| URL: | http://dl.i-funbox.com/ifunbox_setup.exe?7/8/2015.exe |
| Full analysis: | https://app.any.run/tasks/bf6f8f5e-a5ac-4024-ac50-d0f2ba442510 |
| Verdict: | Suspicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | November 20, 2020, 06:27:43 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 8D06680A10C4F111EEC81A31F4BB9A9E |
| SHA1: | 91267806CDE02B8662247D37A56A25C5789933C4 |
| SHA256: | F19D4693150AF94A004A044C3CC509C29ACD46608D9AA62327108F33B1F9DADA |
| SSDEEP: | 3:N1KaJ5dybKmDVL4/DIn:CaJ5d+KmJL4/U |
MALICIOUS
Application was dropped or rewritten from another process
- ifunbox_setup.exe (PID: 732)
- ifunbox.exe (PID: 2152)
- ifunbox_setup.exe (PID: 1504)
Loads dropped or rewritten executable
- ifunbox.exe (PID: 2152)
Changes the autorun value in the registry
- ifunbox.exe (PID: 2152)
SUSPICIOUS
Executable content was dropped or overwritten
- chrome.exe (PID: 996)
- ifunbox_setup.exe (PID: 732)
- ifunbox_setup.exe (PID: 1504)
- ifunbox_setup.tmp (PID: 2276)
Reads the Windows organization settings
- ifunbox_setup.tmp (PID: 2276)
Reads Windows owner or organization settings
- ifunbox_setup.tmp (PID: 2276)
Creates files in the user directory
- ifunbox.exe (PID: 2152)
Searches for installed software
- ifunbox.exe (PID: 2152)
INFO
Reads the hosts file
- chrome.exe (PID: 2240)
- chrome.exe (PID: 996)
Application launched itself
- chrome.exe (PID: 996)
Application was dropped or rewritten from another process
- ifunbox_setup.tmp (PID: 1792)
- ifunbox_setup.tmp (PID: 2276)
Reads Internet Cache Settings
- chrome.exe (PID: 996)
Creates files in the program directory
- ifunbox_setup.tmp (PID: 2276)
Loads dropped or rewritten executable
- ifunbox_setup.tmp (PID: 2276)
Creates a software uninstall entry
- ifunbox_setup.tmp (PID: 2276)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
55
Monitored processes
15
Malicious processes
3
Suspicious processes
3
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 732 | "C:\Users\admin\Downloads\ifunbox_setup.exe" | C:\Users\admin\Downloads\ifunbox_setup.exe | chrome.exe | ||||||||||||
User: admin Company: iFunbox DevTeam Integrity Level: MEDIUM Description: iFunbox Setup Exit code: 0 Version: Modules
| |||||||||||||||
| 864 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1008,8947188622698995859,12864619034492495900,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=5664062285964089191 --mojo-platform-channel-handle=980 --ignored=" --type=renderer " /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 996 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking "http://dl.i-funbox.com/ifunbox_setup.exe?7/8/2015.exe" | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 1504 | "C:\Users\admin\Downloads\ifunbox_setup.exe" /SPAWNWND=$20172 /NOTIFYWND=$50158 | C:\Users\admin\Downloads\ifunbox_setup.exe | ifunbox_setup.tmp | ||||||||||||
User: admin Company: iFunbox DevTeam Integrity Level: HIGH Description: iFunbox Setup Exit code: 0 Version: Modules
| |||||||||||||||
| 1792 | "C:\Users\admin\AppData\Local\Temp\is-H5G2D.tmp\ifunbox_setup.tmp" /SL5="$50158,32711852,119296,C:\Users\admin\Downloads\ifunbox_setup.exe" | C:\Users\admin\AppData\Local\Temp\is-H5G2D.tmp\ifunbox_setup.tmp | — | ifunbox_setup.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 1976 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1008,8947188622698995859,12864619034492495900,131072 --enable-features=PasswordImport --lang=en-US --no-sandbox --service-request-channel-token=16018879180146735754 --mojo-platform-channel-handle=1060 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 2152 | "C:\Program Files\i-Funbox DevTeam\ifunbox.exe" | C:\Program Files\i-Funbox DevTeam\ifunbox.exe | ifunbox_setup.tmp | ||||||||||||
User: admin Company: i-Funbox.com Integrity Level: MEDIUM Description: File & App Manager for iPhone/iPad Exit code: 3221225477 Version: V4.1 BUILD4338.2105 Modules
| |||||||||||||||
| 2232 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,8947188622698995859,12864619034492495900,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=13756412942503026486 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2160 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 2240 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1008,8947188622698995859,12864619034492495900,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=9770055449265864164 --mojo-platform-channel-handle=1568 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 2276 | "C:\Users\admin\AppData\Local\Temp\is-8IBMB.tmp\ifunbox_setup.tmp" /SL5="$30170,32711852,119296,C:\Users\admin\Downloads\ifunbox_setup.exe" /SPAWNWND=$20172 /NOTIFYWND=$50158 | C:\Users\admin\AppData\Local\Temp\is-8IBMB.tmp\ifunbox_setup.tmp | ifunbox_setup.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
