Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Chrome Cache Entry: 44

ASCII text, with very long lines (7916), with no line terminators

downloaded

Details

File:	Chrome Cache Entry: 44
Category:	downloaded
Dump:	chromecache_44.2.dr
ID:	dr_3
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (7916), with no line terminators
Entropy:	5.757199540889538
Encrypted:	false
Ssdeep:	96:hFaF/0GNejelhRJxI67BBh+PAwer98zeD7pjY6WXdZxR/XHmgMq4RoakqFYv:Xe0HCXJ7Bf+Plermzg9jfqZPo38v
Size:	7916
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 45

HTML document, ASCII text

downloaded

Details

File:	Chrome Cache Entry: 45
Category:	downloaded
Dump:	chromecache_45.2.dr
ID:	dr_4
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text
Entropy:	5.0572271090563765
Encrypted:	false
Ssdeep:	6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoFEHcLgabzjsKtgsg93wzRbKqD:J0+oxBeRmR9etdzRxGezZfCzjsKtgizR
Size:	315
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 46

HTML document, ASCII text, with very long lines (952)

downloaded

Details

File:	Chrome Cache Entry: 46
Category:	downloaded
Dump:	chromecache_46.2.dr
ID:	dr_5
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with very long lines (952)
Entropy:	5.339857169416013
Encrypted:	false
Ssdeep:	24:yjeRmfe9xvVCzjsuRpFGLnxbFGWt0u1JJSa7oRW7aRWXCunouOvTMOKFId6J39S:8eLX4/DGLrGWtpSTw2wptI8Id6a
Size:	1253
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	4284
Target ID:	0
Parent PID:	4408
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	19:57:57
Date:	01/07/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2040,i,18179157204559598168,15964914206527604190,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	332
Target ID:	2
Parent PID:	4284
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2040,i,18179157204559598168,15964914206527604190,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	19:57:59
Date:	01/07/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://punchbowl-sc.info/in/&d=DwMFAw"

Details

Is windows:	true
Is dropped:	false
PID:	6552
Target ID:	3
Parent PID:	4408
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://punchbowl-sc.info/in/&d=DwMFAw"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	19:58:03
Date:	01/07/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://punchbowl-sc.info/in/&d=DwMFAw

https://a.nel.cloudflare.com/report/v4?s=NBT166iQ8kKQaOUBdNzESzvBQt3sa%2BH1mPUsK4jzv%2BzxzJWc%2B3J5pJ%2BEMhsUmYu7pg3Oe8e7%2B0FQjPNa90z6Bp530MjyPjGWprvweGYrO8USRnZZwskD517f8t8RjMiF44QnHw%3D%3D

35.190.80.1

https://a.nel.cloudflare.com/report/v4?s=mmCr%2B3UxGreCde%2B0%2Bj%2BFU1Rv1zcP8t4tMsXn1YQuJhJWBRXO%2Fs4JXOmgKK74JFh758ebD1018nkKt2evGU9TV1ckWXdmsCQG2dOka5FNee8ilBlLpBpE5vVBwi8DGT0bRQvdEw%3D%3D

35.190.80.1

https://punchbowl-sc.info/cdn-cgi/challenge-platform/h/g/jsd/r/89ca57922cc8438e

188.114.96.3

https://punchbowl-sc.info/favicon.ico

188.114.96.3

https://a.nel.cloudflare.com/report/v4?s=pKUTHbOrr2DM0cKY%2FbTADoK7GsRm4ZjBpi5KHeSk%2BZJ6mHE5%2BXgtAO2OAvADa3wBue%2F3xkvvIcLIF7Q18nBrf15Hlf3HTHeaGgACMSsn0e2VhQAGIQe5%2FX9jj7xFuh60Q9wgzw%3D%3D

35.190.80.1

about:blank

https://punchbowl-sc.info/cdn-cgi/challenge-platform/h/g/scripts/jsd/d2a97f6b6ec9/main.js

188.114.96.3

https://punchbowl-sc.info/cdn-cgi/challenge-platform/scripts/jsd/main.js

188.114.96.3

Domains

Name

Malicious

a.nel.cloudflare.com

35.190.80.1

Details

Name:	a.nel.cloudflare.com
IP:	35.190.80.1
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

punchbowl-sc.info

188.114.96.3

Details

Name:	punchbowl-sc.info
IP:	188.114.96.3
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

www.google.com

142.250.185.164

Details

Name:	www.google.com
IP:	142.250.185.164
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

fp2e7a.wpc.phicdn.net

192.229.221.95

IPs

Domain

Country

Malicious

239.255.255.250

unknown

Reserved

188.114.97.3

unknown

European Union

142.250.185.164

www.google.com

United States

188.114.96.3

punchbowl-sc.info

European Union

35.190.80.1

a.nel.cloudflare.com

United States

192.168.2.4

unknown

DOM / HTML

URL

Malicious

about:blank

https://punchbowl-sc.info/in/&d=DwMFAw

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://punchbowl-sc.info/in/&d=DwMFAw

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://punchbowl-sc.info/in/&d=DwMFAw

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
https://punchbowl-sc.info/in/&d=DwMFAw