analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://urldefense.com/v3/__http:/www.tinyurl.com/2ohg2o4n__;!!Lk4A-Bay!AMXNqH2G3-jx4boZcDUItUcVJ7e2bOZPe84-k_5sdLAAGjE-wjzBkF2NhsaeNVxaL48lGKbgQOb9wAYaq8IA$

Full analysis: https://app.any.run/tasks/7f9fe2bc-1b08-4faf-b176-73d6ada76151
Verdict: Malicious activity
Analysis date: August 12, 2022, 14:10:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

BA162EFA390ADD894D813957328EA1EB

SHA1:

C323A54C4DB551B646A05C720EC20EF6277C0D59

SHA256:

FED0D3A95CECCB29A36ADCC6ABA7FDE603FA7F5ADBEC431AD396BCAB8F0D7ADC

SSDEEP:

3:N8U2DAL5IKTWK66NRld+ZLdI5UQJAbIcgcREGbFv21QGpchskyHieBn:2UJtIrhZ1dWUmArgcOGeQG+yHie

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3496)
      • iexplore.exe (PID: 3084)
      • iexplore.exe (PID: 544)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 3084)
      • iexplore.exe (PID: 3496)
      • iexplore.exe (PID: 544)

    • Reads the computer name

      • iexplore.exe (PID: 3084)
      • iexplore.exe (PID: 3496)
      • iexplore.exe (PID: 544)

    • Changes internet zones settings

      • iexplore.exe (PID: 3084)

    • Application launched itself

      • iexplore.exe (PID: 3084)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3084)
      • iexplore.exe (PID: 3496)
      • iexplore.exe (PID: 544)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3084)
      • iexplore.exe (PID: 3496)
      • iexplore.exe (PID: 544)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 3084)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3084)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3084)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3496)
      • iexplore.exe (PID: 544)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3084"C:\Program Files\Internet Explorer\iexplore.exe" "https://urldefense.com/v3/__http:/www.tinyurl.com/2ohg2o4n__;!!Lk4A-Bay!AMXNqH2G3-jx4boZcDUItUcVJ7e2bOZPe84-k_5sdLAAGjE-wjzBkF2NhsaeNVxaL48lGKbgQOb9wAYaq8IAf7f81a39-5f63-5b42-9efd-1f13b5431005quot;C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3496"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3084 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
544"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3084 CREDAT:3085582 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
25 339
Read events
24 749
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
21
Text files
108
Unknown types
14

