Malware Analysis Report

2024-11-13 13:29

Sample ID 240604-bmsstsga6z
Target http://links.crm.wix.com/ls/click?upn=u001.cbspIyd-2FENjmzRBJA2NTM0FaS4Aga2Vc5DnRREgj8uGAX7q1MTTxqaotcs5mr8nD1Ztf_RCZbjg-2FKOBO6f0pyp9qfjvpjs0BEESzHaQmHQS568aUqn5tQBFbXndo8SoEtxBrdSVpu7k-2Fe2e3aBOzsHPX4oMAiGDEM0aZKxsAuhWgwaatb6jEHotyrMQBeqGmiXHBpy4AWALto8eH44pvIxt3-2F0nfOeKOjQOKE59yNi62tQ7yvMJA-2Bom2QsTVZaay41R-2BOEHOKnac0ArWwnB3C3c5k9OG2xRG55rJC5TPWZZAhjSpfQLpMxiup4wDIILjpdyu2BN3Jj5HGTegGfaRq49MF1uzAnp4etkLbG61wB-2BTM8BitQPcFMq421Uvyrf72HtCvs7WDJG-2FWuWwxWSQfngRvr9FqzyI-2BHl1fY70zPeQil5XOr5fBqCxZimzljG0DOe42dIX86Z5ukYYdfF1GTLLhZ6edRy0MCzah3mGQ5APR6g-2B0-2FB9mbFZPq92FCSCAF0rqoozJ0D8h-2FY-2BIErZjcG8uSa03TJPptYX9N9vx4xjkn7omiA8EtzkFYiwTzGxmhjCwqnfCV65ZYFCMuqtwEeVdvAHerO-2B-2BVafurqkhdN8HRm49c4cSPJVkd25kW3baVsIvAvM0gIg3Q4MuC-2BUesbpHko8GPliBTPdcX2g46bzNjy79ZhxXNeQHGAyTqp2kmEwCB9Ga29QDYuzUuxvLnkeQlafYkVTAEoFGublHUXrEAnZZ9SHHzwh5Z6stpR5FWuhgj9n2LOTRcZeQPpxYKQ0Nv3VnKWT0zgmaJm0Ix-2Fcd3kxsqG-2FVSINVU6jTq-2BXi6sWU7KCCBv7-2FXdV0qOx5hFFqCMQwMB8ft19p6jKNRSQXe33Qt9Ov6rV1ddSd-2B5s-2BfLtpW7-2BFubVToz4O-2FEe-2FnXUB5yA4o-2BcRMdziusiMrgxD3hT9OB-2FL-2FRHhCR4OF-2BRfwBn0ScR-2Fl5gDFTJOPUREQ1Na3tIw-2Bmx01c4keuaebIYz3uv4dTs1u-2B04j1aSt9MtqLMmzYGz-2BkWHtVfiEKJyOvs0ipgtOzzPpJjjsrNjZrU86fd-2Fnd-2BiJnKg3gGdGomuucGA
Tags
discovery evasion collection
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

Threat Level: Shows suspicious behavior

The file http://links.crm.wix.com/ls/click?upn=u001.cbspIyd-2FENjmzRBJA2NTM0FaS4Aga2Vc5DnRREgj8uGAX7q1MTTxqaotcs5mr8nD1Ztf_RCZbjg-2FKOBO6f0pyp9qfjvpjs0BEESzHaQmHQS568aUqn5tQBFbXndo8SoEtxBrdSVpu7k-2Fe2e3aBOzsHPX4oMAiGDEM0aZKxsAuhWgwaatb6jEHotyrMQBeqGmiXHBpy4AWALto8eH44pvIxt3-2F0nfOeKOjQOKE59yNi62tQ7yvMJA-2Bom2QsTVZaay41R-2BOEHOKnac0ArWwnB3C3c5k9OG2xRG55rJC5TPWZZAhjSpfQLpMxiup4wDIILjpdyu2BN3Jj5HGTegGfaRq49MF1uzAnp4etkLbG61wB-2BTM8BitQPcFMq421Uvyrf72HtCvs7WDJG-2FWuWwxWSQfngRvr9FqzyI-2BHl1fY70zPeQil5XOr5fBqCxZimzljG0DOe42dIX86Z5ukYYdfF1GTLLhZ6edRy0MCzah3mGQ5APR6g-2B0-2FB9mbFZPq92FCSCAF0rqoozJ0D8h-2FY-2BIErZjcG8uSa03TJPptYX9N9vx4xjkn7omiA8EtzkFYiwTzGxmhjCwqnfCV65ZYFCMuqtwEeVdvAHerO-2B-2BVafurqkhdN8HRm49c4cSPJVkd25kW3baVsIvAvM0gIg3Q4MuC-2BUesbpHko8GPliBTPdcX2g46bzNjy79ZhxXNeQHGAyTqp2kmEwCB9Ga29QDYuzUuxvLnkeQlafYkVTAEoFGublHUXrEAnZZ9SHHzwh5Z6stpR5FWuhgj9n2LOTRcZeQPpxYKQ0Nv3VnKWT0zgmaJm0Ix-2Fcd3kxsqG-2FVSINVU6jTq-2BXi6sWU7KCCBv7-2FXdV0qOx5hFFqCMQwMB8ft19p6jKNRSQXe33Qt9Ov6rV1ddSd-2B5s-2BfLtpW7-2BFubVToz4O-2FEe-2FnXUB5yA4o-2BcRMdziusiMrgxD3hT9OB-2FL-2FRHhCR4OF-2BRfwBn0ScR-2Fl5gDFTJOPUREQ1Na3tIw-2Bmx01c4keuaebIYz3uv4dTs1u-2B04j1aSt9MtqLMmzYGz-2BkWHtVfiEKJyOvs0ipgtOzzPpJjjsrNjZrU86fd-2Fnd-2BiJnKg3gGdGomuucGA was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery evasion collection

