hxxps://gemini[.]google[.]com/app/9405ebeeed73ae5d

Analysis

max time kernel
108s
max time network
76s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 13:11 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gemini.google.com/app/9405ebeeed73ae5d

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a09fba369170da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415979028"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5D166A81-DC84-11EE-86A4-EA483E0BCDAF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd00000000020000000000106600000001000020000000082ca2a95158f932450f1411c8cbf39dc8a77095b08705aed1771f74db5ff5fd000000000e8000000002000020000000fcc0213250d3123670c882fe74726860e007a4bc8fed4c92a593acf1390521ea200000001e887586b2fa5e57e7e1ec35d2c1ee87334856f3d45d5ce4dc69e3372635e5194000000018c7375c9d5684c3e550511a59c935ad0a2676fc1016875c634db7e268e1e20edc1a401aff4443f708b272b3938a2f33670695ad60a049f08005e8bee2c03ad3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd00000000020000000000106600000001000020000000917868b5a8914a7abedf78adbfb9ed595e64541b8d2b030ae7f4c31ed081bdab000000000e8000000002000020000000fd23edd099c8c567d59e32381af439d8dd013b6ba7e2e6eb3569a1c30eed662b90000000aa38fba92cf4759d06bcc7a3249a8cccae23ade660c16ff6453952905abe322345cbf1429d2c1e383b7e5f01e6861fa1214ab377387fd695c09187c15f5e1671b34a63d530aadb96dbb092ca335d6a21b06083ffe932782b182f3266add72e3f5df640ac873f84066a592294c9ea789d8e2448cc0dfcc08635c960d5d9c39d44742d9c8ce7627fe3f91a59bcd6a8a55440000000314f6d2411b992aa1b13fa4002c012251dad2403df93c8fc7426e3227907b752f16e2feece2a524365f45bafe754fbe9f77a90a04e0cde5f9bda2239c2bef408	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3040	iexplore.exe
3040	iexplore.exe
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2124	3040	iexplore.exe	28
PID 3040 wrote to memory of 2124	3040	iexplore.exe	28
PID 3040 wrote to memory of 2124	3040	iexplore.exe	28
PID 3040 wrote to memory of 2124	3040	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://gemini.google.com/app/9405ebeeed73ae5d
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2124

Network

DNS

gemini.google.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

gemini.google.com

IN A

Response

gemini.google.com

IN A

142.250.180.14
GET

https://gemini.google.com/app/9405ebeeed73ae5d

IEXPLORE.EXE

Remote address:

142.250.180.14:443

Request

GET /app/9405ebeeed73ae5d HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: gemini.google.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Content-Type: application/binary
X-Frame-Options: DENY
Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
Content-Security-Policy: report-uri /_/BardChatUi/cspreport;default-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';object-src * 'unsafe-inline' 'unsafe-eval';worker-src * 'unsafe-inline' 'unsafe-eval';img-src https://*.google.com https://*.googleusercontent.com https://*.gstatic.com https://*.youtube.com https://*.ytimg.com https://*.ggpht.com https://bard.datacommons.org blob: data: https://*.googleapis.com;media-src https://*.google.com https://*.googleusercontent.com https://*.gstatic.com https://*.youtube.com https://*.ytimg.com https://*.ggpht.com https://bard.datacommons.org blob: https://*.googleapis.com;child-src 'self' https://*.google.com https://*.scf.usercontent.goog https://www.youtube.com https://docs.google.com/picker/v2/home blob:;frame-src 'self' https://*.google.com https://*.scf.usercontent.goog https://www.youtube.com https://docs.google.com/picker/v2/home blob:;connect-src 'self' https://*.google.com https://*.gstatic.com https://*.google-analytics.com https://csp.withgoogle.com/csp/proto/BardChatUi https://content-push.googleapis.com/upload/ https://*.googleusercontent.com https://ogads-pa.googleapis.com/ data: https://*.googleapis.com;style-src 'report-sample' 'unsafe-inline' https://www.gstatic.com https://fonts.googleapis.com;font-src https://fonts.gstatic.com https://www.gstatic.com;form-action https://ogs.google.com;manifest-src 'none'
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/BardChatUi/cspreport
Content-Security-Policy: script-src 'nonce-ZVLbbps7J7X7mLHksNMRkw' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/BardChatUi/cspreport;worker-src 'self'
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Thu, 07 Mar 2024 13:12:43 GMT
Location: https://consent.google.com/m?continue=https://gemini.google.com/app/9405ebeeed73ae5d&gl=GB&m=0&pc=bard&cm=2&hl=en-US&src=1
P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
Cross-Origin-Resource-Policy: same-site
Cross-Origin-Opener-Policy: same-origin-allow-popups
Server: ESF
Content-Length: 0
X-XSS-Protection: 0
X-Content-Type-Options: nosniff
Set-Cookie: SOCS=CAAaBgiAh6SvBg; Domain=.google.com; Expires=Sun, 06-Apr-2025 13:12:43 GMT; Path=/; Secure; SameSite=lax
Set-Cookie: __Secure-ENID=18.SE=DWHrxKwWL2npz6-rxNZV8P5wmLuTjszVlDl7p7zNSh3r7TtXZSLGsONQUsIx7JSErsqBpu5X2xD3pp9LSmXAI3YUEb_D-dup0QrnBAh9C8isKVtex3qz2Q-E_6YfhTlPqio45jHNq-u9md2RU5JDX-23JuQAnHH3rqePlBuIR_0; expires=Mon, 07-Apr-2025 05:31:01 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
DNS

