File name:

2018-12-10-Ursnif-retrieved-by-Word-macro.exe

Full analysis: https://app.any.run/tasks/60371173-14de-46fe-b6de-06dbb2f5fc77
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 02:43:07
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
gozi
ursnif
dreambot
banker
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

5D72F1508055964F7E900CBEF5231674

SHA1:

8F76C6EECDA320F33A02BB6495F43559799FEB93

SHA256:

FB3B1F56271DFD3B8AC5170BE62702F619600905D9B58FB87E420328A453CCE6

SSDEEP:

12288:ueHj92GcEWVffCYm8lIZQ0KycNIeT3TlN:ueHj92GhWVfXm8AQTEGTlN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • URSNIF has been detected (SURICATA)

      • iexplore.exe (PID: 5964)
      • iexplore.exe (PID: 6436)
      • iexplore.exe (PID: 5244)
      • iexplore.exe (PID: 6468)
      • iexplore.exe (PID: 5512)
      • iexplore.exe (PID: 2776)
      • iexplore.exe (PID: 2268)
      • iexplore.exe (PID: 5188)
      • iexplore.exe (PID: 7020)

    • Connects to the CnC server

      • iexplore.exe (PID: 5964)
      • iexplore.exe (PID: 6468)
      • iexplore.exe (PID: 5244)
      • iexplore.exe (PID: 6436)
      • iexplore.exe (PID: 5512)
      • iexplore.exe (PID: 2268)
      • iexplore.exe (PID: 2776)
      • iexplore.exe (PID: 7020)
      • iexplore.exe (PID: 5188)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • iexplore.exe (PID: 5964)
      • iexplore.exe (PID: 6436)
      • iexplore.exe (PID: 5244)
      • iexplore.exe (PID: 5512)
      • iexplore.exe (PID: 2776)
      • iexplore.exe (PID: 5188)
      • iexplore.exe (PID: 2268)
      • iexplore.exe (PID: 7020)
      • iexplore.exe (PID: 6468)

  • INFO

    • The sample compiled with english language support

      • 2018-12-10-Ursnif-retrieved-by-Word-macro.exe (PID: 6668)

    • Checks supported languages

      • ielowutil.exe (PID: 1328)
      • 2018-12-10-Ursnif-retrieved-by-Word-macro.exe (PID: 6668)

    • Reads the software policy settings

      • slui.exe (PID: 5176)
      • slui.exe (PID: 4336)

    • Reads the computer name

      • 2018-12-10-Ursnif-retrieved-by-Word-macro.exe (PID: 6668)
      • ielowutil.exe (PID: 1328)

    • Checks proxy server information

      • slui.exe (PID: 4336)

    • Local mutex for internet shortcut management

      • iexplore.exe (PID: 5400)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2014:12:10 12:09:38+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 210432
InitializedDataSize: 112128
UninitializedDataSize: -
EntryPoint: 0x25495
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 8.4.64.28
ProductVersionNumber: 8.4.64.28
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: AvidXchange Wild
ProductVersion: 8.4.64.28
ProductName: Weatherhand
LegalCopyright: Copyright © 2003 AvidXchange Wild. All rights reserved.
FileDescription: Weatherhand
OriginalFileName: butrepresent.exe
FileVersion: 8.4.64.28
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
175
Monitored processes
30
Malicious processes
11
Suspicious processes
4

Behavior graph

Click at the process to see the details
start 2018-12-10-ursnif-retrieved-by-word-macro.exe no specs sppextcomobj.exe no specs slui.exe ielowutil.exe no specs iexplore.exe #URSNIF iexplore.exe slui.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe iexplore.exe no specs #URSNIF iexplore.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
208"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
668"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
900"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1328"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -EmbeddingC:\Program Files (x86)\Internet Explorer\ielowutil.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Low-Mic Utility Tool
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\ielowutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1764"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2268"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2796 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2320C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2776"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2796"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
41 413
Read events
41 122
Write events
241
Delete events
50

