Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

wp-4033.html

HTML document, ASCII text, with CRLF line terminators

initial sample

Details

Filetype:	HTML document, ASCII text, with CRLF line terminators
Entropy:	5.470511006435721
Filename:	wp-4033.html
Filesize:	12981
MD5:	6f7e0cd4d5008a7e4722f927601464c2
SHA1:	48cb1046c3995c8b7806a1b04db059fb008ae4d3
SHA256:	3020f226f8bfd344bbb2caacd641557ded1b7967e5c9ab333d9946653ec9c47f
SHA512:	53d6cc12043550236a8f1204c4ba3dbd639ed3dbdec6bb70e5cabd3c2005a27b05ac5ba70389db454ba782f62ae5753a22580f6c0cd88df934faa44d91788bd2
SSDEEP:	192:tVE5lS8Q0U5W57LLJbYBTM1gJ2wPyDlHvhEQQQ8wLa8:bCPtYBow2wPyQQQQP
Preview:	<!DOCTYPE html>..<html>..<head>...<title>404 Not Found</title>..</head>..<body bgcolor="black" text="#ffffff">..<link href="" rel="stylesheet" type="text/css">..<style>...@import url('https://fonts.googleapis.com/css?family=Dosis');...@import url('https:/

Signature Hits	Behavior Group	Mitre Attack
HTML page is missing a favicon	Phishing
URLs found in memory or binary data	Networking

Chrome Cache Entry: 100

Web Open Font Format (Version 2), TrueType, length 14344, version 1.0

downloaded

Details

File:	Chrome Cache Entry: 100
Category:	downloaded
Dump:	chromecache_100.2.dr
ID:	dr_6
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	Web Open Font Format (Version 2), TrueType, length 14344, version 1.0
Entropy:	7.9840148586973285
Encrypted:	false
Ssdeep:	384:QSxlUKMuvYmg5c1bQwJeSsBK062877TDzZaJAVsz:Q4bpAmF1VeS26nxM5
Size:	14344
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 101

PNG image data, 950 x 950, 8-bit/color RGBA, non-interlaced

downloaded

Details

File:	Chrome Cache Entry: 101
Category:	downloaded
Dump:	chromecache_101.2.dr
ID:	dr_7
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 950 x 950, 8-bit/color RGBA, non-interlaced
Entropy:	7.977464041683244
Encrypted:	false
Ssdeep:	12288:J38P2A4z7WMQhkVTiNHLbXIVA4qOwF63qKebKrXP:OPGQRbXPVOebS/
Size:	441600
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 96

PNG image data, 950 x 950, 8-bit/color RGBA, non-interlaced

dropped

Details

File:	Chrome Cache Entry: 96
Category:	dropped
Dump:	chromecache_96.2.dr
ID:	dr_0
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 950 x 950, 8-bit/color RGBA, non-interlaced
Entropy:	7.977464041683244
Encrypted:	false
Ssdeep:	12288:J38P2A4z7WMQhkVTiNHLbXIVA4qOwF63qKebKrXP:OPGQRbXPVOebS/
Size:	441600
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 97

Web Open Font Format (Version 2), TrueType, length 16552, version 1.0

downloaded

Details

File:	Chrome Cache Entry: 97
Category:	downloaded
Dump:	chromecache_97.2.dr
ID:	dr_8
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	Web Open Font Format (Version 2), TrueType, length 16552, version 1.0
Entropy:	7.985287984992894
Encrypted:	false
Ssdeep:	384:7gzTiMXMyWIq95xKev751SeSvjZNfxSqvrwroRb0RPErz/Y61Ml10:MfzxDq9td8rvjzEqvh4Rcrz/gl10
Size:	16552
Whitelisted:	false
Reputation:	timeout

Chrome Cache Entry: 98

ASCII text

downloaded

Details

File:	Chrome Cache Entry: 98
Category:	downloaded
Dump:	chromecache_98.2.dr
ID:	dr_9
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text
Entropy:	5.287103116161011
Encrypted:	false
Ssdeep:	24:81/00OYscwAZzh00OYsatJc+u/r00OYsgwy96cGSSf7:cc0OLwi0OLsJc+uI0OLgN0xD
Size:	1155
Whitelisted:	false
Reputation:	timeout

Chrome Cache Entry: 99

ASCII text

downloaded

Details

File:	Chrome Cache Entry: 99
Category:	downloaded
Dump:	chromecache_99.2.dr
ID:	dr_10
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text
Entropy:	5.42873304356825
Encrypted:	false
Ssdeep:	24:81/POYsVF6SyAZzhPOYsVF6SGtJc+u/rPOYsVF6SOCwy96cGSSf7:cnOLV4IJOLV4HJc+uDOLV4AN0xD
Size:	1197
Whitelisted:	false
Reputation:	timeout

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\wp-4033.html"

