Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Chrome Cache Entry: 44

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513

dropped

Details

File:	Chrome Cache Entry: 44
Category:	dropped
Dump:	chromecache_44.2.dr
ID:	dr_0
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513
Entropy:	7.316609873335077
Encrypted:	false
Ssdeep:	6:XtqDFR4m68lkQfanvbEzXI0iP427cnLPw6/aqqmb/:XUD34sMDaXI0demb/
Size:	276
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 45

HTML document, ASCII text, with very long lines (65474)

downloaded

Details

File:	Chrome Cache Entry: 45
Category:	downloaded
Dump:	chromecache_45.2.dr
ID:	dr_6
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with very long lines (65474)
Entropy:	5.916737582209033
Encrypted:	false
Ssdeep:	12288:xaiGQtTgESHzx8Q+z2BTfWCgoVDeMj3Gxw11aioTKlKsKh:kiG5jTeGq5xw11aUETh
Size:	749686
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 46

ASCII text, with no line terminators

downloaded

Details

File:	Chrome Cache Entry: 46
Category:	downloaded
Dump:	chromecache_46.2.dr
ID:	dr_7
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with no line terminators
Entropy:	4.833283245439395
Encrypted:	false
Ssdeep:	3:qinPbMTH+YKthUox42YY:qyPbTCoxfYY
Size:	68
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 47

Unicode text, UTF-8 text, with very long lines (65335)

downloaded

Details

File:	Chrome Cache Entry: 47
Category:	downloaded
Dump:	chromecache_47.2.dr
ID:	dr_8
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	Unicode text, UTF-8 text, with very long lines (65335)
Entropy:	4.985051603437628
Encrypted:	false
Ssdeep:	1536:Xa/tfXbf98fOdBfvO5wlP79y9A37onOHFsY/ElV6V6pz600I41r:itfL98fVnOHVI6V6pz600I41r
Size:	232691
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 48

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513

downloaded

Details

File:	Chrome Cache Entry: 48
Category:	downloaded
Dump:	chromecache_48.2.dr
ID:	dr_9
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513
Entropy:	7.316609873335077
Encrypted:	false
Ssdeep:	6:XtqDFR4m68lkQfanvbEzXI0iP427cnLPw6/aqqmb/:XUD34sMDaXI0demb/
Size:	276
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 49

HTML document, ASCII text, with very long lines (1632)

downloaded

Details

File:	Chrome Cache Entry: 49
Category:	downloaded
Dump:	chromecache_49.2.dr
ID:	dr_10
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with very long lines (1632)
Entropy:	5.48122955408967
Encrypted:	false
Ssdeep:	96:yhp3MuQi5MtjyV3YKexszQucQ0JF06vSrOK1Ieq72nSi:yhp3MuQi5LVexuifo6vSSWqKSi
Size:	6875
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	4328
Target ID:	0
Parent PID:	5544
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	18:25:05
Date:	23/05/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Allocates a big amount of memory (probably used for heap spraying)	Software Vulnerabilities	Extra Window Memory Injection
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2380,i,2447524931460829136,4382483967890670615,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	6040
Target ID:	2
Parent PID:	4328
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2380,i,2447524931460829136,4382483967890670615,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	18:25:10
Date:	23/05/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Allocates a big amount of memory (probably used for heap spraying)	Software Vulnerabilities	Extra Window Memory Injection
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.dweb.link/"

Details

Is windows:	true
Is dropped:	false
PID:	2020
Target ID:	3
Parent PID:	5544
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.dweb.link/"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	18:25:13
Date:	23/05/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Allocates a big amount of memory (probably used for heap spraying)	Software Vulnerabilities	Extra Window Memory Injection
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.dweb.link/

Details

Filetype:	URL
Filename:	https://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.dweb.link/

