Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Chrome Cache Entry: 47

HTML document, ASCII text, with very long lines (3909)

downloaded

Details

File:	Chrome Cache Entry: 47
Category:	downloaded
Dump:	chromecache_47.4.dr
ID:	dr_7
Target ID:	4
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with very long lines (3909)
Entropy:	6.039920236951935
Encrypted:	false
Ssdeep:	192:Iwnb1iC9OA9XXMa9bYnr7JMkrALQDUnulGVopLAGCALQD6vnglET31iCLL3d:rB8HN3DUulGmmv3D6vglETliCfN
Size:	9379
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 48

PNG image data, 947 x 351, 8-bit/color RGBA, non-interlaced

downloaded

Details

File:	Chrome Cache Entry: 48
Category:	downloaded
Dump:	chromecache_48.4.dr
ID:	dr_8
Target ID:	4
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 947 x 351, 8-bit/color RGBA, non-interlaced
Entropy:	7.988033840724363
Encrypted:	false
Ssdeep:	3072:booNIqBlaGmPQHFNI0EN/xxcEX+oZ1ChDRQAalMIcl5lctfzD:booNlajmFQbaEXPggA2MWtfP
Size:	162994
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 49

ASCII text, with CRLF line terminators

downloaded

Details

File:	Chrome Cache Entry: 49
Category:	downloaded
Dump:	chromecache_49.4.dr
ID:	dr_9
Target ID:	4
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.760381897051469
Encrypted:	false
Ssdeep:	48:0phO6FNflPgi2nr1eFj2ERHv65oi0/0CcKRtWFPwxz:Eh1FllYi2r1eVbRHv65o3ZxRtCIxz
Size:	2284
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 50

ASCII text, with no line terminators

downloaded

Details

File:	Chrome Cache Entry: 50
Category:	downloaded
Dump:	chromecache_50.4.dr
ID:	dr_10
Target ID:	4
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with no line terminators
Entropy:	4.567734420933131
Encrypted:	false
Ssdeep:	3:WZoS8/Z5k2N6DthGDthGDthGDthGDthllkKxlkKUxt1:WZoS8/Z7N6GGGGllDxlDgt1
Size:	128
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 51

HTML document, Unicode text, UTF-8 text, with very long lines (339), with CRLF line terminators

downloaded

Details

File:	Chrome Cache Entry: 51
Category:	downloaded
Dump:	chromecache_51.4.dr
ID:	dr_11
Target ID:	4
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, Unicode text, UTF-8 text, with very long lines (339), with CRLF line terminators
Entropy:	4.076492840941168
Encrypted:	false
Ssdeep:	96:mIQIPVuDXjhCttYHW8tdCdtNtKt3t5t2tstpxtMt5tWtPoG:RPVuDTItMOdv0xz8Sbx6nwFV
Size:	9943
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 52

PNG image data, 947 x 351, 8-bit/color RGBA, non-interlaced

dropped

Details

File:	Chrome Cache Entry: 52
Category:	dropped
Dump:	chromecache_52.4.dr
ID:	dr_5
Target ID:	4
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 947 x 351, 8-bit/color RGBA, non-interlaced
Entropy:	7.988033840724363
Encrypted:	false
Ssdeep:	3072:booNIqBlaGmPQHFNI0EN/xxcEX+oZ1ChDRQAalMIcl5lctfzD:booNlajmFQbaEXPggA2MWtfP
Size:	162994
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 53

HTML document, Unicode text, UTF-8 text, with very long lines (339), with CRLF line terminators

downloaded

Details

File:	Chrome Cache Entry: 53
Category:	downloaded
Dump:	chromecache_53.4.dr
ID:	dr_12
Target ID:	4
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, Unicode text, UTF-8 text, with very long lines (339), with CRLF line terminators
Entropy:	4.076492840941168
Encrypted:	false
Ssdeep:	96:mIQIPVuDXjhCttYHW8tdCdtNtKt3t5t2tstpxtMt5tWtPoG:RPVuDTItMOdv0xz8Sbx6nwFV
Size:	9943
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	568
Target ID:	2
Parent PID:	6084
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	02:29:03
Date:	27/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6c4390000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2008,i,11914359049453020221,13615553556127594117,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	3808
Target ID:	4
Parent PID:	568
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2008,i,11914359049453020221,13615553556127594117,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	02:29:05
Date:	27/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6c4390000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://steephan2003.github.io/"

Details

Is windows:	true
Is dropped:	false
PID:	6472
Target ID:	6
Parent PID:	6084
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://steephan2003.github.io/"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	02:29:08
Date:	27/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6c4390000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://steephan2003.github.io/

185.199.110.153

https://steephan2003.github.io/index.html

https://steephan2003.github.io/

https://steephan2003.github.io/fb2.png

185.199.110.153

https://steephan2003.github.io/style.css

185.199.110.153

https://steephan2003.github.io/favicon.ico

185.199.110.153

https://githubstatus.com

unknown

https://help.github.com/pages/

unknown

https://twitter.com/githubstatus

unknown

Domains

Name

Malicious

bg.microsoft.map.fastly.net

199.232.210.172

www.google.com

216.58.206.68

Details

Name:	www.google.com
IP:	216.58.206.68
TargetID:	4
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

steephan2003.github.io

185.199.110.153

Details

Name:	steephan2003.github.io
IP:	185.199.110.153
TargetID:	4
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

IPs

Domain

Country

Malicious

239.255.255.250

unknown

Reserved

192.168.2.7

unknown

185.199.110.153

steephan2003.github.io

Netherlands

216.58.206.68

www.google.com

United States

DOM / HTML

URL

Malicious

https://steephan2003.github.io/

Details

Filename:	0.0.pages.html.dom
Url:	https://steephan2003.github.io/
Target ID:	4
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2008,i,11914359049453020221,13615553556127594117,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Signature Hits	Behavior Group	Mitre Attack
Yara detected HtmlPhish64	Phishing

https://steephan2003.github.io/index.html

Details

Filename:	1.1.pages.html.dom
Url:	https://steephan2003.github.io/index.html
Target ID:	4
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2008,i,11914359049453020221,13615553556127594117,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Signature Hits	Behavior Group	Mitre Attack
Yara detected HtmlPhish64	Phishing

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
http://steephan2003.github.io/

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttp://steephan2003.github.io/

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
http://steephan2003.github.io/