Details

Is windows:	true
Is dropped:	false
PID:	1248
Target ID:	0
Parent PID:	2744
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\wp-4033.html"
Size:	3001952
MD5:	290DF23002E9B52249B5549F0C668A86
Time:	07:33:10
Date:	24/12/2024
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76d150000
Modulesize:	3084288
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1852,i,1246780445846859488,14320660525965824350,262144 --variations-seed-version=20241208-180523.718000 --mojo-platform-channel-handle=2248 /prefetch:11

Details

Is windows:	true
Is dropped:	false
PID:	6852
Target ID:	2
Parent PID:	1248
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1852,i,1246780445846859488,14320660525965824350,262144 --variations-seed-version=20241208-180523.718000 --mojo-platform-channel-handle=2248 /prefetch:11
Size:	3001952
MD5:	290DF23002E9B52249B5549F0C668A86
Time:	07:33:11
Date:	24/12/2024
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76d150000
Modulesize:	3084288
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --string-annotations=is-enterprise-managed=no --field-trial-handle=4228,i,1246780445846859488,14320660525965824350,262144 --variations-seed-version=20241208-180523.718000 --mojo-platform-channel-handle=4304 /prefetch:14

Details

Is windows:	true
Is dropped:	false
PID:	7280
Target ID:	22
Parent PID:	1248
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --string-annotations=is-enterprise-managed=no --field-trial-handle=4228,i,1246780445846859488,14320660525965824350,262144 --variations-seed-version=20241208-180523.718000 --mojo-platform-channel-handle=4304 /prefetch:14
Size:	3001952
MD5:	290DF23002E9B52249B5549F0C668A86
Time:	07:35:11
Date:	24/12/2024
Reason:	newprocess
Reputation:	moderate
Is admin:	false
Is elevated:	false
Modulebase:	0x7ff76d150000
Modulesize:	3084288
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

file:///C:/Users/user/Desktop/wp-4033.html

https://res.public.onecdn.static.microsoft/creativeservice/2d863f0f-0fd5-72db-6971-f905df03ef53_3255140379518978990_128000000004796009_assets__image_1709055739600.jpg

184.30.26.134

https://chrome.cloudflare-dns.com/dns-query

162.159.61.3

https://tse1.mm.bing.net/th?id=OADD2.10239381745532_1JDRPDZH72BPX8C2U&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

150.171.27.10

https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Condition/AAei6xJ.png

95.100.135.50

https://tse1.mm.bing.net/th?id=OADD2.10239400982061_1EHZVYH9FVJ5IHVOG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

150.171.27.10

https://cxcs.microsoft.net/api/tips-content/de-ch/xml/tips?release=cobalt&environment=dashboard&resolutionType=merge

23.201.169.47

https://tse1.mm.bing.net/th?id=OADD2.10239400982062_1OH80Z91ZG0E7FIE6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

150.171.27.10

https://Mirror-H.xyz/

unknown

https://assets.msn.com/weathermapdata/1/static/weather/Icons/MSIAWwA=/Alert/Alert_SN_B.png

95.100.135.50

https://ecn.dev.virtualearth.net/REST/v1/Imagery/Map/RoadVibrant/40.7416,-73.9509/13?ms=266,192&ml=Basemap,OsmBuildings,TrafficFlow&key=AuK9Wj9_fIFeSA2BncPNlMXKaYsr9N1FuExVVA5dMSpJYQ8_Ga2AaeMqEE2MT2j6&c=de-ch&fmt=png&od=1&logo=n&da=ro&maxAge=1200&pushpin=40.741644,-73.950879;cls.f

23.199.50.102

https://browser.events.data.msn.cn/OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=c498711f02654edca8a715ca6e1cb4d4-dc31da17-845c-4cca-84e5-547d05dad708-6945&upload-time=1735043581053&w=0&anoncknm=al_app_anon&NoResponseBody=true

20.189.173.11

https://tse1.mm.bing.net/th?id=OADD2.10239381745531_14NMMGXOBD5ROU0L2&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

150.171.27.10

https://tse1.mm.bing.net/th?id=OADD2.10239400907278_18Z8XATNERZPPW6AG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

150.171.27.10

https://i.ibb.co/xzvcd1f/Cyb3r-Drag0nz-Team-1.png

91.134.9.160

https://tse1.mm.bing.net/th?id=OADD2.10239400907277_1XBKHGYGEB4DHBRDY&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

150.171.27.10

There are 6 hidden URLs, click here to show them.

Domains

Name

Malicious

www.google.com

142.250.181.68

Details

Name:	www.google.com
IP:	142.250.181.68
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

ax-0001.ax-msedge.net

150.171.27.10

i.ibb.co

91.134.9.160

Details

Name:	i.ibb.co
IP:	91.134.9.160
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

srtb.msn.com

unknown

tse1.mm.bing.net

unknown

Details

Name:	tse1.mm.bing.net
TargetID:	-1
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Malicious

91.134.9.160

i.ibb.co

France

192.168.2.24

unknown

142.250.181.68

www.google.com

United States

91.134.9.159

unknown

France

DOM / HTML

URL

Malicious

file:///C:/Users/user/Desktop/wp-4033.html

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
wp-4033.php

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportwp-4033.php

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
wp-4033.php