consent.google.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

consent.google.com

IN A

Response

consent.google.com

IN A

142.250.178.14
GET

https://consent.google.com/m?continue=https://gemini.google.com/app/9405ebeeed73ae5d&gl=GB&m=0&pc=bard&cm=2&hl=en-US&src=1

IEXPLORE.EXE

Remote address:

142.250.178.14:443

Request

GET /m?continue=https://gemini.google.com/app/9405ebeeed73ae5d&gl=GB&m=0&pc=bard&cm=2&hl=en-US&src=1 HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: consent.google.com
Connection: Keep-Alive
Cookie: SOCS=CAAaBgiAh6SvBg; __Secure-ENID=18.SE=DWHrxKwWL2npz6-rxNZV8P5wmLuTjszVlDl7p7zNSh3r7TtXZSLGsONQUsIx7JSErsqBpu5X2xD3pp9LSmXAI3YUEb_D-dup0QrnBAh9C8isKVtex3qz2Q-E_6YfhTlPqio45jHNq-u9md2RU5JDX-23JuQAnHH3rqePlBuIR_0

Response

HTTP/1.1 302 Found

Content-Type: application/binary
Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Thu, 07 Mar 2024 13:12:44 GMT
Location: https://consent.google.com/ml?continue=https://gemini.google.com/app/9405ebeeed73ae5d&gl=GB&hl=en-US&cm=2&pc=bard&src=1
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Cross-Origin-Opener-Policy: unsafe-none
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
Cross-Origin-Resource-Policy: same-site
Content-Security-Policy: script-src 'nonce-KKRPRQ54sd8OJtPQ-Nh-0A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ConsentUi/cspreport;worker-src 'self'
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/ConsentUi/cspreport
Server: ESF
Content-Length: 0
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://consent.google.com/ml?continue=https://gemini.google.com/app/9405ebeeed73ae5d&gl=GB&hl=en-US&cm=2&pc=bard&src=1

IEXPLORE.EXE

Remote address:

142.250.178.14:443

Request

GET /ml?continue=https://gemini.google.com/app/9405ebeeed73ae5d&gl=GB&hl=en-US&cm=2&pc=bard&src=1 HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: consent.google.com
Connection: Keep-Alive
Cookie: SOCS=CAAaBgiAh6SvBg; __Secure-ENID=18.SE=DWHrxKwWL2npz6-rxNZV8P5wmLuTjszVlDl7p7zNSh3r7TtXZSLGsONQUsIx7JSErsqBpu5X2xD3pp9LSmXAI3YUEb_D-dup0QrnBAh9C8isKVtex3qz2Q-E_6YfhTlPqio45jHNq-u9md2RU5JDX-23JuQAnHH3rqePlBuIR_0

