Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	6112
Target ID:	0
Parent PID:	5920
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	05:03:25
Date:	31/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=1940,i,15838400745647305406,11125155622381018543,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	3004
Target ID:	2
Parent PID:	6112
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=1940,i,15838400745647305406,11125155622381018543,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	05:03:28
Date:	31/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://official-mailing.com/nl/login/?tracker=8OyQ79l8fzgMrJewcNuG3bEtcLf5zgt9p0NC"

Details

Is windows:	true
Is dropped:	false
PID:	6324
Target ID:	3
Parent PID:	5920
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://official-mailing.com/nl/login/?tracker=8OyQ79l8fzgMrJewcNuG3bEtcLf5zgt9p0NC"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	05:03:30
Date:	31/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5968 --field-trial-handle=1940,i,15838400745647305406,11125155622381018543,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	6516
Target ID:	5
Parent PID:	6112
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5968 --field-trial-handle=1940,i,15838400745647305406,11125155622381018543,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	05:03:44
Date:	31/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://official-mailing.com/nl/login/?tracker=8OyQ79l8fzgMrJewcNuG3bEtcLf5zgt9p0NC

https://a.nel.cloudflare.com/report/v4?s=RoWjGgCDQgQub2TQOg9SZTXMeEChxU5uNGMVongmeQXsmU7YFn5bCLvdiHcbbNqakB5vXzClu7M61uhnnUZQ8t4fOx1t1i5bC5AY5Y54bsagfm8tt%2BTZ%2BUR0%2BFHhOpQrkfGLxUrjeg%3D%3D

35.190.80.1

https://popper.js.org

unknown

https://kit-pro.fontawesome.com/releases/v5.15.2/css/pro.min.css

unknown

http://wonko.com/post/html-escaping)

unknown

http://ejohn.org/blog/javascript-micro-templating/)

unknown

https://official-mailing.com/favicon.png

188.114.96.3

https://github.com/olado/doT).

unknown

http://ecma-international.org/ecma-262/7.0/#sec-patterns).

unknown

https://github.com/FezVrasta/popper.js/issues/373).

unknown

https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/

unknown

https://promisesaplus.com/#point-75

unknown

https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled

unknown

https://official-mailing.com/assets/images/aftermath/check.svg

188.114.96.3

https://bugs.webkit.org/show_bug.cgi?id=29084

unknown

https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace

unknown

https://fontawesome.com

unknown

https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled

unknown

https://lodash.com/)

unknown

http://www.ecma-international.org/ecma-262/7.0/#sec-function.prototype.apply).

unknown

https://github.com/twbs/bootstrap/graphs/contributors)

unknown

http://www.ecma-international.org/ecma-262/7.0/#sec-tointeger).

unknown

https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon

unknown

http://www.videolan.org/x264.html

unknown

https://bugzilla.mozilla.org/show_bug.cgi?id=687787

unknown

https://official-mailing.com/assets/js/spinner.js

188.114.96.3

https://bugs.chromium.org/p/chromium/issues/detail?id=470258

unknown

https://official-mailing.com/assets/css/style.css

188.114.96.3

https://bugs.jquery.com/ticket/13378

unknown

https://www.quirksmode.org/blog/archives/2014/02/mouse_event_bub.html

unknown

https://mdn.io/clearTimeout).

unknown

https://promisesaplus.com/#point-64

unknown

https://mdn.io/Number/isSafeInteger).

unknown

https://openjsf.org/

unknown

http://eev.ee/blog/2015/09/12/dark-corners-of-unicode/).

unknown

https://promisesaplus.com/#point-61

unknown

https://official-mailing.com/assets/images/aftermath/logo.png

188.114.96.3

https://mdn.io/Number/isNaN)

unknown

http://www.html5rocks.com/en/tutorials/developertools/sourcemaps/#toc-sourceurl)

unknown

https://official-mailing.com/js/main.js

188.114.96.3

https://bugs.chromium.org/p/v8/issues/detail?id=90

unknown

http://dimsemenov.com/plugins/magnific-popup/

unknown

https://html.spec.whatwg.org/#nonce-attributes

unknown

https://mdn.io/toUpperCase).

unknown

https://github.com/jashkenas/underscore/pull/1247

unknown

https://official-mailing.com/assets/fonts/feather-font/css/iconfont.css

188.114.96.3

https://videojs.com/html5-video-support/

unknown

https://official-mailing.com/assets/images/aftermath/footer-bg.png);

unknown

http://ecma-international.org/ecma-262/7.0/#sec-properties-of-the-map-prototype-object)

unknown

https://jsperf.com/getall-vs-sizzle/2

unknown

https://mathiasbynens.be/notes/ambiguous-ampersands)

unknown

https://official-mailing.com/assets/js/template.js

188.114.96.3

https://official-mailing.com/js/jquery.magnific-popup.min.js

188.114.96.3

https://mdn.io/Number/isInteger).

