| URL: | https://gixel.gnetwork.me |
| Full analysis: | https://app.any.run/tasks/93f0c33d-39c1-4bb3-b1a7-c5cf63d22837 |
| Verdict: | Malicious activity |
| Analysis date: | August 22, 2023, 01:29:14 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | B868538DFDBC9CD38C631FC605A63015 |
| SHA1: | DEFE87D969D94CCEB70DC0C64B37D0CC6550F6ED |
| SHA256: | B892EB912977AD2ED237AEDE73F7B2DEB8BCF5B257810A447DB5CBC0B5EC5A4B |
| SSDEEP: | 3:N8tYSKm:2BJ |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 348 | "C:\Program Files\Internet Explorer\iexplore.exe" "https://gixel.gnetwork.me" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 600 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=884 --field-trial-handle=1184,i,16426851191036022485,13521611001652022899,131072 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1020 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1152 --field-trial-handle=1184,i,16426851191036022485,13521611001652022899,131072 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1128 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2292 --field-trial-handle=1184,i,16426851191036022485,13521611001652022899,131072 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1584 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1300 --field-trial-handle=1184,i,16426851191036022485,13521611001652022899,131072 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1592 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1536 --field-trial-handle=1184,i,16426851191036022485,13521611001652022899,131072 /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1824 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4200 --field-trial-handle=1184,i,16426851191036022485,13521611001652022899,131072 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 2088 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3400 --field-trial-handle=1184,i,16426851191036022485,13521611001652022899,131072 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 2120 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:348 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 2288 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3316 --field-trial-handle=1184,i,16426851191036022485,13521611001652022899,131072 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| (PID) Process: | (348) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPDaysSinceLastAutoMigration |
Value: 0 | |||
| (PID) Process: | (348) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPLastLaunchHighDateTime |
Value: 30847387 | |||
| (PID) Process: | (348) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
| Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 30847437 | |||
| (PID) Process: | (348) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (348) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (348) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
| (PID) Process: | (348) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (348) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (348) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (348) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2120 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\76129F73682CC69086990386236A991E | binary | |
MD5:1C5D52E1F0958F49979D64B0A5395EB2 | SHA256:E1CBC3C125FDD227612D52B5A0480FE0F47572D581BF0B0BA15F7552F691C7A7 | |||
| 2120 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | compressed | |
MD5:F7DCB24540769805E5BB30D193944DCE | SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA | |||
| 2120 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\76129F73682CC69086990386236A991E | binary | |
MD5:541638A61C3B628C4F9F2719F560489A | SHA256:87728D962B55060CC52B95BE78E29A11D35D376EF7CB9771C0C4CE1EABCEB1D0 | |||
| 2120 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:1DDC8E28693821D39AFC4E07AA876D87 | SHA256:08D25E355B0CF361982AB6131A68AC371503749C48EC4D0D5BDF64C7D796BA70 | |||
| 2120 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\DY46KHMU.htm | html | |
MD5:BF6680F906883496C84E5D57D31ADA83 | SHA256:CE8EEF3FA474181753042ADF9F5B349D9C664DDCB89274BFCB3E58CA6E9A9BFD | |||
| 2120 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61 | binary | |
