analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://es.r.emails.fnac.com/r/?id=h1aa5b54b,bc53f7f,bc54024&OriginClick=YES&Origin=mailes_bc54024

Full analysis: https://app.any.run/tasks/b8f3d065-5d71-41aa-8f12-fd4621f16656
Verdict: Malicious activity
Analysis date: June 27, 2022, 08:26:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

C0CB84656FCA23D03A195CDD9D82D4E1

SHA1:

9ACC238F909F0EF8566B41BD8C3584979A598E8D

SHA256:

FFC67F23DD0E3E9A205A2617E07168A3C65C5B266A52A63F9FF84EDDCDBAEFBE

SSDEEP:

3:N1KbMdMhKHBi5wP7Vm81sMPL+XWLlE9T:CvhKHBjxm81sMz+ce9T

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 960)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 960)
      • iexplore.exe (PID: 2908)

    • Application launched itself

      • iexplore.exe (PID: 2908)

    • Changes internet zones settings

      • iexplore.exe (PID: 2908)

    • Reads the computer name

      • iexplore.exe (PID: 960)
      • iexplore.exe (PID: 2908)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 960)
      • iexplore.exe (PID: 2908)

    • Reads internet explorer settings

      • iexplore.exe (PID: 960)

    • Creates files in the user directory

      • iexplore.exe (PID: 960)
      • iexplore.exe (PID: 2908)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2908)
      • iexplore.exe (PID: 960)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 960)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2908)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2908)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2908"C:\Program Files\Internet Explorer\iexplore.exe" "http://es.r.emails.fnac.com/r/?id=h1aa5b54b,bc53f7f,bc54024&OriginClick=YES&Origin=mailes_bc54024"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
960"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2908 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
14 408
Read events
14 116
Write events
290
Delete events
2

Modification events

(PID) Process:(2908) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2908) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2908) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30968319
(PID) Process:(2908) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(2908) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30968319
(PID) Process:(2908) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2908) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2908) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2908) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2908) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
31
Text files
144
Unknown types
40

