Windows Analysis Report
https://file.privacy-shield.cc/prvcy/PrivacyShield.Msix

Overview

General Information

Sample URL: https://file.privacy-shield.cc/prvcy/PrivacyShield.Msix
Analysis ID: 1558882
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Program does not show much activity (idle)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: https://file.privacy-shield.cc/prvcy/PrivacyShield.Msix Avira URL Cloud: detection malicious, Label: malware
Source: classification engine Classification label: mal48.win@16/2@0/10
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\Downloads\89913904-cd67-4aeb-bd1f-1b7b24d39404.tmp Jump to behavior
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2004,i,10600604948691717322,12840706920262592925,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://file.privacy-shield.cc/prvcy/PrivacyShield.Msix"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2004,i,10600604948691717322,12840706920262592925,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1558882 URL: https://file.privacy-shield... Startdate: 19/11/2024 Architecture: WINDOWS Score: 48 26 Antivirus / Scanner detection for submitted sample 2->26 6 chrome.exe 14 2->6         started        9 chrome.exe 2->9         started        process3 dnsIp4 14 192.168.2.16 unknown unknown 6->14 16 192.168.2.4 unknown unknown 6->16 18 239.255.255.250 unknown Reserved 6->18 11 chrome.exe 6->11         started        process5 dnsIp6 20 142.250.185.131 GOOGLEUS United States 11->20 22 142.250.186.142 GOOGLEUS United States 11->22 24 5 other IPs or domains 11->24
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
13.32.121.78
 unknown United States
16509 AMAZON-02US false
1.1.1.1
 unknown Australia
13335 CLOUDFLARENETUS false
239.255.255.250
 unknown Reserved
unknown unknown false
74.125.133.84
 unknown United States
15169 GOOGLEUS false
142.250.185.131
 unknown United States
15169 GOOGLEUS false
142.250.186.142
 unknown United States
15169 GOOGLEUS false
172.217.18.4
 unknown United States
15169 GOOGLEUS false
172.217.18.3
 unknown United States
15169 GOOGLEUS false

Private

IP
192.168.2.16
192.168.2.4