Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Chrome Cache Entry: 46

ASCII text

downloaded

Details

File:	Chrome Cache Entry: 46
Category:	downloaded
Dump:	chromecache_46.2.dr
ID:	dr_7
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text
Entropy:	5.066072968014419
Encrypted:	false
Ssdeep:	6144:V0Hh4V/Y+TCtlIhTze/RZcYmDvzK8m/7EtPx+WI+Y7cFys/CL/+uQxN0IPfKuGA7:atZcYmDhOgPx+WI+Y7cFycuq1PfQAv5t
Size:	278263
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 47

Unicode text, UTF-8 (with BOM) text

downloaded

Details

File:	Chrome Cache Entry: 47
Category:	downloaded
Dump:	chromecache_47.2.dr
ID:	dr_8
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	Unicode text, UTF-8 (with BOM) text
Entropy:	4.714222479262894
Encrypted:	false
Ssdeep:	48:TWgzXlMOSgoF4YYWX/S+ABva0jegyLNe/b5blv7ecqtemzpkt6dTBbTicc:iom3tYUS+SkLNe/b5blv7ec2eftKdW
Size:	2151
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 48

ASCII text, with CRLF line terminators

downloaded

Details

File:	Chrome Cache Entry: 48
Category:	downloaded
Dump:	chromecache_48.2.dr
ID:	dr_9
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.296217536182897
Encrypted:	false
Ssdeep:	48:keCjGbvGbXbDxXBnwN8SwKihE2AM1bnecEZbfZSXhGWoalEJP4Sf:GvbDxx4ihE21bnRobhwoSEJPr
Size:	4733
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 49

Unicode text, UTF-8 (with BOM) text

downloaded

Details

File:	Chrome Cache Entry: 49
Category:	downloaded
Dump:	chromecache_49.2.dr
ID:	dr_10
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	Unicode text, UTF-8 (with BOM) text
Entropy:	5.8846252380152055
Encrypted:	false
Ssdeep:	768:MnLIX6QyOmaS3Z1l2n67IMzbZwaFDDpucviP+ZJot9wY+9ZRP2GPS9erCfbr5qGA:MnrQDUrzKiD7JJB4GPrAA/2i
Size:	84638
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 50

PNG image data, 125 x 34, 8-bit/color RGBA, non-interlaced

dropped

Details

File:	Chrome Cache Entry: 50
Category:	dropped
Dump:	chromecache_50.2.dr
ID:	dr_4
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 125 x 34, 8-bit/color RGBA, non-interlaced
Entropy:	5.572647065027471
Encrypted:	false
Ssdeep:	96:iSm27nFEUOk0IrL3Wnxat2wWk/VWShUMIuPfSC2RSod:5TF0k4cYShuuPfS/1d
Size:	5851
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 51

PNG image data, 125 x 34, 8-bit/color RGBA, non-interlaced

downloaded

Details

File:	Chrome Cache Entry: 51
Category:	downloaded
Dump:	chromecache_51.2.dr
ID:	dr_11
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 125 x 34, 8-bit/color RGBA, non-interlaced
Entropy:	5.572647065027471
Encrypted:	false
Ssdeep:	96:iSm27nFEUOk0IrL3Wnxat2wWk/VWShUMIuPfSC2RSod:5TF0k4cYShuuPfS/1d
Size:	5851
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 52

HTML document, ASCII text

downloaded

Details

File:	Chrome Cache Entry: 52
Category:	downloaded
Dump:	chromecache_52.2.dr
ID:	dr_12
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text
Entropy:	4.281395497073754
Encrypted:	false
Ssdeep:	192:pA7lvMnkvyVUCk/Kij5U3vM1iQVPK3PSX0jhiSRIPhzWyoQuZzJARA3wVUOE+BS:G75jKA0jV3JAO3UHE+Y
Size:	13603
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	4144
Target ID:	0
Parent PID:	1076
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	08:46:31
Date:	24/05/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1568,i,8042035595341962039,8795045047212554398,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	2716
Target ID:	2
Parent PID:	4144
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1568,i,8042035595341962039,8795045047212554398,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	08:46:34
Date:	24/05/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://us-phishalarm-ewt.proofpoint.com/EWT/v1/I-gv3HeEIA!IXui9LmLmXTYW0ChV3m6g9GXkRGpJg8qmgV35mVjVu2AD89bY2MHfUevS98yZ4i8sUHWveCAqzlrDbIgBYwe6uuq$"

Details

Is windows:	true
Is dropped:	false
PID:	6440
Target ID:	3
Parent PID:	1076
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://us-phishalarm-ewt.proofpoint.com/EWT/v1/I-gv3HeEIA!IXui9LmLmXTYW0ChV3m6g9GXkRGpJg8qmgV35mVjVu2AD89bY2MHfUevS98yZ4i8sUHWveCAqzlrDbIgBYwe6uuq$"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	08:46:36
Date:	24/05/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://us-phishalarm-ewt.proofpoint.com/EWT/v1/I-gv3HeEIA!IXui9LmLmXTYW0ChV3m6g9GXkRGpJg8qmgV35mVjVu2AD89bY2MHfUevS98yZ4i8sUHWveCAqzlrDbIgBYwe6uuq$

