Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Download

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1954187670\_metadata\verified_contents.json

JSON data

dropped

Details

File:	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1954187670\_metadata\verified_contents.json
Category:	dropped
Dump:	verified_contents.json.1.dr
ID:	dr_2
Target ID:	1
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	JSON data
Entropy:	6.016932513650603
Encrypted:	false
Ssdeep:	48:p/hKAGj0FnAp7XgNGIaku9E5tPJXaWqkbszesM:R5Gj0FAlsaBmfPsRD3M
Size:	1765
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1954187670\manifest.fingerprint

ASCII text, with no line terminators

dropped

Details

File:	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1954187670\manifest.fingerprint
Category:	dropped
Dump:	manifest.fingerprint.1.dr
ID:	dr_3
Target ID:	1
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with no line terminators
Entropy:	3.9555383032528804
Encrypted:	false
Ssdeep:	3:SWjBMq9+jigBeQrEj3vWXyDt:SW93KBeQIj+XQ
Size:	66
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1954187670\manifest.json

JSON data

dropped

Details

File:	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1954187670\manifest.json
Category:	dropped
Dump:	manifest.json.1.dr
ID:	dr_1
Target ID:	1
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	JSON data
Entropy:	4.169145448714876
Encrypted:	false
Ssdeep:	3:rR6TAulhFphifFY8Wypv/KS1f:F6VlMQyBSS1f
Size:	76
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1954187670\ssl_error_assistant.pb

data

dropped

Details

File:	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3948_1954187670\ssl_error_assistant.pb
Category:	dropped
Dump:	ssl_error_assistant.pb.1.dr
ID:	dr_0
Target ID:	1
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	data
Entropy:	6.108955364911366
Encrypted:	false
Ssdeep:	48:jkbh6AW2Bfc3osI6Hc3+XgU+EVeY55J4gXM/QDH4yq2dxckdfmkM:jkbhM2a3pntgQVb8Ylq2di
Size:	2816
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the system directory	System Summary	Masquerading

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	3948
Target ID:	1
Parent PID:	3256
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3388000
MD5:	E81F54E6C1129887AEA47E7D092680BF
Time:	20:42:48
Date:	13/03/2025
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff63b000000
Modulesize:	3469312
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2012,i,11247473949130860856,15678733379132640968,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:3

Details

Is windows:	true
Is dropped:	false
PID:	4116
Target ID:	4
Parent PID:	3948
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2012,i,11247473949130860856,15678733379132640968,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:3
Size:	3388000
MD5:	E81F54E6C1129887AEA47E7D092680BF
Time:	20:42:52
Date:	13/03/2025
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff63b000000
Modulesize:	3469312
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://s.team-fg.com/p/jjnh-trfg/frmkhpcw/"

Details

Is windows:	true
Is dropped:	false
PID:	4360
Target ID:	13
Parent PID:	3256
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://s.team-fg.com/p/jjnh-trfg/frmkhpcw/"
Size:	3388000
MD5:	E81F54E6C1129887AEA47E7D092680BF
Time:	20:42:58
Date:	13/03/2025
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff63b000000
Modulesize:	3469312
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://s.team-fg.com/p/jjnh-trfg/frmkhpcw/

Details

Filetype:	URL
Filename:	http://s.team-fg.com/p/jjnh-trfg/frmkhpcw/

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Creates files inside the system directory	System Summary	Masquerading
Deletes files inside the Windows folder	System Summary	File Deletion
Detected non-DNS traffic on DNS port	Networking
Classification label	System Summary
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking
Spawns processes	System Summary	Process Injection
Uses HTTPS	Networking	Encrypted Channel Application Layer Protocol
Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis
Found graphical window changes (likely an installer)	System Summary

http://s.team-fg.com/p/jjnh-trfg/frmkhpcw/

185.208.156.194

Details

Name:	http://s.team-fg.com/p/jjnh-trfg/frmkhpcw/
IP:	185.208.156.194
TargetID:	4
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Spawns processes	System Summary	Process Injection

Domains

Name

Malicious

s.team-fg.com

185.208.156.194

Details

Name:	s.team-fg.com
IP:	185.208.156.194
TargetID:	4
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

beacons-handoff.gcp.gvt2.com

142.250.180.67

www.google.com

142.250.186.164

Details

Name:	www.google.com
IP:	142.250.186.164
TargetID:	4
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

beacons.gvt2.com

142.251.143.35

Details

Name:	beacons.gvt2.com
IP:	142.251.143.35
TargetID:	4
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

beacons6.gvt2.com

142.250.185.67

beacons.gcp.gvt2.com

unknown

IPs

Domain

Country

Malicious

185.208.156.194

s.team-fg.com

Switzerland

192.168.2.4

unknown

192.168.2.6

unknown

192.168.2.13

unknown

192.168.2.23

unknown

142.250.186.164

www.google.com

United States

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
http://s.team-fg.com/p/jjnh-trfg/frmkhpcw/

Files

Processes

URLs

Domains

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttp://s.team-fg.com/p/jjnh-trfg/frmkhpcw/

Files

Processes

URLs

Domains

IPs

IOC Report
http://s.team-fg.com/p/jjnh-trfg/frmkhpcw/