Checks CPU information

Checks memory information

Reads the content of photos stored on the user's device.

Enumerates system info in registry

Modifies data under HKEY_USERS

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-04 01:16

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-04 01:16

Reported

2024-06-04 01:21

Platform

win10v2004-20240508-en

Max time kernel

299s

Max time network

245s

Command Line

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://links.crm.wix.com/ls/click?upn=u001.cbspIyd-2FENjmzRBJA2NTM0FaS4Aga2Vc5DnRREgj8uGAX7q1MTTxqaotcs5mr8nD1Ztf_RCZbjg-2FKOBO6f0pyp9qfjvpjs0BEESzHaQmHQS568aUqn5tQBFbXndo8SoEtxBrdSVpu7k-2Fe2e3aBOzsHPX4oMAiGDEM0aZKxsAuhWgwaatb6jEHotyrMQBeqGmiXHBpy4AWALto8eH44pvIxt3-2F0nfOeKOjQOKE59yNi62tQ7yvMJA-2Bom2QsTVZaay41R-2BOEHOKnac0ArWwnB3C3c5k9OG2xRG55rJC5TPWZZAhjSpfQLpMxiup4wDIILjpdyu2BN3Jj5HGTegGfaRq49MF1uzAnp4etkLbG61wB-2BTM8BitQPcFMq421Uvyrf72HtCvs7WDJG-2FWuWwxWSQfngRvr9FqzyI-2BHl1fY70zPeQil5XOr5fBqCxZimzljG0DOe42dIX86Z5ukYYdfF1GTLLhZ6edRy0MCzah3mGQ5APR6g-2B0-2FB9mbFZPq92FCSCAF0rqoozJ0D8h-2FY-2BIErZjcG8uSa03TJPptYX9N9vx4xjkn7omiA8EtzkFYiwTzGxmhjCwqnfCV65ZYFCMuqtwEeVdvAHerO-2B-2BVafurqkhdN8HRm49c4cSPJVkd25kW3baVsIvAvM0gIg3Q4MuC-2BUesbpHko8GPliBTPdcX2g46bzNjy79ZhxXNeQHGAyTqp2kmEwCB9Ga29QDYuzUuxvLnkeQlafYkVTAEoFGublHUXrEAnZZ9SHHzwh5Z6stpR5FWuhgj9n2LOTRcZeQPpxYKQ0Nv3VnKWT0zgmaJm0Ix-2Fcd3kxsqG-2FVSINVU6jTq-2BXi6sWU7KCCBv7-2FXdV0qOx5hFFqCMQwMB8ft19p6jKNRSQXe33Qt9Ov6rV1ddSd-2B5s-2BfLtpW7-2BFubVToz4O-2FEe-2FnXUB5yA4o-2BcRMdziusiMrgxD3hT9OB-2FL-2FRHhCR4OF-2BRfwBn0ScR-2Fl5gDFTJOPUREQ1Na3tIw-2Bmx01c4keuaebIYz3uv4dTs1u-2B04j1aSt9MtqLMmzYGz-2BkWHtVfiEKJyOvs0ipgtOzzPpJjjsrNjZrU86fd-2Fnd-2BiJnKg3gGdGomuucGA

