askinstall25.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | Nov. 1, 2021, 10:58 a.m. | Nov. 1, 2021, 11:12 a.m. |
-
-
-
taskkill.exe taskkill /f /im chrome.exe
2164
-
-
-
chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=65.0.3325.181 --initial-client-data=0x88,0x8c,0x90,0x84,0x94,0x7fef1c6f1e8,0x7fef1c6f1f8,0x7fef1c6f208
2656 -
chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=1348 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6
1912
-
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| www.jjnices.top | 91.210.171.115 | |
| www.listincode.com | 149.28.253.196 | |
| www.iyiqian.com | 103.155.92.58 | |
| iplogger.org | 88.99.66.31 |
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.101:49197 -> 149.28.253.196:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.101:49210 -> 91.210.171.115:80 | 2023882 | ET INFO HTTP Request to a *.top domain | Potentially Bad Traffic |
| TCP 192.168.56.101:49199 -> 88.99.66.31:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| UDP 192.168.56.101:55450 -> 164.124.101.2:53 | 2023883 | ET DNS Query to a *.top domain - Likely Hostile | Potentially Bad Traffic |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.101:49197 149.28.253.196:443 |
C=CN, O=TrustAsia Technologies, Inc., OU=Domain Validated SSL, CN=TrustAsia TLS RSA CA | CN=listincode.com | 84:23:95:42:66:09:11:39:0d:e6:22:7f:eb:b3:cc:79:dd:fa:36:ed |
|
TLSv1 192.168.56.101:49199 88.99.66.31:443 |
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA | CN=*.iplogger.org | 55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb |
| file | C:\Program Files (x86)\Google\Chrome\Application\65.0.3325.181\Locales\ko.pak |
| registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome |
| section | .zgffhhg |
| resource name | ZIP |
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.jjnices.top/Home/Index/lkdinl | ||||||
| request | GET http://www.iyiqian.com/ |
| request | POST http://www.jjnices.top/Home/Index/lkdinl |
| request | GET https://www.listincode.com/ |
| request | GET https://iplogger.org/1b4887 |
| request | POST http://www.jjnices.top/Home/Index/lkdinl |
| domain | www.jjnices.top | description | Generic top level domain TLD | ||||||
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_0 |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-spare.pma |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Bloom Prefix Set |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\js\content.js |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\ChromeFilenameClientIncident.store |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\js\pad-nopadding.js |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Bloom |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\icon.png |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics-spare.pma |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\js\jquery-3.3.1.min.js |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\AnyIpMalware.store |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\First Run |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\reports |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Stability\1420-1635731907375000.pma |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\metadata |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\js\aes.js |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\reports\8aa267b1-5bd2-419c-805c-3376c118e3c3.dmp |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\manifest.json |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\background.html |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-617F57D9-58C.pma |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1\Cookies |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\js\mode-ecb.js |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\js\background.js |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\index |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1 |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_2 |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_3 |
| name | ZIP | language | LANG_CHINESE | filetype | Zip archive data, at least v1.0 to extract | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x00163b50 | size | 0x0000cc07 | ||||||||||||||||||
| name | RT_ICON | language | LANG_CHINESE | filetype | dBase III DBT, version number 0, next free block index 40 | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x00153180 | size | 0x00010828 | ||||||||||||||||||