https://bugs.webkit.org/show_bug.cgi?id=136851

unknown

https://jsperf.com/thor-indexof-vs-for/5

unknown

https://bugs.jquery.com/ticket/12359

unknown

https://us-phishalarm-ewt.proofpoint.com/EWT/v1/Scripts/error_translations.js

50.17.48.180

http://www.gimp.org/xmp/

unknown

https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/

unknown

https://html.spec.whatwg.org/#strip-and-collapse-whitespace

unknown

https://us-phishalarm-ewt.securityeducation.com/api/Workflow/ProcessWorkflow

unknown

https://promisesaplus.com/#point-75

unknown

https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-a

unknown

https://us-phishalarm-ewt.proofpoint.com/EWT/v1/jslog.js

50.17.48.180

https://drafts.csswg.org/cssom/#common-serializing-idioms

unknown

https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled

unknown

https://bugs.webkit.org/show_bug.cgi?id=29084

unknown

https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace

unknown

https://localhost:44360/k8s/o365/AppRead/Home/Functions.js:25:30)

unknown

https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled

unknown

https://us-phishalarm-ewt.proofpoint.com/EWT/v1/Site.css

50.17.48.180

https://bugs.chromium.org/p/chromium/issues/detail?id=378607

unknown

https://us-phishalarm-ewt.proofpoint.com/EWT/v1/Scripts/jquery-3.4.1.js

50.17.48.180

https://bugzilla.mozilla.org/show_bug.cgi?id=687787

unknown

https://bugs.chromium.org/p/chromium/issues/detail?id=470258

unknown

https://bugs.jquery.com/ticket/13378

unknown

https://promisesaplus.com/#point-64

unknown

https://promisesaplus.com/#point-61

unknown

https://drafts.csswg.org/cssom/#resolved-values

unknown

https://bugs.chromium.org/p/chromium/issues/detail?id=589347

unknown

https://html.spec.whatwg.org/#nonce-attributes

unknown

https://html.spec.whatwg.org/multipage/syntax.html#attributes-2

unknown

https://promisesaplus.com/#point-59

unknown

https://jsperf.com/getall-vs-sizzle/2

unknown

https://promisesaplus.com/#point-57

unknown

https://github.com/eslint/eslint/issues/3229

unknown

https://promisesaplus.com/#point-54

unknown

https://html.spec.whatwg.org/multipage/forms.html#category-listed

unknown

https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled

unknown

https://developer.mozilla.org/en-US/docs/CSS/display

unknown

https://jquery.org/license

unknown

https://us-phishalarm-ewt.proofpoint.com/EWT/v1/I-gv3HeEIA!IXui9LmLmXTYW0ChV3m6g9GXkRGpJg8qmgV35mVjVu2AD89bY2MHfUevS98yZ4i8sUHWveCAqzlrDbIgBYwe6uuq$

https://us-phishalarm-ewt.proofpoint.com/EWT/v1/images/pfpt-logo.png

50.17.48.180

https://jquery.com/

unknown

https://bugs.webkit.org/show_bug.cgi?id=137337

unknown

https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled

unknown

https://promisesaplus.com/#point-48

unknown

https://us-phishalarm-ewt.proofpoint.com/favicon.ico

50.17.48.180

https://github.com/jquery/sizzle/pull/225

unknown

https://bugs.jquery.com/ticket/4833

unknown

https://github.com/whatwg/html/issues/2369

unknown

https://sizzlejs.com/

unknown

https://bugs.chromium.org/p/chromium/issues/detail?id=449857

unknown

https://js.foundation/

unknown

https://bugs.jquery.com/ticket/13393

unknown

There are 42 hidden URLs, click here to show them.

Domains

Name

Malicious

us-phishalarm-ewt.securityeducation.com

50.17.48.180

www.google.com

142.250.184.196

Details

Name:	www.google.com
IP:	142.250.184.196
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

fp2e7a.wpc.phicdn.net

192.229.221.95

us-phishalarm-ewt.proofpoint.com

unknown

Details

Name:	us-phishalarm-ewt.proofpoint.com
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

IPs

Domain

Country

Malicious

142.250.184.196

www.google.com

United States

239.255.255.250

unknown

Reserved

52.1.130.164

unknown

United States

192.168.2.4

unknown

50.17.48.180

us-phishalarm-ewt.securityeducation.com

United States

DOM / HTML

URL

Malicious

https://us-phishalarm-ewt.proofpoint.com/EWT/v1/I-gv3HeEIA!IXui9LmLmXTYW0ChV3m6g9GXkRGpJg8qmgV35mVjVu2AD89bY2MHfUevS98yZ4i8sUHWveCAqzlrDbIgBYwe6uuq$

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://us-phishalarm-ewt.proofpoint.com/EWT/v1/I-gv3HeEIA!IXui9LmLmXTYW0ChV3m6g9GXkRGpJg8qmgV35mVjVu2AD89bY2MHfUevS98yZ4i8sUHWveCAqzlrDbIgBYwe6uuq$

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://us-phishalarm-ewt.proofpoint.com/EWT/v1/I-gv3HeEIA!IXui9LmLmXTYW0ChV3m6g9GXkRGpJg8qmgV35mVjVu2AD89bY2MHfUevS98yZ4i8sUHWveCAqzlrDbIgBYwe6uuq$

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
https://us-phishalarm-ewt.proofpoint.com/EWT/v1/I-gv3HeEIA!IXui9LmLmXTYW0ChV3m6g9GXkRGpJg8qmgV35mVjVu2AD89bY2MHfUevS98yZ4i8sUHWveCAqzlrDbIgBYwe6uuq$