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133619374162943517" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4976 wrote to memory of 1512 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 1512 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 5036 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 3996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 3996 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4976 wrote to memory of 2860 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://links.crm.wix.com/ls/click?upn=u001.cbspIyd-2FENjmzRBJA2NTM0FaS4Aga2Vc5DnRREgj8uGAX7q1MTTxqaotcs5mr8nD1Ztf_RCZbjg-2FKOBO6f0pyp9qfjvpjs0BEESzHaQmHQS568aUqn5tQBFbXndo8SoEtxBrdSVpu7k-2Fe2e3aBOzsHPX4oMAiGDEM0aZKxsAuhWgwaatb6jEHotyrMQBeqGmiXHBpy4AWALto8eH44pvIxt3-2F0nfOeKOjQOKE59yNi62tQ7yvMJA-2Bom2QsTVZaay41R-2BOEHOKnac0ArWwnB3C3c5k9OG2xRG55rJC5TPWZZAhjSpfQLpMxiup4wDIILjpdyu2BN3Jj5HGTegGfaRq49MF1uzAnp4etkLbG61wB-2BTM8BitQPcFMq421Uvyrf72HtCvs7WDJG-2FWuWwxWSQfngRvr9FqzyI-2BHl1fY70zPeQil5XOr5fBqCxZimzljG0DOe42dIX86Z5ukYYdfF1GTLLhZ6edRy0MCzah3mGQ5APR6g-2B0-2FB9mbFZPq92FCSCAF0rqoozJ0D8h-2FY-2BIErZjcG8uSa03TJPptYX9N9vx4xjkn7omiA8EtzkFYiwTzGxmhjCwqnfCV65ZYFCMuqtwEeVdvAHerO-2B-2BVafurqkhdN8HRm49c4cSPJVkd25kW3baVsIvAvM0gIg3Q4MuC-2BUesbpHko8GPliBTPdcX2g46bzNjy79ZhxXNeQHGAyTqp2kmEwCB9Ga29QDYuzUuxvLnkeQlafYkVTAEoFGublHUXrEAnZZ9SHHzwh5Z6stpR5FWuhgj9n2LOTRcZeQPpxYKQ0Nv3VnKWT0zgmaJm0Ix-2Fcd3kxsqG-2FVSINVU6jTq-2BXi6sWU7KCCBv7-2FXdV0qOx5hFFqCMQwMB8ft19p6jKNRSQXe33Qt9Ov6rV1ddSd-2B5s-2BfLtpW7-2BFubVToz4O-2FEe-2FnXUB5yA4o-2BcRMdziusiMrgxD3hT9OB-2FL-2FRHhCR4OF-2BRfwBn0ScR-2Fl5gDFTJOPUREQ1Na3tIw-2Bmx01c4keuaebIYz3uv4dTs1u-2B04j1aSt9MtqLMmzYGz-2BkWHtVfiEKJyOvs0ipgtOzzPpJjjsrNjZrU86fd-2Fnd-2BiJnKg3gGdGomuucGA

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffd7dfab58,0x7fffd7dfab68,0x7fffd7dfab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1868,i,11454423177740225794,7764567273819817654,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1868,i,11454423177740225794,7764567273819817654,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2208 --field-trial-handle=1868,i,11454423177740225794,7764567273819817654,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2960 --field-trial-handle=1868,i,11454423177740225794,7764567273819817654,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2968 --field-trial-handle=1868,i,11454423177740225794,7764567273819817654,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4248 --field-trial-handle=1868,i,11454423177740225794,7764567273819817654,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4396 --field-trial-handle=1868,i,11454423177740225794,7764567273819817654,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 --field-trial-handle=1868,i,11454423177740225794,7764567273819817654,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4160 --field-trial-handle=1868,i,11454423177740225794,7764567273819817654,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4116 --field-trial-handle=1868,i,11454423177740225794,7764567273819817654,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=1552 --field-trial-handle=1868,i,11454423177740225794,7764567273819817654,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=1736 --field-trial-handle=1868,i,11454423177740225794,7764567273819817654,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1868,i,11454423177740225794,7764567273819817654,131072 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 links.crm.wix.com udp
US 167.89.123.124:80 links.crm.wix.com tcp
US 167.89.123.124:80 links.crm.wix.com tcp
US 8.8.8.8:53 servicesupportgoo.info udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 10.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 124.123.89.167.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
N/A 224.0.0.251:5353 udp
NL 23.62.61.129:443 www.bing.com tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.129:443 www.bing.com tcp
US 8.8.8.8:53 129.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 servicesupportgoo.info udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 servicesupportgoo.info udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 servicesupportgoo.info udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

