Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4872_689076878\LICENSE

ASCII text

dropped

Details

File:	C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4872_689076878\LICENSE
Category:	dropped
Dump:	LICENSE.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text
Entropy:	5.11458514637545
Encrypted:	false
Ssdeep:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
Size:	1558
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4872_689076878\_metadata\verified_contents.json

JSON data

dropped

Details

File:	C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4872_689076878\_metadata\verified_contents.json
Category:	dropped
Dump:	verified_contents.json.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	JSON data
Entropy:	6.021127689065198
Encrypted:	false
Ssdeep:	48:p/hUI1atAdI567akUmYWEFw/3+ovGJ4F3jkZUbvzk98g5m7:RnYQI47avYUwvVGJ41jkZIzxgA7
Size:	1864
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4872_689076878\manifest.fingerprint

ASCII text, with no line terminators

dropped

Details

File:	C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4872_689076878\manifest.fingerprint
Category:	dropped
Dump:	manifest.fingerprint.0.dr
ID:	dr_4
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with no line terminators
Entropy:	3.9159446964030753
Encrypted:	false
Ssdeep:	3:Sq5TQRaELVHecsUDBAeHD5k:Sq5gJ+csHej5k
Size:	66
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4872_689076878\manifest.json

JSON data

dropped

Details

File:	C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4872_689076878\manifest.json
Category:	dropped
Dump:	manifest.json.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	JSON data
Entropy:	4.4533115571544695
Encrypted:	false
Ssdeep:	3:rR6TAulhFphifFCmMARWHJqS1tean:F6VlM8aRWpqS1ln
Size:	85
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4872_689076878\sets.json

JSON data

dropped

Details

File:	C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping4872_689076878\sets.json
Category:	dropped
Dump:	sets.json.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	JSON data
Entropy:	4.629326694042306
Encrypted:	false
Ssdeep:	96:Mon4mvC4qX19s1blbw/BNKLcxbdmf56MFJtRTGXvcxN43uP+8qJq:v5C4ql7BkIVmtRTGXvcxBsq
Size:	9748
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Chrome Cache Entry: 104

PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced

dropped

Details

File:	Chrome Cache Entry: 104
Category:	dropped
Dump:	chromecache_104.2.dr
ID:	dr_5
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Entropy:	7.430195247998127
Encrypted:	false
Ssdeep:	12:6v/7iY7/6Ts/4a3X/IVXFnBCE3tG7DC8V2f0o4+dJG4/2hXzCuDoG:27/6jggVVnBhG7D9NxKJ8h5DoG
Size:	572
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 105

GIF image data, version 89a, 1 x 1

downloaded

Details

File:	Chrome Cache Entry: 105
Category:	downloaded
Dump:	chromecache_105.2.dr
ID:	dr_8
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	GIF image data, version 89a, 1 x 1
Entropy:	2.9302005337813077
Encrypted:	false
Ssdeep:	3:CUkrllHh/:qJ/
Size:	35
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 106

PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced

downloaded

Details

File:	Chrome Cache Entry: 106
Category:	downloaded
Dump:	chromecache_106.2.dr
ID:	dr_9
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Entropy:	7.430195247998127
Encrypted:	false
Ssdeep:	12:6v/7iY7/6Ts/4a3X/IVXFnBCE3tG7DC8V2f0o4+dJG4/2hXzCuDoG:27/6jggVVnBhG7D9NxKJ8h5DoG
Size:	572
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	4872
Target ID:	0
Parent PID:	5928
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	18:51:05
Date:	24/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2512 --field-trial-handle=2484,i,9615499536714307526,10021745460016112960,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	3568
Target ID:	2
Parent PID:	4872
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2512 --field-trial-handle=2484,i,9615499536714307526,10021745460016112960,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	18:51:08
Date:	24/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.match.com/email/open.aspx?EmailID=98d433a1-9223-4e5c-b2a4-753f05258ab2&SrcSystem=1/"

Details

Is windows:	true
Is dropped:	false
PID:	3048
Target ID:	3
Parent PID:	5928
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.match.com/email/open.aspx?EmailID=98d433a1-9223-4e5c-b2a4-753f05258ab2&SrcSystem=1/"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	18:51:11
Date:	24/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://www.match.com/email/open.aspx?EmailID=98d433a1-9223-4e5c-b2a4-753f05258ab2&SrcSystem=1/