MD5:DEC6BBE308EB44937F77160A25EE32DB | SHA256:68A71DE28F488586C2B169F4652347E0A1FD632D48A6D6725393607BFA18BC7E | |||
| 2120 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 | binary | |
MD5:EB804FFBE3042FF975AF6E9E967CC1C8 | SHA256:5F4CDD00F8445FBAF720AA9177297E9C47E424DDD886BAB6C3E1BF84D095668E | |||
| 2120 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\HWRHT8P3.txt | text | |
MD5:66341FDC0877DC052ED6CF07871C316E | SHA256:68A26C648EB027A5A922D632CCA12476458A5CE77654031170A3652F281CDFA9 | |||
| 348 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | image | |
MD5:DA597791BE3B6E732F0BC8B20E38EE62 | SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07 | |||
| 2120 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4E3E4B05E877647EF3D7B912F256A94C | binary | |
MD5:6C57B6BAF6AAAAEB359E16AC81ABEC85 | SHA256:D607AD61E0D9F95C07AD2F59736EAD50748A66B44C9F5CDDDCBDE5EE0FBB2C23 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
348 | iexplore.exe | GET | 304 | 8.238.34.254:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4eaf1865ab24839f | US | — | — | whitelisted |
2120 | iexplore.exe | GET | 200 | 142.250.185.163:80 | http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDGEBdwFpkQsQqVJE7B7pj%2F | US | der | 472 b | whitelisted |
2120 | iexplore.exe | GET | 200 | 23.56.202.135:80 | http://x2.c.lencr.org/ | GB | der | 300 b | whitelisted |
2120 | iexplore.exe | GET | 200 | 142.250.185.163:80 | http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCvq657SSGH4BCK4BLaKjFp | US | binary | 472 b | whitelisted |
348 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D | US | der | 1.47 Kb | whitelisted |
2120 | iexplore.exe | GET | 200 | 142.250.185.163:80 | http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D | US | der | 1.41 Kb | whitelisted |
2120 | iexplore.exe | GET | 200 | 142.250.185.163:80 | http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCxveB4eLEIHAqwCg22TKZB | US | der | 472 b | whitelisted |
2120 | iexplore.exe | GET | 200 | 2.21.242.242:80 | http://e1.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTvkAFw3ViPKmUeIVEf3NC7b1ErqwQUWvPtK%2Fw2wjd5uVIw6lRvz1XLLqwCEgMdswzkUbMJEHDvhlwE6SPT2Q%3D%3D | NL | der | 345 b | whitelisted |
2120 | iexplore.exe | GET | 200 | 199.191.50.153:80 | http://ww01.gnetwork.me/px.js?ch=2 | VG | text | 346 b | malicious |
2120 | iexplore.exe | GET | 200 | 199.191.50.153:80 | http://ww01.gnetwork.me/?pid=9POT3387I&pbsubid=b3238b52-48d6-4ae5-9dad-d7325548705b&noads=http%3A%2F%2Fww01.gnetwork.me%2F%3Fskipskenzo%3Dtrue&enc_txt=ftvy41m9V9r2HdnkhGGlyvfek%2FhphKGQR6kQ9Ff4trvlvtf7F9buM2%2BlnxR2q%2Bj5yP391RhhFGkScAtE6W%2BoAl08bEEahuIOb6J3O7Qn8qccgsEWtlJ9PTJzHSrPdM2b&enc_lnk=4fiHOOd3bUPFsb69bWhKgHiQp8dCXS2GiXZt%2BsqtFN%2FAtW1XyIeg7%2BdU67KYQaFmI%2BcI9%2Bfm%2BEnuA%2B4ySceqBVFeUvfVq1S5tL4VRCucdFC8abD1bdhvP16wjPYQ5ruL | VG | html | 91.1 Kb | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2120 | iexplore.exe | 199.59.243.224:443 | gixel.gnetwork.me | AMAZON-02 | US | malicious |
2120 | iexplore.exe | 8.238.34.254:80 | ctldl.windowsupdate.com | LEVEL3 | US | suspicious |
2120 | iexplore.exe | 23.56.202.135:80 | x2.i.lencr.org | AKAMAI-AS | GB | suspicious |
2120 | iexplore.exe | 2.21.242.242:80 | e1.o.lencr.org | Akamai International B.V. | DE | whitelisted |
348 | iexplore.exe | 8.238.34.254:80 | ctldl.windowsupdate.com | LEVEL3 | US | suspicious |
348 | iexplore.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
348 | iexplore.exe | 104.126.37.163:443 | www.bing.com | Akamai International B.V. | DE | suspicious |
2120 | iexplore.exe | 142.250.186.132:443 | www.google.com | GOOGLE | US | whitelisted |
2120 | iexplore.exe | 142.250.185.163:80 | ocsp.pki.goog | GOOGLE | US | whitelisted |
2760 | chrome.exe | 142.250.186.132:443 | www.google.com | GOOGLE | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
gixel.gnetwork.me |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
x2.i.lencr.org |
| suspicious |
x1.c.lencr.org |
| whitelisted |
x2.c.lencr.org |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
e1.o.lencr.org |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
www.google.com |
| malicious |