URL: | http://start.iminent.com/?appId=8763BFFC-1010-4793-A5E4-3820FF58619A |
Full analysis: | https://app.any.run/tasks/4252d448-b659-4a5d-acaa-e9a525716c67 |
Verdict: | Malicious activity |
Analysis date: | March 30, 2020, 18:23:30 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MD5: | 4D59CE349C22AD5CF5FA103748A5D283 |
SHA1: | 16A12E8241E5E72C4E48483A5324C2982FB24227 |
SHA256: | 45889AB97804D70BFB753A8A2F5650D7D37997099E2513ACD8239A8450F73587 |
SSDEEP: | 3:N1KNRSMCLKBEsSrjofSuiuUck:CGJoFG0SRp |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
628 | "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://start.iminent.com/?appId=8763BFFC-1010-4793-A5E4-3820FF58619A" | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | |
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 75.0.3770.100 | ||||
1744 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6fa8a9d0,0x6fa8a9e0,0x6fa8a9ec | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 75.0.3770.100 | ||||
340 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3244 --on-initialized-event-handle=324 --parent-handle=328 /prefetch:6 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 75.0.3770.100 | ||||
2116 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1024,3636438212186767846,16619227975177386843,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=5299364090080546900 --mojo-platform-channel-handle=1032 --ignored=" --type=renderer " /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Version: 75.0.3770.100 | ||||
2436 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1024,3636438212186767846,16619227975177386843,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=14254712866339799931 --mojo-platform-channel-handle=1584 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe | |
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 75.0.3770.100 | ||||
4056 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1024,3636438212186767846,16619227975177386843,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=1502181848980920525 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2240 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Version: 75.0.3770.100 | ||||
1524 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1024,3636438212186767846,16619227975177386843,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=16387027028638512128 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2212 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Version: 75.0.3770.100 | ||||
1676 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1024,3636438212186767846,16619227975177386843,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=6717278594481863659 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2532 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 | ||||
4080 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1024,3636438212186767846,16619227975177386843,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=4520229620003721981 --mojo-platform-channel-handle=3376 --ignored=" --type=renderer " /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 | ||||
2896 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1024,3636438212186767846,16619227975177386843,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=12669575667873077704 --mojo-platform-channel-handle=3612 --ignored=" --type=renderer " /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 |
PID | Process | Filename | Type | |
---|---|---|---|---|
628 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5E823937-274.pma | — | |
MD5:— | SHA256:— | |||
628 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\87e97f17-7057-44dd-966e-c617ce6471af.tmp | — | |
MD5:— | SHA256:— | |||
628 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000028.dbtmp | — | |
MD5:— | SHA256:— | |||
628 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old~RFa67e21.TMP | text | |
MD5:AC43135B8C9FED46A92448C4E711F45C | SHA256:D840BA7CEBACF86DDBAD75BFB61A53449AA7AE3DE6B8ADC97FE45624626A6F09 | |||
628 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Last Tabs | binary | |
MD5:702AEC53DCDCFEA33C4BE3D2F888473E | SHA256:D16286D6EE0EB33E7907EE4FCB8FDB6B5A54E5A56BFAF99A9C2451D239BC9765 | |||
628 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RFa67db4.TMP | text | |