\??\pipe\crashpad_4976_LFCCSSIIBLBIDMVW

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 efa97fd591d3135b82c177aa5539687c
SHA1 b2453ee6ce127f903a660bdd953a9de405bc0fcd
SHA256 ed2d7e5d7f21d781fb06d9222f59463c01e917162ce3cef83777eeec714e990b
SHA512 5ccbe434ed4fe7ef181588fe305245470ee7273de18abe9ce29b2cf2555b01970ed956f12c823a3d9616ba614e9c7e0ec968ab941302e5d1c1f9aeb11029b1bf

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 d0024805324bbba82929e4fed94b8681
SHA1 d07f54b276995ef13f16f8013bbeb3e46df994a8
SHA256 d29bbd923b0c1f1b714d38ecca0f412a14ef7b0b658cade7a5606f02c76b8b63
SHA512 2d5491b3d76080dc06bd74f88d49e0d8824d2c122ed506f4bc27112fbbde3ca31420acf7c0a7c6adc02bbe6cb0da95924618165914e145d8149fca07d5b5b9f6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 eaee2fecbd6a3648a79b7071d4fe66f7
SHA1 6a51739005d8c5022a861c678f358f20d5528fd7
SHA256 67ed4b46c2312b2b4970beb572e9e14f7b106c31d16b0a5762c49d6946e63e66
SHA512 5622d942ea08489aec0b214ec994a708292f177c674c697930f60c5941286f26e1e357a89b88a2acf2d2d912f96687ac26430793cdcc76f783491db8f39e9b15

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-04 01:16

Reported

2024-06-04 01:22

Platform

android-x86-arm-20240603-en

Max time kernel

312s

Max time network

331s

Command Line

com.android.chrome

Signatures

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.android.chrome

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 links.crm.wix.com udp
US 1.1.1.1:53 links.crm.wix.com udp
US 167.89.123.204:80 links.crm.wix.com tcp
US 167.89.123.204:80 links.crm.wix.com tcp
US 1.1.1.1:53 servicesupportgoo.info udp
US 1.1.1.1:53 servicesupportgoo.info udp
US 1.1.1.1:53 google.com udp
US 8.8.8.8:53 google.com udp
US 1.1.1.1:53 servicesupportgoo.info udp
US 1.1.1.1:53 update.googleapis.com udp
GB 142.250.180.3:443 update.googleapis.com tcp
US 1.1.1.1:53 servicesupportgoo.info udp
US 1.1.1.1:53 google.com udp
US 8.8.8.8:53 google.com udp
GB 142.250.200.46:443 google.com tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.201.110:443 android.apis.google.com tcp
US 1.1.1.1:53 servicesupportgoo.info udp
US 1.1.1.1:53 google.com udp
US 8.8.8.8:53 google.com udp
US 1.1.1.1:53 servicesupportgoo.info udp
US 1.1.1.1:53 servicesupportgoo.info udp
US 1.1.1.1:53 google.com udp
US 8.8.8.8:53 google.com udp
GB 216.58.212.227:80 tcp
GB 142.250.180.4:443 tcp
GB 142.250.179.226:443 tcp
GB 142.250.180.3:443 update.googleapis.com tcp
GB 142.250.180.14:443 tcp
GB 142.250.180.3:443 update.googleapis.com tcp
GB 142.250.180.14:443 tcp
GB 142.250.180.3:443 update.googleapis.com tcp
GB 142.250.180.3:443 update.googleapis.com tcp

Files

files/dom-0.html

MD5 356ae7b39d043e66e99389f6662d5d35
SHA1 fa7b424cbc7649b71c1d96f0c85fd8ff40f9191d
SHA256 8177468179080193324147e58d2e2808d60f675acfc0a0c7965e3a933e7af5a9
SHA512 4871dabeb8b9eb1fa2d54fe170d99afff7a8a251c9b7bfbf1022a4f015172617d7f312e069c1d6597da293fe35c7c34ac6cbc7848ee687e74effb392c013a0b1

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-04 01:16

Reported

2024-06-04 01:22

Platform

android-x64-20240603-en

Max time kernel

313s

Max time network

320s

Command Line

com.android.chrome

Signatures

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Reads the content of photos stored on the user's device.

collection
Description Indicator Process Target
URI accessed for read content://media/external/images/media N/A N/A

