| URL: | https://getpopcorntime.is/ |
| Full analysis: | https://app.any.run/tasks/da6e4eb9-cc0c-479e-943b-3b1902881b26 |
| Verdict: | Malicious activity |
| Analysis date: | June 17, 2019, 19:29:23 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | 361761B56C9BF7B034BCCDAC67C3DE8F |
| SHA1: | 47F87D4E49004F68EAFF54803C8EE168F69D739F |
| SHA256: | F67C680545222DCAE77CB46FB327737EC2FEE4D32A02D64C7AAF42FE77F38D64 |
| SSDEEP: | 3:N8hmVhRFN:2ABr |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 880 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=940,16708445020135051685,17252138367246493940,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=9891132836805981860 --mojo-platform-channel-handle=4552 --ignored=" --type=renderer " /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 73.0.3683.75 Modules
| |||||||||||||||
| 948 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=940,16708445020135051685,17252138367246493940,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=9086785745406744739 --mojo-platform-channel-handle=4596 --ignored=" --type=renderer " /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 73.0.3683.75 Modules
| |||||||||||||||
| 948 | "C:\Program Files\Popcorn Time\PopcornTimeDesktop.exe" | C:\Program Files\Popcorn Time\PopcornTimeDesktop.exe | PopcornTime-latest.tmp | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 6.1.0.0 Modules
| |||||||||||||||
| 1040 | "C:\Windows\system32\taskkill.exe" /f /IM PopcornTimeDesktop | C:\Windows\system32\taskkill.exe | — | PopcornTime-latest.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1116 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=940,16708445020135051685,17252138367246493940,131072 --enable-features=PasswordImport --disable-gpu-compositing --service-pipe-token=8474599293499279482 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=8474599293499279482 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 73.0.3683.75 Modules
| |||||||||||||||
| 1140 | "C:\Windows\system32\sc.exe" delete "Update service" | C:\Windows\system32\sc.exe | — | PopcornTime-latest.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: A tool to aid in developing services for WindowsNT Exit code: 1060 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1156 | "C:\Users\admin\Downloads\PopcornTime-latest.exe" | C:\Users\admin\Downloads\PopcornTime-latest.exe | chrome.exe | ||||||||||||
User: admin Company: Popcorn Time Integrity Level: MEDIUM Description: Popcorn Time Setup Exit code: 0 Version: Modules
| |||||||||||||||
| 1416 | "C:\Program Files\Popcorn Time\QtWebEngineProcess.exe" --type=renderer --disable-accelerated-video-decode --enable-threaded-compositing --no-sandbox --disable-webrtc-hw-encoding --lang=en --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-gpu-compositing --channel="948.1.437480851\1353831543" /prefetch:673131151 | C:\Program Files\Popcorn Time\QtWebEngineProcess.exe | — | PopcornTimeDesktop.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 1500 | "C:\Program Files\Popcorn Time\Updater.exe" | C:\Program Files\Popcorn Time\Updater.exe | services.exe | ||||||||||||
User: SYSTEM Company: Popcorn Time Integrity Level: SYSTEM Description: Updater Exit code: 0 Version: 1.2.1.0 Modules
| |||||||||||||||
| 1520 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=940,16708445020135051685,17252138367246493940,131072 --enable-features=PasswordImport --service-pipe-token=953879581538579774 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=953879581538579774 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2036 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 73.0.3683.75 Modules
| |||||||||||||||
| (PID) Process: | (2796) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (2796) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (2796) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: | |||
| (PID) Process: | (2796) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (2796) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (3320) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | write | Name: | 2796-13205273394886250 |
Value: 259 | |||
| (PID) Process: | (2796) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (2796) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
| Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
| (PID) Process: | (2796) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | delete value | Name: | 3488-13197474229333984 |
