Malware analysis /download/10c796b7308ac0b9c38f1caa95c798b2b28c46adaa037a9c3a9ebdd3569824e3/ Malicious activity

Add for printing

download:	/download/10c796b7308ac0b9c38f1caa95c798b2b28c46adaa037a9c3a9ebdd3569824e3/
Full analysis:	https://app.any.run/tasks/d2ee6f1f-40b9-4a06-9ebd-eeab23344ef5
Verdict:	Malicious activity
Analysis date:	February 22, 2024, 19:45:38
OS:	Ubuntu 22.04.2
MIME:	text/html
File info:	HTML document, ASCII text
MD5:	BDCD890677A32B056FFD78CD896EFF89
SHA1:	92AB74ED8D40E336C4C33A44435521F377007DF8
SHA256:	1041A83D20C8CB7B9303C65AA563078DC4B10E6DB8F3547B74278BC6C0644E98
SSDEEP:	96:GiOts4fcZxpPsCkHInCnir7NVirCQXqHVoITMF6apE4sW:7Ots5sGnRTirio6+sW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Checks DMI information (probably VM detection)
  - systemd-hostnamed (PID: 8374)
- Executes commands using command-line interpreter
  - nautilus (PID: 8409)
  - nautilus (PID: 8413)
  - nautilus (PID: 8420)
  - nautilus (PID: 8424)
  - nautilus (PID: 8428)
  - nautilus (PID: 8431)
  - nautilus (PID: 8434)
  - nautilus (PID: 8437)
  - nautilus (PID: 8441)
  - nautilus (PID: 8444)
  - nautilus (PID: 8448)
  - nautilus (PID: 8452)
  - nautilus (PID: 8457)
INFO
- Manipulating modules (likely to execute programs on system boot)
  - modprobe (PID: 8415)
  - modprobe (PID: 8426)
  - modprobe (PID: 8423)
  - modprobe (PID: 8412)
  - modprobe (PID: 8430)
  - modprobe (PID: 8433)
  - modprobe (PID: 8436)
  - modprobe (PID: 8439)
  - modprobe (PID: 8446)
  - modprobe (PID: 8443)
  - modprobe (PID: 8451)
  - modprobe (PID: 8459)
  - modprobe (PID: 8456)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.html	\|	HyperText Markup Language (100)

EXIF

HTML

Robots:	noindex
Viewport:	width=device-width, initial-scale=1, shrink-to-fit=no
Title:	MalwareBazaar \| Browse Checking your browser

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

373

Monitored processes

153

Malicious processes

1

Suspicious processes

1

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
7935	/bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome \"/home/user/Desktop/10c796b7308ac0b9c38f1caa95c798b2b28c46adaa037a9c3a9ebdd3569824e3\.html\" "	/bin/sh	—	any-guest-agent
User: root Integrity Level: UNKNOWN Exit code: 0
7937	/usr/libexec/tracker-extract-3	/usr/libexec/tracker-extract-3	—	systemd
User: user Integrity Level: UNKNOWN Exit code: 1214
7941	sudo -iu user google-chrome /home/user/Desktop/10c796b7308ac0b9c38f1caa95c798b2b28c46adaa037a9c3a9ebdd3569824e3.html	/usr/bin/sudo	—	sh
User: root Integrity Level: UNKNOWN Exit code: 0
7945	/usr/bin/google-chrome /home/user/Desktop/10c796b7308ac0b9c38f1caa95c798b2b28c46adaa037a9c3a9ebdd3569824e3.html	/opt/google/chrome/chrome	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 0
7946	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
7947	readlink -f /usr/bin/google-chrome	/usr/bin/readlink	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
7948	dirname /opt/google/chrome/google-chrome	/usr/bin/dirname	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
7949	mkdir -p /home/user/.local/share/applications	/usr/bin/mkdir	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
7950	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
7951	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

PID	Process	Filename		Type
7945	chrome	/7945/fd/63		—
		MD5:—	SHA256:—
7945	chrome	/home/user/.config/google-chrome/BrowserMetrics/BrowserMetrics-65D7A46A-1F09.pma		—
		MD5:—	SHA256:—
7945	chrome	/.com.google.Chrome.BtcvOc		—
		MD5:—	SHA256:—
7945	chrome	/home/user/.config/google-chrome/Default/Sync Data/LevelDB/LOG		—
		MD5:—	SHA256:—
7945	chrome	/.com.google.Chrome.TkWW0R		—
		MD5:—	SHA256:—
7945	chrome	/.com.google.Chrome.ckETJ7		—
		MD5:—	SHA256:—
7945	chrome	/.com.google.Chrome.8FJxa7		—
		MD5:—	SHA256:—
7945	chrome	/home/user/.config/google-chrome/Default/Site Characteristics Database/LOG		—
		MD5:—	SHA256:—
7945	chrome	/home/user/.config/google-chrome/Default/commerce_subscription_db/LOG		—
		MD5:—	SHA256:—
7945	chrome	/home/user/.config/google-chrome/Default/discounts_db/LOG		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

