Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Chrome Cache Entry: 43

HTML document, ASCII text

downloaded

Details

File:	Chrome Cache Entry: 43
Category:	downloaded
Dump:	chromecache_43.2.dr
ID:	dr_9
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text
Entropy:	4.857921040274951
Encrypted:	false
Ssdeep:	3:PouV7uJzhquHbttKvYl/UvKX8ZDocWLvYAOIL0NhtvxL0Hac4NGL:hxuJzhqIziY2SX8ZkZvYm4Nhdx434QL
Size:	167
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 44

ASCII text

dropped

Details

File:	Chrome Cache Entry: 44
Category:	dropped
Dump:	chromecache_44.2.dr
ID:	dr_0
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text
Entropy:	4.7537370799412955
Encrypted:	false
Ssdeep:	24:XNstmjdOE1TtFMdZGU79pjHiuNYoSJ7U8ERvuZ+af7jFvqDRObe:XNsQ1TtiSU79pLQw8kbaJqDEbe
Size:	930
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 45

gzip compressed data, from Unix, original size modulo 2^32 7041

downloaded

Details

File:	Chrome Cache Entry: 45
Category:	downloaded
Dump:	chromecache_45.2.dr
ID:	dr_10
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	gzip compressed data, from Unix, original size modulo 2^32 7041
Entropy:	7.903080494163791
Encrypted:	false
Ssdeep:	48:X6XWuBbZF9mJNXXsABFlBcJc4jtZOZMsCLrjPqDdWfsDWxT3:iHFsmAflBsc4jO9CuYfsDGT3
Size:	2153
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 46

ASCII text

downloaded

Details

File:	Chrome Cache Entry: 46
Category:	downloaded
Dump:	chromecache_46.2.dr
ID:	dr_11
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text
Entropy:	4.7537370799412955
Encrypted:	false
Ssdeep:	24:XNstmjdOE1TtFMdZGU79pjHiuNYoSJ7U8ERvuZ+af7jFvqDRObe:XNsQ1TtiSU79pLQw8kbaJqDEbe
Size:	930
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 47

HTML document, ASCII text

downloaded

Details

File:	Chrome Cache Entry: 47
Category:	downloaded
Dump:	chromecache_47.2.dr
ID:	dr_12
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text
Entropy:	5.200917738252535
Encrypted:	false
Ssdeep:	6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoIRVUjFKHA30wcXaoD:J0+oxBeRmR9etdzRxGezHLKFKHM7ma+
Size:	282
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 48

ASCII text, with very long lines (15005)

downloaded

Details

File:	Chrome Cache Entry: 48
Category:	downloaded
Dump:	chromecache_48.2.dr
ID:	dr_13
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (15005)
Entropy:	5.206988093706638
Encrypted:	false
Ssdeep:	384:/yKlnAKXPD899vDMKXExXI7EhgKkVGVXvPGt7MD:hfPD899vDMKHLVGVXvPGNA
Size:	15196
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 49

ASCII text, with very long lines (15005)

dropped

Details

File:	Chrome Cache Entry: 49
Category:	dropped
Dump:	chromecache_49.2.dr
ID:	dr_5
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (15005)
Entropy:	5.206988093706638
Encrypted:	false
Ssdeep:	384:/yKlnAKXPD899vDMKXExXI7EhgKkVGVXvPGt7MD:hfPD899vDMKHLVGVXvPGNA
Size:	15196
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 50

HTML document, ASCII text, with CRLF line terminators

downloaded

Details

File:	Chrome Cache Entry: 50
Category:	downloaded
Dump:	chromecache_50.2.dr
ID:	dr_14
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with CRLF line terminators
Entropy:	4.812662598700002
Encrypted:	false
Ssdeep:	24:hP/hC6UGtsk6uSf7p9Nxtc+fXl6HMOhDsTSBZuvfP2MCO:ta2BTip9N3cUlE1ZBUvfRCO
Size:	1403
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 51

HTML document, ASCII text

downloaded

Details

File:	Chrome Cache Entry: 51
Category:	downloaded
Dump:	chromecache_51.2.dr
ID:	dr_15
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text
Entropy:	5.200917738252535
Encrypted:	false
Ssdeep:	6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoIRVUjFKHA30wcXaoD:J0+oxBeRmR9etdzRxGezHLKFKHM7ma+
Size:	282
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	5264
Target ID:	0
Parent PID:	600
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	00:46:22
Date:	29/08/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2192,i,10110161044368454811,7874456063879550184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	5100
Target ID:	2
Parent PID:	5264
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2192,i,10110161044368454811,7874456063879550184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	00:46:24
Date:	29/08/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://trk.pmifunds.com/y.z?l=http://security1.b-cdn.net&j=375634604&e=3028&p=1&t=h&D6EBE0CCEBB74CE191551D6EE653FA1E"

