Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

httpsworker-nameless-haze-86e5.berwieberwieberwieberwieberwie.workers.deveba=.htm

HTML document, Unicode text, UTF-8 text, with CRLF line terminators

initial sample

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 17:11:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 17:11:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 17:11:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 17:11:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Chrome Cache Entry: 100

ASCII text, with very long lines (32793), with CRLF line terminators

downloaded

Chrome Cache Entry: 101

HTML document, Unicode text, UTF-8 text, with very long lines (2830), with CRLF line terminators

downloaded

Chrome Cache Entry: 102

HTML document, Unicode text, UTF-8 text, with very long lines (2830), with CRLF line terminators

dropped

Chrome Cache Entry: 103

ASCII text, with very long lines (47992), with no line terminators

dropped

Chrome Cache Entry: 104

HTML document, Unicode text, UTF-8 text, with very long lines (2830), with CRLF line terminators

downloaded

Chrome Cache Entry: 105

ASCII text, with very long lines (45034)

downloaded

Chrome Cache Entry: 106

ASCII text, with very long lines (47992), with no line terminators

downloaded

Chrome Cache Entry: 107

HTML document, ASCII text, with very long lines (1350), with CRLF line terminators

downloaded

Chrome Cache Entry: 108

HTML document, Unicode text, UTF-8 text, with very long lines (2830), with CRLF line terminators

dropped

Chrome Cache Entry: 109

ASCII text, with very long lines (65447)

downloaded

Chrome Cache Entry: 110

HTML document, ASCII text, with no line terminators

downloaded

Chrome Cache Entry: 111

HTML document, ASCII text

downloaded

Chrome Cache Entry: 94

ASCII text, with very long lines (65447)

dropped

Chrome Cache Entry: 95

HTML document, Unicode text, UTF-8 text, with very long lines (2830), with CRLF line terminators

downloaded

Chrome Cache Entry: 96

ASCII text, with very long lines (47992), with no line terminators

downloaded

Chrome Cache Entry: 97

ASCII text, with very long lines (45034)

dropped

Chrome Cache Entry: 98

ASCII text, with very long lines (32961), with CRLF line terminators

dropped

Chrome Cache Entry: 99

HTML document, ASCII text, with very long lines (440), with CRLF line terminators

dropped

There are 15 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\httpsworker-nameless-haze-86e5.berwieberwieberwieberwieberwie.workers.deveba=.htm"

Details

Is windows:	true
Is dropped:	false
PID:	3752
Target ID:	0
Parent PID:	5748
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\httpsworker-nameless-haze-86e5.berwieberwieberwieberwieberwie.workers.deveba=.htm"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	14:11:08
Date:	27/08/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=2108,i,18282856199490387947,11030613626168180458,262144 /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	6276
Target ID:	2
Parent PID:	3752
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=2108,i,18282856199490387947,11030613626168180458,262144 /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	14:11:13
Date:	27/08/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://glansaolksnu.ru//

104.21.51.138

https://glansaolksnu.ru///7627.php

104.21.51.138

https://www.estampariaimagemeacao.com.br/js/images/tvavx.php

https://www.estampariaimagemeacao.com.br/js/images/tvavx.php?1-44636c424373417744415042487958332f735a466b5979684a6144513939655850637a6d4f6476586e4a476f4b454d68563149674d716973446c487154376c5a4362385062384e6a68355948316a642f-dauber

45.164.92.188

https://ahdjajsdgagsjhfgdfdhafghjafgfdjgahdfgsgdfghdsnmfbsds.pages.dev/

172.66.47.111

file:///C:/Users/user/Desktop/httpsworker-nameless-haze-86e5.berwieberwieberwieberwieberwie.workers.deveba=.htm

https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js

104.17.25.14

https://cdn.jsdelivr.net/npm/

unknown

https://cdn.jsdelivr.net/npm/bootstrap

unknown

https://glansaolksnu.ru/#modern-supercars

unknown

https://code.jquery.com/jquery-3.6.0.min.js

151.101.2.137

https://code.jquery.com/jquery-3.5.1.slim.min.js

unknown

https://glansaolksnu.ru/#privacy

unknown

https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js

unknown

https://challenges.cloudflare.com/turnstile/v0/api.js

104.18.94.41

https://ahdjajsdgagsjhfgdfdhafghjafgfdjgahdfgsgdfghdsnmfbsds.pages.dev/favicon.ico

172.66.47.111

https://ahdjajsdgagsjhfgdfdhafghjafgfdjgahdfgsgdfghdsnmfbsds.pages.dev/,

172.66.47.111

https://glansaolksnu.ru/#electric-vehicles

unknown

https://glansaolksnu.ru/#classic-cars

unknown

https://glansaolksnu.ru/#learn-more

unknown

https://glansaolksnu.ru/#

unknown

https://glansaolksnu.ru/#faq

unknown

https://www.estampariaimagemeacao.com.br/favicon.ico

45.164.92.188

https://challenges.cloudflare.com/turnstile/v0/b/6790c32b9fc9/api.js

104.18.94.41

https://glansaolksnu.ru/#about

unknown

https://glansaolksnu.ru/#services

unknown

https://glansaolksnu.ru/#contact

unknown

https://glansaolksnu.ru/#terms

unknown

There are 18 hidden URLs, click here to show them.