Total events
1 563
Read events
1 468
Write events
86
Delete events
9
Modification events
| (PID) Process: | (996) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (996) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (996) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: | |||
| (PID) Process: | (996) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (996) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (2564) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | write | Name: | 996-13250327279333125 |
Value: 259 | |||
| (PID) Process: | (996) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (996) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
| Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
| (PID) Process: | (996) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | delete value | Name: | 3252-13245750958665039 |
Value: 0 | |||
| (PID) Process: | (996) chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
| Operation: | write | Name: | usagestats |
Value: 0 | |||
Executable files
34
Suspicious files
10
Text files
88
Unknown types
7
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 996 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5FB761F0-3E4.pma | — | |
MD5:— | SHA256:— | |||
| 996 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old | — | |
MD5:— | SHA256:— | |||
| 996 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old | — | |
MD5:— | SHA256:— | |||
| 996 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF127085.TMP | — | |
MD5:— | SHA256:— | |||
| 996 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF1270a4.TMP | — | |
MD5:— | SHA256:— | |||
| 996 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\d091f1b3-f803-48b3-b35c-f837beb30be1.tmp | — | |
MD5:— | SHA256:— | |||
| 996 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000048.dbtmp | — | |
MD5:— | SHA256:— | |||
| 996 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG.old | — | |
MD5:— | SHA256:— | |||
| 996 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 996 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RF127363.TMP | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
11
DNS requests
8
Threats
2
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2152 | ifunbox.exe | GET | — | 52.59.225.70:80 | http://stat.i-funbox.com/appicon/$track.updt&N=4.1.4338.2105&O=0.0.0.0&FB=nsTYGNQJo5aN5B4rNKFhcw | DE | — | — | suspicious |
2240 | chrome.exe | GET | 200 | 209.160.40.71:80 | http://dl.i-funbox.com/ifunbox_setup.exe?7/8/2015.exe | US | executable | 31.6 Mb | suspicious |
2152 | ifunbox.exe | GET | 200 | 216.58.212.174:80 | http://www.google-analytics.com/__utm.gif?utmwv=5.2.6&utmvp=0x0&utmac=UA-15685107-2&utmhn=i-funbox.com&utmul=en&utms=1&utmn=41&utmp=%2Fifbwin.install_4_1_4338_2105&utmcc=__utma%3D237675928.1948540156.1605853730.1605853730.1605853730.1%3B%2B__utmz%3D237675928.1605853730.1.1.utmcsr%3Dnative%7Cutmccn%3D(organic)%7Cutmcmd%3Dhttp_get%7Cutmctr%3D(not%2520provided)%3B&utmu=qh~ | US | image | 35 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2240 | chrome.exe | 172.217.22.46:443 | sb-ssl.google.com | Google Inc. | US | whitelisted |
2152 | ifunbox.exe | 52.59.225.70:80 | stat.i-funbox.com | Amazon.com, Inc. | DE | suspicious |
2152 | ifunbox.exe | 216.58.212.174:80 | www.google-analytics.com | Google Inc. | US | whitelisted |
2240 | chrome.exe | 172.217.23.174:443 | clients4.google.com | Google Inc. | US | whitelisted |
2240 | chrome.exe | 108.177.104.84:443 | accounts.google.com | Google Inc. | US | unknown |
2240 | chrome.exe | 209.160.40.71:80 | dl.i-funbox.com | HopOne Internet Corporation | US | suspicious |
2240 | chrome.exe | 172.217.18.163:443 | ssl.gstatic.com | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
dl.i-funbox.com |
| suspicious |
accounts.google.com |
| shared |
ssl.gstatic.com |
| whitelisted |
sb-ssl.google.com |
| whitelisted |
stat.i-funbox.com |
| suspicious |
www.google-analytics.com |
| whitelisted |
clients4.google.com |
| whitelisted |
clients1.google.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2240 | chrome.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
1 ETPRO signatures available at the full report