Response

HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8
Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Thu, 07 Mar 2024 13:12:44 GMT
Cross-Origin-Resource-Policy: same-site
Content-Security-Policy: script-src 'nonce-nCNLGWxo8Yfr7ETL_pfBCQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ConsentHttp/cspreport;worker-src 'self'
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/ConsentHttp/cspreport
Cross-Origin-Opener-Policy: unsafe-none
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
reporting-endpoints: default="/_/ConsentHttp/web-reports?context=eJzjctDikmJw15BiiPr4nOndl5dMPF9fMkkAsQYQb_fxYOFbN51VBYh1109nDQVip_QZrEFA7FM_gzUGiIV4OM78WraeTWDDte_HGQG7Mh9U"
Content-Encoding: gzip
Server: ESF
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked
DNS

www.google.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.google.com

IN A

Response

www.google.com

IN A

172.217.16.228
GET

https://www.google.com/favicon.ico

IEXPLORE.EXE

Remote address:

172.217.16.228:443

Request

GET /favicon.ico HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: www.google.com
Connection: Keep-Alive
Cookie: SOCS=CAAaBgiAh6SvBg; __Secure-ENID=18.SE=DWHrxKwWL2npz6-rxNZV8P5wmLuTjszVlDl7p7zNSh3r7TtXZSLGsONQUsIx7JSErsqBpu5X2xD3pp9LSmXAI3YUEb_D-dup0QrnBAh9C8isKVtex3qz2Q-E_6YfhTlPqio45jHNq-u9md2RU5JDX-23JuQAnHH3rqePlBuIR_0

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Encoding: gzip
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable"
Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
Content-Length: 1494
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Thu, 07 Mar 2024 06:04:06 GMT
Expires: Fri, 15 Mar 2024 06:04:06 GMT
Cache-Control: public, max-age=691200
Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT
Content-Type: image/x-icon
Vary: Accept-Encoding
Age: 25720
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

142.250.180.14:443

gemini.google.com

tls

IEXPLORE.EXE

714 B
7.2kB
9
9
142.250.180.14:443

https://gemini.google.com/app/9405ebeeed73ae5d

tls, http

IEXPLORE.EXE

1.2kB
10.6kB
13
12

HTTP Request

GET https://gemini.google.com/app/9405ebeeed73ae5d

HTTP Response

302
142.250.178.14:443

https://consent.google.com/ml?continue=https://gemini.google.com/app/9405ebeeed73ae5d&gl=GB&hl=en-US&cm=2&pc=bard&src=1

tls, http

IEXPLORE.EXE

2.4kB
16.3kB
16
21

HTTP Request

GET https://consent.google.com/m?continue=https://gemini.google.com/app/9405ebeeed73ae5d&gl=GB&m=0&pc=bard&cm=2&hl=en-US&src=1

HTTP Response

302

HTTP Request

GET https://consent.google.com/ml?continue=https://gemini.google.com/app/9405ebeeed73ae5d&gl=GB&hl=en-US&cm=2&pc=bard&src=1

HTTP Response

200
142.250.178.14:443

consent.google.com

tls

IEXPLORE.EXE

872 B
7.2kB
9
10
172.217.16.228:443

www.google.com

tls

IEXPLORE.EXE

659 B
4.7kB
8
9
172.217.16.228:443

https://www.google.com/favicon.ico

tls, http

IEXPLORE.EXE

1.2kB
7.9kB
9
10

HTTP Request

GET https://www.google.com/favicon.ico

HTTP Response

200
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

1.0kB
7.7kB
11
13
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

1.1kB
7.7kB
13
12
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

869 B
7.6kB
11
11

8.8.8.8:53

gemini.google.com

dns

IEXPLORE.EXE

63 B
79 B
1
1

DNS Request

gemini.google.com

DNS Response

142.250.180.14
8.8.8.8:53

consent.google.com

dns

IEXPLORE.EXE

64 B
80 B
1
1

DNS Request

consent.google.com

DNS Response

142.250.178.14
8.8.8.8:53

www.google.com

dns

IEXPLORE.EXE

60 B
76 B
1
1

DNS Request

www.google.com

DNS Response

172.217.16.228

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d025f69ae7dba6008c072a1ebbf878e