| name | RT_GROUP_ICON | language | LANG_CHINESE | filetype | data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x001639a8 | size | 0x00000014 | ||||||||||||||||||
| name | RT_VERSION | language | LANG_CHINESE | filetype | PGP symmetric key encrypted data - Plaintext or unencrypted data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x001639c0 | size | 0x0000018c | ||||||||||||||||||
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\js\pad-nopadding.js |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\js\aes.js |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\js\jquery-3.3.1.min.js |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\js\content.js |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\js\mode-ecb.js |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\js\background.js |
| cmdline | cmd.exe /c taskkill /f /im chrome.exe |
| wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe") |
| url | https://clients4.google.com/invalidation/android/request/ |
| url | http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0 |
| url | http://services.ukrposhta.com/postindex_new/ |
| url | http://dts.search-results.com/sr?lng= |
| url | http://inposdom.gob.do/codigo-postal/ |
| url | http://creativecommons.org/ns |
| url | http://www.postur.fo/ |
| url | https://qc.search.yahoo.com/search?ei= |
| url | https://cacert.omniroot.com/baltimoreroot.crt09 |
| url | https://codereview.chromium.org/25305002). |
| url | https://search.yahoo.com/search?ei= |
| url | http://t1.symcb.com/ThawtePCA.crl0/ |
| url | http://crbug.com/31395. |
| url | https://support.google.com/chrome/answer/165139 |
| url | https://ct.googleapis.com/aviator/ |
| url | https://datasaver.googleapis.com/v1/clientConfigs |
| url | http://crl.starfieldtech.com/sfroot-g2.crl0L |
| url | https://ct.startssl.com/ |
| url | https://suggest.yandex.com.tr/suggest-ff.cgi?part= |
| url | https://de.search.yahoo.com/favicon.ico |
| url | https://github.com/GoogleChrome/Lighthouse/issues |
| url | http://www.searchnu.com/favicon.ico |
| url | https://support.google.com/installer/?product= |
| url | http://msdn.microsoft.com/en-us/library/ms792901.aspx |
| url | https://www.najdi.si/search.jsp?q= |
| url | http://x.ss2.us/x.cer0 |
| url | http://crl.geotrust.com/crls/gtglobal.crl04 |
| url | https://accounts.google.com/ServiceLogin |
| url | https://accounts.google.com/OAuthLogin |
| url | https://c.android.clients.google.com/ |
| url | https://www.google.com/tools/feedback/chrome/__submit |
| url | https://chrome.google.com/webstore/category/collection/dark_themes |
| url | http://check.googlezip.net/generate_204 |
| url | http://ocsp.starfieldtech.com/08 |
| url | http://www.guernseypost.com/postcode_finder/ |
| url | http://crl.certum.pl/ca.crl0h |
| url | http://ator |
| url | https://suggest.yandex.by/suggest-ff.cgi?part= |
| url | http://feed.snap.do/?q= |
| url | https://sp.uk.ask.com/sh/i/a16/favicon/favicon.ico |
| url | http://www.language |
| url | https://support.google.com/chrome/ |
| url | http://developer.chrome.com/apps/declare_permissions.html |
| url | https://ct.googleapis.com/rocketeer/ |
| url | https://www.globalsign.com/repository/03 |
| url | http://www.startssl.com/sfsca.crl0 |
| url | http://UA-Compatible |
| url | https://se.search.yahoo.com/search?ei= |
| url | http://EVSecure-ocsp.geotrust.com0 |
| url | https://developers.google.com/web/fundamentals/accessibility/accessible-styles |
| description | Create a windows service | rule | Create_Service | ||||||
| description | Communication using DGA | rule | Network_DGA | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | Steal credential | rule | local_credential_Steal | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | Google Chrome User Data Check | rule | Chrome_User_Data_Check_Zero | ||||||
| description | Match Windows Inet API call | rule | Str_Win32_Internet_API | ||||||
| description | Virtual currency | rule | Virtual_currency_Zero | ||||||
| description | Win.Trojan.agentTesla | rule | Win_Trojan_agentTesla_Zero | ||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | Record Audio | rule | Sniff_Audio | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | Run a KeyLogger | rule | KeyLogger | ||||||
| description | Communications over FTP | rule | Network_FTP | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | File Downloader | rule | Network_Downloader | ||||||
