| URL: | http://d1ye4i82ttwe0c.cloudfront.net/0vsnzm55)8v0y/adobe_flash_player.exe |
| Full analysis: | https://app.any.run/tasks/e5073e57-f41d-4168-a6f6-afaad328fefd |
| Verdict: | Malicious activity |
| Threats: | Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. |
| Analysis date: | March 28, 2019, 20:00:21 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 2752C554C38A8FA701DDA72FCDD6A3D9 |
| SHA1: | F2C5E8ADB1C99B95D0F5571D47FF643AE03313DB |
| SHA256: | BE5BCB2AD87D3FAC44D39B8C994F7C8321171613C4323FF2DB36DCD518128937 |
| SSDEEP: | 3:N1KaUcxyl/0HrtOf8/DtbN:CaFZHrbtbN |
MALICIOUS
Application was dropped or rewritten from another process
- adobe_flash_player_2744162724.exe (PID: 3412)
- adobe_flash_player_2744162724.exe (PID: 920)
Downloads executable files from the Internet
- chrome.exe (PID: 2212)
INSTALLCORE was detected
- adobe_flash_player_2744162724.exe (PID: 920)
Connects to CnC server
- adobe_flash_player_2744162724.exe (PID: 920)
Changes settings of System certificates
- adobe_flash_player_2744162724.exe (PID: 920)
Loads the Task Scheduler COM API
- adobe_flash_player_2744162724.exe (PID: 920)
SUSPICIOUS
Executable content was dropped or overwritten
- chrome.exe (PID: 3288)
- chrome.exe (PID: 2212)
- adobe_flash_player_2744162724.exe (PID: 920)
Cleans NTFS data-stream (Zone Identifier)
- adobe_flash_player_2744162724.exe (PID: 3412)
Application launched itself
- adobe_flash_player_2744162724.exe (PID: 3412)
Reads Environment values
- adobe_flash_player_2744162724.exe (PID: 920)
Reads internet explorer settings
- adobe_flash_player_2744162724.exe (PID: 920)
Adds / modifies Windows certificates
- adobe_flash_player_2744162724.exe (PID: 920)
Creates files in the user directory
- adobe_flash_player_2744162724.exe (PID: 920)
Creates a software uninstall entry
- adobe_flash_player_2744162724.exe (PID: 920)
Modifies files in Chrome extension folder
- chrome.exe (PID: 3288)
INFO
Application launched itself
- chrome.exe (PID: 3288)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
55
Monitored processes
21
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 292 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=964,11803774206547213923,26424685011001398,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=10716980422888453190 --mojo-platform-channel-handle=2200 --ignored=" --type=renderer " /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 73.0.3683.75 Modules
| |||||||||||||||
| 300 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=73.0.3683.75 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6fa60f18,0x6fa60f28,0x6fa60f34 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 73.0.3683.75 Modules
| |||||||||||||||
| 828 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=964,11803774206547213923,26424685011001398,131072 --enable-features=PasswordImport --service-pipe-token=17427284760112413217 --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=17427284760112413217 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2272 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 73.0.3683.75 Modules
| |||||||||||||||
| 920 | "C:\Users\admin\Downloads\adobe_flash_player_2744162724.exe" /RSF /ppn:YHhybg0dXAt1eGqREw /ads:1 /mnl | C:\Users\admin\Downloads\adobe_flash_player_2744162724.exe | adobe_flash_player_2744162724.exe | ||||||||||||
User: admin Company: Fabagub Integrity Level: HIGH Description: Bohagaho Setup Exit code: 0 Version: 4.0.5.8 Modules
| |||||||||||||||
| 1240 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=964,11803774206547213923,26424685011001398,131072 --enable-features=PasswordImport --lang=en-US --no-sandbox --service-request-channel-token=11094876228889456047 --mojo-platform-channel-handle=1868 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 73.0.3683.75 Modules
| |||||||||||||||
| 1388 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=964,11803774206547213923,26424685011001398,131072 --enable-features=PasswordImport --disable-gpu-compositing --service-pipe-token=5919744609144019938 --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5919744609144019938 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2840 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 73.0.3683.75 Modules
| |||||||||||||||
| 1740 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=1020 --on-initialized-event-handle=308 --parent-handle=312 /prefetch:6 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 73.0.3683.75 Modules
| |||||||||||||||
| 2204 | C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding | C:\Windows\explorer.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2212 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=964,11803774206547213923,26424685011001398,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=13880593200007958471 --mojo-platform-channel-handle=1476 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe | ||||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 73.0.3683.75 Modules
| |||||||||||||||
| 2448 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=964,11803774206547213923,26424685011001398,131072 --enable-features=PasswordImport --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAACAAwAAAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=5256127585613115174 --mojo-platform-channel-handle=3508 /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 73.0.3683.75 Modules
| |||||||||||||||
Total events
2 319
Read events
2 126
Write events
189
Delete events
4
Modification events
| (PID) Process: | (3288) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (3288) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (3288) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: | |||
