analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://api.vault.netvoyage.com/neWeb2/login.aspx?newUser=VAULT-UD0VZG3A%7c2021-07-23+12%3a20%3a47Z%7c9hoaPQ5bg0Pwq5HKG708Q4RhxD4%3d

Full analysis: https://app.any.run/tasks/474e6db5-68b4-4df4-b633-f9cec734ce20
Verdict: Malicious activity
Analysis date: July 23, 2021, 15:02:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

0B2F0E9B2BACE0B1EBB26858993ECA7E

SHA1:

0433DDF05B0C45C16BD2C614B61F12FE45BFC2D4

SHA256:

FBDC09008D01C0555A57DACF2028E6A5CE13DA676F0D69B636F1A7193CA229E3

SSDEEP:

3:N8DLtJtL0TKX3LVKPnaKBy/1cANSIZ5fIWNKE+QHBSUyGn:2XhL0J5g/qAN7Z50FQhRyGn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 420)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 420)
      • iexplore.exe (PID: 2540)

    • Checks supported languages

      • iexplore.exe (PID: 2540)
      • iexplore.exe (PID: 420)

    • Changes internet zones settings

      • iexplore.exe (PID: 2540)

    • Application launched itself

      • iexplore.exe (PID: 2540)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2540)
      • iexplore.exe (PID: 420)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2540)
      • iexplore.exe (PID: 420)

    • Reads internet explorer settings

      • iexplore.exe (PID: 420)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2540"C:\Program Files\Internet Explorer\iexplore.exe" "https://api.vault.netvoyage.com/neWeb2/login.aspx?newUser=VAULT-UD0VZG3A%7c2021-07-23+12%3a20%3a47Z%7c9hoaPQ5bg0Pwq5HKG708Q4RhxD4%3d"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
420"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2540 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\sechost.dll
Total events
17 080
Read events
16 949
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
25
Text files
40
Unknown types
40

Dropped files

PID
Process
Filename
Type
2540iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:B5CAE31BC8AB74218C500C3C9DDFEDF9
SHA256:EF774A57576A450AD7DB6B83F60F19EB1F752F92EFE63C802D30D388F1DCB7A3
420iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\waitWhite[1].gifimage
MD5:FEE0364C8963820CA3DEA8F4A42527AF
SHA256:9A30D8018F94E4D5CCA0E7921EE68A4558ED70FF1E8D96067462E0EA6F3C916E
420iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\ndCommon[1].jstext
MD5:16AD17823C02B632A4235826D2D42A83
SHA256:675740E53339204F53BD476C3FFA85106098B516668F4554A7951C58C0F84E8A
420iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\neWebCl[1].cabcompressed
MD5:BA6505B604EBC0C13867B077D0630DE8
SHA256:C699D974C121AB1CA62074CA4C8288AF8DA39A0CAAA5702102000C3B580766DB
420iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4der
MD5:452010DF5190805ECCE2E9F404D43048
SHA256:B5A129DC56EA03AF0880964265B4537CF70FE00212AB46D2FFB0931434D3CC90
2540iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:4745B777FE397BA7BB2107A05A6E6ADC
SHA256:2C03F58A9D4D559E3F36BA1501E8213C8611D5AC524BB2851433577DCEF1D9EC
420iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\main[1].csstext
MD5:6FB4C389E7E7744FEAA2FD4274D2FAC4
SHA256:2A2B10B31715076C8E4A766EFB02BAD8A3E115F4E386C8502915566312404F82
420iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\login[1].htmhtml
MD5:9183386DC01AE6E25E177765DD67D183
SHA256:223803B97A7BC7395953CC599B9C21BBE24933B7238941FC97B372BA9066DFE1
420iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\waitBlackGrey[1].gifimage
MD5:B28583233FA90B7369CD8BC5F23D59D5
SHA256:5AE88CD097CEB56102ECBADEDFC2E273014836D2ECBD58235FB86964A6E1A152
420iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:1575B5DECA49B3345BFC30301B09742A
SHA256:1B5BE811423A011A9EB5CC68DE20FF64CFE09DF990C4C748246082512FCEDA46
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
86
DNS requests
35
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
420
iexplore.exe
GET
200
143.204.101.74:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
420
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D
US
der
471 b
whitelisted
2540
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
420
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAo1CNVcKSsBffitZcAP9%2BQ%3D
US
der
471 b
whitelisted
2540
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
420
iexplore.exe
GET
200
13.32.23.104:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
420
iexplore.exe
GET
200
23.55.163.73:80
http://crl.identrust.com/DSTROOTCAX3CRL.crl
US
der
1.16 Kb
whitelisted
420
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
420
iexplore.exe
GET
200
67.27.157.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c19c7e0552192d91
US
compressed
4.70 Kb
whitelisted
420
iexplore.exe
GET
200
23.55.163.58:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgPJI4TIRSJWxIRXrY3bPKl8zA%3D%3D
US
der
503 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2540
iexplore.exe
67.27.157.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
2540
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
420
iexplore.exe
67.27.157.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
420
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2540
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
420
iexplore.exe
23.55.163.73:80
crl.identrust.com
Akamai International B.V.
US
unknown
2540
iexplore.exe
13.107.21.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2540
iexplore.exe
67.26.139.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
420
iexplore.exe
23.36.235.31:443
api.vault.netvoyage.com
Akamai Technologies, Inc.
NL
unknown
420
iexplore.exe
104.117.200.9:80
x1.c.lencr.org
TPG Telecom Limited
US
unknown

DNS requests

Domain
IP
Reputation
api.vault.netvoyage.com
  • 23.36.235.31
unknown
api.bing.com
  • 13.107.13.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ctldl.windowsupdate.com
  • 67.27.157.254
  • 67.26.139.254
  • 8.253.207.120
  • 67.26.81.254
  • 8.253.204.249
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
www.netdocuments.com
  • 52.49.198.28
  • 52.212.43.230
  • 3.248.8.137
malicious
crl.identrust.com
  • 23.55.163.73
  • 23.55.163.57
whitelisted
x1.c.lencr.org
  • 104.117.200.9
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://api.vault.netvoyage.com/neWeb2/login.aspx?newUser=VAULT-UD0VZG3A%7c2021-07-23+12%3a20%3a47Z%7c9hoaPQ5bg0Pwq5HKG708Q4RhxD4%3d