https://wieistmeineip.de

unknown

https://mercadoshops.com.co

unknown

https://gliadomain.com

unknown

https://poalim.xyz

unknown

https://mercadolivre.com

unknown

https://reshim.org

unknown

https://nourishingpursuits.com

unknown

https://medonet.pl

unknown

https://unotv.com

unknown

https://mercadoshops.com.br

unknown

https://joyreactor.cc

unknown

https://zdrowietvn.pl

unknown

https://johndeere.com

unknown

https://songstats.com

unknown

https://baomoi.com

unknown

https://supereva.it

unknown

https://elfinancierocr.com

unknown

https://bolasport.com

unknown

https://rws1nvtvt.com

unknown

https://desimartini.com

unknown

https://hearty.app

unknown

https://hearty.gift

unknown

https://mercadoshops.com

unknown

https://heartymail.com

unknown

https://nlc.hu

unknown

https://p106.net

unknown

https://radio2.be

unknown

https://finn.no

unknown

https://hc1.com

unknown

https://kompas.tv

unknown

https://mystudentdashboard.com

unknown

https://songshare.com

unknown

https://smaker.pl

unknown

https://mercadopago.com.mx

unknown

https://p24.hu

unknown

https://talkdeskqaid.com

unknown

https://24.hu

unknown

https://mercadopago.com.pe

unknown

https://cardsayings.net

unknown

https://text.com

unknown

https://mightytext.net

unknown

https://pudelek.pl

unknown

https://hazipatika.com

unknown

https://joyreactor.com

unknown

https://cookreactor.com

unknown

https://wildixin.com

unknown

https://eworkbookcloud.com

unknown

https://cognitiveai.ru

unknown

https://nacion.com

unknown

https://chennien.com

unknown

https://drimer.travel

unknown

https://deccoria.pl

unknown

https://mercadopago.cl

unknown

https://talkdeskstgid.com

unknown

https://naukri.com

unknown

https://interia.pl

unknown

https://bonvivir.com

unknown

https://carcostadvisor.be

unknown

https://salemovetravel.com

unknown

https://sapo.io

unknown

https://wpext.pl

unknown

https://welt.de

unknown

https://poalim.site

unknown

https://drimer.io

unknown

https://infoedgeindia.com

unknown

https://blackrockadvisorelite.it

unknown

https://cognitive-ai.ru

unknown

https://us.match.com/email/open.aspx?geo-redirection=www.match.com&EmailID=98d433a1-9223-4e5c-b2a4-753f05258ab2&SrcSystem=1/

https://cafemedia.com

unknown

https://graziadaily.co.uk

unknown

https://thirdspace.org.au

unknown

https://mercadoshops.com.ar

unknown

https://smpn106jkt.sch.id

unknown

https://elpais.uy

unknown

https://landyrev.com

unknown

https://the42.ie

unknown

https://commentcamarche.com

unknown

https://tucarro.com.ve

unknown

https://rws3nvtvt.com

unknown

https://eleconomista.net

unknown

https://helpdesk.com

unknown

https://mercadolivre.com.br

unknown

https://clmbtech.com

unknown

https://standardsandpraiserepurpose.com

unknown

https://07c225f3.online

unknown

https://salemovefinancial.com

unknown

https://mercadopago.com.br

unknown

https://commentcamarche.net

unknown

https://etfacademy.it

unknown

https://mighty-app.appspot.com

unknown

https://hj.rs

unknown

https://hearty.me

unknown

https://mercadolibre.com.gt

unknown

https://timesinternet.in

unknown

https://indiatodayne.in

unknown

https://idbs-staging.com

unknown

https://blackrock.com

unknown

https://idbs-eworkbook.com

unknown

https://motherandbaby.com

unknown

https://mercadolibre.co.cr

unknown

There are 90 hidden URLs, click here to show them.

Domains

Name

Malicious

bg.microsoft.map.fastly.net

199.232.214.172

www.google.com

142.250.74.196

Details

Name:	www.google.com
IP:	142.250.74.196
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com

217.20.57.18

us-wac.match.com

208.83.242.49

fp2e7a.wpc.phicdn.net

192.229.221.95

www.match.com

unknown

Details

Name:	www.match.com
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

us.match.com

unknown

Details

Name:	us.match.com
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Malicious

239.255.255.250

unknown

Reserved

208.83.242.49

us-wac.match.com

United States

192.168.2.6

unknown

142.250.74.196

www.google.com

United States

DOM / HTML

URL

Malicious

https://us.match.com/email/open.aspx?geo-redirection=www.match.com&EmailID=98d433a1-9223-4e5c-b2a4-753f05258ab2&SrcSystem=1/

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
http://www.match.com/email/open.aspx?EmailID=98d433a1-9223-4e5c-b2a4-753f05258ab2&SrcSystem=1/

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttp://www.match.com/email/open.aspx?EmailID=98d433a1-9223-4e5c-b2a4-753f05258ab2&SrcSystem=1/

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
http://www.match.com/email/open.aspx?EmailID=98d433a1-9223-4e5c-b2a4-753f05258ab2&SrcSystem=1/