| URL: | http://redirector.gvt1.com/edgedl/chromewebstore/l2nocm9tzv9lehrlbnnpb24vymxvynmvytbmqufzuhrkskgtb01usgnvrhz2tm5hqq/1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx |
| Full analysis: | https://app.any.run/tasks/5a2e234d-fb2a-4b51-b264-4d3dfbd58d48 |
| Verdict: | Malicious activity |
| Analysis date: | June 21, 2024, 16:01:03 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | D1AB55A40649EC5ABD464C43BE8FEF08 |
| SHA1: | B6262FB70737BFE49B369EF5E3BD18B1FF783960 |
| SHA256: | 4A33061B947673BA650948CCC189CEEA80070D4E4655BACD46413566711999BF |
| SSDEEP: | 3:N1KMVdUyGLkVAzhH7cOFJ/tZvMOWOCtWuXNXuYNKUgJAMDajfTykGxd:CMVdOUAzhpDkQCtH+YNKGCKykM |
MALICIOUS
No malicious indicators.SUSPICIOUS
Uses RUNDLL32.EXE to load library
- iexplore.exe (PID: 3384)
Reads the Internet Settings
- rundll32.exe (PID: 2192)
- pwsh.exe (PID: 3220)
Reads security settings of Internet Explorer
- pwsh.exe (PID: 3220)
Reads the date of Windows installation
- pwsh.exe (PID: 3220)
Reads settings of System Certificates
- pwsh.exe (PID: 3220)
Process checks Powershell history file
- pwsh.exe (PID: 3220)
Checks Windows Trust Settings
- pwsh.exe (PID: 3220)
INFO
Application launched itself
- iexplore.exe (PID: 3384)
- msedge.exe (PID: 3696)
- msedge.exe (PID: 3648)
Modifies the phishing filter of IE
- iexplore.exe (PID: 3384)
The process uses the downloaded file
- iexplore.exe (PID: 3384)
Checks supported languages
- pwsh.exe (PID: 3220)
Manual execution by a user
- pwsh.exe (PID: 3220)
- msedge.exe (PID: 3648)
- notepad.exe (PID: 2308)
Reads the computer name
- pwsh.exe (PID: 3220)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
71
Monitored processes
30
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 348 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=1276 --field-trial-handle=1180,i,6329946362668174847,11886562486534591529,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 448 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1332 --field-trial-handle=1364,i,13361577873288201481,7720473926659894250,131072 /prefetch:2 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 952 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2940 --field-trial-handle=1180,i,6329946362668174847,11886562486534591529,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1164 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x6ebbf598,0x6ebbf5a8,0x6ebbf5b4 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1428 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1500 --field-trial-handle=1364,i,13361577873288201481,7720473926659894250,131072 /prefetch:2 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1680 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2208 --field-trial-handle=1180,i,6329946362668174847,11886562486534591529,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1744 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1668 --field-trial-handle=1364,i,13361577873288201481,7720473926659894250,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2124 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2500 --field-trial-handle=1180,i,6329946362668174847,11886562486534591529,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2164 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1456 --field-trial-handle=1180,i,6329946362668174847,11886562486534591529,131072 /prefetch:2 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2192 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Downloads\1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx | C:\Windows\System32\rundll32.exe | — | iexplore.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
41 102
Read events
40 861
Write events
224
Delete events
17
Modification events
| (PID) Process: | (3384) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPDaysSinceLastAutoMigration |
Value: 1 | |||
| (PID) Process: | (3384) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPLastLaunchLowDateTime |
Value: 978392512 | |||
| (PID) Process: | (3384) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPLastLaunchHighDateTime |
Value: 31114228 | |||
| (PID) Process: | (3384) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
| Operation: | write | Name: | NextCheckForUpdateLowDateTime |
Value: | |||
| (PID) Process: | (3384) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
| Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 31114228 | |||
| (PID) Process: | (3384) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (3384) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (3384) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (3384) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
