| URL: | https://www.media.io/video-watermark-remover.html |
| Full analysis: | https://app.any.run/tasks/348e706e-dcce-417e-90cb-cee2553b18cd |
| Verdict: | Malicious activity |
| Analysis date: | December 27, 2023, 04:39:48 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | A00E846C6738FB61CC42063A2A94CA52 |
| SHA1: | E9EFE4A4800BFC31E44DDA1CE0204F1441A01FA8 |
| SHA256: | 7F7F3353E0C40D0B3A5F655D4AA7A9B4BC757650D33A22BD10E6BCB7DD95ECC8 |
| SSDEEP: | 3:N8DSLwvKgKISF5XX4Q0:2OLwvKFtIL |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads Microsoft Outlook installation path
- anieraser_64bit_setup_full14642.exe (PID: 1628)
Reads Internet Explorer settings
- anieraser_64bit_setup_full14642.exe (PID: 1628)
Checks Windows Trust Settings
- anieraser_64bit_setup_full14642.exe (PID: 1628)
Reads security settings of Internet Explorer
- anieraser_64bit_setup_full14642.exe (PID: 1628)
Reads settings of System Certificates
- anieraser_64bit_setup_full14642.exe (PID: 1628)
Reads the Internet Settings
- anieraser_64bit_setup_full14642.exe (PID: 1628)
Process requests binary or script from the Internet
- anieraser_64bit_setup_full14642.exe (PID: 1628)
INFO
The process uses the downloaded file
- chrome.exe (PID: 884)
- chrome.exe (PID: 2184)
Checks supported languages
- anieraser_64bit_setup_full14642.exe (PID: 1628)
- NFWCHK.exe (PID: 3300)
- anieraser_64bit_full14642.exe (PID: 984)
- anieraser_64bit_full14642.tmp (PID: 1904)
Application launched itself
- chrome.exe (PID: 2184)
Create files in a temporary directory
- anieraser_64bit_setup_full14642.exe (PID: 1628)
- anieraser_64bit_full14642.exe (PID: 984)
- anieraser_64bit_full14642.tmp (PID: 1904)
Connects to unusual port
- chrome.exe (PID: 668)
Drops the executable file immediately after the start
- chrome.exe (PID: 2184)
- anieraser_64bit_setup_full14642.exe (PID: 1628)
- anieraser_64bit_full14642.exe (PID: 984)
Reads the machine GUID from the registry
- NFWCHK.exe (PID: 3300)
- anieraser_64bit_setup_full14642.exe (PID: 1628)
Reads the computer name
- NFWCHK.exe (PID: 3300)
- anieraser_64bit_setup_full14642.exe (PID: 1628)
Checks proxy server information
- anieraser_64bit_setup_full14642.exe (PID: 1628)
Creates files or folders in the user directory
- anieraser_64bit_setup_full14642.exe (PID: 1628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
65
Monitored processes
24
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 124 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6e558b38,0x6e558b48,0x6e558b54 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 492 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 --field-trial-handle=1208,i,17791158199005510925,10396821785856124449,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 668 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=1288 --field-trial-handle=1208,i,17791158199005510925,10396821785856124449,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 884 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=3992 --field-trial-handle=1208,i,17791158199005510925,10396821785856124449,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 984 | "C:\Users\Public\Documents\Wondershare\anieraser_64bit_full14642.exe" /VERYSILENT /NOPAGE /LANG=ENG /LOG="C:\Users\admin\AppData\Local\Temp\WAE-AniEraser for Win.log" /installpath: "C:\Program Files\Wondershare\AniEraser for Win\" /DIR="C:\Program Files\Wondershare\AniEraser for Win\" /WAEWIN=20186 /PID=14642 | C:\Users\Public\Documents\Wondershare\anieraser_64bit_full14642.exe | — | anieraser_64bit_setup_full14642.exe | |||||||||||
User: admin Company: Wondershare Software Integrity Level: HIGH Description: AniEraser Setup Exit code: 1 Version: 1.0.3.41 Modules
| |||||||||||||||
| 1028 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --disable-quic --mojo-platform-channel-handle=4056 --field-trial-handle=1208,i,17791158199005510925,10396821785856124449,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1504 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=1528 --field-trial-handle=1208,i,17791158199005510925,10396821785856124449,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1628 | "C:\Users\admin\Downloads\anieraser_64bit_setup_full14642.exe" | C:\Users\admin\Downloads\anieraser_64bit_setup_full14642.exe | chrome.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: anieraser-for-win_setup_full14642.exe Exit code: 0 Version: 3.0.6.5 Modules
| |||||||||||||||
| 1812 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3348 --field-trial-handle=1208,i,17791158199005510925,10396821785856124449,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1832 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2056 --field-trial-handle=1208,i,17791158199005510925,10396821785856124449,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
Total events
12 784
Read events
12 650
Write events
133
Delete events
1
Modification events
| (PID) Process: | (2184) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (2184) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (2184) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (2184) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (2184) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (2184) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics |
| Operation: | write | Name: | user_experience_metrics.stability.exited_cleanly |
Value: 1 | |||
| (PID) Process: | (2184) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
| Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
| (PID) Process: | (2184) chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
| Operation: | write | Name: | usagestats |
Value: 0 | |||
| (PID) Process: | (2184) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | metricsid_installdate |
Value: 0 | |||
| (PID) Process: | (2184) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | metricsid_enableddate |
Value: 0 | |||
Executable files
5
Suspicious files
90
Text files
40
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2184 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RFdfa9d.TMP | — | |
MD5:— | SHA256:— | |||
| 2184 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 2184 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat | binary | |
MD5:9C016064A1F864C8140915D77CF3389A | SHA256:0E7265D4A8C16223538EDD8CD620B8820611C74538E420A88E333BE7F62AC787 | |||
| 2184 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RFdfa9d.TMP | text | |
MD5:05CF4C3C5148DA6355D3561A9EAA5E8A | SHA256:8D720243F6876898E4F197C8867C4CEE69F1C7335C55B8A29C120B1028D93E41 | |||
| 2184 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG.old | text | |
MD5:65239F35CB63C76EA1F59EF64F7AAFF4 | SHA256:252EF82CC03FDE4BEF13CF81CD1AC5CE45854212D1A7359035E7A5D6BEDBE229 | |||
| 2184 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.old | text | |
MD5:BF244CDEBD39A0D20444C1578C0200BE | SHA256:CC7E247D7764DA50D4137E894838F918281D4915FE0823B4FC0CB763BF582F4D | |||
| 2184 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RFe0124.TMP | — | |
MD5:— | SHA256:— | |||
| 2184 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 2184 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old | text | |
MD5:4755704EAEB72509F8E78594142D80D6 | SHA256:52D45B3A4947B8B5B8C48F83F83BA6758CFB7C4434FC574124378F5B01E15999 | |||
| 2184 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old | text | |
MD5:E53573A93829681410D5E7DBB1B61C78 | SHA256:A82D28F2C1E22A2AE0ABC5F5AF0CC8EE7AD913BAB3A0BF84CE6D8D23F67E06A3 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
40
TCP/UDP connections
126
DNS requests
88
Threats
15
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1628 | anieraser_64bit_setup_full14642.exe | HEAD | 200 | 23.50.131.80:80 | http://download.wondershare.com/cbs_down/anieraser_64bit_full14642.exe | DE | — | — | unknown |
1628 | anieraser_64bit_setup_full14642.exe | HEAD | 200 | 23.50.131.80:80 | http://download.wondershare.com/cbs_down/anieraser_64bit_full14642.exe | DE | — | — | unknown |
1628 | anieraser_64bit_setup_full14642.exe | HEAD | 200 | 23.50.131.81:80 | http://download.wondershare.com/cbs_down/anieraser_64bit_full14642.exe | DE | — | — | unknown |
1628 | anieraser_64bit_setup_full14642.exe | GET | 200 | 93.184.221.240:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e5addc05fd2ff435 | GB | compressed | 4.66 Kb | unknown |
1628 | anieraser_64bit_setup_full14642.exe | GET | — | 23.50.131.80:80 | http://download.wondershare.com/cbs_down/anieraser_64bit_full14642.exe | DE | — | — | unknown |
1628 | anieraser_64bit_setup_full14642.exe | GET | 206 | 23.50.131.80:80 | http://download.wondershare.com/cbs_down/anieraser_64bit_full14642.exe | DE | binary | 33.0 Mb | unknown |
1628 | anieraser_64bit_setup_full14642.exe | GET | — | 23.50.131.81:80 | http://download.wondershare.com/cbs_down/anieraser_64bit_full14642.exe | DE | — | — | unknown |
1628 | anieraser_64bit_setup_full14642.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D | US | binary | 471 b | unknown |
1628 | anieraser_64bit_setup_full14642.exe | GET | — | 23.50.131.81:80 | http://download.wondershare.com/cbs_down/anieraser_64bit_full14642.exe | DE | — | — | unknown |
1628 | anieraser_64bit_setup_full14642.exe | GET | 206 | 23.50.131.80:80 | http://download.wondershare.com/cbs_down/anieraser_64bit_full14642.exe | DE | binary | 33.0 Mb | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
668 | chrome.exe | 173.194.76.84:443 | accounts.google.com | GOOGLE | US | whitelisted |
668 | chrome.exe | 193.108.153.22:443 | www.media.io | Akamai International B.V. | DE | unknown |
2184 | chrome.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
668 | chrome.exe | 193.108.153.6:443 | neveragain.allstatics.com | Akamai International B.V. | DE | unknown |
668 | chrome.exe | 23.216.77.9:443 | www.wondershare.com | Akamai International B.V. | DE | unknown |
668 | chrome.exe | 163.181.92.237:443 | crm-static.wondershare.cc | Zhejiang Taobao Network Co.,Ltd | DE | unknown |
668 | chrome.exe | 142.250.185.104:443 | www.googletagmanager.com | GOOGLE | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
accounts.google.com |
| shared |
www.media.io |
| whitelisted |
neveragain.allstatics.com |
| whitelisted |
www.wondershare.com |
| whitelisted |
crm-static.wondershare.cc |
| unknown |
images.media.io |
| unknown |
images.wondershare.com |
| whitelisted |
www.googletagmanager.com |
| whitelisted |
anieraser.media.io |
| unknown |
script.crazyegg.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
668 | chrome.exe | Potentially Bad Traffic | ET DNS Query for .cc TLD |
668 | chrome.exe | Potentially Bad Traffic | ET DNS Query for .cc TLD |
668 | chrome.exe | Potentially Bad Traffic | ET DNS Query for .cc TLD |
668 | chrome.exe | Potentially Bad Traffic | ET DNS Query for .cc TLD |
668 | chrome.exe | Potentially Bad Traffic | ET DNS Query for .cc TLD |
668 | chrome.exe | Potentially Bad Traffic | ET DNS Query for .cc TLD |
668 | chrome.exe | Potentially Bad Traffic | ET DNS Query for .cc TLD |
668 | chrome.exe | Potentially Bad Traffic | ET DNS Query for .cc TLD |
1080 | svchost.exe | Potentially Bad Traffic | ET DNS Query for .cc TLD |
1080 | svchost.exe | Potentially Bad Traffic | ET DNS Query for .cc TLD |
3 ETPRO signatures available at the full report