URL: | https://link.mail.beehiiv.com/ls/click?upn=PJiXoiCNimK-2Fi9LMckSNDx7rWQTKxOjdJ-2BN09-2BtwqSm8LXxSK0LZMDf1ufojQvQ0bseS-2F7K-2FeaS99puT9Bc2MMum4k9J4AqwEKTuibCr-2FQSYQNjAoFrE09TFtfakOJTp9p7skXW6ZA0sxCTYNKqE7Q-3D-3Dtwmq_YAvBKh3T-2FBA6WD-2BTfFiBhRicVIXT3NDWgwYgcoEl-2BGslx7ztBl6Vq83-2BCoA38EDE9mI2OZhLxh1uJOK1-2FwMFcvlAJbw2Zy-2F9-2Bih-2FsGf5OKPVf-2Bz4hdpRCjnFp2lbhIK-2Bo4pW2YcO1mAltZf1buOOZbtSsCeQeQc0gavcJpBk6dwZftUj9Zt1IOIqFxLAfwDVZyDXjr2zUNcrJAhbDSoClFMs46-2F-2BCLY6Xpn3iCA-2B-2FTfTLGPMgyzbuKZ3Y8chtosNRbJdfYUGMC8OCMRt8ofgF7JRoqwfMZIQt8DGOswFmTdjjGFgsK3VUv7mRglvOYuwuqxKczUgiGTbQga1jSU0-2F1Eg7HvaXd1xRoT2KWf3Me1yqgp13fcCS3-2B34UthgnpYazgYYG4SarC0j93hcgfVhmeSD9igqhOUE8qPKc09teNes09zSpFjCLMf1Fkrz4bWGxLtVcSnINhMeK0QBX9Nbg-3D-3D |
Full analysis: | https://app.any.run/tasks/c944530d-d0ad-4924-b0ba-91b274b6e3db |
Verdict: | Malicious activity |
Analysis date: | October 27, 2023, 14:47:15 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
SHA1: | 2944C8DB0E3683DBE905151229F02B75DABDE8A9 |
SHA256: | 7E65B50C80F6380A64B863F8D600434AF0D34120E3EFB1DD3EA21CB57A9D29CA |
SSDEEP: | 12:2MgcelSae2ZEMItJjxWrmC/S33FotJ67+aN7RWdUsyqlgd6ZQcSFa4WB8lNt5Ed8:2hc6ePsrmCCFoC1VWTzZtcGd8 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
4072 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking "https://link.mail.beehiiv.com/ls/click?upn=PJiXoiCNimK-2Fi9LMckSNDx7rWQTKxOjdJ-2BN09-2BtwqSm8LXxSK0LZMDf1ufojQvQ0bseS-2F7K-2FeaS99puT9Bc2MMum4k9J4AqwEKTuibCr-2FQSYQNjAoFrE09TFtfakOJTp9p7skXW6ZA0sxCTYNKqE7Q-3D-3Dtwmq_YAvBKh3T-2FBA6WD-2BTfFiBhRicVIXT3NDWgwYgcoEl-2BGslx7ztBl6Vq83-2BCoA38EDE9mI2OZhLxh1uJOK1-2FwMFcvlAJbw2Zy-2F9-2Bih-2FsGf5OKPVf-2Bz4hdpRCjnFp2lbhIK-2Bo4pW2YcO1mAltZf1buOOZbtSsCeQeQc0gavcJpBk6dwZftUj9Zt1IOIqFxLAfwDVZyDXjr2zUNcrJAhbDSoClFMs46-2F-2BCLY6Xpn3iCA-2B-2FTfTLGPMgyzbuKZ3Y8chtosNRbJdfYUGMC8OCMRt8ofgF7JRoqwfMZIQt8DGOswFmTdjjGFgsK3VUv7mRglvOYuwuqxKczUgiGTbQga1jSU0-2F1Eg7HvaXd1xRoT2KWf3Me1yqgp13fcCS3-2B34UthgnpYazgYYG4SarC0j93hcgfVhmeSD9igqhOUE8qPKc09teNes09zSpFjCLMf1Fkrz4bWGxLtVcSnINhMeK0QBX9Nbg-3D-3D" | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 109.0.5414.120 Modules
| |||||||||||||||
2692 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6e0b8b38,0x6e0b8b48,0x6e0b8b54 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 109.0.5414.120 Modules
| |||||||||||||||
3980 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1072 --field-trial-handle=1084,i,6581520636073963887,15166454704950975846,131072 /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
3208 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1316 --field-trial-handle=1084,i,6581520636073963887,15166454704950975846,131072 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 109.0.5414.120 | |||||||||||||||
3484 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1072 --field-trial-handle=1084,i,6581520636073963887,15166454704950975846,131072 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Version: 109.0.5414.120 | |||||||||||||||
2628 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2004 --field-trial-handle=1084,i,6581520636073963887,15166454704950975846,131072 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 | |||||||||||||||
3336 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2012 --field-trial-handle=1084,i,6581520636073963887,15166454704950975846,131072 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 | |||||||||||||||
2748 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2960 --field-trial-handle=1084,i,6581520636073963887,15166454704950975846,131072 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 | |||||||||||||||
3016 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1224 --field-trial-handle=1084,i,6581520636073963887,15166454704950975846,131072 /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Version: 109.0.5414.120 | |||||||||||||||
2076 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=1344 --field-trial-handle=1084,i,6581520636073963887,15166454704950975846,131072 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 |
(PID) Process: | (4072) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
Operation: | write | Name: | failed_count |
Value: 0 | |||
(PID) Process: | (4072) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
Operation: | write | Name: | state |
Value: 1 | |||
(PID) Process: | (4072) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
(PID) Process: | (4072) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
Operation: | write | Name: | state |
Value: 2 | |||
(PID) Process: | (4072) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
