File name: | Learix_2.0_Fps.bat |
Full analysis: | https://app.any.run/tasks/605b5d76-2d0b-498f-9e04-28984f64a59d |
Verdict: | Malicious activity |
Analysis date: | January 05, 2022, 20:19:22 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | text/plain |
File info: | Little-endian UTF-16 Unicode text, with very long lines, with no line terminators |
MD5: | 00C34BD8BD72D2EFDD70FE6737687246 |
SHA1: | 165C93DB4EF01A071281C7B334A8BD940D53D45F |
SHA256: | D26FA7E729BCB29CA402AAB21D59C17C9C3C1123C3261E93DC71A65579AF4986 |
SSDEEP: | 1536:qW5X449tht1MF+VZKQ9u+7XGq2D3Kutht1MF+Vqz:qkI49tht1MF+VZBYMXNu3Kutht1MF+V0 |
.txt | | | Text - UTF-16 (LE) encoded (66.6) |
---|---|---|
.mp3 | | | MP3 audio (33.3) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2288 | "C:\Windows\system32\NOTEPAD.EXE" "C:\Users\admin\AppData\Local\Temp\Learix_2.0_Fps.bat.txt" | C:\Windows\system32\NOTEPAD.EXE | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
392 | "C:\Program Files\Internet Explorer\iexplore.exe" http://appdata/ | C:\Program Files\Internet Explorer\iexplore.exe | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
4056 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:392 CREDAT:144385 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | — | iexplore.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
1200 | "C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401 | C:\Windows\system32\verclsid.exe | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Extension CLSID Verification Host Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3156 | C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Learix_2.0_Fps.bat" " | C:\Windows\system32\cmd.exe | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2104 | mode 128,33 | C:\Windows\system32\mode.com | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: DOS Device MODE Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1520 | Reg.exe query "HKU\S-1-5-19\Environment" | C:\Windows\System32\reg.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3812 | "C:\Windows\system32\taskmgr.exe" /4 | C:\Windows\system32\taskmgr.exe | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2480 | "C:\Windows\system32\SystemPropertiesPerformance.exe" | C:\Windows\system32\SystemPropertiesPerformance.exe | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Change Computer Performance Settings Exit code: 3221226540 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1480 | "C:\Windows\system32\SystemPropertiesPerformance.exe" | C:\Windows\system32\SystemPropertiesPerformance.exe | Explorer.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Change Computer Performance Settings Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
1864 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61D5FDFA-748.pma | — | |
MD5:— | SHA256:— | |||
392 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{E024546B-6E64-11EC-A20C-12A9866C77DE}.dat | binary | |
MD5:7B7D3AC25F3BFECBE64C0151F6DF1088 | SHA256:C6C787C10A9C57160C3148F3966CC341D782CA86AF950A4C4F07709741D3E8CB | |||
392 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{E0245469-6E64-11EC-A20C-12A9866C77DE}.dat | binary | |
MD5:608C3D4A7FA5A36C87A9185BC4FD10E8 | SHA256:22FD8949E27ACAE1936C34D2FCCBC13710C1E1CF295C300DB7292CF52AFAA666 | |||
392 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF86E301F7C46F8F5F.TMP | gmc | |
MD5:E58CFAF87B2A551357502236D4843C35 | SHA256:8F4F8DC8AE78B7945B068808CC43CBC7D654D840428967EF33B7178FED762753 | |||
392 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF1B017F0845DAE3B8.TMP | gmc | |
MD5:C96CE0F5D30511C345794A7196A80A6B | SHA256:EC6805C4045CF60850D62F4C2009B27FF1B0B93ADCFB0DF54C55286AE9BCDC16 | |||
392 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{E024546C-6E64-11EC-A20C-12A9866C77DE}.dat | binary | |
MD5:3FD82D31E54F104EE852F3BC64DFA8F8 | SHA256:A6093FF093C6F403562967BB10B186DF597128A89A3396AC648EF496BEB7CC7B | |||
392 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF66DB6A234570E3E3.TMP | gmc | |
MD5:2962D6031C2F5F22937CA076679E49A5 | SHA256:DCA51F080E802D5ED07015E7EBBAC252B1E16F345598F7F79A0267C7F7C5A4EF | |||
2916 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cache\index | binary | |
MD5:0237D86C5B6879104CC6F48321EA1E41 | SHA256:796CE9B87440ED404ACD4B0B966BEE0F0D62BB6AA10005477213A40C65D67460 | |||
392 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\RecoveryStore.{42C873D0-1D90-11EB-BA2C-12A9866C77DE}.dat | binary | |
MD5:7EFCCE09F6B69DB9839161C640281796 | SHA256:D5BB0D43123E25DA6C82B32B50F25363E524923B885EA98B5DCC3DA34D45F17C | |||
1864 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old | text | |
MD5:8FF312A95D60ED89857FEB720D80D4E1 | SHA256:946A57FAFDD28C3164D5AB8AB4971B21BD5EC5BFFF7554DBF832CB58CC37700B |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2916 | chrome.exe | GET | 301 | 66.254.114.41:80 | http://pornhub.com/ | US | — | — | whitelisted |
2916 | chrome.exe | GET | 302 | 142.250.186.110:80 | http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx | US | html | 554 b | whitelisted |
2916 | chrome.exe | GET | 200 | 74.125.108.201:80 | http://r4---sn-1gi7znek.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx?cms_redirect=yes&mh=e_&mip=85.203.45.7&mm=28&mn=sn-1gi7znek&ms=nvh&mt=1641413777&mv=m&mvi=4&pl=24&rmhost=r2---sn-1gi7znek.gvt1.com&shardbypass=yes | US | crx | 242 Kb | whitelisted |
2916 | chrome.exe | GET | 403 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx | US | text | 37 b | whitelisted |
2916 | chrome.exe | GET | 200 | 209.197.3.8:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?fa6ffdf6c34f8b3e | US | compressed | 59.9 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2916 | chrome.exe | 142.250.185.78:443 | apis.google.com | Google Inc. | US | whitelisted |
2916 | chrome.exe | 142.250.186.131:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
2916 | chrome.exe | 142.250.186.67:443 | www.gstatic.com | Google Inc. | US | whitelisted |
2916 | chrome.exe | 142.250.185.234:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
2916 | chrome.exe | 142.250.185.228:443 | www.google.com | Google Inc. | US | whitelisted |
2916 | chrome.exe | 66.254.114.41:443 | pornhub.com | Reflected Networks, Inc. | US | malicious |
2916 | chrome.exe | 216.58.212.174:443 | clients2.google.com | Google Inc. | US | whitelisted |
2916 | chrome.exe | 142.250.186.110:443 | encrypted-tbn0.gstatic.com | Google Inc. | US | whitelisted |
2916 | chrome.exe | 66.254.114.41:80 | pornhub.com | Reflected Networks, Inc. | US | malicious |
2916 | chrome.exe | 205.185.208.142:443 | di.phncdn.com | Highwinds Network Group, Inc. | US | suspicious |
Domain | IP | Reputation |
---|---|---|
accounts.google.com |
| shared |
clientservices.googleapis.com |
| whitelisted |
www.google.com |
| whitelisted |
clients2.google.com |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
apis.google.com |
| whitelisted |
encrypted-tbn0.gstatic.com |
| whitelisted |
pornhub.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
2916 | chrome.exe | Generic Protocol Command Decode | SURICATA HTTP unable to match response to request |