Modification events

(PID) Process:(5400) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5400) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5400) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5400) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(5400) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery
Operation:writeName:Active
Value:
0
(PID) Process:(5400) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(5400) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(5400) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{F3AA0FDB-0922-11F0-B4ED-18F7786F96EE}
Value:
0
(PID) Process:(5400) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch
Operation:writeName:Version
Value:
WS not running
(PID) Process:(5400) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:FullScreen
Value:
no
Executable files
0
Suspicious files
50
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5400iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{F3AA0FDD-0922-11F0-B4ED-18F7786F96EE}.datbinary
MD5:08A2095A585C9F9BDC71C170A77EBA82
SHA256:9B5F5B6B40E9114508D18A7F64AED2759C47BBD6488AF05593D90416B17D3470
5964iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DATbinary
MD5:0392ADA071EB68355BED625D8F9695F3
SHA256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
5400iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{F3AA0FDB-0922-11F0-B4ED-18F7786F96EE}.datbinary
MD5:8C012D053A7E097443B2C5C537E2B4B0
SHA256:0B764471F54A38F1135F5BDDAD5D3C544AF897DEBED3601976CA5CF28014CE62
5400iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF65E25B2DCBF857D7.TMPbinary
MD5:DDF87AFADE7F47B0EA528E934FAD420D
SHA256:9DD82D2E38A702E3E1B106492E4081168C3A0255C498D593602070486A4EAA32
5400iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFABFB3A152CC53CA1.TMPbinary
MD5:03B4B81EE9B866FEFAB74D54A7DF492E
SHA256:999EE7214E821FFCBE30D08B82FE321E995D8BFCAB8ABCA4F177F3620E4E03F4
208iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF40C907460CCB7DF7.TMPbinary
MD5:747817E202D26A19F49662C0991986D9
SHA256:8C90CEBC86F18D6FA2D3ABCB4174EB039936C8E84BA8C287EBC7B770953253FB
3828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{33DC56C9-0923-11F0-B4ED-18F7786F96EE}.datbinary
MD5:80CB04CE9B9454CE36CCF7E6644F0952
SHA256:8D16635ABEAA0659E201898573FEF1F20606EC7CAA56305425D4B9C1EEA8F85C
5964iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\SmartScreenCache.datbinary
MD5:0A23D5A0AFA23B40DC5FD04FCA0D29C0
SHA256:87B42394F2CADD1159C978A56EAB4EC4E185BEF0937149A7209EACA71D74F59F
4448iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFF20ACB0A9A24F2FE.TMPbinary
MD5:283C2C3F8C498EE97D49D828F2AE26D3
SHA256:AF92A40AB2AA6CBAA0C95D5ACBBDA9E7390B345B8EDD6EF2027D55962679B525
208iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF74F29DE89E0A5CBF.TMPbinary
MD5:489473D5C91D0C0BBD26AB1F131AE16D
SHA256:D1565FE070A69DBBA296C52AADFF5ACC422AB6BCE48C53330A005AB4871E7C5B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
77
DNS requests
27
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5964
iexplore.exe
GET
404
52.26.80.133:80
http://aplatmesse.com/images/MX_2FVhbt9DURV/K_2FU_2FnGhdpImv9OJQx/pTcZI7_2B0nwHYju/SimmBnkmqzoEhhG/ZWFKvqffO2DXK1TlDe/mjp4pHI3i/WnzSIxf0h0fxttK5v7L2/xM27nD8zphkPtT8aevd/4kowoGkUBuzqS6z1LzQIuH/QvU3.avi
unknown
—
—
malicious
4268
iexplore.exe
GET
404
49.13.77.253:80
http://touggledle.com/images/23Sraj1bR88wI/AvS2egiV/GFEpvBXRY9Dw27vYhV4JUgW/SXqZGdq3Ys/KSHnVPPoVXXieAQWJ/PCwwnYYjC9rZ/dDXbqGBvjN_/2FqJyoPDtRztY4/Mf2qjW52hSZ_2BNHZIzM7/Yi4SzhXqyjk0FpmP/FdPltv2ot8kDaky/sPR2fgpQ2v3rKG/r.avi
unknown
—
—
unknown
6468
iexplore.exe
GET
404
49.13.77.253:80
http://nowerdleat.com/images/P1DNUeu1W1/OlryUw_2BVF0H_2BH/o2ml0_2FImz7/1pEBVe3Waw_/2BfmIWzXsIzfW8/swj_2FxE_2BKqYvCMmClo/wncVchfGQp1z2r46/yvHYsyEjfRIXgA_/2F2hxZMopl6bDs1kee/n50_2F67r/xkfVuEbh7FMHsKuKMfEX/5ehrKZ9B0uFD24Zdqph/_2Bm8pC.avi