9

TCP/UDP connections

67

DNS requests

61

Threats

0

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	91.189.91.49:80	http://connectivity-check.ubuntu.com/	unknown	—	—	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/hb24fnxzbb67xgfuynutqnb4hy_2024.2.21.0/niikhdgajlphfehepabhhblakbdgeefj_2024.02.21.00_all_byuuqzp2h3uttzf2nfyd42zic4.crx3	unknown	binary	5.82 Kb	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/lmelglejhemejginpboagddgdfbepgmp/1.5bdc69c131996e6e6abeeba649e5a21c2f62a0b40bce413f8a728108c0d4fe06/1.1c9ef13b7a63abd8f89d0cbad98858b9e8f54fc3951160950403c72b45812d07/865d7f70f7a9d5db0e532d532dcdac720827d84b53c19d9201854f1c174ccfe7.puff	unknown	binary	2.27 Kb	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01uSGNvRHZ2Tm5HQQ/1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx	unknown	binary	3.07 Kb	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/jflookgnkcckhobaglndicnbbgbonegd/1.af8fa6822a4a3a4aeaf78dd2b562b3b76ed3ef0b362f8ebc822df79717c996df/1.ab8da5b849ba36382f26992fe1b52d72aa457549f31246a0c386d6880fca8afc/3c8c4f546e4fa8003cf45c6c7acda068b295a9b5c871927c28fcffb32827dc42.puff	unknown	binary	41.2 Kb	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/1.4ccf4cac4c37dd966d3bee0b3a4137894eecde1b22a9d4e7ef07d5081b5cf67a/1.6fcc02a365d39485c49c9da8679a9fd979832315b2d47ff7f0ab395b10e303bd/8b2dfe1de637dc8912eaf1e6a5c35ba322def50cc03317c8c7e0b83508ceba87.puff	unknown	binary	15.8 Kb	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adycubrztz5zb5crbgnm5ugdx5qq_8562/hfnkpimlhhgieaddgfemjhofmfblmnib_8562_all_ioynlbm5doun3ovyaami2ybf.crx3	unknown	binary	26.4 Kb	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/gonpemdgkjcecdgbnaabipppbmgfggbe/1.7e7996864a74a4b8db2b59c559f924f321668848edbcb85386212a4901ef0e6e/1.48fecfa3c6f59eb6c34fdd5e8f19e0678699e2f27dc8ebfa7025c246d4575c68/4f40609d14bbd0e6dbc34e28e63286a878e52c3c2e623faa62306d69c2705d63.puff	unknown	binary	2.78 Kb	unknown
—	—	GET	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/achbl36stp77xmtl7bf4ynoyeduq_2024.2.21.1/jflhchccmppkfebkiaminageehmchikm_2024.02.21.01_all_kngxaemc3fjbnntpm2j46wzyse.crx3	unknown	binary	7.79 Kb	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	91.189.91.49:80	—	Canonical Group Limited	US	unknown
—	—	224.0.0.251:5353	—	—	—	unknown
—	—	212.102.56.179:443	—	Datacamp Limited	DE	unknown
—	—	185.125.190.48:80	—	Canonical Group Limited	GB	unknown
—	—	185.125.190.49:80	—	Canonical Group Limited	GB	unknown
—	—	142.250.186.163:443	clientservices.googleapis.com	GOOGLE	US	unknown
—	—	239.255.255.250:1900	—	—	—	unknown
—	—	172.217.18.4:443	www.google.com	—	—	unknown
—	—	64.233.167.84:443	accounts.google.com	GOOGLE	US	unknown
—	—	142.250.186.104:443	www.googletagmanager.com	GOOGLE	US	unknown

DNS requests

Domain	IP	Reputation
clientservices.googleapis.com	142.250.186.163	whitelisted
accounts.google.com	64.233.167.84	shared
www.googletagmanager.com	142.250.186.104	whitelisted
www.google.com	172.217.18.4	whitelisted
www.gstatic.com	142.250.186.131	whitelisted
fonts.gstatic.com	172.217.18.3	whitelisted
124.100.168.192.in-addr.arpa	—	unknown
update.googleapis.com	142.250.185.195	whitelisted
api.snapcraft.io	185.125.188.55 185.125.188.58 185.125.188.59 185.125.188.54	unknown
connectivity-check.ubuntu.com	2620:2d:4002:1::196 2620:2d:4000:1::2b 2620:2d:4002:1::197 2620:2d:4002:1::198 2001:67c:1562::23 2620:2d:4000:1::22 2001:67c:1562::24 2620:2d:4000:1::23 2620:2d:4000:1::96 2620:2d:4000:1::2a 2620:2d:4000:1::97 2620:2d:4000:1::98	unknown

Threats

No threats detected

Add for printing

No debug info

General Info

/download/10c796b7308ac0b9c38f1caa95c798b2b28c46adaa037a9c3a9ebdd3569824e3/

BDCD890677A32B056FFD78CD896EFF89

92AB74ED8D40E336C4C33A44435521F377007DF8

1041A83D20C8CB7B9303C65AA563078DC4B10E6DB8F3547B74278BC6C0644E98

96:GiOts4fcZxpPsCkHInCnir7NVirCQXqHVoITMF6apE4sW:7Ots5sGnRTirio6+sW

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Checks DMI information (probably VM detection)

Executes commands using command-line interpreter

INFO

Manipulating modules (likely to execute programs on system boot)

Malware configuration

Static information

TRiD

EXIF

HTML

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings