analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www.mediafire.com/file/ojnie9qrupnpn5d/Debug.rar/file

Full analysis: https://app.any.run/tasks/78117851-fb7f-4d6e-b716-7cdaab533391
Verdict: Malicious activity
Analysis date: July 23, 2019, 10:05:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

84643262F85ABBF76CDC716DA4098388

SHA1:

D8BC192BD2AABFFAC8BBBF41BBC6DD4328678E1B

SHA256:

36C49AC2A0524AD89579E780D3F1B68D860C40E9D026001CFED27C3F11311140

SSDEEP:

3:N8DSLw3eGUo/5dh3hzgIA:2OLw3eGD5dZ1HA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3016)
      • PremiumGet.exe (PID: 620)
      • CefSharp.BrowserSubprocess.exe (PID: 2812)
      • CefSharp.BrowserSubprocess.exe (PID: 3964)
      • CefSharp.BrowserSubprocess.exe (PID: 2800)
      • WerFault.exe (PID: 2804)
      • PremiumGet.exe (PID: 288)
      • CefSharp.BrowserSubprocess.exe (PID: 1680)
      • CefSharp.BrowserSubprocess.exe (PID: 3612)
      • CefSharp.BrowserSubprocess.exe (PID: 3528)

    • Application was dropped or rewritten from another process

      • CefSharp.BrowserSubprocess.exe (PID: 2812)
      • CefSharp.BrowserSubprocess.exe (PID: 3964)
      • CefSharp.BrowserSubprocess.exe (PID: 2800)
      • CefSharp.BrowserSubprocess.exe (PID: 3528)
      • CefSharp.BrowserSubprocess.exe (PID: 1680)
      • CefSharp.BrowserSubprocess.exe (PID: 3612)

  • SUSPICIOUS

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 3924)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3396)

  • INFO

    • Changes settings of System certificates

      • chrome.exe (PID: 3800)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 3924)

    • Manual execution by user

      • PremiumGet.exe (PID: 620)
      • PremiumGet.exe (PID: 288)

    • Reads settings of System Certificates

      • chrome.exe (PID: 3800)
      • PremiumGet.exe (PID: 620)
      • PremiumGet.exe (PID: 288)

    • Application launched itself

      • chrome.exe (PID: 3924)

    • Application was crashed

      • PremiumGet.exe (PID: 620)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
78
Monitored processes
38
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe chrome.exe no specs searchprotocolhost.exe no specs premiumget.exe cefsharp.browsersubprocess.exe no specs cefsharp.browsersubprocess.exe no specs cefsharp.browsersubprocess.exe no specs werfault.exe no specs premiumget.exe cefsharp.browsersubprocess.exe no specs cefsharp.browsersubprocess.exe no specs cefsharp.browsersubprocess.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3924"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.mediafire.com/file/ojnie9qrupnpn5d/Debug.rar/file"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
3221225547
Version:
75.0.3770.100
1304"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6e55a9d0,0x6e55a9e0,0x6e55a9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
868"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3928 --on-initialized-event-handle=312 --parent-handle=316 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
3512"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=996,12763040644896390323,2109333734312739031,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=3622577851353412343 --mojo-platform-channel-handle=1048 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
3800"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=996,12763040644896390323,2109333734312739031,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=2438824792894683095 --mojo-platform-channel-handle=1600 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
3784"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=996,12763040644896390323,2109333734312739031,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=442003450834405405 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2128 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
1888"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=996,12763040644896390323,2109333734312739031,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=13449470682003872506 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2168 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
3228"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=996,12763040644896390323,2109333734312739031,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=15190999630404507477 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2444 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
3820"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=996,12763040644896390323,2109333734312739031,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=14423195370346052264 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
3300"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=996,12763040644896390323,2109333734312739031,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=10625740670717786984 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2412 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Total events
1 441
Read events
1 291
Write events
0
Delete events
0