Dropped files

PID
Process
Filename
Type
3496iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833Bder
MD5:614F7B75F8BA6B85B0D3B6988FDAC98B
SHA256:06F72B87CF5655F9C09E1A4ED84BC5FDBABD6DF87A613FD64FE70606ED9C7AEF
3496iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:BD2BFC0A550375EEC5AD32DDE159D500
SHA256:F3628173F202015818210C03BAA2C7846408A5D297059D1577919416294E998D
3084iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:7C2819BB065830424641D805C3F8DDAA
SHA256:8372F4EA255B9BC80CAA71006FEF945CB58E783476CF75B400115088E396A306
3496iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Eder
MD5:6AAC8582893304B7B678B7E864946238
SHA256:8986A95049C4208CB8D384C59720ADA1E8CF2795CB9AEAE70317D88789049590
3496iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:589C442FC7A0C70DCA927115A700D41E
SHA256:2E5CB72E9EB43BAAFB6C6BFCC573AAC92F49A8064C483F9D378A9E8E781A526A
3496iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\72BA427A91F50409B9EAC87F2B59B951_F0B960C3B1E522BB9772662759982F90binary
MD5:430F08EBE93836A77901C644B375729C
SHA256:E4ED5E11E32BF188ED5BAFF77791F6DA001456F7E1AB58D200939693B14EC35C
3084iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:EE87BB11E233C12009CC11725035DBDC
SHA256:D82930A5B051B3C3F1639C24E83BDDF41D5AA66E467A0944D1AC3D59AE6330C5
3496iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833Bbinary
MD5:8449A6E585D7A50D212F6E80BBD3C040
SHA256:6684556B0B1588DEF0758BDE213490EFC69A5046ACC5340DD0478C6FDBCAF1E9
3496iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:A0C973E354C30CBF4AE2C18F526EF9AC
SHA256:90113B899D2AEF0458F2549A404AB128B25A7329E37B03006E27E8E4B6276FEF
3496iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab7013.tmpcompressed
MD5:589C442FC7A0C70DCA927115A700D41E
SHA256:2E5CB72E9EB43BAAFB6C6BFCC573AAC92F49A8064C483F9D378A9E8E781A526A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
74
DNS requests
32
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3496
iexplore.exe
GET
301
104.20.139.65:80
http://www.tinyurl.com/2ohg2o4n
US
—
—
suspicious
3496
iexplore.exe
GET
200
172.64.155.188:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
1.42 Kb
whitelisted
3496
iexplore.exe
GET
200
172.64.155.188:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEBN9U5yqfDGppDNwGWiEeo0%3D
US
der
2.18 Kb
whitelisted
3496
iexplore.exe
GET
200
172.64.155.188:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEA2KFitLH9n0LY9WTWFSpcE%3D
US
der
471 b
whitelisted
3496
iexplore.exe
GET
200
95.140.236.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?758eb514580d10af
GB
compressed
60.2 Kb
whitelisted
3084
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3496
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAvMX0E2%2BIYBmpSK4QMgZjA%3D
US
der
471 b
whitelisted
3084
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
der
471 b
whitelisted
3496
iexplore.exe
GET
301
104.20.138.65:80
http://tinyurl.com/2ohg2o4n
US
html
438 b
shared
3496
iexplore.exe
GET
200
184.24.77.77:80
http://e1.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTvkAFw3ViPKmUeIVEf3NC7b1ErqwQUWvPtK%2Fw2wjd5uVIw6lRvz1XLLqwCEgRjy9znccGo6O6AoAV5RNWGhg%3D%3D
US
der
346 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3496
iexplore.exe
52.6.56.188:443
urldefense.com
Amazon.com, Inc.
US
suspicious
3084
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3084
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3496
iexplore.exe
172.64.155.188:80
ocsp.comodoca.com
—
US
suspicious
3496
iexplore.exe
95.140.236.0:80
ctldl.windowsupdate.com
Limelight Networks, Inc.
GB
whitelisted
3496
iexplore.exe
104.20.139.65:80
www.tinyurl.com
Cloudflare Inc
US
suspicious
3496
iexplore.exe
188.114.96.3:443
goakendmest.ga
Cloudflare Inc
US
malicious
3496
iexplore.exe
157.240.20.35:443
facebook.com
Facebook, Inc.
US
whitelisted
3496
iexplore.exe
184.24.77.77:80
e1.o.lencr.org
Time Warner Cable Internet LLC
US
unknown
3496
iexplore.exe
96.16.145.230:80
x1.c.lencr.org
Akamai Technologies, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
urldefense.com
  • 52.204.90.22
  • 52.6.56.188
  • 52.71.28.102
shared
ctldl.windowsupdate.com
  • 95.140.236.0
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
  • 131.253.33.200
  • 13.107.22.200
whitelisted
ocsp.comodoca.com
  • 172.64.155.188
  • 104.18.32.68
whitelisted
ocsp.usertrust.com
  • 172.64.155.188
  • 104.18.32.68
whitelisted
ocsp.sectigo.com
  • 172.64.155.188
  • 104.18.32.68
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
www.tinyurl.com
  • 104.20.139.65
  • 172.67.1.225
  • 104.20.138.65
suspicious
tinyurl.com
  • 104.20.138.65
  • 172.67.1.225
  • 104.20.139.65
shared

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .ga Domain
3496
iexplore.exe
Potentially Bad Traffic
ET INFO Suspicious Domain (*.ga) in TLS SNI
3496
iexplore.exe
Potentially Bad Traffic
ET INFO Observed Let's Encrypt Certificate for Suspicious TLD (.ga)
3496
iexplore.exe
Potentially Bad Traffic
ET INFO Observed Let's Encrypt Certificate for Suspicious TLD (.ga)
3496
iexplore.exe
Potentially Bad Traffic
ET INFO Observed Let's Encrypt Certificate for Suspicious TLD (.ga)
3496
iexplore.exe
Generic Protocol Command Decode
SURICATA STREAM CLOSEWAIT FIN out of window
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://urldefense.com/v3/__http:/www.tinyurl.com/2ohg2o4n__;!!Lk4A-Bay!AMXNqH2G3-jx4boZcDUItUcVJ7e2bOZPe84-k_5sdLAAGjE-wjzBkF2NhsaeNVxaL48lGKbgQOb9wAYaq8IA$