Windows Analysis Report
https://gmperu.com/gm/&c=E,1,btHxrwc4AzADScwJuwrou71OT1lTEVByo9jWAGKtdXj9aUSOb1Jhp16ieaB40Oep_5e9AnvCkS0i4WVo_YziYgngugIDj8Q2lmGIRMs8Cs2Z&typo=1

Overview

General Information

Sample URL:	https://gmperu.com/gm/&c=E,1,btHxrwc4AzADScwJuwrou71OT1lTEVByo9jWAGKtdXj9aUSOb1Jhp16ieaB40Oep_5e9AnvCkS0i4WVo_YziYgngugIDj8Q2lmGIRMs8Cs2Z&typo=1
Analysis ID:	1467027

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

Classification

Signatures

Source: https://gmperu.com/gm/&c=E,1,btHxrwc4AzADScwJuwrou71OT1lTEVByo9jWAGKtdXj9aUSOb1Jhp16ieaB40Oep_5e9AnvCkS0i4WVo_YziYgngugIDj8Q2lmGIRMs8Cs2Z&typo=1

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49725 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	DNS traffic detected: DNS query: gmperu.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49725 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@13/12@6/33

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gmperu.com/gm/&c=E,1,btHxrwc4AzADScwJuwrou71OT1lTEVByo9jWAGKtdXj9aUSOb1Jhp16ieaB40Oep_5e9AnvCkS0i4WVo_YziYgngugIDj8Q2lmGIRMs8Cs2Z&typo=1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1900,i,16064423596050396194,13408274588338998602,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1900,i,16064423596050396194,13408274588338998602,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.46	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
192.185.186.170	gmperu.com	United States	46606	UNIFIEDLAYER-AS-1US	false
172.217.16.195	unknown	United States	15169	GOOGLEUS	false
142.251.173.84	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
gmperu.com	192.185.186.170	true
www.google.com	142.250.186.68	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://gmperu.com/gm/&c=E,1,btHxrwc4AzADScwJuwrou71OT1lTEVByo9jWAGKtdXj9aUSOb1Jhp16ieaB40Oep_5e9AnvCkS0i4WVo_YziYgngugIDj8Q2lmGIRMs8Cs2Z&typo=1	false		unknown
https://gmperu.com/gm/&c=E,1,btHxrwc4AzADScwJuwrou71OT1lTEVByo9jWAGKtdXj9aUSOb1Jhp16ieaB40Oep_5e9AnvCkS0i4WVo_YziYgngugIDj8Q2lmGIRMs8Cs2Z&typo=1#	false		unknown

ID:	1467027
Product:	CloudBasic
Start time:	16:36:23
Start date:	03.07.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 13:36:50 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	24F411821780A7D69A29E9F707836B44	04256485F3BC6472DF84FBA06CEB985115CE32D2	BD72A437454DFEAA67DB0929F7286CED3728F9571BB4D86D08AA1B7024A76758
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 13:36:50 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	6D1859B42A1A466DF247ABC5E27BF323	6C3716173DBFCB5AB96C8FEFB441BF8DB565BC55	06C21A67CF9267ACBF78A99FF83816E03582C677B4BDBC8CFB810E2070B78EF0
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	31D2CC53843134F3F086B3C9BF0DF748	9E4E708EC4A489ED6844D5703E2D92CF86654212	AB89273AF1652CEFE92F76B157FBDFBFDF92A10B1494B6F72C3DAFC79AB1F05B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 13:36:50 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	66168C54681485DF9F2AC30D02077EB7	FC05F1654E32EE879ACB2B758D5CD337457EEA72	B0F83F5A083176E8CC48DA053CBEB6871B84CC9718F02C47AFE1C1F5037D25BE
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 13:36:50 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	7AD3E2F51817E0CE8BA4D3B60E1021A4	47848B1B4C1E22AC793F41723DD70FA797668DC9	778C550FCC523495CA86FF94C3991753FEFF163C5C7CB9300B9DDAB77A2630DA
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jul 3 13:36:49 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	2024ABC31F9A17B015FAD5F663D223E4	3E511DDED43A8B8268271F69F36439880599118F	1D2C2100B99626E2E5F4F7261D92933CF8839E36538E03AF9C38F017FEF0CBB4
Chrome Cache Entry: 51	HTML document, ASCII text, with very long lines (358)	A8063BD37D3C8FB3176A6BF140558A4D	E32CF4B407DB3D3773DED13FF64B70FDBAD7735F	BCCB23D41C2CC69CF0C7D22C4314CA8181A513C6999B73E45307792830F4E482
Chrome Cache Entry: 53	GIF image data, version 89a, 868 x 4	DC8055F43FBB4A4B6DFB298EC35188F2	1FFC540743DE1CDB929D9D1218978005141E8D9D	B857737891B84293B3DF526B48CE3D54FDCC5789C250EADFF9DD38E3C2C68CAF
Chrome Cache Entry: 54	PNG image data, 97 x 97, 8-bit colormap, non-interlaced	F851DB995B0253A71D638F779BE88330	5F5319E016676E6B92F7E597B837677DDF52C0A5	2C024E287D53DCC084B60B01A69990C369E758DC7C91B0FE4791F02D18AAE61A
Chrome Cache Entry: 57	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 868x169, components 3	DE6ECBBB2471827D90BF32C47A0CBC45	FFEAAFE8B9CA2752908C5D4E95E4803EF7FFDD18	5CAE6C33F0F9D4449CE8539A60E7D40EBA2DDC75979FC26284854A29C36D08CB
Chrome Cache Entry: 58	ASCII text, with very long lines (2608)	42CB9467FD660B25209863C072E69342	C4D32879D225F46588FBA989F8A2AFCB9B49A519	7989430E3C85121CAA76C6DA31AA38D43EF139062E2C3BD4F4350B62FE90D4D4
Chrome Cache Entry: 60	GIF image data, version 89a, 868 x 14	54EB288427ACF79ED320EFD4916FE0B7	67BA813FF74D52035D70FCDA58B57563F01FB829	70E4A5F9F7D98C1564B17ECC69196FED4F74FE5AFB2C61B4FB7045DD3309DC4F

Windows Analysis Report
https://gmperu.com/gm/&c=E,1,btHxrwc4AzADScwJuwrou71OT1lTEVByo9jWAGKtdXj9aUSOb1Jhp16ieaB40Oep_5e9AnvCkS0i4WVo_YziYgngugIDj8Q2lmGIRMs8Cs2Z&typo=1

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://gmperu.com/gm/&c=E,1,btHxrwc4AzADScwJuwrou71OT1lTEVByo9jWAGKtdXj9aUSOb1Jhp16ieaB40Oep_5e9AnvCkS0i4WVo_YziYgngugIDj8Q2lmGIRMs8Cs2Z&typo=1

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://gmperu.com/gm/&c=E,1,btHxrwc4AzADScwJuwrou71OT1lTEVByo9jWAGKtdXj9aUSOb1Jhp16ieaB40Oep_5e9AnvCkS0i4WVo_YziYgngugIDj8Q2lmGIRMs8Cs2Z&typo=1