unknown

https://official-mailing.com/cdn-cgi/challenge-platform/scripts/jsd/main.js

188.114.96.3

http://underscorejs.org/LICENSE

unknown

https://developer.mozilla.org/en-US/docs/CSS/display

unknown

http://ecma-international.org/ecma-262/7.0/#sec-ecmascript-function-objects-call-thisargument-argume

unknown

https://bugs.webkit.org/show_bug.cgi?id=156034

unknown

https://jquery.com/

unknown

https://phishedacademy.io

unknown

http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring)

unknown

https://mths.be/he).

unknown

https://mdn.io/String/replace).

unknown

https://official-mailing.com/assets/css/bootstrap.min.css

188.114.96.3

https://official-mailing.com/assets/images/aftermath/icon2.png

188.114.96.3

https://github.com/jquery/sizzle/pull/225

unknown

https://bugs.jquery.com/ticket/4833

unknown

https://mathiasbynens.be/notes/javascript-unicode).

unknown

https://sizzlejs.com/

unknown

https://bugs.chromium.org/p/chromium/issues/detail?id=449857

unknown

https://js.foundation/

unknown

https://bugs.jquery.com/ticket/13393

unknown

https://official-mailing.com

unknown

https://bugs.chromium.org/p/v8/issues/detail?id=2070)

unknown

https://npms.io/search?q=ponyfill.

unknown

https://bugs.webkit.org/show_bug.cgi?id=136851

unknown

https://official-mailing.com/js/app.js

188.114.96.3

https://nodejs.org/api/http.html#http_message_headers

unknown

https://jsperf.com/thor-indexof-vs-for/5

unknown

https://bugs.jquery.com/ticket/12359

unknown

https://mdn.io/Object/assign).

unknown

http://ecma-international.org/ecma-262/7.0/#sec-object.keys)

unknown

https://official-mailing.com/assets/images/aftermath/footer-bg.png

188.114.96.3

https://github.com/FezVrasta/popper.js/pull/715

unknown

http://peter.michaux.ca/articles/lazy-function-definition-pattern)

unknown

https://html.spec.whatwg.org/#strip-and-collapse-whitespace

unknown

http://url.spec.whatwg.org/#urlutils

unknown

https://official-mailing.com/assets/images/aftermath/road.png

188.114.96.3

https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-a

unknown

https://official-mailing.com/assets/images/aftermath/1.png

188.114.96.3

https://drafts.csswg.org/cssom/#common-serializing-idioms

unknown

https://official-mailing.com/nl/login/?tracker=8OyQ79l8fzgMrJewcNuG3bEtcLf5zgt9p0NC

http://ecma-international.org/ecma-262/7.0/#sec-tolength).

unknown

https://github.com/jquery/jquery/pull/557)

unknown

https://mdn.io/Array/slice)

unknown

https://official-mailing.com/assets/images/aftermath/icon.png

188.114.96.3

https://bugs.chromium.org/p/chromium/issues/detail?id=378607

unknown

https://official-mailing.com/cdn-cgi/challenge-platform/h/b/jsd/r/8db278f97e883aa9

188.114.96.3

https://fontawesome.com/license

unknown

https://mdn.io/Number/isFinite).

unknown

There are 90 hidden URLs, click here to show them.

Domains

Name

Malicious

bg.microsoft.map.fastly.net

199.232.210.172

a.nel.cloudflare.com

35.190.80.1

Details

Name:	a.nel.cloudflare.com
IP:	35.190.80.1
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

s-part-0017.t-0009.t-msedge.net

13.107.246.45

www.google.com

142.250.186.68

Details

Name:	www.google.com
IP:	142.250.186.68
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

official-mailing.com

188.114.96.3

Details

Name:	official-mailing.com
IP:	188.114.96.3
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

fp2e7a.wpc.phicdn.net

192.229.221.95

kit-pro.fontawesome.com

unknown

Details

Name:	kit-pro.fontawesome.com
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

142.250.186.68

www.google.com

United States

192.168.2.4

unknown

239.255.255.250

unknown

Reserved

188.114.97.3

unknown

European Union

188.114.96.3

official-mailing.com

European Union

35.190.80.1

a.nel.cloudflare.com

United States

DOM / HTML

URL

Malicious

https://official-mailing.com/nl/login/?tracker=8OyQ79l8fzgMrJewcNuG3bEtcLf5zgt9p0NC

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://official-mailing.com/nl/login/?tracker=8OyQ79l8fzgMrJewcNuG3bEtcLf5zgt9p0NC

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://official-mailing.com/nl/login/?tracker=8OyQ79l8fzgMrJewcNuG3bEtcLf5zgt9p0NC

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
https://official-mailing.com/nl/login/?tracker=8OyQ79l8fzgMrJewcNuG3bEtcLf5zgt9p0NC