Malware analysis https://explainplaysettwisting.com/collect?v=2028264&var=2028266&prpsrc= Malicious activity

Add for printing

URL:	https://explainplaysettwisting.com/collect?v=2028264&var=2028266&prpsrc=
Full analysis:	https://app.any.run/tasks/1e8d6156-0d78-4390-9a00-3f4d976855bc
Verdict:	Malicious activity
Analysis date:	August 01, 2024, 17:29:05
OS:	Ubuntu 22.04.2
MD5:	A572C54E9770FE6950B0301DE3292F8A
SHA1:	C97428C7F6BC74E0A45A713D06AB365B1D863507
SHA256:	63E536F42C04E2469C54B92C26AD7E37157084663EF1A4DF80817CC142187059
SSDEEP:	3:N8aXROKdKJJAutVd8IHrWXP:2aVdSOQeIiXP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Checks the user who created the process
  - cron (PID: 13322)
- Checks DMI information (probably VM detection)
  - udevadm (PID: 13152)
- Manipulating modules (likely to execute programs on system boot)
  - modprobe (PID: 13151)
- Executes commands using command-line interpreter
  - cron (PID: 13322)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

315

Monitored processes

102

Malicious processes

0

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
12919	/bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome https://explainplaysettwisting\.com/collect?v=2028264&var=2028266&prpsrc= "	/bin/sh	—	any-guest-agent
User: user Integrity Level: UNKNOWN Exit code: 0
12920	sudo -iu user google-chrome https://explainplaysettwisting.com/collect?v=2028264	/usr/bin/sudo	—	sh
User: user Integrity Level: UNKNOWN
12921	/bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome https://explainplaysettwisting\.com/collect?v=2028264&var=2028266&prpsrc= "	/usr/bin/dash	—	sh
User: user Integrity Level: UNKNOWN Exit code: 0
12923	/usr/bin/google-chrome https://explainplaysettwisting.com/collect?v=2028264	/opt/google/chrome/chrome		sudo
User: user Integrity Level: UNKNOWN
12924	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
12925	readlink -f /usr/bin/google-chrome	/usr/bin/readlink	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
12926	dirname /opt/google/chrome/google-chrome	/usr/bin/dirname	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
12927	mkdir -p /home/user/.local/share/applications	/usr/bin/mkdir	—	chrome
User: user Integrity Level: UNKNOWN Exit code: 0
12928	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN
12929	cat	/usr/bin/cat	—	chrome
User: user Integrity Level: UNKNOWN

Add for printing

Executable files

0

Suspicious files

86

Text files

4

Unknown types

11

Dropped files

PID	Process	Filename		Type
12923	chrome	/home/user/.config/google-chrome/ShaderCache/data_3		vxd
		MD5:—	SHA256:—
12923	chrome	/home/user/.config/google-chrome/ShaderCache/data_2		vxd
		MD5:—	SHA256:—
12923	chrome	/home/user/.config/google-chrome/ShaderCache/data_0		vxd
		MD5:—	SHA256:—
12923	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_3		vxd
		MD5:—	SHA256:—
12923	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_2		vxd
		MD5:—	SHA256:—
12923	chrome	/home/user/.config/google-chrome/Default/GPUCache/data_0		vxd
		MD5:—	SHA256:—
12923	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_3		vxd
		MD5:—	SHA256:—
12923	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_2		vxd
		MD5:—	SHA256:—
12923	chrome	/home/user/.config/google-chrome/Default/DawnCache/data_0		vxd
		MD5:—	SHA256:—
13072	chrome	/home/user/.cache/mesa_shader_cache/index		koa
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

1

TCP/UDP connections

128

DNS requests

300

Threats

3

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	91.189.91.49:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	185.125.190.97:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	unknown
470	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	91.189.91.49:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	unknown
1195	snap-store	195.181.175.41:443	odrs.gnome.org	Datacamp Limited	DE	unknown
—	—	216.58.212.131:443	clientservices.googleapis.com	GOOGLE	US	whitelisted
12923	chrome	239.255.255.250:1900	—	—	—	whitelisted
—	—	66.102.1.84:443	accounts.google.com	GOOGLE	US	unknown
—	—	212.117.190.201:443	explainplaysettwisting.com	—	LU	unknown
—	—	142.250.185.138:443	safebrowsingohttpgateway.googleapis.com	GOOGLE	US	whitelisted
—	—	151.101.129.91:443	google-ohttp-relay-safebrowsing.fastly-edge.com	FASTLY	US	unknown

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	185.125.190.97 185.125.190.49 91.189.91.97 185.125.190.96 185.125.190.98 91.189.91.98 185.125.190.17 91.189.91.49 185.125.190.48 185.125.190.18 91.189.91.48 91.189.91.96 2001:67c:1562::23 2620:2d:4000:1::98 2620:2d:4002:1::197 2001:67c:1562::24 2620:2d:4000:1::2b 2620:2d:4002:1::196 2620:2d:4000:1::96 2620:2d:4000:1::2a 2620:2d:4000:1::97 2620:2d:4000:1::23 2620:2d:4000:1::22 2620:2d:4002:1::198	whitelisted
google.com	142.250.185.206 2a00:1450:4001:82a::200e	whitelisted
odrs.gnome.org	195.181.175.41 212.102.56.179 138.199.37.40 138.199.37.38 156.146.33.15 138.199.37.35 195.181.170.19 2a02:6ea0:c700::101 2a02:6ea0:c700::11 2a02:6ea0:c700::107 2a02:6ea0:c700::112 2a02:6ea0:c700::18 2a02:6ea0:c700::19 2a02:6ea0:c700::21	whitelisted
clientservices.googleapis.com	216.58.212.131	whitelisted
accounts.google.com	66.102.1.84	whitelisted
explainplaysettwisting.com	212.117.190.201	unknown
safebrowsingohttpgateway.googleapis.com	142.250.185.138 172.217.16.138 142.250.184.234 142.250.186.138 142.250.185.234 142.250.185.202 142.250.184.202 142.250.185.106 142.250.186.74 216.58.212.170 216.58.206.74 172.217.16.202 142.250.185.170 172.217.18.10 142.250.181.234 142.250.186.42	whitelisted
google-ohttp-relay-safebrowsing.fastly-edge.com	151.101.129.91 151.101.65.91 151.101.1.91 151.101.193.91	unknown
s.click.aliexpress.com	23.45.110.4	whitelisted
e11956.x.akamaiedge.net	—	whitelisted

Threats

PID	Process	Class	Message
425	systemd-resolved	Misc activity	ET INFO DNS Query to Alibaba Cloud CDN Domain (aliyuncs .com)
—	—	Misc activity	ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)
425	systemd-resolved	Misc activity	ET INFO DNS Query to Alibaba Cloud CDN Domain (aliyuncs .com)

Add for printing

No debug info

General Info

https://explainplaysettwisting.com/collect?v=2028264&var=2028266&prpsrc=

A572C54E9770FE6950B0301DE3292F8A

C97428C7F6BC74E0A45A713D06AB365B1D863507

63E536F42C04E2469C54B92C26AD7E37157084663EF1A4DF80817CC142187059

3:N8aXROKdKJJAutVd8IHrWXP:2aVdSOQeIiXP

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Checks the user who created the process

Checks DMI information (probably VM detection)

Manipulating modules (likely to execute programs on system boot)

Executes commands using command-line interpreter

INFO

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings