| URL: | https://cosmeticsrc.com |
| Full analysis: | https://app.any.run/tasks/d9bc63c8-b17f-450d-b974-bee71113b80f |
| Verdict: | Malicious activity |
| Analysis date: | November 20, 2020, 15:25:57 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | D89DCBD12AF3E179CC6B354C62C13BB3 |
| SHA1: | 3846F27440FF0F32229E1ABC98D84F3F9CAD7A6B |
| SHA256: | 80936C7B73F71B5D44AC998E036B4A9B21E88EE63A2EDDE61D43AE7013095CAF |
| SSDEEP: | 3:N8XP1BMK:2NBMK |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
33
Monitored processes
1
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 1540 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking "https://cosmeticsrc.com" | C:\Program Files\Google\Chrome\Application\chrome.exe | — | explorer.exe |
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 | ||||
Total events
0
Read events
0
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
9
DNS requests
3
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 216.58.212.173:443 | accounts.google.com | Google Inc. | US | whitelisted |
— | — | 142.250.74.195:443 | ssl.gstatic.com | Google Inc. | US | whitelisted |
— | — | 172.241.69.4:443 | cosmeticsrc.com | — | NL | malicious |
— | — | 172.241.69.20:443 | cosmeticsrc.com | — | NL | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
cosmeticsrc.com |
| malicious |
accounts.google.com |
| shared |
ssl.gstatic.com |
| whitelisted |