Dropped files

PID
Process
Filename
Type
960iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:3CE99FB75765046F891C1DBC22A24E15
SHA256:DA1308F78DD640CF3EDF476B6E19C9DE9337D08016BF5A3B9D532EA099ED7BC0
2908iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:C39CB27D7A54B0933D55C5210B641DC4
SHA256:7827334D0023600C279F3A0665AE0F7CBB19CD58F0652C134DE7E13CFA535C0E
960iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\065E58930AB051B0FBB88C41D1DE3990_13BCAC4AE9A9B2123BA80E35DFF615CDder
MD5:790888C0D613934359E1E6AE02AD0642
SHA256:C9FBEA16CCBE29CECA210111159CC004B635E1AECC030FAD0FF11A0CB3D73FC3
960iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\HGD7SPUT.txttext
MD5:2E032EFFFB6B1B4EBCC5B7384D9F75D5
SHA256:54231A2411A530267443DC74C54F16408A6E69F11386A4428E67C684DBE45AE4
960iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894der
MD5:70D95E3307DD1636981EB98F22320529
SHA256:4292EEE1FA677D4D2137F894A62ED35695C3FB8D66B080DEB5292C0B6B8A4783
960iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4Fder
MD5:8352A68E577A4F7AA01A568BA9110CF9
SHA256:0F7F8E22508EFC9EAF167F51ED956BC7703C69B0B848A0B94A5D988AEAA369A0
960iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\065E58930AB051B0FBB88C41D1DE3990_13BCAC4AE9A9B2123BA80E35DFF615CDbinary
MD5:70B2056397EAAFBCBEA99B6F578DBA6E
SHA256:32CD4661B5056EF2B9F598C3634A790412BAC0B1DDC45F6BC4FCBB0A01CD3277
960iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62der
MD5:C7B33A5171B37E83B2AC6D3473E63BE3
SHA256:334F918A1C31E0077473B071BD772E41E445988FD3237E99DE91576DD604E0C1
2908iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:28CC3D4B0DA8A29A9DCD6D4755C84342
SHA256:A4CA2DD1D4545838F7A9102623442BC76BDEB2185E9991A294BCB0B6456DDA0E
960iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D6243C18F0F8F9AEC6638DD210F1984_4ADA85C2445B62E7C1862BA7D123C0C1der
MD5:38876B43E77967F0AB8B29BFF64EC15A
SHA256:F2D46703CB2C3F715EDD12C180352F7465D742030BDF5AE6CEA15DC139F10BDE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
144
DNS requests
48
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
960
iexplore.exe
GET
200
108.156.253.168:80
http://ocsp.sca1b.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEAfuZznx0Uk4G%2BGMvl5JJZ0%3D
US
der
471 b
whitelisted
960
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
960
iexplore.exe
GET
200
23.45.103.152:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSEQoGovlaDsPZhmnjxqjsosks6QwQUt2PnGt2N6QimVYOk4GpQQWURQkkCEAqD1IA%2Bfp9RAAAAAFHUwfc%3D
NL
der
1.07 Kb
whitelisted
960
iexplore.exe
GET
200
23.45.103.152:80
http://ocsp.entrust.net/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSEQoGovlaDsPZhmnjxqjsosks6QwQUt2PnGt2N6QimVYOk4GpQQWURQkkCEQC2AZE9hVO6%2BgAAAABR1MH2
NL
der
1.07 Kb
whitelisted
960
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAfy81yHqHeveu%2FpR5k1Jb0%3D
US
der
471 b
whitelisted
960
iexplore.exe
GET
200
18.66.242.45:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
960
iexplore.exe
GET
200
18.66.242.155:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D
US
der
1.39 Kb
shared
2908
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
960
iexplore.exe
GET
200
172.217.18.3:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCfB0sRdF8W%2FBIjdfpYeZPw
US
der
472 b
whitelisted
960
iexplore.exe
GET
200
172.217.18.3:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDNqcm0ttxULAoGqTwy8PoU
US
der
472 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
960
iexplore.exe
193.108.69.68:80
es.r.emails.fnac.com
—
—
unknown
960
iexplore.exe
34.249.97.7:443
queue.fnacdarty.com
Amazon.com, Inc.
IE
unknown
2908
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
960
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
2908
iexplore.exe
13.107.22.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
960
iexplore.exe
23.45.103.152:80
ocsp.entrust.net
Akamai International B.V.
NL
suspicious
960
iexplore.exe
143.204.101.177:80
o.ss2.us
—
US
suspicious
960
iexplore.exe
23.36.163.232:443
www.fnac.es
CW Vodafone Group PLC
NL
suspicious
960
iexplore.exe
18.66.242.45:80
ocsp.rootg2.amazontrust.com
Massachusetts Institute of Technology
US
whitelisted
960
iexplore.exe
18.66.242.155:80
ocsp.rootg2.amazontrust.com
Massachusetts Institute of Technology
US
whitelisted

DNS requests

Domain
IP
Reputation
es.r.emails.fnac.com
  • 193.108.69.68
suspicious
www.fnac.es
  • 23.36.163.232
  • 23.36.163.235
whitelisted
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 13.107.22.200
  • 131.253.33.200
whitelisted
ocsp.entrust.net
  • 23.45.103.152
whitelisted
queue.fnacdarty.com
  • 34.249.97.7
  • 52.211.235.189
  • 54.195.221.89
unknown
ocsp.digicert.com
  • 93.184.220.29
whitelisted
o.ss2.us
  • 143.204.101.177
  • 143.204.101.99
  • 143.204.101.123
  • 143.204.101.195
whitelisted
ocsp.rootg2.amazontrust.com
  • 18.66.242.45
  • 18.66.242.155
  • 18.66.242.58
  • 18.66.242.62
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://es.r.emails.fnac.com/r/?id=h1aa5b54b,bc53f7f,bc54024&OriginClick=YES&Origin=mailes_bc54024