\Internet Explorer\iexplore.exe" "https://bit.ly/3UXpb6T"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3780"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3664 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
20 222
Read events
20 014
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
23
Text files
34
Unknown types
20

Dropped files

PID
Process
Filename
Type
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442der
MD5:B8BDA0B382A7D056A4241B388338B778
SHA256:7BAA967F6686CCE471826B20FFA5CB7FEB4BF3C5C0BF43F51F08E84EB5850DD2
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442binary
MD5:0FA026EE9F8B73F6B085559F564A5B2E
SHA256:1FB8743F81A1B58E7D5F9CF4764B5ED21F4B736AC4970D0E4E1DD40724ACCE0C
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:0FE748C5567FA6978C44DBC5FBAAC6AC
SHA256:9A9B799B546D30FA068AF63B83726E3A6C1A2222DE0EBE934DDAA9DCB6BBFC38
3780iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619der
MD5:FDF91F6E6430159255A855CFA8DB51BD
SHA256:6F023549DEA5615AD2C405C3C1AB1D9EF8F0C8792646644C13B15BD63A642633
3780iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:4015CCC222B796A129B56FCC44DAB578
SHA256:E7D299B0239F1A5BDF3FFF56A3EEEE355C45F53ADB9C3CA0993E65033C5FA3D4
3780iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:7DA0CE23C92B2C229969BB279F6850CC
SHA256:C992520EEFADFFF8EF61F6D50E0A687F479CDBB8C863ADB0A3EBE1109E95FA11
3780iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_86DE1A2F4E338B551466CB806CD2D7B8binary
MD5:916B3C7AA0ED5950711F3414E0E6FB41
SHA256:E9F3C40EC7F5CFEAAB1982BAA67A6DB4C2558825D0FBBE86AD49AF1F82799305
3780iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619binary
MD5:9874E6B25D72F603CF9FE49E73EFFC6C
SHA256:67BC639CD82CEF9551E44FF28317B69DBEA1FDDF6842400EA6FADD1D4AEE087A
3780iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4D1ED785E3365DE6C966A82E99CCE8EA_BE51B43F9F95B8E556690D4EA2757FD1der
MD5:4E74F170A6482B587C3C0D3B7F6DE309
SHA256:ADF3814C09268330D8F40161DFC84BE013C8DBA4A7EFEEA1F319409670A6E106
3780iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4D1ED785E3365DE6C966A82E99CCE8EA_BE51B43F9F95B8E556690D4EA2757FD1binary
MD5:C0BFC18C005DE78E5729765CA5DFD22A
SHA256:55FC7E095BE673483B82C164E1CFE91A8C370399FDABA67F9EB2CFFD4349872F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
51
DNS requests
27
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3664
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
3780
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D
US
der
471 b
whitelisted
3780
iexplore.exe
GET
200
104.18.20.226:80
http://ocsp2.globalsign.com/rootr5/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQiD0S5cIHyfrLTJ1fvAkJWflH%2B2QQUPeYpSJvqB8ohREom3m7e0oPQn1kCDQHuXyKVQkkF%2BQGRqNw%3D
US
der
1.26 Kb
whitelisted
3780
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
3780
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/gseccovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSTMjK03nNiYoQYvu4Izyfn9OJNdAQUWHuOdSr%2BYYCqkEABrtboB0ZuP0gCDDr6WyPB2UqgqvyNjw%3D%3D
US
der
940 b
whitelisted
3780
iexplore.exe
GET
200
184.24.77.57:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgTfHj1i%2F6ETNRYiY0E%2F1BkCsA%3D%3D
US
der
503 b
shared
3780
iexplore.exe
GET
200
67.27.159.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?315d2374dcff7e41
US
compressed
4.70 Kb
whitelisted
3780
iexplore.exe
GET
200
96.16.145.230:80
http://x1.c.lencr.org/
US
der
717 b
whitelisted
3664
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3780
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJ9L2KGL92BpjF3kAtaDtxauTmhgQUPdNQpdagre7zSmAKZdMh1Pj41g8CEAoIoPYH8AScgXOj0yKW3ww%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3780
iexplore.exe
67.199.248.10:443
bit.ly
GOOGLE-CLOUD-PLATFORM
US
shared
3664
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
3664
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3780
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
3780
iexplore.exe
8.238.29.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
3664
iexplore.exe
8.238.29.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
3780
iexplore.exe
142.250.184.195:80
ocsp.pki.goog
GOOGLE
US
whitelisted
3780
iexplore.exe
142.250.186.161:443
hotgrls1192.page.link
GOOGLE
US
whitelisted
3780
iexplore.exe
188.130.138.176:443
angelshotone2.online
Kontel LLC
RU
unknown
3780
iexplore.exe
188.114.97.3:443
svntrk.com
CLOUDFLARENET
NL
malicious

DNS requests

Domain
IP
Reputation
bit.ly
  • 67.199.248.10
  • 67.199.248.11
shared
ctldl.windowsupdate.com
  • 8.238.29.254
  • 67.27.159.126
  • 67.27.159.254
  • 67.26.83.254
  • 8.248.149.254
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
hotgrls1192.page.link
  • 142.250.186.161
suspicious
ocsp.pki.goog
  • 142.250.184.195
whitelisted
angelshotone2.online
  • 188.130.138.176
unknown
x1.c.lencr.org
  • 96.16.145.230
whitelisted
r3.o.lencr.org
  • 184.24.77.57
  • 184.24.77.65
  • 184.24.77.52
  • 184.24.77.83
  • 184.24.77.48
  • 184.24.77.45
  • 184.24.77.71
  • 184.24.77.74
  • 184.24.77.77
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://bit.ly/3UXpb6T