Domains

Name

Malicious

ahdjajsdgagsjhfgdfdhafghjafgfdjgahdfgsgdfghdsnmfbsds.pages.dev

172.66.47.111

Details

Name:	ahdjajsdgagsjhfgdfdhafghjafgfdjgahdfgsgdfghdsnmfbsds.pages.dev
IP:	172.66.47.111
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
HTML file submission requesting Cloudflare captcha challenge	Data Obfuscation
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

cdnjs.cloudflare.com

104.17.25.14

Details

Name:	cdnjs.cloudflare.com
IP:	104.17.25.14
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)	Phishing	Scripting Deobfuscate/Decode Files or Information
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

glansaolksnu.ru

104.21.51.138

Details

Name:	glansaolksnu.ru
IP:	104.21.51.138
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
HTML page contains hidden URLs	Phishing
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

code.jquery.com

151.101.2.137

Details

Name:	code.jquery.com
IP:	151.101.2.137
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

challenges.cloudflare.com

104.18.94.41

Details

Name:	challenges.cloudflare.com
IP:	104.18.94.41
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

www.google.com

108.177.122.105

Details

Name:	www.google.com
IP:	108.177.122.105
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

estampariaimagemeacao.com.br

45.164.92.188

Details

Name:	estampariaimagemeacao.com.br
IP:	45.164.92.188
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol

www.estampariaimagemeacao.com.br

unknown

Details

Name:	www.estampariaimagemeacao.com.br
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Malicious

104.21.51.138

glansaolksnu.ru

United States

172.66.47.111

ahdjajsdgagsjhfgdfdhafghjafgfdjgahdfgsgdfghdsnmfbsds.pages.dev

United States

104.17.25.14

cdnjs.cloudflare.com

United States

104.17.24.14

unknown

United States

172.66.44.145

unknown

United States

104.18.94.41

challenges.cloudflare.com

United States

192.168.2.17

unknown

192.168.2.8

unknown

192.168.2.7

unknown

192.168.2.5

unknown

151.101.130.137

unknown

United States

151.101.2.137

code.jquery.com

United States

239.255.255.250

unknown

Reserved

45.164.92.188

estampariaimagemeacao.com.br

Brazil

108.177.122.105

www.google.com

United States

There are 5 hidden IPs, click here to show them.

DOM / HTML

URL

Malicious

https://ahdjajsdgagsjhfgdfdhafghjafgfdjgahdfgsgdfghdsnmfbsds.pages.dev/#YY2Fyb2xpbmUudmlhbm5hQGdsb2JhbGZvdW5kcmllcy5jb20=

Details

Filename:	4.2.pages.html.dom
Url:	https://ahdjajsdgagsjhfgdfdhafghjafgfdjgahdfgsgdfghdsnmfbsds.pages.dev/#YY2Fyb2xpbmUudmlhbm5hQGdsb2JhbGZvdW5kcmllcy5jb20=
Target ID:	2
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=2108,i,18282856199490387947,11030613626168180458,262144 /prefetch:8

Signature Hits	Behavior Group	Mitre Attack
Yara detected HtmlPhish70	Phishing

https://ahdjajsdgagsjhfgdfdhafghjafgfdjgahdfgsgdfghdsnmfbsds.pages.dev/#YY2Fyb2xpbmUudmlhbm5hQGdsb2JhbGZvdW5kcmllcy5jb20=

Details

Filename:	4.3.pages.html.dom
Url:	https://ahdjajsdgagsjhfgdfdhafghjafgfdjgahdfgsgdfghdsnmfbsds.pages.dev/#YY2Fyb2xpbmUudmlhbm5hQGdsb2JhbGZvdW5kcmllcy5jb20=
Target ID:	2
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=2108,i,18282856199490387947,11030613626168180458,262144 /prefetch:8

Signature Hits	Behavior Group	Mitre Attack
Yara detected HtmlPhish10	Phishing

https://ahdjajsdgagsjhfgdfdhafghjafgfdjgahdfgsgdfghdsnmfbsds.pages.dev/#YY2Fyb2xpbmUudmlhbm5hQGdsb2JhbGZvdW5kcmllcy5jb20=

Details

Filename:	4.4.pages.html.dom
Url:	https://ahdjajsdgagsjhfgdfdhafghjafgfdjgahdfgsgdfghdsnmfbsds.pages.dev/#YY2Fyb2xpbmUudmlhbm5hQGdsb2JhbGZvdW5kcmllcy5jb20=
Target ID:	2
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=2108,i,18282856199490387947,11030613626168180458,262144 /prefetch:8

Signature Hits	Behavior Group	Mitre Attack
Yara detected HtmlPhish10	Phishing

file:///C:/Users/user/Desktop/httpsworker-nameless-haze-86e5.berwieberwieberwieberwieberwie.workers.deveba=.htm

https://www.estampariaimagemeacao.com.br/js/images/tvavx.php

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
httpsworker-nameless-haze-86e5.berwieberwieberwieberwieberwie.workers.deveba=.htm

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttpsworker-nameless-haze-86e5.berwieberwieberwieberwieberwie.workers.deveba=.htm

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
httpsworker-nameless-haze-86e5.berwieberwieberwieberwieberwie.workers.deveba=.htm