Windows Analysis Report
http://remotescripps.org

Overview

General Information

Sample URL: http://remotescripps.org
Analysis ID: 1432283
Infos:

Detection

Score: 1
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Program does not show much activity (idle)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)

Classification

Source: chromecache_80.2.dr String found in binary or memory: http://104.154.23.126/data-ingest
Source: chromecache_62.2.dr String found in binary or memory: https://api-js.mixpanel.com
Source: chromecache_62.2.dr String found in binary or memory: https://cdn.mxpnl.com
Source: chromecache_75.2.dr String found in binary or memory: https://cdn.mxpnl.com/libs/mixpanel-2-latest.min.js
Source: chromecache_75.2.dr String found in binary or memory: https://dtools.zautils.online/geturl/PrivacyGuard/intpgdirect
Source: chromecache_75.2.dr String found in binary or memory: https://fonts.googleapis.com
Source: chromecache_75.2.dr String found in binary or memory: https://fonts.googleapis.com/css2?family=Inter:wght
Source: chromecache_75.2.dr String found in binary or memory: https://fonts.gstatic.com
Source: chromecache_79.2.dr String found in binary or memory: https://fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa0ZL7SUc.woff2)
Source: chromecache_79.2.dr String found in binary or memory: https://fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2)
Source: chromecache_79.2.dr String found in binary or memory: https://fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1pL7SUc.woff2)
Source: chromecache_79.2.dr String found in binary or memory: https://fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa25L7SUc.woff2)
Source: chromecache_79.2.dr String found in binary or memory: https://fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa2JL7SUc.woff2)
Source: chromecache_79.2.dr String found in binary or memory: https://fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa2ZL7SUc.woff2)
Source: chromecache_79.2.dr String found in binary or memory: https://fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa2pL7SUc.woff2)
Source: chromecache_75.2.dr String found in binary or memory: https://impr.zautils.online/impression?c=intpgdirect
Source: chromecache_78.2.dr String found in binary or memory: https://mc.yandex.
Source: chromecache_78.2.dr String found in binary or memory: https://mc.yandex.md/cc
Source: chromecache_62.2.dr String found in binary or memory: https://mixpanel.com
Source: chromecache_75.2.dr String found in binary or memory: https://red.zautils.online/downloadproxy/intpgdirect/
Source: chromecache_78.2.dr String found in binary or memory: https://s3.mds.yandex.net/internal-metrika-betas
Source: chromecache_78.2.dr String found in binary or memory: https://yandex.com/an/sync_cookie
Source: chromecache_78.2.dr String found in binary or memory: https://yastatic.net/s3/gdpr/v3/gdpr
Source: chromecache_78.2.dr String found in binary or memory: https://yastatic.net/s3/metrika
Source: chromecache_78.2.dr String found in binary or memory: https://yastatic.net/s3/taxi-front/yango-gdpr-popup/
Source: chromecache_78.2.dr String found in binary or memory: https://ymetrica1.com/watch/3/1
Source: classification engine Classification label: clean1.win@22/44@0/21
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\Downloads\5c166f86-33b0-438e-9ef6-44ff2f08b22d.tmp Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5324:120:WilError_03
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1904,i,16374361133097479990,13026938040437888917,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://remotescripps.org"
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe cmd /c "C:\Users\user\Desktop\"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1904,i,16374361133097479990,13026938040437888917,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1432283 URL: http://remotescripps.org Startdate: 26/04/2024 Architecture: WINDOWS Score: 1 5 chrome.exe 16 2->5         started        8 cmd.exe 1 2->8         started        10 chrome.exe 2->10         started        dnsIp3 17 192.168.2.4 unknown unknown 5->17 19 239.255.255.250 unknown Reserved 5->19 12 chrome.exe 5->12         started        15 conhost.exe 8->15         started        process4 dnsIp5 21 87.250.251.119 YANDEXRU Russian Federation 12->21 23 93.158.134.119 YANDEXRU Russian Federation 12->23 25 17 other IPs or domains 12->25
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
192.178.50.36
 unknown United States
15169 GOOGLEUS false
142.250.189.131
 unknown United States
15169 GOOGLEUS false
1.1.1.1
 unknown Australia
13335 CLOUDFLARENETUS false
35.186.241.51
 unknown United States
15169 GOOGLEUS false
192.178.50.46
 unknown United States
15169 GOOGLEUS false
173.194.212.84
 unknown United States
15169 GOOGLEUS false
130.211.34.183
 unknown United States
15169 GOOGLEUS false
162.254.207.59
 unknown United States
29066 VELIANET-ASvelianetInternetdiensteGmbHDE false
142.250.189.138
 unknown United States
15169 GOOGLEUS false
130.211.5.208
 unknown United States
15169 GOOGLEUS false
172.67.136.85
 unknown United States
13335 CLOUDFLARENETUS false
142.250.217.163
 unknown United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
206.189.225.178
 unknown United States
14061 DIGITALOCEAN-ASNUS false
93.158.134.119
 unknown Russian Federation
13238 YANDEXRU false
3.220.57.224
 unknown United States
14618 AMAZON-AESUS false
87.250.251.119
 unknown Russian Federation
13238 YANDEXRU false
142.250.217.195
 unknown United States
15169 GOOGLEUS false
52.20.78.240
 unknown United States
14618 AMAZON-AESUS false
13.35.116.96
 unknown United States
16509 AMAZON-02US false

Private

IP
192.168.2.4

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://cintlp.zautils.online/?subid=90818130074&cid=8899&tag=dm&dkw=remotescripps.org&rhi=a35e5edf-bf95-4e80-bdb3-bc6efdf294a5 false
    		unknown