Operation: | write | Name: | dr |
Value: 1 | |||
(PID) Process: | (4072) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics |
Operation: | write | Name: | user_experience_metrics.stability.exited_cleanly |
Value: 1 | |||
(PID) Process: | (4072) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
(PID) Process: | (4072) chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
Operation: | write | Name: | usagestats |
Value: 0 | |||
(PID) Process: | (4072) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
Operation: | write | Name: | metricsid_installdate |
Value: 0 | |||
(PID) Process: | (4072) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
Operation: | write | Name: | metricsid_enableddate |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
4072 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF1eb719.TMP | — | |
MD5:— | SHA256:— | |||
4072 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
4072 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat | binary | |
MD5:9C016064A1F864C8140915D77CF3389A | SHA256:0E7265D4A8C16223538EDD8CD620B8820611C74538E420A88E333BE7F62AC787 | |||
4072 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG.old~RF1eb93c.TMP | text | |
MD5:0917C6BFC618ACD47C1F53C7E7FFFF9C | SHA256:A5CAF56982DA7AE34B201E8609610786B4730371EF0812B7D418A2F9B73547BC | |||
4072 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF1eb719.TMP | text | |
MD5:CDCC923CEC2CD9228330551E6946A9C2 | SHA256:592F4750166BE662AA88728F9969537163FEC5C3E95E81537C8C6917F8D0929E | |||
4072 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old | text | |
MD5:A5EB529D94D3E97D0EE4A7E07700E0B2 | SHA256:08D211BFC570221AF7995C0625052FA7848F7E707D559C266656CDC3A9CC9F9C | |||
4072 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old~RF1eb91c.TMP | text | |
MD5:99EC94B2503FAD33EDAF99779EBA5BC8 | SHA256:DC554AB7EDCAD375F39ED106CA1EF9A89FB8D9063A4D08F377F2C80D66799D7E | |||
4072 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old~RF1eb89f.TMP | text | |
MD5:561161B0FF5BCA89BF47F8AC972A7499 | SHA256:ECCA5CCFA0BEED7581B39FCE03D0FD3B694DF0F92BFFF780F702118AD51FC17D | |||
4072 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG.old~RF1eb93c.TMP | text | |
MD5:7C1C23F006788D107F8A01B852CC6701 | SHA256:9FA4E627077EDCBEC8AAA1ED2DD5538E630790893F88F02F1E9CC863E6A27848 | |||
4072 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old | text | |
MD5:E91E138A25FD7E5BCA5E60111F39C91A | SHA256:B1F7E3537A31A4B847F862858E5D2581993CC9372F19ABF19EA2A9185FE42A4F |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1088 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4072 | chrome.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
3208 | chrome.exe | 142.250.185.77:443 | accounts.google.com | GOOGLE | US | unknown |
3208 | chrome.exe | 104.19.157.23:443 | link.mail.beehiiv.com | CLOUDFLARENET | — | unknown |
3208 | chrome.exe | 104.17.3.184:443 | challenges.cloudflare.com | CLOUDFLARENET | — | unknown |
2656 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4072 | chrome.exe | 224.0.0.251:5353 | — | — | — | unknown |
3208 | chrome.exe | 142.250.184.228:443 | www.google.com | GOOGLE | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
accounts.google.com |
| shared |
link.mail.beehiiv.com |
| unknown |
challenges.cloudflare.com |
| whitelisted |
www.google.com |
| whitelisted |
duuchek.com |
| unknown |
a.nel.cloudflare.com |
| whitelisted |
safebrowsing.googleapis.com |
| whitelisted |
optimizationguide-pa.googleapis.com |
| whitelisted |
content-autofill.googleapis.com |
| whitelisted |
www.googleapis.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
3208 | chrome.exe | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge |
3208 | chrome.exe | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge |
3208 | chrome.exe | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare Network Error Logging (NEL) |
3208 | chrome.exe | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge |
3208 | chrome.exe | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge |
3208 | chrome.exe | Possible Social Engineering Attempted | PHISHING [ANY.RUN] A phishing domain chain was detected (axioscaptcha) |
3208 | chrome.exe | Not Suspicious Traffic | INFO [ANY.RUN] Global content delivery network (unpkg .com) |
3208 | chrome.exe | Possible Social Engineering Attempted | PHISHING [ANY.RUN] A phishing domain chain was detected (LOGPAS MRxC0DER) |
3208 | chrome.exe | Not Suspicious Traffic | INFO [ANY.RUN] Image branding component hosted by Microsoft |