Automated Malware Analysis IOC Report for

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	1892
Target ID:	0
Parent PID:	5776
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	11:53:20
Date:	23/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2004,i,13061649624349182603,857125993022094789,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	1900
Target ID:	2
Parent PID:	1892
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2004,i,13061649624349182603,857125993022094789,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	11:53:22
Date:	23/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://crmri.crm.dynamics.com/api/EmailAnalytics/OpenLink?TrackingId=659cf4f2-4d91-ef11-ac21-000d3a56f3be&ConversationTrackingId=e128c86a-df31-48c7-b419-f5dd100bada6&ClientType=webclient&OrganizationId=aeae68a5-57e4-49ca-a82c-f2df71524041&Salt=30a65c1c-a240-495b-a4c0-d65d7dcbd0bd&RedirectUrl=https%3a%2f%2foutlook.office365.com%2fowa%2fcalendar%2fJaimeRubiano15minutemeeting%40bookings.microsoft.com%2fbookings%2f&ValidityToken=ekPdlX6P0%2b21E5TNtc5DHCTEQmFIpI2OUrJ55EeRFaQ%3d"

Details

Is windows:	true
Is dropped:	false
PID:	6332
Target ID:	3
Parent PID:	5776
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://crmri.crm.dynamics.com/api/EmailAnalytics/OpenLink?TrackingId=659cf4f2-4d91-ef11-ac21-000d3a56f3be&ConversationTrackingId=e128c86a-df31-48c7-b419-f5dd100bada6&ClientType=webclient&OrganizationId=aeae68a5-57e4-49ca-a82c-f2df71524041&Salt=30a65c1c-a240-495b-a4c0-d65d7dcbd0bd&RedirectUrl=https%3a%2f%2foutlook.office365.com%2fowa%2fcalendar%2fJaimeRubiano15minutemeeting%40bookings.microsoft.com%2fbookings%2f&ValidityToken=ekPdlX6P0%2b21E5TNtc5DHCTEQmFIpI2OUrJ55EeRFaQ%3d"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	11:53:27
Date:	23/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

Domains

Name

Malicious

s-part-0044.t-0009.fb-t-msedge.net

13.107.253.72

www.google.com

216.58.212.132

Details

Name:	www.google.com
IP:	216.58.212.132
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

HHN-efz.ms-acdc.office.com

52.98.179.66

crmri.crm.dynamics.com

unknown

Details

Name:	crmri.crm.dynamics.com
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

241.42.69.40.in-addr.arpa

unknown

outlook.office365.com

unknown

Details

Name:	outlook.office365.com
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

200.163.202.172.in-addr.arpa

unknown

IPs

Domain

Country

Malicious

216.58.212.132

www.google.com

United States

192.168.2.17

unknown

142.250.185.132

unknown

United States

192.168.2.18

unknown

192.168.2.4

unknown

40.99.214.34

unknown

United States

239.255.255.250

unknown

Reserved

52.98.179.66

HHN-efz.ms-acdc.office.com

United States

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Processes

Domains

IPs