SHA1
73dba367a8950b42b57e2025304d7ea3946f91c3

SHA256
b1dda2db1b46913ab267b36b8e1790b98e558f32ce8e431ff821a6f1cf610e6e

SHA512
32c702582531c12b75bde048ca7f3d0db1ecc014c232cb58c26a7d7b09cb4fa3c94a5f936c139e838befcdf0f8558d740ca5a3c0a41a72f9ac5e5f70f2fdff86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b67f09480680f32d41e14c43f36d770

SHA1
c398a2b0c0ddbf2db8982b3948995416a02def38

SHA256
16fa393eaf9cb5a48717e0ea5a63819beaca3f9f0d59fdca0ac5afa31835e877

SHA512
658fe46e272ed347eed372ac904e107efc80486cd4219267f64db68c9cc8c842b3fe3ae285303d50d963c1795072c558b9b95df0bdf6053ac702477fa51436f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c39ac59e9501132996f2386469e9eba

SHA1
9cc6f26767c965c37bdd5736116420c42772c24c

SHA256
09d87cd709072be7e2f20798f466703b21f13b46689e5cbd07283943fd31f467

SHA512
7ecf2955fc4ee2b5deb484fee74145a8a82cff0c83174ddc27a0c97183789412d4b35dc198e2297fc642f9de25f50a08917f0c89a26440d9f2d9251748c5e752

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f5ce4f3adbafa205dd86fbda63aa9d2

SHA1
245f00b812721c94e96926e4517d8b1bf9e52b08

SHA256
7d781f1ad1da37ef4661cb564a5e47e3d3da8d2f29fd300897276617db557752

SHA512
e0eacd93c913bed7742624aef3feb08926baef6bcf53aa0f25cfc9c2c6a95000e102dea48e41f2b8525ac151c1ad642f1ecba52f8a140a6a86843b610128f7d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2aedc213a2ead23b4d3ded7444314b0

SHA1
aca4410db3ea09f23630cb7ec8350f74a7e3f332

SHA256
958fa9285b59f959b57aa1d98cce3524b86b8a6efeff99f3767fa5d4eeffc50c

SHA512
fd796e603930ab539b6b3005c98a5bed98ca3146e51231d81dd414c098943604c9438a81d1a8f8925011484dc91ebc9b3cd7d8f171bbdc959a90c6da0e361f4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7288e16ec5180037d9da3da98c40d188

SHA1
a712bc75445af23a6af459fbf321ed12cd643adc

SHA256
2d00fdcfbee69317cdbff5e110633803ac33f7f07f081b61dce66a00f15f16b7

SHA512
116129aafdd86116a4a8024e9d8afa758eb5a6f83fe055cba5fd52368f3f5787944cc5829b008df0baa03865e0e44cc1ec5851247899cc0389a3559da5458268

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
96af3952e9a377ac19995bd46b9a8a42

SHA1
61a1b6e64602fa88a5ac8d2ced3243531931212d

SHA256
868a83848966d8e6330a3507f0727077ff7a626325f5f0b3370a17ecd52b5df5

SHA512
102af434f8cc97db767e276c061be680cde21ec75b1c2cfd0033f13d305d9acea42d816403476daebd1bbef210fc61aa7858d493f9fd5e70ce13417dec3fd153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1172300e3fbce5c17815038baa4cec6f

SHA1
0dbb47467fc727dc893e0f3c3ae97f3814b7c6dc

SHA256
8c849b2541e42435ca51d76a921a4e03efe7821b2b47919aed7db2b8bc1b05d5

SHA512
3682d3f701ba5f80998dfc2f8c494adf003a33802b912b217427701ed8ba0f3779b3637a1345e51233643e8885879a1e4be24cb2f53726a785530c2424728f23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
531cf8a84537b419c0810e3a727a1c74

SHA1
93027e2323d8e910a7dec69aa7f6d8c2ceb5e76a

SHA256
54f1dfc114ae8256732dc6bf12f630e494f893024333a60504f58d51b18d485d

SHA512
493b25bad1a93932f836754eceacf4fe7d723f1c8ae09f2ed2b0924b23e88ac8b03363a196e3f2ad70cf5b6d1e8be59248e0797ad48d226f1af2b92342ba75f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38d24f97776f25b39a49d87f13625697