MD5:F69C20D5B552B8D973FB1CBA5FDD7D87 | SHA256:48799968D50E2D74E625A0AB18E93C6792AF20010334C6BB4E935C8D26F7026A | |||
628 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old | text | |
MD5:DA692BE42E4EF2668AE7499A7D5DA720 | SHA256:EB865CAF59002C092F5FDBE22D01935866BC1277108B29E897052CB2439630ED | |||
628 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.old | text | |
MD5:FC9FFE77348619CC285333DFF5E1D5D1 | SHA256:7CB9B3575330B3D776A21EB7A7407E34F013A0975B7418DA11B5C85DEC91D1F3 | |||
628 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old | text | |
MD5:33B05E8AC9C178C58ED3321F496588C0 | SHA256:2CDF6A09638A0B563EA2672D6926210771902E0A9203FE15D2857FC4EB954CDE | |||
628 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RFa67de3.TMP | text | |
MD5:33B05E8AC9C178C58ED3321F496588C0 | SHA256:2CDF6A09638A0B563EA2672D6926210771902E0A9203FE15D2857FC4EB954CDE |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2436 | chrome.exe | GET | 200 | 163.171.132.119:80 | http://www.staticbucket.com/start/bundles/iSearchStartCss?v=smkHGt6cwRXBsa5bLyccICtyakR2iNz-QCFNGSDvv_w1 | US | text | 11.6 Kb | malicious |
2436 | chrome.exe | GET | 200 | 163.171.132.119:80 | http://www.staticbucket.com/start/Images/logo_t.png | US | image | 7.11 Kb | malicious |
2436 | chrome.exe | GET | 200 | 52.55.12.167:80 | http://geoloc.iminent.com/getCountry/?callback=Application.Search.Geoloc.Callbacks.onCountryAvailable | US | text | 271 b | unknown |
2436 | chrome.exe | GET | 200 | 163.171.128.148:80 | http://start.iminent.com/?appId=8763BFFC-1010-4793-A5E4-3820FF58619A | US | html | 1.70 Kb | malicious |
2436 | chrome.exe | GET | — | 172.217.22.78:80 | http://www.google-analytics.com/r/collect?v=1&_v=j81&a=1241895559&t=pageview&_s=1&dl=http%3A%2F%2Fstart.iminent.com%2F%3FappId%3D8763BFFC-1010-4793-A5E4-3820FF58619A&dp=%2F&ul=en-us&de=UTF-8&dt=Search&sd=24-bit&sr=1280x720&vp=1280x572&je=0&_u=IEBAAAAB~&jid=1611072824&gjid=819187253&cid=830678135.1585592634&tid=UA-1789425-40&_gid=943929656.1585592634&_r=1&z=1888424000 | US | — | — | whitelisted |
2436 | chrome.exe | GET | 200 | 172.217.16.138:80 | http://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js | US | text | 32.1 Kb | whitelisted |
2436 | chrome.exe | GET | 200 | 163.171.128.148:80 | http://start.iminent.com/Images/ql/maps.png | US | image | 4.54 Kb | malicious |
2436 | chrome.exe | GET | 200 | 163.171.128.148:80 | http://start.iminent.com/bundles/iSearchStartIndex?v=qURMYmxRC8PHw4H81ugn2cOOxsS7xSg8hE7AinKAUv01 | US | text | 17.0 Kb | malicious |
2436 | chrome.exe | GET | 200 | 163.171.128.148:80 | http://start.iminent.com/Images/ql/videos.png | US | image | 2.77 Kb | malicious |
2436 | chrome.exe | GET | 200 | 163.171.132.119:80 | http://www.staticbucket.com/start/Images/micicon.png | US | image | 741 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2436 | chrome.exe | 216.58.210.13:443 | accounts.google.com | Google Inc. | US | whitelisted |
2436 | chrome.exe | 172.217.16.138:80 | ajax.googleapis.com | Google Inc. | US | whitelisted |
2436 | chrome.exe | 163.171.128.148:80 | start.iminent.com | — | US | malicious |
2436 | chrome.exe | 163.171.132.119:80 | start.iminent.com | — | US | malicious |
2436 | chrome.exe | 163.171.132.119:443 | start.iminent.com | — | US | malicious |
2436 | chrome.exe | 178.250.2.130:80 | static.criteo.net | Criteo SA | FR | suspicious |
2436 | chrome.exe | 172.217.21.227:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
2436 | chrome.exe | 172.217.22.78:80 | www.google-analytics.com | Google Inc. | US | whitelisted |
2436 | chrome.exe | 172.217.22.14:443 | clients1.google.com | Google Inc. | US | whitelisted |
2436 | chrome.exe | 104.111.230.142:80 | ads.rubiconproject.com | Akamai International B.V. | NL | whitelisted |
Domain | IP | Reputation |
---|---|---|
clientservices.googleapis.com |
| whitelisted |
start.iminent.com |
| malicious |
accounts.google.com |
| shared |
ajax.googleapis.com |
| whitelisted |
www.google-analytics.com |
| whitelisted |
www.staticbucket.com |
| malicious |
static.criteo.net |
| whitelisted |
adserver.ads-srv.net |
| malicious |
mail.google.com |
| shared |
mail.yahoo.com |
| shared |
PID | Process | Class | Message |
---|---|---|---|
2436 | chrome.exe | Generic Protocol Command Decode | SURICATA HTTP gzip decompression failed |