Signature Hits	Behavior Group	Mitre Attack
AI detected phishing page	Phishing	Extra Window Memory Injection
Antivirus / Scanner detection for submitted sample	AV Detection	Extra Window Memory Injection
Antivirus detection for URL or domain	AV Detection
Yara detected HtmlPhish10	Phishing	Extra Window Memory Injection
Yara detected HtmlPhish44	Phishing	Extra Window Memory Injection
AI detected suspicious javascript	Phishing	Extra Window Memory Injection
HTML body contains low number of good links	Phishing
HTML body contains password input but no form action	Phishing	Extra Window Memory Injection
HTML body with high number of embedded images detected	Phishing	Extra Window Memory Injection
HTML title does not match URL	Phishing	Extra Window Memory Injection
Invalid T&C link found	Phishing
Allocates a big amount of memory (probably used for heap spraying)	Software Vulnerabilities	Extra Window Memory Injection
Classification label	System Summary	Extra Window Memory Injection
Connects to IPs without corresponding DNS lookups	Networking	Extra Window Memory Injection
Downloads files from webservers via HTTP	Networking	Extra Window Memory Injection Non-Application Layer Protocol Ingress Tool Transfer
HTML body contains password input	Phishing	Extra Window Memory Injection
META author tag missing	Phishing
META copyright tag missing	Phishing
Performs DNS lookups	Networking
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Uses HTTPS	Networking	Encrypted Channel Application Layer Protocol
Uses secure TLS version for HTTPS connections	Compliance, Networking
Found graphical window changes (likely an installer)	System Summary

https://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.dweb.link/

Details

Name:	https://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.dweb.link/
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	browser

Signature Hits	Behavior Group	Mitre Attack
AI detected phishing page	Phishing
Antivirus / Scanner detection for submitted sample	AV Detection
AI detected suspicious javascript	Phishing
HTML body contains low number of good links	Phishing
HTML body contains password input but no form action	Phishing
HTML body with high number of embedded images detected	Phishing
HTML title does not match URL	Phishing
Invalid T&C link found	Phishing
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
HTML body contains password input	Phishing
META author tag missing	Phishing
META copyright tag missing	Phishing
Spawns processes	System Summary	Process Injection

https://www.html-code-generator.com

unknown

https://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.dweb.link/cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css

209.94.90.3

Details

Name:	https://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.dweb.link/cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css
IP:	209.94.90.3
TargetID:	2
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
AI detected phishing page	Phishing
Antivirus / Scanner detection for submitted sample	AV Detection
AI detected suspicious javascript	Phishing
HTML body contains low number of good links	Phishing
HTML body contains password input but no form action	Phishing
HTML body with high number of embedded images detected	Phishing
HTML title does not match URL	Phishing
Invalid T&C link found	Phishing
HTML body contains password input	Phishing
META author tag missing	Phishing
META copyright tag missing	Phishing

https://docs.ipfs.tech/install/?utm_source=bifrost&utm_medium=ipfsio&utm_campaign=error_pages

unknown

https://getbootstrap.com/)

unknown

https://ipfs.tech?utm_source=bifrost&utm_medium=ipfsio&utm_campaign=error_pages

unknown

https://github.com/twbs/bootstrap/blob/main/LICENSE)

unknown

https://cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha3/dist/css/bootstrap.min.css

151.101.129.229

Domains

Name

Malicious

officedocuments.com.ng

unknown

Details

Name:	officedocuments.com.ng
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
AI detected suspicious javascript	Phishing
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

jsdelivr.map.fastly.net

151.101.129.229

part-0017.t-0009.t-msedge.net

13.107.213.45

www.google.com

142.250.185.100

Details

Name:	www.google.com
IP:	142.250.185.100
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

fp2e7a.wpc.phicdn.net

192.229.221.95

bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.dweb.link

209.94.90.3

Details

Name:	bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.dweb.link
IP:	209.94.90.3
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

cdn.jsdelivr.net

unknown

Details

Name:	cdn.jsdelivr.net
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Malicious

13.107.246.45

unknown

United States

151.101.129.229

jsdelivr.map.fastly.net

United States

142.250.185.100

www.google.com

United States

192.168.2.4

unknown

192.168.2.6

unknown

13.107.213.45

part-0017.t-0009.t-msedge.net

United States

239.255.255.250

unknown

Reserved

209.94.90.3

bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.dweb.link

United States

DOM / HTML

URL

Malicious

https://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.dweb.link/

Details

Filename:	0.0.pages.html.dom
Url:	https://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.dweb.link/
Target ID:	2
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2380,i,2447524931460829136,4382483967890670615,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Signature Hits	Behavior Group	Mitre Attack
AI detected phishing page	Phishing
Yara detected HtmlPhish10	Phishing
AI detected suspicious javascript	Phishing

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.dweb.link/

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.dweb.link/

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
https://bafybeicyoou3q7k5bml4hx2cqyi7ytj76vckg4hfeuvxbwxh3uw3qlhwwu.ipfs.dweb.link/