| (PID) Process: | (3288) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (3288) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (1740) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | write | Name: | 3288-13198276837792875 |
Value: 259 | |||
| (PID) Process: | (3288) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (3288) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
| Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
| (PID) Process: | (3288) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | delete value | Name: | 3488-13197474229333984 |
Value: 0 | |||
| (PID) Process: | (3288) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | delete value | Name: | 3288-13198276837792875 |
Value: 259 | |||
Executable files
6
Suspicious files
22
Text files
271
Unknown types
3
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3288 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\index | — | |
MD5:— | SHA256:— | |||
| 3288 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_0 | — | |
MD5:— | SHA256:— | |||
| 3288 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1 | — | |
MD5:— | SHA256:— | |||
| 3288 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_2 | — | |
MD5:— | SHA256:— | |||
| 3288 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_3 | — | |
MD5:— | SHA256:— | |||
| 3288 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3288 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\4ab9e216-fa18-4035-aa9a-04790f04371b.tmp | — | |
MD5:— | SHA256:— | |||
| 3288 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000018.dbtmp | — | |
MD5:— | SHA256:— | |||
| 3288 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\index | — | |
MD5:— | SHA256:— | |||
| 3288 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0 | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
33
TCP/UDP connections
29
DNS requests
19
Threats
9
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
920 | adobe_flash_player_2744162724.exe | HEAD | 200 | 46.166.187.59:80 | http://www2.ferelar-yofi.com/ofr/Niniwic/YL/Niniwic_Tefenece_12Apr16.cis | NL | — | — | malicious |
920 | adobe_flash_player_2744162724.exe | POST | 200 | 52.214.73.247:80 | http://vpn.ferelar-yofi.com/ | IE | — | — | malicious |
920 | adobe_flash_player_2744162724.exe | POST | 200 | 18.203.190.76:80 | http://www3.ferelar-yofi.com/?besh=0 | US | text | 1.86 Kb | malicious |
920 | adobe_flash_player_2744162724.exe | POST | 200 | 52.214.73.247:80 | http://vpn.ferelar-yofi.com/ | IE | — | — | malicious |
920 | adobe_flash_player_2744162724.exe | POST | 200 | 52.51.129.59:80 | http://support.ferelar-yofi.com/ | IE | binary | 502 Kb | malicious |
920 | adobe_flash_player_2744162724.exe | GET | 200 | 185.59.222.146:80 | http://img.ferelar-yofi.com/img/Jimomoromoj/Jimomoromoj_logo.png | NL | image | 2.10 Kb | malicious |
920 | adobe_flash_player_2744162724.exe | GET | 200 | 185.59.222.146:80 | http://img.ferelar-yofi.com/img/Sibarasawi/bg_comp.png | NL | image | 25.2 Kb | malicious |
920 | adobe_flash_player_2744162724.exe | GET | 200 | 185.59.222.146:80 | http://img.ferelar-yofi.com/img/Sibarasawi/logo_comp.png | NL | image | 12.4 Kb | malicious |
920 | adobe_flash_player_2744162724.exe | GET | 200 | 185.59.222.146:80 | http://img.ferelar-yofi.com/img/Tefenece/Tefenece_logo_black.png | NL | image | 1.82 Kb | malicious |
920 | adobe_flash_player_2744162724.exe | GET | 200 | 185.59.222.146:80 | http://img.ferelar-yofi.com/img/Nuhududanew/BG.jpg | NL | image | 100 Kb | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2212 | chrome.exe | 172.217.18.174:443 | sb-ssl.google.com | Google Inc. | US | whitelisted |
2212 | chrome.exe | 172.217.18.99:443 | ssl.gstatic.com | Google Inc. | US | whitelisted |
920 | adobe_flash_player_2744162724.exe | 52.214.73.247:80 | vpn.ferelar-yofi.com | Amazon.com, Inc. | IE | malicious |
920 | adobe_flash_player_2744162724.exe | 52.51.129.59:80 | support.ferelar-yofi.com | Amazon.com, Inc. | IE | malicious |
920 | adobe_flash_player_2744162724.exe | 185.59.222.146:80 | img.ferelar-yofi.com | Datacamp Limited | NL | malicious |
920 | adobe_flash_player_2744162724.exe | 46.166.187.59:80 | www2.ferelar-yofi.com | NForce Entertainment B.V. | NL | malicious |
920 | adobe_flash_player_2744162724.exe | 199.115.112.67:80 | ww2.ferelar-yofi.com | Leaseweb USA, Inc. | US | malicious |
2212 | chrome.exe | 172.217.21.195:443 | www.gstatic.com | Google Inc. | US | whitelisted |
2212 | chrome.exe | 172.217.18.110:443 | clients1.google.com | Google Inc. | US | whitelisted |
2212 | chrome.exe | 216.58.207.46:80 | redirector.gvt1.com | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
clientservices.googleapis.com |
| whitelisted |
d1ye4i82ttwe0c.cloudfront.net |
| whitelisted |
accounts.google.com |
| shared |
sb-ssl.google.com |
| whitelisted |
ssl.gstatic.com |
| whitelisted |
vpn.ferelar-yofi.com |
| malicious |
www3.ferelar-yofi.com |
| malicious |
d3rgy9jxa1r1e2.cloudfront.net |
| whitelisted |
support.ferelar-yofi.com |
| malicious |
img.ferelar-yofi.com |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2212 | chrome.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2212 | chrome.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
920 | adobe_flash_player_2744162724.exe | Misc activity | ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M2 |
920 | adobe_flash_player_2744162724.exe | Misc activity | ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M1 |
920 | adobe_flash_player_2744162724.exe | Misc activity | ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M3 |
920 | adobe_flash_player_2744162724.exe | Misc activity | ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M4 |
2212 | chrome.exe | Generic Protocol Command Decode | SURICATA STREAM TIMEWAIT ACK with wrong seq |
2 ETPRO signatures available at the full report