URL: | https://go.shukatsu-times.jp/e/1002701/p-a8mat-3HGMEO8WB90A2JK43B34F6/4lmwj/566161911/h/bA-c6x2DigzIFNqVy7KRbsBhCs8yBdFjS66zlUuSjnM |
Full analysis: | https://app.any.run/tasks/71500990-ddda-4b1a-bf6c-a486a5499047 |
Verdict: | Malicious activity |
Analysis date: | July 09, 2024, 14:05:13 |
OS: | Ubuntu 22.04.2 |
Indicators: | |
MD5: | 1690F88A18239B6C71DFF4CC2DEE068A |
SHA1: | 354A372540A7A214EF6E10B6702DE949AC3F0ED8 |
SHA256: | E221669097CEB32314A2699E1B435A70A15DF29CB5CF0802AA107C9A4BEEF9C6 |
SSDEEP: | 3:N8riRd3hnTEKEnvwqkv3TKFPEIGnI2Jwjzo:2+vxTEKEnIqkQPgvuo |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
12926 | /bin/sh -c "DISPLAY=:0 sudo -iu user google-chrome https://go\.shukatsu-times\.jp/e/1002701/p-a8mat-3HGMEO8WB90A2JK43B34F6/4lmwj/566161911/h/bA-c6x2DigzIFNqVy7KRbsBhCs8yBdFjS66zlUuSjnM " | /bin/sh | — | any-guest-agent |
User: root Integrity Level: UNKNOWN | ||||
12927 | sudo -iu user google-chrome https://go.shukatsu-times.jp/e/1002701/p-a8mat-3HGMEO8WB90A2JK43B34F6/4lmwj/566161911/h/bA-c6x2DigzIFNqVy7KRbsBhCs8yBdFjS66zlUuSjnM | /usr/bin/sudo | — | sh |
User: root Integrity Level: UNKNOWN | ||||
12928 | /usr/bin/google-chrome https://go.shukatsu-times.jp/e/1002701/p-a8mat-3HGMEO8WB90A2JK43B34F6/4lmwj/566161911/h/bA-c6x2DigzIFNqVy7KRbsBhCs8yBdFjS66zlUuSjnM | /opt/google/chrome/chrome | sudo | |
User: user Integrity Level: UNKNOWN | ||||
12929 | /usr/bin/locale-check C.UTF-8 | /usr/bin/locale-check | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
12930 | readlink -f /usr/bin/google-chrome | /usr/bin/readlink | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
12931 | dirname /opt/google/chrome/google-chrome | /usr/bin/dirname | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
12932 | mkdir -p /home/user/.local/share/applications | /usr/bin/mkdir | — | chrome |
User: user Integrity Level: UNKNOWN Exit code: 0 | ||||
12933 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN | ||||
12934 | cat | /usr/bin/cat | — | chrome |
User: user Integrity Level: UNKNOWN | ||||
12935 | /opt/google/chrome/chrome | — | chrome | |
User: user Integrity Level: UNKNOWN Exit code: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
12928 | chrome | /home/user/.config/google-chrome/ShaderCache/data_3 | vxd | |
MD5:— | SHA256:— | |||
12928 | chrome | /home/user/.config/google-chrome/ShaderCache/data_2 | binary | |
MD5:— | SHA256:— | |||
12928 | chrome | /home/user/.config/google-chrome/ShaderCache/data_0 | binary | |
MD5:— | SHA256:— | |||
12928 | chrome | /home/user/.config/google-chrome/Default/GPUCache/data_3 | vxd | |
MD5:— | SHA256:— | |||
12928 | chrome | /home/user/.config/google-chrome/Default/GPUCache/data_2 | vxd | |
MD5:— | SHA256:— | |||
12928 | chrome | /home/user/.config/google-chrome/Default/GPUCache/data_0 | vxd | |
MD5:— | SHA256:— | |||
12928 | chrome | /home/user/.config/google-chrome/Default/DawnCache/data_3 | vxd | |
MD5:— | SHA256:— | |||
12928 | chrome | /home/user/.config/google-chrome/Default/DawnCache/data_2 | vxd | |
MD5:— | SHA256:— | |||
12928 | chrome | /home/user/.config/google-chrome/Default/DawnCache/data_0 | vxd | |
MD5:— | SHA256:— | |||
13075 | chrome | /home/user/.cache/mesa_shader_cache/index | koa | |
MD5:— | SHA256:— |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
12928 | chrome | 224.0.0.251:5353 | — | — | — | unknown |
— | — | 212.102.56.179:443 | odrs.gnome.org | Datacamp Limited | DE | unknown |
485 | snapd | 185.125.188.58:443 | api.snapcraft.io | Canonical Group Limited | GB | unknown |
12974 | chrome | 142.250.186.131:443 | clientservices.googleapis.com | GOOGLE | US | whitelisted |
12974 | chrome | 172.217.16.138:443 | safebrowsingohttpgateway.googleapis.com | GOOGLE | US | whitelisted |
12974 | chrome | 34.237.219.119:443 | go.shukatsu-times.jp | AMAZON-AES | US | unknown |
12928 | chrome | 239.255.255.250:1900 | — | — | — | whitelisted |
12974 | chrome | 151.101.193.91:443 | google-ohttp-relay-safebrowsing.fastly-edge.com | FASTLY | US | unknown |
12974 | chrome | 142.250.184.228:443 | www.google.com | — | — | whitelisted |
12974 | chrome | 142.250.186.35:443 | update.googleapis.com | GOOGLE | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
odrs.gnome.org |
| unknown |
api.snapcraft.io |
| unknown |
clientservices.googleapis.com |
| whitelisted |
go.shukatsu-times.jp |
| unknown |
safebrowsingohttpgateway.googleapis.com |
| unknown |
pi-ue1-public-lb-f0209c6950285322.elb.us-east-1.amazonaws.com |
| unknown |
google-ohttp-relay-safebrowsing.fastly-edge.com |
| unknown |
197.100.168.192.in-addr.arpa |
| unknown |
www.google.com |
| whitelisted |
update.googleapis.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Not Suspicious Traffic | INFO [ANY.RUN] An application monitoring request to newrelic .com |
12974 | chrome | Potential Corporate Privacy Violation | AV POLICY Observed TikTok Domain in TLS SNI (tiktok.com) |