| URL: | httP://rbk.ru |
| Full analysis: | https://app.any.run/tasks/db72d775-7474-4921-8965-774290351412 |
| Verdict: | Malicious activity |
| Analysis date: | June 17, 2021, 16:16:51 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | 80A09F497D79C95A18378F4E0C102587 |
| SHA1: | FEB0579E76F16019294A5D73A91C928E74BB753F |
| SHA256: | EFE0C0375A0257F39D44B144765873D97459E0B1E029FC25EFA594A038D33DEA |
| SSDEEP: | 3:NVRXP:ZP |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads Microsoft Outlook installation path
- iexplore.exe (PID: 3168)
Modifies files in Chrome extension folder
- chrome.exe (PID: 2808)
INFO
Reads the computer name
- iexplore.exe (PID: 3168)
- iexplore.exe (PID: 780)
- chrome.exe (PID: 2808)
- chrome.exe (PID: 2792)
- chrome.exe (PID: 3540)
- chrome.exe (PID: 2336)
- chrome.exe (PID: 3180)
- chrome.exe (PID: 3364)
- chrome.exe (PID: 860)
- chrome.exe (PID: 3388)
- chrome.exe (PID: 1796)
Checks supported languages
- iexplore.exe (PID: 780)
- chrome.exe (PID: 3540)
- chrome.exe (PID: 2808)
- iexplore.exe (PID: 3168)
- chrome.exe (PID: 1916)
- chrome.exe (PID: 2792)
- chrome.exe (PID: 2032)
- chrome.exe (PID: 4072)
- chrome.exe (PID: 1412)
- chrome.exe (PID: 3992)
- chrome.exe (PID: 272)
- chrome.exe (PID: 2336)
- chrome.exe (PID: 2236)
- chrome.exe (PID: 1964)
- chrome.exe (PID: 1208)
- chrome.exe (PID: 2296)
- chrome.exe (PID: 1124)
- chrome.exe (PID: 3180)
- chrome.exe (PID: 2584)
- chrome.exe (PID: 3972)
- chrome.exe (PID: 304)
- chrome.exe (PID: 860)
- chrome.exe (PID: 3364)
- chrome.exe (PID: 2296)
- chrome.exe (PID: 3388)
- chrome.exe (PID: 1796)
- chrome.exe (PID: 2648)
- chrome.exe (PID: 2516)
- chrome.exe (PID: 3996)
- chrome.exe (PID: 1284)
- chrome.exe (PID: 2852)
- chrome.exe (PID: 3464)
- chrome.exe (PID: 2248)
- chrome.exe (PID: 3144)
- chrome.exe (PID: 1032)
- chrome.exe (PID: 3812)
- chrome.exe (PID: 2932)
- chrome.exe (PID: 1912)
- chrome.exe (PID: 1836)
Checks Windows Trust Settings
- iexplore.exe (PID: 780)
Reads the hosts file
- chrome.exe (PID: 2792)
- chrome.exe (PID: 2808)
Changes internet zones settings
- iexplore.exe (PID: 780)
Reads settings of System Certificates
- iexplore.exe (PID: 780)
- chrome.exe (PID: 2792)
Application launched itself
- iexplore.exe (PID: 780)
- chrome.exe (PID: 2808)
Reads the date of Windows installation
- iexplore.exe (PID: 780)
- chrome.exe (PID: 860)
Manual execution by user
- chrome.exe (PID: 2808)
Dropped object may contain Bitcoin addresses
- chrome.exe (PID: 2808)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
74
Monitored processes
39
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 272 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1024,3099687432994879532,10727157892139075986,131072 --enable-features=PasswordImport --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1964 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 304 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1024,3099687432994879532,10727157892139075986,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 780 | "C:\Program Files\Internet Explorer\iexplore.exe" "httP://rbk.ru" | C:\Program Files\Internet Explorer\iexplore.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 860 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1024,3099687432994879532,10727157892139075986,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3404 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 1032 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1024,3099687432994879532,10727157892139075986,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 1124 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1024,3099687432994879532,10727157892139075986,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2380 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 1208 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1024,3099687432994879532,10727157892139075986,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 1284 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1024,3099687432994879532,10727157892139075986,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2420 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 1412 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1024,3099687432994879532,10727157892139075986,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2156 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 1796 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1024,3099687432994879532,10727157892139075986,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
Total events
21 896
Read events
21 682
Write events
205
Delete events
9
Modification events
| (PID) Process: | (780) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPDaysSinceLastAutoMigration |
Value: 1 | |||
| (PID) Process: | (780) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPLastLaunchLowDateTime |
Value: 957801392 | |||
| (PID) Process: | (780) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPLastLaunchHighDateTime |
Value: 30892948 | |||
| (PID) Process: | (780) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
| Operation: | write | Name: | NextCheckForUpdateLowDateTime |
Value: | |||
| (PID) Process: | (780) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
| Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 30892948 | |||
| (PID) Process: | (780) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (780) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (780) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (780) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
