| URL: | https://www.google.com/url?rct=j&sa=t&url=http://travel15546.myq-see.com/xjg2.html&ct=ga&cd=CAEYACoTNTQ5NjUzMDY5NTU5NjMxNTQyMTIcNWUxZDBlNWE3OWZjNDUwMTpjb206ZW46VVM6Ug&usg=AFQjCNFrcI_usfP7SjGK7z5MDv0WC-6nng |
| Full analysis: | https://app.any.run/tasks/92c845b8-fc8e-4e69-8a04-c369eb62325a |
| Verdict: | Malicious activity |
| Analysis date: | October 09, 2019, 13:16:40 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | 3362E5C7B1167F9B243ABD4B347E68E7 |
| SHA1: | 7767F9FE1EF539DDB7B3895BE2ACBB5CF9257CD2 |
| SHA256: | EFDEBE2CC85AD21F2A9CD109CAE0D8A158F9AD7E1D94E6968BDE90562ED5EBA0 |
| SSDEEP: | 6:2OLI2AtURJX06yGOj2A7fi/IkY3Dv0S0W8De2:2V2SaRyGO6wykvab |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 184 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=992,17346389577468341068,9422554064083927192,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=14681367303573069051 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 684 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=992,17346389577468341068,9422554064083927192,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=8298247055193733635 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2236 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 968 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=992,17346389577468341068,9422554064083927192,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=1638257691930577941 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 1008 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=992,17346389577468341068,9422554064083927192,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=16587221597360268685 --mojo-platform-channel-handle=3140 --ignored=" --type=renderer " /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 1340 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=992,17346389577468341068,9422554064083927192,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=10658599413190180436 --mojo-platform-channel-handle=2460 --ignored=" --type=renderer " /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 1632 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=992,17346389577468341068,9422554064083927192,131072 --enable-features=PasswordImport --lang=en-US --no-sandbox --service-request-channel-token=10512258845504760642 --mojo-platform-channel-handle=3732 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 1680 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=992,17346389577468341068,9422554064083927192,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=17071929398223169552 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2472 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 1712 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=992,17346389577468341068,9422554064083927192,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=6059648376449107789 --mojo-platform-channel-handle=3412 --ignored=" --type=renderer " /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 1808 | "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.google.com/url?rct=j&sa=t&url=http://travel15546.myq-see.com/xjg2.html&ct=ga&cd=CAEYACoTNTQ5NjUzMDY5NTU5NjMxNTQyMTIcNWUxZDBlNWE3OWZjNDUwMTpjb206ZW46VVM6Ug&usg=AFQjCNFrcI_usfP7SjGK7z5MDv0WC-6nng" | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 2120 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=992,17346389577468341068,9422554064083927192,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=7410983600107527126 --mojo-platform-channel-handle=956 --ignored=" --type=renderer " /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| (PID) Process: | (1808) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (1808) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (1808) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: | |||
| (PID) Process: | (1808) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (1808) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (2460) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | write | Name: | 1808-13215100615733125 |
Value: 259 | |||
| (PID) Process: | (1808) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (1808) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
| Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
| (PID) Process: | (1808) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | delete value | Name: | 1512-13197841398593750 |
Value: 0 | |||
| (PID) Process: | (1808) chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
| Operation: | write | Name: | usagestats |
Value: 0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1808 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old | — | |
MD5:— | SHA256:— | |||
| 1808 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\2d3cc450-9c39-4a0b-94cb-745d2516fd3f.tmp | — | |