Value: 0 | |||
| (PID) Process: | (2796) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | delete value | Name: | 2796-13205273394886250 |
Value: 259 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2796 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\index | — | |
MD5:— | SHA256:— | |||
| 2796 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_0 | — | |
MD5:— | SHA256:— | |||
| 2796 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1 | — | |
MD5:— | SHA256:— | |||
| 2796 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_2 | — | |
MD5:— | SHA256:— | |||
| 2796 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_3 | — | |
MD5:— | SHA256:— | |||
| 2796 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old | — | |
MD5:— | SHA256:— | |||
| 2796 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\da81ad3d-0ad4-42d4-af9b-1190a0267d60.tmp | — | |
MD5:— | SHA256:— | |||
| 2796 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\index | — | |
MD5:— | SHA256:— | |||
| 2796 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000018.dbtmp | — | |
MD5:— | SHA256:— | |||
| 2796 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0 | — | |
MD5:— | SHA256:— | |||
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2796 | chrome.exe | 172.217.16.131:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
2796 | chrome.exe | 185.248.160.75:443 | getpopcorntime.is | — | — | unknown |
2796 | chrome.exe | 216.58.210.13:443 | accounts.google.com | Google Inc. | US | whitelisted |
2796 | chrome.exe | 74.125.133.198:443 | www.youtube.com | Google Inc. | US | whitelisted |
2796 | chrome.exe | 216.58.206.6:443 | static.doubleclick.net | Google Inc. | US | whitelisted |
2796 | chrome.exe | 216.58.206.2:443 | googleads.g.doubleclick.net | Google Inc. | US | whitelisted |
2796 | chrome.exe | 216.58.207.86:443 | i.ytimg.com | Google Inc. | US | whitelisted |
2796 | chrome.exe | 66.102.1.198:443 | yt3.ggpht.com | Google Inc. | US | whitelisted |
2796 | chrome.exe | 74.125.206.188:5228 | mtalk.google.com | Google Inc. | US | whitelisted |
2796 | chrome.exe | 172.217.22.14:443 | android.clients.google.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
clientservices.googleapis.com |
| whitelisted |
getpopcorntime.is |
| unknown |
accounts.google.com |
| shared |
www.youtube.com |
| whitelisted |
ssl.google-analytics.com |
| whitelisted |
googleads.g.doubleclick.net |
| whitelisted |
www.google.com |
| malicious |
static.doubleclick.net |
| whitelisted |
yt3.ggpht.com |
| whitelisted |
i.ytimg.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
1500 | Updater.exe | Potentially Bad Traffic | AV INFO HTTP Request to a *.xyz domain |
3128 | node.exe | Potential Corporate Privacy Violation | ET P2P BitTorrent DHT ping request |
3128 | node.exe | Potential Corporate Privacy Violation | ET P2P Vuze BT UDP Connection (5) |
1048 | svchost.exe | Potentially Bad Traffic | ET DNS Query to a *.pw domain - Likely Hostile |
1048 | svchost.exe | Potentially Bad Traffic | ET DNS Query to a *.pw domain - Likely Hostile |
1048 | svchost.exe | Potentially Bad Traffic | ET DNS Query to a *.pw domain - Likely Hostile |
3128 | node.exe | A Network Trojan was detected | ET CNC Ransomware Tracker Reported CnC Server group 69 |
3128 | node.exe | Potential Corporate Privacy Violation | GPL P2P BitTorrent announce request |
3128 | node.exe | Potential Corporate Privacy Violation | GPL P2P BitTorrent announce request |
3128 | node.exe | Potential Corporate Privacy Violation | GPL P2P BitTorrent transfer |
Process | Message |
|---|---|
Updater.exe | Service: Start |
PopcornTimeDesktop.exe | QWindowsEGLStaticContext::create: Could not initialize EGL display: error 0x3001
|
PopcornTimeDesktop.exe | QWindowsEGLStaticContext::create: When using ANGLE, check if d3dcompiler_4x.dll is available
|
PopcornTimeDesktop.exe | js: Uncaught ReferenceError: ui is not defined
|
PopcornTimeDesktop.exe | js: Uncaught TypeError: Cannot read property 'file_path' of undefined
|
PopcornTimeDesktop.exe | "[ShaderManager] cache a new shader material type(10): gl material 16to8bit: 0, planar: 1, has alpha: 0, 2d texture: 1, 2nd plane rg: 0, xyz: 0"
|
PopcornTimeDesktop.exe | input yuv limited range
|
PopcornTimeDesktop.exe | creating VBO...
|
PopcornTimeDesktop.exe | creating VAO...
|
PopcornTimeDesktop.exe | vao updated
|