File name: | TL_legacy_beta.jar |
Full analysis: | https://app.any.run/tasks/e6ca33d9-9a7c-44d3-8ed8-f03008ba75a7 |
Verdict: | Malicious activity |
Analysis date: | August 12, 2022, 17:13:37 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v1.0 to extract |
MD5: | 83547D1727806A69E16FE4C6C1417D2C |
SHA1: | 5655500DC45868B929328A96601807BF81FF2FD2 |
SHA256: | B59DA929C81B76F2EA1AD1280FEA1D550EFE02FCF89B13E6157E449F51E13617 |
SSDEEP: | 98304:WfEALdvFlvA8qqrAZfast+9FtMMypuf7qCHPoeefjGlOk:WnhqhJast4zypufmcAfjCOk |
.spe | | | SPSS Extension (54) |
---|---|---|
.jar | | | Java Archive (26.1) |
.zip | | | ZIP compressed archive (7.2) |
ZipRequiredVersion: | 10 |
---|---|
ZipBitFlag: | 0x0800 |
ZipCompression: | Deflated |
ZipModifyDate: | 1980:02:01 00:00:00 |
ZipCRC: | 0x00000000 |
ZipCompressedSize: | 2 |
ZipUncompressedSize: | - |
ZipFileName: | META-INF/ |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
700 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL "C:\Users\admin\Desktop\TL_legacy_beta.jar.spe" | C:\Windows\system32\rundll32.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2948 | "C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -jar "C:\Users\admin\Desktop\TL_legacy_beta.jar" | C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.2710.9 Modules
| |||||||||||||||
3164 | C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M | C:\Windows\system32\icacls.exe | — | javaw.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3880 | "C:\Program Files\Java\jre1.8.0_271\bin\java.exe" -Xmx128m -Dfile.encoding=UTF-8 -Dtlauncher.systemCharset=windows-1252 -Dtlauncher.logFolder=C:\Users\admin\AppData\Roaming\.tlauncher\logs -classpath C:\Users\admin\Desktop\TL_legacy_beta.jar ru.turikhay.tlauncher.bootstrap.Bootstrap | C:\Program Files\Java\jre1.8.0_271\bin\java.exe | javaw.exe | ||||||||||||
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Version: 8.0.2710.9 Modules
| |||||||||||||||
1732 | "C:\Program Files\Google\Chrome\Application\chrome.exe" | C:\Program Files\Google\Chrome\Application\chrome.exe | Explorer.EXE | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 86.0.4240.198 Modules
| |||||||||||||||
372 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6dcfd988,0x6dcfd998,0x6dcfd9a4 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 86.0.4240.198 Modules
| |||||||||||||||
2664 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,11933534931536665065,2015693081905396810,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1064 /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
2700 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1040,11933534931536665065,2015693081905396810,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1424 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 86.0.4240.198 Modules
| |||||||||||||||
3232 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,11933534931536665065,2015693081905396810,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1916 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
3312 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,11933534931536665065,2015693081905396810,131072 --enable-features=PasswordImport --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1924 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
1732 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-62F68A5C-6C4.pma | — | |
MD5:— | SHA256:— | |||
2700 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cache\index | binary | |
MD5:3757A445A5F5AC5916152B0E474E07E1 | SHA256:B9B97E66CD2A43C49D8170DC843D1108820000A0AA998D603CC2FA84DD037895 | |||
1732 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferences | text | |
MD5:B73CE2B3479237D13B8EE10A429C1998 | SHA256:91EEFFBB0AB432B1229FCC48B1DC5D3CFB03234B40EC637C399741845FB52361 | |||
2948 | javaw.exe | C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8061.timestamp | text | |
MD5:277375F9CB67E92C1BBA10BC6CA2EF1E | SHA256:BD5FFB2602CA6E00BDB9B6FE573887D5001EDDB5A340F3F9D6EE38D858C92B4C | |||
1732 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\8bfd6382-9cfa-4258-9e0a-a0186d0abf97.tmp | text | |
MD5:B73CE2B3479237D13B8EE10A429C1998 | SHA256:91EEFFBB0AB432B1229FCC48B1DC5D3CFB03234B40EC637C399741845FB52361 | |||
1732 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Version | text | |
MD5:00046F773EFDD3C8F8F6D0F87A2B93DC | SHA256:593EDE11D17AF7F016828068BCA2E93CF240417563FB06DC8A579110AEF81731 | |||
1732 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old | text | |