unknown
—
—
malicious
5512
iexplore.exe
GET
404
49.13.77.253:80
http://touggledle.com/images/uFFCvskPS/XgsJmou4LL3CeF8_2BNO/AJTUxklShFZKmOECxcn/BRNNZrmHuugZNz7dLpfvAL/c9LKc49exetq0/HZCoU8ce/d_2B7Kt8fNPHwTu2ZULw50h/ydysEy7AWh/hsl4U9f5o609cKrwH/PZFVdh68/NZpZd.avi
unknown
—
—
malicious
5360
iexplore.exe
GET
404
52.26.80.133:80
http://aplatmesse.com/images/xZqnXem6ijEH3e_2Fm/gxmAV66Nj/nOrmhscKeFMp3yJUKrji/jWRFIepWw9BbdODc6cF/CIQzig4BUQCZw2LMv1oe6v/8z4zPQUnAXjiX/PRRD2tYO/H9Z5m9GgAeANpu_2FbWm43o/Ke3vF6RFn6oAb0nh/1U4oYE.avi
unknown
—
—
malicious
6972
iexplore.exe
GET
404
52.26.80.133:80
http://aplatmesse.com/images/UeUkQPM1USoQhFVoDlQ/eF9D1Ee3d9XULEvCVqq_2F/IATO8aYfQOQDO/fL42bU_2/FdL61m0zk3rGYbrujj2VA_2/Bmyv2xMR7X/WbrYqlohEdR_2Bcsr/vllQ5lg6_2FZ/OMoYTXSBSWq/5cMuEHKIJAklL1/eq8qzlY_/2FpFY.avi
unknown
—
—
malicious
2776
iexplore.exe
GET
404
49.13.77.253:80
http://nowerdleat.com/images/rGmj_2F4Wtft/VceNK_2F99b/S2VMFftNc8qX2J/i6ljxoFFsJOwMxWfcZwot/dxqpNY02I4JISsHl/whpNJTQeA7d3ZrZ/DZPr60U1R8w27u2gIY/jOkAm3DLI/9CV4j_2BfT_2BiPv4oWD/BBXmjxVyve9FF89pkuz/QySiR8FUAvlIuz_2FZTj_2/BcEU90.avi
unknown
—
—
malicious
2268
iexplore.exe
GET
404
49.13.77.253:80
http://nowerdleat.com/images/7ysd_2FhvO9E8HN4G9jR5/X5pRQAVVSMYucoI1/iJia_2FgepRjiAT/RmlYb1l_2BY669ZiPf/yrmpIUi8I/9wIAJzj3xFn_2F7J1NpY/pzSTfTH8XePgemWFiD1/NsrG0_2F71qXiA0exKMXJ_/2BZ58HVvAuhAg/Ly0ncDZZ/h5801mTHAJI5pb7WC/O2ywW.avi
unknown
—
—
malicious
5188
iexplore.exe
GET
404
52.26.80.133:80
http://aplatmesse.com/images/uIDyvgt9Guv6FC57OBcaHq/GB_2Bm90thvM5/k_2FsD3j/54BDOSDkvP5B8DeGFdjBqsY/QKsF5vfzcr/99FwzPXFauwLpljjS/TKYSmspeBJ0y/1eUI98DilOE/vglWPGe4HWpIHs/Yz86aSvhM72zwQ_2Bwz9P/FV04F.avi
unknown
—
—
malicious
7020
iexplore.exe
GET
404
49.13.77.253:80
http://touggledle.com/images/GDlI9K3_/2FTfMQc_2F9iu_2Bzut_2BS/40Di34Nqzq/zxTWYfhi76rtCwms4/HaX9WEp2CEZW/fcKiAwh4y6D/z6oYCvRcwKY8d2/IXcZLrOJTTr4DwUXdJM3_/2F1Dbn4SH3r6OPmI/AuAOtdrmLpgGS2v/2rkT1k3RKVy/rq.avi
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5964
iexplore.exe
52.26.80.133:80
aplatmesse.com
AMAZON-02
US
malicious
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.132:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
728
backgroundTaskHost.exe
20.31.169.57:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5400
iexplore.exe
52.239.160.33:443
iecvlist.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 172.217.16.206
whitelisted
aplatmesse.com
  • 52.26.80.133
malicious
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.160.132
  • 20.190.160.22
  • 20.190.160.67
  • 20.190.160.5
  • 20.190.160.17
  • 40.126.32.72
  • 40.126.32.136
  • 20.190.160.128
whitelisted
arc.msn.com
  • 20.31.169.57
  • 20.74.47.205
whitelisted
iecvlist.microsoft.com
  • 52.239.160.33
whitelisted
c.urs.microsoft.com
  • 20.93.72.182
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
  • 2603:1030:c02:2::284
whitelisted

Threats

PID
Process
Class
Message
5964
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
6436
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
6436
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
5244
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
6468
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
6468
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
5512
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
2776
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
2776
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
7020
iexplore.exe
Malware Command and Control Activity Detected
ET MALWARE Ursnif Variant CnC Beacon - URI Struct M1 (_2B)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2018-12-10-Ursnif-retrieved-by-Word-macro.exe