| (PID) Process: | (3384) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
Executable files
2
Suspicious files
214
Text files
72
Unknown types
8
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3696 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF57ead.TMP | — | |
MD5:— | SHA256:— | |||
| 3696 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3252 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo[1].crx | binary | |
MD5:39FBC1BF4C6C8F919181E3E72630F974 | SHA256:3A118962EF814C91F6476BB9F0DE58AFA63103AF6AC1B8729BE9B39A86789E96 | |||
| 3696 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF57ead.TMP | — | |
MD5:— | SHA256:— | |||
| 3696 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3696 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF57ebd.TMP | — | |
MD5:— | SHA256:— | |||
| 3384 | iexplore.exe | C:\Users\admin\Downloads\1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx | binary | |
MD5:39FBC1BF4C6C8F919181E3E72630F974 | SHA256:3A118962EF814C91F6476BB9F0DE58AFA63103AF6AC1B8729BE9B39A86789E96 | |||
| 3384 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 | der | |
MD5:3E69B4F7D8B24E6C9606A99DCCEB1477 | SHA256:A8616AFC4AC83452B293FAEB861B299486ED4A881C4A0D9856FB55C877354DB5 | |||
| 3384 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{77ECF127-2FE7-11EF-9AAA-12A9866C77DE}.dat | binary | |
MD5:A298D454B450890CECB63F7075158611 | SHA256:ADED6A33476F37D820EB39FC76027289CBE22376005005499A9CE31128CC7751 | |||
| 3696 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF57efb.TMP | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
71
DNS requests
93
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3252 | iexplore.exe | GET | 302 | 95.168.222.15:80 | http://r4---sn-n02xgoxufvg3-2gbz.gvt1.com/edgedl/chromewebstore/l2nocm9tzv9lehrlbnnpb24vymxvynmvytbmqufzuhrkskgtb01usgnvrhz2tm5hqq/1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx?cms_redirect=yes&mh=EK&mip=84.17.48.114&mm=28&mn=sn-n02xgoxufvg3-2gbz&ms=nvh&mt=1718984902&mv=m&mvi=4&pl=23&rmhost=r7---sn-n02xgoxufvg3-2gbz.gvt1.com&shardbypass=sd | unknown | — | — | unknown |
3252 | iexplore.exe | GET | 302 | 74.125.108.167:80 | http://r2---sn-2gb7sn7y.gvt1.com/edgedl/chromewebstore/l2nocm9tzv9lehrlbnnpb24vymxvynmvytbmqufzuhrkskgtb01usgnvrhz2tm5hqq/1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx?mh=EK&pl=23&shardbypass=sd&redirect_counter=1&cm2rm=sn-n02xgoxufvg3-2gbz7z&fexp=24350485&req_id=2699c4429fce4b7a&cms_redirect=yes&mip=84.17.48.114&mm=42&mn=sn-2gb7sn7y&ms=onc&mt=1718985170&mv=m&mvi=2 | unknown | — | — | unknown |
1372 | svchost.exe | GET | 304 | 199.232.214.172:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33 | unknown | — | — | unknown |
1372 | svchost.exe | GET | 200 | 2.16.241.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
3252 | iexplore.exe | GET | 302 | 142.250.74.206:80 | http://redirector.gvt1.com/edgedl/chromewebstore/l2nocm9tzv9lehrlbnnpb24vymxvynmvytbmqufzuhrkskgtb01usgnvrhz2tm5hqq/1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx | unknown | — | — | unknown |
3084 | msedge.exe | GET | 301 | 2.18.64.224:80 | http://shell.windows.com/fileassoc/fileassoc.asp?Ext=crx | unknown | — | — | unknown |
1372 | svchost.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
1060 | svchost.exe | GET | 304 | 199.232.210.172:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?32e8c3cdb69e6bfa | unknown | — | — | unknown |
3384 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | unknown |
3384 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2564 | svchost.exe | 239.255.255.250:3702 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1060 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
1372 | svchost.exe | 52.137.106.217:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
3252 | iexplore.exe | 142.250.74.206:80 | redirector.gvt1.com | GOOGLE | US | whitelisted |
3252 | iexplore.exe | 95.168.222.15:80 | r4---sn-n02xgoxufvg3-2gbz.gvt1.com | SH.cz s.r.o. | CZ | whitelisted |
3252 | iexplore.exe | 74.125.108.167:80 | r2---sn-2gb7sn7y.gvt1.com | GOOGLE | US | whitelisted |
3252 | iexplore.exe | 74.125.173.202:80 | r5---sn-4g5e6nzz.gvt1.com | GOOGLE | US | whitelisted |
1372 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
redirector.gvt1.com |
| whitelisted |
r4---sn-n02xgoxufvg3-2gbz.gvt1.com |
| whitelisted |
r2---sn-2gb7sn7y.gvt1.com |
| whitelisted |
r5---sn-4g5e6nzz.gvt1.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
r20swj13mr.microsoft.com |
| whitelisted |
iecvlist.microsoft.com |
| whitelisted |
Threats
Process | Message |
|---|---|
pwsh.exe | Profiler was prevented from loading notification profiler due to app settings.
Process ID (decimal): 3220. Message ID: [0x2509].
|