Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	6112
Target ID:	0
Parent PID:	3040
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	05:01:38
Date:	31/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 --field-trial-handle=2228,i,16754288020780876168,17948243108775276119,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	2496
Target ID:	2
Parent PID:	6112
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 --field-trial-handle=2228,i,16754288020780876168,17948243108775276119,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	05:01:43
Date:	31/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://backup-mailer.com/nl/uitloggen/?secret=oEaM4qMC3jhlycbbxxQlLbCFI2HdDsJrTdsW"

Details

Is windows:	true
Is dropped:	false
PID:	5848
Target ID:	3
Parent PID:	3040
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://backup-mailer.com/nl/uitloggen/?secret=oEaM4qMC3jhlycbbxxQlLbCFI2HdDsJrTdsW"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	05:01:45
Date:	31/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4184 --field-trial-handle=2228,i,16754288020780876168,17948243108775276119,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	5536
Target ID:	5
Parent PID:	6112
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4184 --field-trial-handle=2228,i,16754288020780876168,17948243108775276119,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	05:02:09
Date:	31/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://backup-mailer.com/nl/uitloggen/?secret=oEaM4qMC3jhlycbbxxQlLbCFI2HdDsJrTdsW

https://backup-mailer.com/assets/images/aftermath/logo.png

104.21.92.82

https://popper.js.org

unknown

https://kit-pro.fontawesome.com/releases/v5.15.2/css/pro.min.css

unknown

http://wonko.com/post/html-escaping)

unknown

https://backup-mailer.com/css/app.css

104.21.92.82

http://ejohn.org/blog/javascript-micro-templating/)

unknown

https://github.com/olado/doT).

unknown

http://ecma-international.org/ecma-262/7.0/#sec-patterns).

unknown

https://github.com/FezVrasta/popper.js/issues/373).

unknown

https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/

unknown

https://backup-mailer.com/assets/css/magnific-popup.css

104.21.92.82

https://promisesaplus.com/#point-75

unknown

https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled

unknown

https://bugs.webkit.org/show_bug.cgi?id=29084

unknown

https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace

unknown

https://fontawesome.com

unknown

https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled

unknown

https://lodash.com/)

unknown

http://www.ecma-international.org/ecma-262/7.0/#sec-function.prototype.apply).

unknown

https://backup-mailer.com/assets/images/404.svg

unknown

https://github.com/twbs/bootstrap/graphs/contributors)

unknown

http://www.ecma-international.org/ecma-262/7.0/#sec-tointeger).

unknown

https://backup-mailer.com/js/jquery.magnific-popup.min.js

104.21.92.82

https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon

unknown

http://www.videolan.org/x264.html

unknown

https://backup-mailer.com/assets/images/aftermath/footer-logo.png

104.21.92.82

https://bugzilla.mozilla.org/show_bug.cgi?id=687787

unknown

https://bugs.chromium.org/p/chromium/issues/detail?id=470258

unknown

https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js

104.18.11.207

https://bugs.jquery.com/ticket/13378

unknown

https://www.quirksmode.org/blog/archives/2014/02/mouse_event_bub.html

unknown

https://mdn.io/clearTimeout).

unknown

https://promisesaplus.com/#point-64

unknown

https://mdn.io/Number/isSafeInteger).

unknown

https://openjsf.org/

unknown

http://eev.ee/blog/2015/09/12/dark-corners-of-unicode/).

unknown

https://promisesaplus.com/#point-61

unknown

https://mdn.io/Number/isNaN)

unknown

http://www.html5rocks.com/en/tutorials/developertools/sourcemaps/#toc-sourceurl)

unknown

https://backup-mailer.com/assets/js/spinner.js

104.21.92.82

https://backup-mailer.com/assets/css/style.css

104.21.92.82

https://bugs.chromium.org/p/v8/issues/detail?id=90

unknown

http://dimsemenov.com/plugins/magnific-popup/

unknown

https://html.spec.whatwg.org/#nonce-attributes

unknown

https://mdn.io/toUpperCase).

unknown

https://github.com/jashkenas/underscore/pull/1247

unknown

https://videojs.com/html5-video-support/

unknown

http://ecma-international.org/ecma-262/7.0/#sec-properties-of-the-map-prototype-object)

unknown

https://jsperf.com/getall-vs-sizzle/2

unknown

https://mathiasbynens.be/notes/ambiguous-ampersands)

unknown

https://mdn.io/Number/isInteger).