MD5:8FF312A95D60ED89857FEB720D80D4E1 | SHA256:946A57FAFDD28C3164D5AB8AB4971B21BD5EC5BFFF7554DBF832CB58CC37700B | |||
1732 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old | text | |
MD5:7721CDA9F5B73CE8A135471EB53B4E0E | SHA256:DD730C576766A46FFC84E682123248ECE1FF1887EC0ACAB22A5CE93A450F4500 | |||
372 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma | binary | |
MD5:03C4F648043A88675A920425D824E1B3 | SHA256:F91DBB7C64B4582F529C968C480D2DCE1C8727390482F31E4355A27BB3D9B450 | |||
1732 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old | text | |
MD5:995C92837E4775CAFFE387D51ADBA520 | SHA256:51247C3464FD988B72670002D01A57FBFF1348704D325DC8FF8817ED2459D0D9 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2700 | chrome.exe | GET | 302 | 79.132.136.12:80 | http://ccl1.xyz/go.php?to=quxW&a=2922647315&b=&c=1661011078 | DE | — | — | suspicious |
2700 | chrome.exe | GET | 302 | 79.132.136.12:80 | http://ccl1.xyz/go.php?to=quxW&a=2922647315&b=&c=1661011078 | DE | — | — | suspicious |
892 | svchost.exe | HEAD | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ac5q25btpqhkjhcekqoslcldvuya_1.3.36.141/ihnlcenocehgdaegdmhbidjhnhdchfmm_1.3.36.141_win_ehzjmd5kjmert7jdgsrj4xqxj4.crx3 | US | — | — | whitelisted |
2700 | chrome.exe | GET | 200 | 79.132.136.12:80 | http://catcut.net/go/view.php?l=quxW | DE | html | 20.7 Kb | suspicious |
892 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ac5q25btpqhkjhcekqoslcldvuya_1.3.36.141/ihnlcenocehgdaegdmhbidjhnhdchfmm_1.3.36.141_win_ehzjmd5kjmert7jdgsrj4xqxj4.crx3 | US | binary | 9.70 Kb | whitelisted |
2700 | chrome.exe | GET | 200 | 79.132.136.12:80 | http://ccl1.xyz/s/quxW | DE | html | 7.96 Kb | suspicious |
2700 | chrome.exe | GET | 404 | 79.132.136.12:80 | http://catcut.net/favicon.ico | DE | html | 65.4 Kb | suspicious |
892 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ac5q25btpqhkjhcekqoslcldvuya_1.3.36.141/ihnlcenocehgdaegdmhbidjhnhdchfmm_1.3.36.141_win_ehzjmd5kjmert7jdgsrj4xqxj4.crx3 | US | binary | 9.65 Kb | whitelisted |
892 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ac5q25btpqhkjhcekqoslcldvuya_1.3.36.141/ihnlcenocehgdaegdmhbidjhnhdchfmm_1.3.36.141_win_ehzjmd5kjmert7jdgsrj4xqxj4.crx3 | US | binary | 9.65 Kb | whitelisted |
892 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ac5q25btpqhkjhcekqoslcldvuya_1.3.36.141/ihnlcenocehgdaegdmhbidjhnhdchfmm_1.3.36.141_win_ehzjmd5kjmert7jdgsrj4xqxj4.crx3 | US | binary | 20.9 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2700 | chrome.exe | 142.250.186.36:443 | www.google.com | Google Inc. | US | whitelisted |
3880 | java.exe | 159.223.209.252:443 | eu01-www.tlaun.ch | — | US | unknown |
2700 | chrome.exe | 216.58.212.174:443 | encrypted-tbn0.gstatic.com | Google Inc. | US | whitelisted |
2700 | chrome.exe | 142.250.186.142:443 | clients2.google.com | Google Inc. | US | whitelisted |
3880 | java.exe | 151.236.118.192:443 | cdn.turikhay.ru | CDNvideo LLC | RU | suspicious |
2700 | chrome.exe | 142.250.184.195:443 | update.googleapis.com | Google Inc. | US | whitelisted |
2700 | chrome.exe | 142.250.185.163:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
2700 | chrome.exe | 142.250.186.163:443 | ssl.gstatic.com | Google Inc. | US | whitelisted |
2700 | chrome.exe | 142.250.184.193:443 | clients2.googleusercontent.com | Google Inc. | US | whitelisted |
3880 | java.exe | 104.21.30.156:443 | tlaun.ch | Cloudflare Inc | US | malicious |
Domain | IP | Reputation |
---|---|---|
cdn.turikhay.ru |
| suspicious |
tlaun.ch |
| unknown |
eu01-www.tlaun.ch |
| unknown |
eu02-www.tlaun.ch |
| unknown |
ru01-www.tlaun.ch |
| suspicious |
ru02-www.tlaun.ch |
| unknown |
eu01-www.tln4.ru |
| unknown |
eu02-www.tln4.ru |
| unknown |
ru01-www.tln4.ru |
| suspicious |
ru02-www.tln4.ru |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
2700 | chrome.exe | Potentially Bad Traffic | AV INFO HTTP Request to a *.xyz domain |
2700 | chrome.exe | Potentially Bad Traffic | AV INFO HTTP Request to a *.xyz domain |
2700 | chrome.exe | Potentially Bad Traffic | AV INFO HTTP Request to a *.xyz domain |
2700 | chrome.exe | Potentially Bad Traffic | AV INFO HTTP Request to a *.xyz domain |
2700 | chrome.exe | Potentially Bad Traffic | AV INFO HTTP Request to a *.xyz domain |
2700 | chrome.exe | Potentially Bad Traffic | AV INFO HTTP Request to a *.xyz domain |
2700 | chrome.exe | Potentially Bad Traffic | AV INFO HTTP Request to a *.xyz domain |
— | — | Potentially Bad Traffic | ET DNS Query for .to TLD |
— | — | Potentially Bad Traffic | ET DNS Query for .to TLD |