Processes

com.android.chrome

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 accounts.google.com udp
BE 74.125.206.84:443 accounts.google.com tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.178.14:443 android.apis.google.com tcp
US 1.1.1.1:53 links.crm.wix.com udp
US 167.89.115.120:80 links.crm.wix.com tcp
US 167.89.115.120:80 links.crm.wix.com tcp
US 1.1.1.1:53 servicesupportgoo.info udp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 servicesupportgoo.info udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 172.217.16.232:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 servicesupportgoo.info udp
US 1.1.1.1:53 google.com udp
US 8.8.8.8:53 google.com udp
US 1.1.1.1:53 servicesupportgoo.info udp
US 1.1.1.1:53 update.googleapis.com udp
GB 142.250.187.227:443 update.googleapis.com tcp
US 1.1.1.1:53 servicesupportgoo.info udp
US 1.1.1.1:53 google.com udp
US 8.8.8.8:53 google.com udp
US 1.1.1.1:53 servicesupportgoo.info udp
US 1.1.1.1:53 google.com udp
US 8.8.8.8:53 google.com udp
GB 142.250.187.228:443 tcp
GB 142.250.187.228:443 tcp
US 1.1.1.1:53 servicesupportgoo.info udp
US 1.1.1.1:53 google.com udp
US 8.8.8.8:53 google.com udp
GB 172.217.169.66:443 tcp
GB 172.217.16.227:443 tcp

Files

files/dom-0.html

MD5 3d68001e646ebe171a3477f1f91da64e
SHA1 8884f1b1ac4df4e4a258639115671f74e5d955bc
SHA256 7f8af90dd9e64e6e2c1016dc9126bd7e6112e2b9453086d23095305ca29407bb
SHA512 874552de2791305e1fa49818da2083ad592fe954502c40481e0e00941feff810a40dd8a8613b01c3052b85f27322aef0459299951aa337accae30e7bf0ddcee1

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-04 01:16

Reported

2024-06-04 01:22

Platform

android-x64-arm64-20240603-en

Max time kernel

314s

Max time network

321s

Command Line

com.android.chrome

Signatures

Checks CPU information

evasion discovery
Description Indicator Process Target
File opened for read /proc/cpuinfo N/A N/A

Checks memory information

evasion discovery
Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.android.chrome

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.187.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
US 1.1.1.1:53 links.crm.wix.com udp
US 1.1.1.1:53 accounts.google.com udp
BE 142.251.5.84:443 accounts.google.com tcp
US 1.1.1.1:53 accounts.google.com udp
US 1.1.1.1:53 links.crm.wix.com udp
BE 64.233.184.84:443 accounts.google.com tcp
US 167.89.115.56:80 links.crm.wix.com tcp
US 1.1.1.1:53 servicesupportgoo.info udp
US 1.1.1.1:53 servicesupportgoo.info udp
US 167.89.115.56:80 links.crm.wix.com tcp
US 1.1.1.1:53 servicesupportgoo.info udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.187.200:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 google.com udp
US 8.8.8.8:53 google.com udp
US 1.1.1.1:53 servicesupportgoo.info udp
US 1.1.1.1:53 servicesupportgoo.info udp
US 1.1.1.1:53 update.googleapis.com udp
GB 216.58.212.227:443 update.googleapis.com tcp
US 1.1.1.1:53 servicesupportgoo.info udp
US 1.1.1.1:53 google.com udp
US 8.8.8.8:53 google.com udp
GB 172.217.169.68:443 tcp
GB 172.217.169.68:443 tcp
US 1.1.1.1:53 servicesupportgoo.info udp
US 1.1.1.1:53 google.com udp
US 8.8.8.8:53 google.com udp
US 1.1.1.1:53 update.googleapis.com udp
GB 172.217.169.3:443 update.googleapis.com tcp
US 1.1.1.1:53 servicesupportgoo.info udp
US 1.1.1.1:53 servicesupportgoo.info udp
US 1.1.1.1:53 google.com udp
US 8.8.8.8:53 google.com udp
US 1.1.1.1:53 servicesupportgoo.info udp
US 1.1.1.1:53 servicesupportgoo.info udp
US 1.1.1.1:53 servicesupportgoo.info udp
US 1.1.1.1:53 servicesupportgoo.info udp
GB 142.250.187.194:443 tcp

Files

files/dom-0.html

MD5 56c6b24bf3ecfdb150ef3fbfec5c9c2b
SHA1 5f8ea03e203d538984376e37827c17c83c7b891d
SHA256 de85be37c6b7afad7127cc750325b49251ae28e9d340e0a7fc9d79762785aa06
SHA512 77dbcd2ea86400d7d96e1e7409d8801ff6081d999ae9474f362cbc6e90d0e38ca18510f502841116a6b52a74951bafd21d3bdb026634fc8456a0900f7d0af67d