MD5:— | SHA256:— | |||
| 1808 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000020.dbtmp | — | |
MD5:— | SHA256:— | |||
| 1808 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old | text | |
MD5:— | SHA256:— | |||
| 1808 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 1808 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF10100f.TMP | text | |
MD5:— | SHA256:— | |||
| 1808 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old | text | |
MD5:— | SHA256:— | |||
| 1808 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1 | — | |
MD5:— | SHA256:— | |||
| 1808 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF10100f.TMP | text | |
MD5:— | SHA256:— | |||
| 1808 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old | text | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2492 | chrome.exe | GET | — | 93.170.13.82:80 | http://travel15546.myq-see.com/xjg2.html | NL | — | — | unknown |
2492 | chrome.exe | GET | 200 | 185.89.102.6:80 | http://mobile3153.hometoday100.life/7402865068/?u=31epbev&o=pdak7bf&t=3&f=1 | UA | html | 17.1 Kb | suspicious |
2492 | chrome.exe | GET | 200 | 185.89.102.6:80 | http://mobile3153.hometoday100.life/media/mainstream/us/wap/mobsurvey/font-awesome.css | UA | text | 17.2 Kb | suspicious |
2492 | chrome.exe | GET | 302 | 172.217.22.14:80 | http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx | US | html | 507 b | whitelisted |
2492 | chrome.exe | GET | 200 | 185.89.102.6:80 | http://mobile3153.hometoday100.life/media/mainstream/us/wap/mobsurvey/en-en.js | UA | text | 5.95 Kb | suspicious |
2492 | chrome.exe | GET | 200 | 185.89.102.6:80 | http://mobile3153.hometoday100.life/media/mainstream/jquery.js | UA | text | 94.0 Kb | suspicious |
2492 | chrome.exe | GET | 200 | 172.217.135.6:80 | http://r1---sn-p5qlsndk.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx?cms_redirect=yes&mip=85.203.20.5&mm=28&mn=sn-p5qlsndk&ms=nvh&mt=1570626924&mv=m&mvi=0&pl=24&shardbypass=yes | US | crx | 293 Kb | whitelisted |
2492 | chrome.exe | GET | 200 | 185.89.102.6:80 | http://mobile3153.hometoday100.life/media/mainstream/us/wap/mobsurvey/logo_f01.png | UA | image | 6.60 Kb | suspicious |
2492 | chrome.exe | GET | 200 | 185.89.102.6:80 | http://mobile3153.hometoday100.life/media/mainstream/us/wap/mobsurvey/jquery-ui.min.js | UA | text | 222 Kb | suspicious |
2492 | chrome.exe | GET | 200 | 185.223.95.38:80 | http://waabgmla.tk/js.js | unknown | text | 653 b | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2492 | chrome.exe | 172.217.16.132:443 | www.google.com | Google Inc. | US | whitelisted |
2492 | chrome.exe | 172.217.21.195:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
2492 | chrome.exe | 172.217.16.142:443 | clients2.google.com | Google Inc. | US | whitelisted |
2492 | chrome.exe | 93.170.13.82:80 | travel15546.myq-see.com | Hosting Solution Ltd. | NL | unknown |
2492 | chrome.exe | 216.58.210.3:80 | www.gstatic.com | Google Inc. | US | whitelisted |
2492 | chrome.exe | 172.217.135.6:80 | r1---sn-p5qlsndk.gvt1.com | Google Inc. | US | whitelisted |
2492 | chrome.exe | 79.110.27.50:80 | megaprizes-area.life | — | UA | suspicious |
2492 | chrome.exe | 185.89.102.6:80 | mobile3153.hometoday100.life | LLHost Inc | UA | suspicious |
2492 | chrome.exe | 79.110.27.50:443 | megaprizes-area.life | — | UA | suspicious |
2492 | chrome.exe | 173.194.7.89:80 | r3---sn-p5qs7n7e.gvt1.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
www.google.com |
| malicious |
clientservices.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
ssl.gstatic.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
clients2.google.com |
| whitelisted |
travel15546.myq-see.com |
| unknown |
redirector.gvt1.com |
| whitelisted |
waabgmla.tk |
| suspicious |
r1---sn-p5qlsndk.gvt1.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
1044 | svchost.exe | Potential Corporate Privacy Violation | ET INFO Observed DNS Query to .myq-see .com DDNS Domain |
1044 | svchost.exe | Potentially Bad Traffic | ET DNS Query to a .tk domain - Likely Hostile |
2492 | chrome.exe | Potentially Bad Traffic | ET POLICY HTTP Request to a *.tk domain |
1044 | svchost.exe | Potentially Bad Traffic | ET INFO Observed DNS Query to .life TLD |
1044 | svchost.exe | Potentially Bad Traffic | ET INFO Observed DNS Query to .life TLD |
2492 | chrome.exe | Potentially Bad Traffic | ET INFO HTTP Request to Suspicious *.life Domain |
2492 | chrome.exe | Potentially Bad Traffic | ET INFO HTTP Request to Suspicious *.life Domain |
2492 | chrome.exe | Potentially Bad Traffic | ET INFO HTTP Request to Suspicious *.life Domain |
2492 | chrome.exe | Potentially Bad Traffic | ET INFO HTTP Request to Suspicious *.life Domain |
2492 | chrome.exe | Potentially Bad Traffic | ET INFO HTTP Request to Suspicious *.life Domain |