SHA1
5bf5ede6e6c0a44d80e7cfb87f373dfaf6e79076

SHA256
e043f97f2b77ed637593b8bedd72c451dc6ccf702f6ac9708d7009046f7c51ce

SHA512
4ca618285132681bde5f255daa856e25d21de1b0e6e336ce6ecf90f95bd66d782a60130a15df1f055b8f39a247b77d8bed53770851b8f8589546a704a7ef7acd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5f9932edbbe05abb7fec1d82d6f572f

SHA1
304218a338a224d6d86fa5dc8d04df0f2ba3d122

SHA256
7e72bc79874cac6322df9fca7b0692189cc75ab82648405c56a193b87f20ff66

SHA512
429fd02d4967cf9014a93b286e456d8136202948895559c4b30467d78608ddfcfa5ca67deb47fe03b337aa3e60d5bd37162424beb92c0f1aa757fd682044c7c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
313883599b0c2d94e5973820ed0fa1af

SHA1
ea2a8be4b8cb51cc453b68b699a819770a07f8f3

SHA256
ed3a471d876cfa0bc454c0a160f3792b39bd5d8e5ddcc9036b4a565dc27cb49e

SHA512
63fbc6fb5ada17e24698e2343c761ad79b0921d2efe8b076735466d6858fa31723b4a33508af3176a296f2a25f957ef0765d094fb882c86946f8bdb4b81d5e61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
490c9e05863cbd036cab2b037d6575a0

SHA1
45125e7b95298be8acce467bfbf68f85a4e8dcd5

SHA256
c58caa6c8e0ab5dc6b6ebdfac62ca4b5ecc01798c33756270afb2a7ed20c59fd

SHA512
baa37647f42bdf9cba3b8849be8d16f702187028fbfdcc23a34d4d1fa1b4cfd2bb4fbad1c86dbc05fdec045dce5b5a3ddb16e0a63f7d1574f523a2b88e648c8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f80f8f2f9b05ca3d55f7d6cd404cc9b0

SHA1
8114f9c332cbafbdb0ef0b5e3bb306c7b60f3900

SHA256
563d50d5ed5579b442e67dfe52105fa24e4d813569d98d81212a6dcc57a7c06a

SHA512
680380da8c769bfbb4ff18871a9c3327968752fac3c7c9b150ae0ebac806da47cae7cebc4028156abcd69f99003dbca25dc20d2406da76c02224a944e02a2ead

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0653f7cd18de9a4fb2a64a3485e85a53

SHA1
83181ddd80e7cd9d430c699ca117ea6a2a04b693

SHA256
f3ea120ab20d51ac8b3bab9546812b6f523eca8d71cd5d0fb1809a5488f18971

SHA512
955b85d584635488b2ff59e6cec75cade88e4cf034da08bc633bfa49f6df32e705f1ecbfbe6bce03b93b290fd24ed834fd62f9a2262efe23c5ffc57cdad94b7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9105168e8fa66203a70cb5654b12cb0

SHA1
40de8ec527c3776c921d3885d68f7c7526a963a5

SHA256
7b54191b719040421202e33eac95645a64e0f714b064434e1092a4c303db4f16

SHA512
c0910b13404d23e251401c2830a651c8ab6ece71b6d12d6a33be815d10e5e70f50e2d0554201f2a225433daa9264c5599280b1b59e4b12fc124847e83953e13e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\5dcsbzd\imagestore.dat

Filesize
5KB

MD5
fb418aad61106241f8ea857778f3170d

SHA1
76fec61e891fbc0bf9396b184c1b7a8d1d94c280

SHA256
e4c977f111cce8e20fbec2017d45e26b958bbca8fd00fbc1533a9bd7fbd11827

SHA512
5ac0afd1c933d21c9cb485c0815cc7c1bcfc6bbc3ad5a4ba581942710fe450f15f3574e637cda44d059077307a0fdf86378970c1dc3471ddf2f244d439384bd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNQNAXHS\favicon[1].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab83A3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar83A5.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9161.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.