| (PID) Process: | (780) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
Executable files
0
Suspicious files
139
Text files
302
Unknown types
25
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2808 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-60CB758F-AF8.pma | — | |
MD5:— | SHA256:— | |||
| 780 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DFD2AA718AFC7DB670.TMP | gmc | |
MD5:— | SHA256:— | |||
| 780 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:— | SHA256:— | |||
| 780 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{76BA0BB0-CF87-11EB-AD6C-12A9866C77DE}.dat | binary | |
MD5:— | SHA256:— | |||
| 780 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{76BA0BAF-CF87-11EB-AD6C-12A9866C77DE}.dat | binary | |
MD5:— | SHA256:— | |||
| 780 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63 | der | |
MD5:— | SHA256:— | |||
| 780 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63 | binary | |
MD5:— | SHA256:— | |||
| 780 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{76BA0BAD-CF87-11EB-AD6C-12A9866C77DE}.dat | binary | |
MD5:— | SHA256:— | |||
| 780 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF226565EE6479C61B.TMP | gmc | |
MD5:— | SHA256:— | |||
| 780 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | compressed | |
MD5:F7DCB24540769805E5BB30D193944DCE | SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
41
TCP/UDP connections
183
DNS requests
80
Threats
3
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | HEAD | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/JTa6clSwbVbw6iz-OA8daw_2021.6.14.1141/AKQV5ts_316d64HCzam9Y8g | US | — | — | whitelisted |
— | — | HEAD | 200 | 173.194.183.136:80 | http://r3---sn-aigl6ner.gvt1.com/edgedl/release2/chrome_component/ZZ2KIOFWIS0uv8xaOFAwDg_2652/dn5ngTTVXmoA2Mh2nn8kag?cms_redirect=yes&mh=AP&mip=102.129.202.24&mm=28&mn=sn-aigl6ner&ms=nvh&mt=1623946345&mv=m&mvi=3&pl=24&shardbypass=yes&smhost=r3---sn-aigl6nl7.gvt1.com | US | — | — | whitelisted |
— | — | HEAD | 200 | 74.125.4.169:80 | http://r4---sn-aigzrne7.gvt1.com/edgedl/release2/chrome_component/AIDSJGrIAR_6GKekQJvhOSI_1.3.36.81/FlU1w6tFdzzsxVNvvqMiCQ?cms_redirect=yes&mh=Pe&mip=102.129.202.24&mm=28&mn=sn-aigzrne7&ms=nvh&mt=1623946590&mv=m&mvi=4&pl=24&rmhost=r1---sn-aigzrne7.gvt1.com&shardbypass=yes&smhost=r1---sn-aigzrn7s.gvt1.com | US | — | — | whitelisted |
— | — | HEAD | 302 | 142.250.184.206:80 | http://redirector.gvt1.com/edgedl/release2/chrome_component/AIDSJGrIAR_6GKekQJvhOSI_1.3.36.81/FlU1w6tFdzzsxVNvvqMiCQ | US | — | — | whitelisted |
— | — | HEAD | 302 | 142.250.184.206:80 | http://redirector.gvt1.com/edgedl/release2/chrome_component/ZZ2KIOFWIS0uv8xaOFAwDg_2652/dn5ngTTVXmoA2Mh2nn8kag | US | — | — | whitelisted |
2792 | chrome.exe | GET | 302 | 142.250.184.206:80 | http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx | US | html | 594 b | whitelisted |
— | — | GET | 206 | 173.194.183.136:80 | http://r3---sn-aigl6ner.gvt1.com/edgedl/release2/chrome_component/ZZ2KIOFWIS0uv8xaOFAwDg_2652/dn5ngTTVXmoA2Mh2nn8kag?cms_redirect=yes&mh=AP&mip=102.129.202.24&mm=28&mn=sn-aigl6ner&ms=nvh&mt=1623946345&mv=m&mvi=3&pl=24&shardbypass=yes&smhost=r3---sn-aigl6nl7.gvt1.com | US | binary | 9.66 Kb | whitelisted |
— | — | GET | 206 | 173.194.183.136:80 | http://r3---sn-aigl6ner.gvt1.com/edgedl/release2/chrome_component/ZZ2KIOFWIS0uv8xaOFAwDg_2652/dn5ngTTVXmoA2Mh2nn8kag?cms_redirect=yes&mh=AP&mip=102.129.202.24&mm=28&mn=sn-aigl6ner&ms=nvh&mt=1623946345&mv=m&mvi=3&pl=24&shardbypass=yes&smhost=r3---sn-aigl6nl7.gvt1.com | US | binary | 3.03 Kb | whitelisted |
— | — | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/JTa6clSwbVbw6iz-OA8daw_2021.6.14.1141/AKQV5ts_316d64HCzam9Y8g | US | binary | 6.06 Kb | whitelisted |
— | — | GET | 302 | 142.250.184.206:80 | http://redirector.gvt1.com/edgedl/release2/chrome_component/ZZ2KIOFWIS0uv8xaOFAwDg_2652/dn5ngTTVXmoA2Mh2nn8kag | US | html | 507 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
780 | iexplore.exe | 2.21.242.196:80 | ctldl.windowsupdate.com | Akamai International B.V. | NL | whitelisted |
780 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2792 | chrome.exe | 142.250.181.227:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
2792 | chrome.exe | 216.58.212.173:443 | accounts.google.com | Google Inc. | US | whitelisted |
2792 | chrome.exe | 142.250.184.196:443 | www.google.com | Google Inc. | US | whitelisted |
2792 | chrome.exe | 172.217.16.142:443 | clients2.google.com | Google Inc. | US | whitelisted |
2792 | chrome.exe | 216.58.212.170:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
2792 | chrome.exe | 216.58.212.131:443 | www.gstatic.com | Google Inc. | US | whitelisted |
2792 | chrome.exe | 142.250.186.110:443 | ogs.google.com | Google Inc. | US | whitelisted |
2792 | chrome.exe | 142.250.185.110:443 | apis.google.com | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
rbk.ru |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
clients2.google.com |
| whitelisted |
www.google.com |
| malicious |
accounts.google.com |
| shared |
fonts.googleapis.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Potentially Bad Traffic | ET DNS Query to a .tk domain - Likely Hostile |
2792 | chrome.exe | Potentially Bad Traffic | ET POLICY HTTP Request to a *.tk domain |
2792 | chrome.exe | Potentially Bad Traffic | ET POLICY HTTP Request to a *.tk domain |