Details

Is windows:	true
Is dropped:	false
PID:	6476
Target ID:	3
Parent PID:	600
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://trk.pmifunds.com/y.z?l=http://security1.b-cdn.net&j=375634604&e=3028&p=1&t=h&D6EBE0CCEBB74CE191551D6EE653FA1E"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	00:46:27
Date:	29/08/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://trk.pmifunds.com/y.z?l=http://security1.b-cdn.net&j=375634604&e=3028&p=1&t=h&D6EBE0CCEBB74CE191551D6EE653FA1E

104.248.15.35

http://l4wjyimk.zone.investir-sur-mesure.fr/preview/

https://fingerprint.com)

unknown

https://trk.pmifunds.com/z.aspx?page=y&l=http%3a%2f%2fsecurity1.b-cdn.net&j=375634604&e=3028&p=1&t=h&D6EBE0CCEBB74CE191551D6EE653FA1E

104.248.15.35

https://l4wjyimk.zone.investir-sur-mesure.fr/preview

34.233.69.206

http://www.opensource.org/licenses/mit-license.php)

unknown

https://l4wjyimk.zone.investir-sur-mesure.fr/

http://security1.b-cdn.net/

169.150.247.36

https://l4wjyimk.zone.investir-sur-mesure.fr/?_js=_1

34.233.69.206

https://l4wjyimk.zone.investir-sur-mesure.fr/?_r=

34.233.69.206

https://security1.b-cdn.net/

169.150.247.36

http://l4wjyimk.zone.investir-sur-mesure.fr/favicon.ico

52.205.53.110

https://l4wjyimk.zone.investir-sur-mesure.fr/favicon.ico

34.233.69.206

https://openfpcdn.io/botd/v1

3.160.150.40

There are 4 hidden URLs, click here to show them.

Domains

Name

Malicious

openfpcdn.io

3.160.150.40

Details

Name:	openfpcdn.io
IP:	3.160.150.40
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

jngo.net

104.248.15.35

fien-198008767.us-east-1.elb.amazonaws.com

34.233.69.206

www.google.com

142.250.185.132

Details

Name:	www.google.com
IP:	142.250.185.132
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

security1.b-cdn.net

169.150.247.36

Details

Name:	security1.b-cdn.net
IP:	169.150.247.36
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Detected suspicious crossdomain redirect	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

fp2e7a.wpc.phicdn.net

192.229.221.95

l4wjyimk.zone.investir-sur-mesure.fr

unknown

Details

Name:	l4wjyimk.zone.investir-sur-mesure.fr
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

trk.pmifunds.com

unknown

Details

Name:	trk.pmifunds.com
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Detected suspicious crossdomain redirect	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

IPs

Domain

Country

Malicious

3.160.150.111

unknown

United States

52.205.53.110

unknown

United States

142.250.185.132

www.google.com

United States

192.168.2.4

unknown

3.160.150.40

openfpcdn.io

United States

34.233.69.206

fien-198008767.us-east-1.elb.amazonaws.com

United States

169.150.247.36

security1.b-cdn.net

United States

104.248.15.35

jngo.net

United States

239.255.255.250

unknown

Reserved

DOM / HTML

URL

Malicious

http://l4wjyimk.zone.investir-sur-mesure.fr/preview/

Details

Filename:	4.2.pages.html.dom
Url:	http://l4wjyimk.zone.investir-sur-mesure.fr/preview/
Target ID:	2
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2192,i,10110161044368454811,7874456063879550184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Signature Hits	Behavior Group	Mitre Attack
AI detected landing page (webpage, office document or email)	Persistence and Installation Behavior	Browser Extensions

https://l4wjyimk.zone.investir-sur-mesure.fr/

http://l4wjyimk.zone.investir-sur-mesure.fr/preview/

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://trk.pmifunds.com/y.z?l=http://security1.b-cdn.net&j=375634604&e=3028&p=1&t=h&D6EBE0CCEBB74CE191551D6EE653FA1E

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://trk.pmifunds.com/y.z?l=http://security1.b-cdn.net&j=375634604&e=3028&p=1&t=h&D6EBE0CCEBB74CE191551D6EE653FA1E

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
https://trk.pmifunds.com/y.z?l=http://security1.b-cdn.net&j=375634604&e=3028&p=1&t=h&D6EBE0CCEBB74CE191551D6EE653FA1E