unknown

https://backup-mailer.com/assets/css/bootstrap.min.css

104.21.92.82

https://backup-mailer.com/assets/images/aftermath/alert.svg

104.21.92.82

http://underscorejs.org/LICENSE

unknown

https://developer.mozilla.org/en-US/docs/CSS/display

unknown

http://ecma-international.org/ecma-262/7.0/#sec-ecmascript-function-objects-call-thisargument-argume

unknown

https://backup-mailer.com/favicon.png

104.21.92.82

https://bugs.webkit.org/show_bug.cgi?id=156034

unknown

https://jquery.com/

unknown

https://phishedacademy.io

unknown

http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring)

unknown

https://backup-mailer.com/assets/images/aftermath/arrow.svg

104.21.92.82

https://github.com/twbs/bootstrap/blob/master/LICENSE)

unknown

https://mths.be/he).

unknown

https://mdn.io/String/replace).

unknown

https://backup-mailer.com/assets/fonts/feather-font/css/iconfont.css

104.21.92.82

https://github.com/jquery/sizzle/pull/225

unknown

https://bugs.jquery.com/ticket/4833

unknown

https://mathiasbynens.be/notes/javascript-unicode).

unknown

https://sizzlejs.com/

unknown

https://bugs.chromium.org/p/chromium/issues/detail?id=449857

unknown

https://js.foundation/

unknown

https://bugs.jquery.com/ticket/13393

unknown

https://backup-mailer.com/assets/css/responsive.css

104.21.92.82

https://bugs.chromium.org/p/v8/issues/detail?id=2070)

unknown

https://npms.io/search?q=ponyfill.

unknown

https://backup-mailer.com/assets/images/aftermath/road.png

104.21.92.82

https://bugs.webkit.org/show_bug.cgi?id=136851

unknown

https://phished.io/contact

unknown

https://nodejs.org/api/http.html#http_message_headers

unknown

https://jsperf.com/thor-indexof-vs-for/5

unknown

https://bugs.jquery.com/ticket/12359

unknown

https://mdn.io/Object/assign).

unknown

http://ecma-international.org/ecma-262/7.0/#sec-object.keys)

unknown

https://github.com/FezVrasta/popper.js/pull/715

unknown

http://peter.michaux.ca/articles/lazy-function-definition-pattern)

unknown

https://html.spec.whatwg.org/#strip-and-collapse-whitespace

unknown

https://backup-mailer.com/assets/images/aftermath/1.png

104.21.92.82

http://url.spec.whatwg.org/#urlutils

unknown

https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-a

unknown

https://drafts.csswg.org/cssom/#common-serializing-idioms

unknown

https://backup-mailer.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

104.21.92.82

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js

104.17.24.14

http://ecma-international.org/ecma-262/7.0/#sec-tolength).

unknown

https://github.com/jquery/jquery/pull/557)

unknown

https://mdn.io/Array/slice)

unknown

https://bugs.chromium.org/p/chromium/issues/detail?id=378607

unknown

https://fontawesome.com/license

unknown

https://mdn.io/Number/isFinite).

unknown

https://lodash.com/custom-builds).

unknown

There are 90 hidden URLs, click here to show them.

Domains

Name

Malicious

bg.microsoft.map.fastly.net

199.232.214.172

cdnjs.cloudflare.com

104.17.24.14

Details

Name:	cdnjs.cloudflare.com
IP:	104.17.24.14
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

maxcdn.bootstrapcdn.com

104.18.11.207

Details

Name:	maxcdn.bootstrapcdn.com
IP:	104.18.11.207
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

www.google.com

142.250.74.196

Details

Name:	www.google.com
IP:	142.250.74.196
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

fp2e7a.wpc.phicdn.net

192.229.221.95

backup-mailer.com

104.21.92.82

Details

Name:	backup-mailer.com
IP:	104.21.92.82
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

kit-pro.fontawesome.com

unknown

Details

Name:	kit-pro.fontawesome.com
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

104.17.24.14

cdnjs.cloudflare.com

United States

104.21.92.82

backup-mailer.com

United States

192.168.2.6

unknown

104.18.11.207

maxcdn.bootstrapcdn.com

United States

239.255.255.250

unknown

Reserved

142.250.74.196

www.google.com

United States

DOM / HTML

URL

Malicious

https://backup-mailer.com/nl/uitloggen/?secret=oEaM4qMC3jhlycbbxxQlLbCFI2HdDsJrTdsW

https://backup-mailer.com/nl/di

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://backup-mailer.com/nl/uitloggen/?secret=oEaM4qMC3jhlycbbxxQlLbCFI2HdDsJrTdsW

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://backup-mailer.com/nl/uitloggen/?secret=oEaM4qMC3jhlycbbxxQlLbCFI2HdDsJrTdsW

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
https://backup-mailer.com/nl/uitloggen/?secret=oEaM4qMC3jhlycbbxxQlLbCFI2HdDsJrTdsW