| description | Perform crypto currency mining | rule | BitCoin | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Communications over P2P network | rule | Network_P2P_Win | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerCheck__RemoteAPI | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | DebuggerException__ConsoleCtrl | ||||||
| description | (no description) | rule | DebuggerException__SetConsoleCtrl | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | (no description) | rule | Check_Dlls | ||||||
| description | Possibly employs anti-virtualization techniques | rule | vmdetect | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Anti-Sandbox checks for ThreatExpert | rule | antisb_threatExpert | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Affect hook table | rule | win_hook | ||||||
| description | Install itself for autorun at Windows startup | rule | Persistence | ||||||
| description | browser info stealer | rule | infoStealer_browser_Zero | ||||||
| description | Create a windows service | rule | Create_Service | ||||||
| description | Communication using DGA | rule | Network_DGA | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | Steal credential | rule | local_credential_Steal | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | Google Chrome User Data Check | rule | Chrome_User_Data_Check_Zero | ||||||
| description | Match Windows Inet API call | rule | Str_Win32_Internet_API | ||||||
| description | Virtual currency | rule | Virtual_currency_Zero | ||||||
| description | Win.Trojan.agentTesla | rule | Win_Trojan_agentTesla_Zero | ||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | Record Audio | rule | Sniff_Audio | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | Run a KeyLogger | rule | KeyLogger | ||||||
| cmdline | taskkill /f /im chrome.exe |
| cmdline | cmd.exe /c taskkill /f /im chrome.exe |
| parent_process | chrome.exe | martian_process | "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=65.0.3325.181 --initial-client-data=0x88,0x8c,0x90,0x84,0x94,0x7fef1c6f1e8,0x7fef1c6f1f8,0x7fef1c6f208 | ||||||
| parent_process | chrome.exe | martian_process | "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=1348 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6 | ||||||
| parent_process | chrome.exe | martian_process | "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1160,14321391821343464360,9070479945774809946,131072 --gpu-preferences=KAAAAAAAAAAABwAAAQAAAAAAAAAAAGAAAQAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x80ee --gpu-device-id=0xbeef --gpu-driver-vendor=Microsoft --gpu-driver-version=6.1.7600.16385 --gpu-driver-date=6-21-2006 --service-request-channel-token=587881A6308554374CAA6D036CF19ACD --mojo-platform-channel-handle=1168 --ignored=" --type=renderer " /prefetch:2 | ||||||
| url | http://127.0.0.1 |
| Bkav | W32.AIDetect.malware1 |
| Lionic | Trojan.Script.Generic.4!c |
| Elastic | malicious (high confidence) |
| MicroWorld-eScan | Gen:Variant.Zusy.372273 |
| FireEye | Generic.mg.867f1890d45a83e6 |
| McAfee | Artemis!867F1890D45A |
| Cylance | Unsafe |
| Sangfor | Trojan.Win32.Save.a |
| K7AntiVirus | Spyware ( 005690661 ) |
| BitDefender | Gen:Variant.Zusy.372273 |
| K7GW | Spyware ( 005690661 ) |
| Cybereason | malicious.0d45a8 |
| BitDefenderTheta | Gen:NN.ZexaF.34236.B10@aWSpmVaj |
| Symantec | ML.Attribute.HighConfidence |
| ESET-NOD32 | a variant of Win32/Spy.Agent.PYV |
| APEX | Malicious |
| Paloalto | generic.ml |
| Kaspersky | HEUR:Trojan.Script.Generic |
| Ad-Aware | Gen:Variant.Zusy.372273 |
| Sophos | Mal/Generic-S |
| TrendMicro | TROJ_GEN.R002C0WJV21 |
| McAfee-GW-Edition | BehavesLike.Win32.Generic.th |
| Emsisoft | Gen:Variant.Zusy.372273 (B) |
| SentinelOne | Static AI - Malicious PE |
| MAX | malware (ai score=80) |
| Microsoft | Trojan:Win32/Sabsik.FL.B!ml |
| ZoneAlarm | HEUR:Trojan.Script.Generic |
| GData | Gen:Variant.Zusy.372273 |
| Cynet | Malicious (score: 100) |
| AhnLab-V3 | Infostealer/Win.Socelars.R372531 |
| VBA32 | BScope.Trojan.Agentb |
| ALYac | Gen:Variant.Zusy.372273 |
| Malwarebytes | Spyware.Socelars |
| Panda | Trj/Genetic.gen |
| TrendMicro-HouseCall | TROJ_GEN.R002C0WJV21 |
| Rising | Stealer.FBAdsCard!1.CE03 (CLASSIC) |
| Fortinet | W32/Socelars.S!tr.spy |
| AVG | Win32:PWSX-gen [Trj] |
| Avast | Win32:PWSX-gen [Trj] |
| CrowdStrike | win/malicious_confidence_60% (W) |