Modification events

No data
Executable files
11
Suspicious files
89
Text files
182
Unknown types
54

Dropped files

PID
Process
Filename
Type
3924chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\3e6ea5f7-7951-4404-b30d-434eb914b7f4.tmp —
MD5:—
SHA256:—
3924chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000022.dbtmp —
MD5:—
SHA256:—
3924chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Last Tabsbinary
MD5:F13E47CA8822333F0B06C5DF4AE03C6A
SHA256:259C8802467E24EF97E9042A44C20177D4C35BBABE6FC4F08411AF55391F14A4
3924chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.oldtext
MD5:9858374766B9F08C6C40DA811F1D48C5
SHA256:C9ECAD7DB0598161334BC3F38CDB44BFCB307B609596840B990E7C8BEAAE8C30
3924chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old~RF18ba52.TMPtext
MD5:93C5F55481CEFFD68AEE51D675F936CD
SHA256:B0B058C9EB00B61B8760295C049F86B46E71ECBA3938DA1F195F2C0E9540E7F4
3924chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF18ba23.TMPtext
MD5:D2F885AB466F1CFB727E75DBA59D2237
SHA256:6A9F282C684387E883C9BF9C6BAF3DAFFAD958D0CEA2A0F8F17F1CF50B805A5A
3924chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF18ba33.TMPtext
MD5:8990FEBA82E1DCFD0884B92851E7D508
SHA256:3FDDD7BBE89A5FD6692A9C8DDD7844394F113726D1700C36CB33EF900D3F1B2A
3924chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old~RF18baee.TMPtext
MD5:BB8B462F519A00770A71D634DC712ED6
SHA256:1A9176CD03E7E8716252643EA5404BA8D9350E7E95D34C0295E19063F11FCC0E
3924chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT~RF18babf.TMPtext
MD5:6671DB8C02F3C234BC5B756619A0ED77
SHA256:F7858098C26EF2A143B0E7CAFBC03040C3C1C3185F446517108A7BDD2A6D9C4D
3924chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
141
DNS requests
103
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3800
chrome.exe
GET
302
35.244.218.203:80
http://download.televisionfanatic.com/index.jhtml?partner=XPxpw132&s1=101-c6a7de1e-6292-4fa9-a3d8-054352551a42&s2=eivDqnXRZFk
US
—
—
whitelisted
3800
chrome.exe
GET
200
93.184.220.29:80
http://status.geotrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTIyCPRUzvKHRw7iRE1lF%2BfcLu%2FjgQUypJnUmHervy6Iit%2FHIdMJftvmVgCEA8U5EqxnJKPhgtu86L%2BgMk%3D
US
der
471 b
whitelisted
3800
chrome.exe
GET
200
8.241.123.254:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
56.3 Kb
whitelisted
3800
chrome.exe
GET
302
172.217.16.174:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx
US
html
513 b
whitelisted
3800
chrome.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAP%2B7xu1tkg0miCVD4vGl1M%3D
US
der
471 b
whitelisted
3800
chrome.exe
GET
200
91.199.212.52:80
http://crt.comodoca.com/COMODORSAAddTrustCA.crt
GB
der
1.37 Kb
whitelisted
3800
chrome.exe
GET
200
204.13.202.71:80
http://ssl.trustwave.com/issuers/STCA.crt
US
der
956 b
whitelisted
3800
chrome.exe
GET
200
74.125.168.9:80
http://r4---sn-q0cedn7s.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mip=78.153.204.5&mm=28&mn=sn-q0cedn7s&ms=nvh&mt=1563875682&mv=u&mvi=3&pl=21&shardbypass=yes
US
crx
862 Kb
whitelisted
3800
chrome.exe
GET
200
52.222.245.68:80
http://x.ss2.us/x.cer
US
der
1.27 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3800
chrome.exe
172.217.22.3:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
3800
chrome.exe
216.58.207.46:443
translate.google.com
Google Inc.
US
whitelisted
3800
chrome.exe
104.19.195.29:443
www.mediafire.com
Cloudflare Inc
US
shared
3800
chrome.exe
35.190.74.157:443
desiredirt.com
Google Inc.
US
unknown
3800
chrome.exe
172.217.23.130:443
adservice.google.com
Google Inc.
US
whitelisted
3800
chrome.exe
216.58.205.232:443
www.googletagmanager.com
Google Inc.
US
whitelisted
3800
chrome.exe
172.217.16.194:443
www.googletagservices.com
Google Inc.
US
whitelisted
3800
chrome.exe
172.217.16.141:443
accounts.google.com
Google Inc.
US
suspicious
3800
chrome.exe
216.58.207.70:443
ad.doubleclick.net
Google Inc.
US
whitelisted
3800
chrome.exe
172.217.22.66:443
adservice.google.ie
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.mediafire.com
  • 104.19.195.29
  • 104.19.194.29
shared
accounts.google.com
  • 172.217.16.141
shared
clientservices.googleapis.com
  • 172.217.22.3
whitelisted
www.googletagmanager.com
  • 216.58.205.232
whitelisted
translate.google.com
  • 216.58.207.46
whitelisted
www.googletagservices.com
  • 172.217.16.194
whitelisted
desiredirt.com
  • 35.190.74.157
unknown
static.mediafire.com
  • 104.19.194.29
  • 104.19.195.29
shared
adservice.google.ie
  • 172.217.22.66
whitelisted
adservice.google.com
  • 172.217.23.130
whitelisted

Threats

PID
Process
Class
Message
—
—
Not Suspicious Traffic
ET INFO Observed Free Hosting Domain (*.000webhostapp .com in DNS Lookup)
Process
Message
PremiumGet.exe
[0723/110717.035:INFO:CONSOLE(2)] "[OptinMonster]", source: https://a.optnmstr.com/app/js/api.min.js (2)
PremiumGet.exe
[0723/110804.676:INFO:CONSOLE(0)] "The connection used to load resources from https://ws-na.assoc-amazon.com used TLS 1.0 or TLS 1.1, which are deprecated and will be disabled in the future. Once disabled, users will be prevented from loading these resources. The server should enable TLS 1.2 or later. See https://www.chromestatus.com/feature/5654791610957824 for more information.", source: about:blank (0)
PremiumGet.exe
[0723/110804.676:INFO:CONSOLE(0)] "The connection used to load resources from https://ws-na.assoc-amazon.com used TLS 1.0 or TLS 1.1, which are deprecated and will be disabled in the future. Once disabled, users will be prevented from loading these resources. The server should enable TLS 1.2 or later. See https://www.chromestatus.com/feature/5654791610957824 for more information.", source: https://ws-na.assoc-amazon.com/widgets/cm?o=1&p=13&l=ez&f=ifr&linkID=1ee7ccc90e0b45c5ec25131a4504713f&t=pastalord-20&tracking_id=pastalord-20 (0)
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.mediafire.com/file/ojnie9qrupnpn5d/Debug.rar/file