Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Chrome Cache Entry: 43

HTML document, ASCII text, with very long lines (522)

dropped

Details

File:	Chrome Cache Entry: 43
Category:	dropped
Dump:	chromecache_43.2.dr
ID:	dr_5
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with very long lines (522)
Entropy:	4.620225065066007
Encrypted:	false
Ssdeep:	384:7MLzDcD2sNHNB+7OrXdzmGQBByP5EEDzEDi/ihH:oLp6tB+74XdzmG8yP5EEDzEm6hH
Size:	24826
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 44

HTML document, ASCII text, with very long lines (394)

downloaded

Details

File:	Chrome Cache Entry: 44
Category:	downloaded
Dump:	chromecache_44.2.dr
ID:	dr_6
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with very long lines (394)
Entropy:	5.089240897577867
Encrypted:	false
Ssdeep:	96:1j9jwIjYjUDK/D5DMF+BOis35A2ZLimWrR49PaQxJbGD:1j9jhjYjIK/Vo+ts3zZOmWrO9ieJGD
Size:	4394
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 45

PNG image data, 54 x 54, 8-bit colormap, non-interlaced

dropped

Details

File:	Chrome Cache Entry: 45
Category:	dropped
Dump:	chromecache_45.2.dr
ID:	dr_1
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 54 x 54, 8-bit colormap, non-interlaced
Entropy:	7.0936408308765495
Encrypted:	false
Ssdeep:	12:6v/7EljW8E6Cl2SYh8SZM4tf70FSDvMXDxJp6ScFChY9:U8hCl2SIdZBtAFSDUX/ozIhK
Size:	452
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 46

HTML document, ASCII text, with very long lines (522)

downloaded

Details

File:	Chrome Cache Entry: 46
Category:	downloaded
Dump:	chromecache_46.2.dr
ID:	dr_7
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with very long lines (522)
Entropy:	4.620225065066007
Encrypted:	false
Ssdeep:	384:7MLzDcD2sNHNB+7OrXdzmGQBByP5EEDzEDi/ihH:oLp6tB+74XdzmG8yP5EEDzEm6hH
Size:	24826
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 47

PNG image data, 54 x 54, 8-bit colormap, non-interlaced

downloaded

Details

File:	Chrome Cache Entry: 47
Category:	downloaded
Dump:	chromecache_47.2.dr
ID:	dr_8
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 54 x 54, 8-bit colormap, non-interlaced
Entropy:	7.0936408308765495
Encrypted:	false
Ssdeep:	12:6v/7EljW8E6Cl2SYh8SZM4tf70FSDvMXDxJp6ScFChY9:U8hCl2SIdZBtAFSDUX/ozIhK
Size:	452
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 48

ASCII text, with very long lines (24050)

downloaded

Details

File:	Chrome Cache Entry: 48
Category:	downloaded
Dump:	chromecache_48.2.dr
ID:	dr_9
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (24050)
Entropy:	4.941039417164537
Encrypted:	false
Ssdeep:	192:VuR/6okgTQwq23gGM8lUR9YRGQ2BwoX6zp+1+nDT1FvxKSI7/UsV7MSE6XZ2dKzk:JwV+oUcoQJpdf1dxKSI7/Ue7ZX2qk
Size:	24051
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	5016
Target ID:	0
Parent PID:	6084
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	23:10:54
Date:	27/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1956,i,14141055482816760328,6578647326164265844,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	3852
Target ID:	2
Parent PID:	5016
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1956,i,14141055482816760328,6578647326164265844,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	23:10:57
Date:	27/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://project-may10.pages.dev/"

Details

Is windows:	true
Is dropped:	false
PID:	5536
Target ID:	3
Parent PID:	6084
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://project-may10.pages.dev/"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	23:10:59
Date:	27/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://project-may10.pages.dev/

https://www.cloudflare.com/learning/access-management/phishing-attack/

unknown

https://project-may10.pages.dev/cdn-cgi/styles/cf.errors.css

172.66.44.124

https://ipwho.is/?lang=en

unknown

https://code.jquery.com/jquery-1.4.4.min.js

unknown

https://project-may10.pages.dev/cdn-cgi/images/icon-exclamation.png?1376755637

172.66.44.124

https://www.clarity.ms/tag/

unknown

https://project-may10.pages.dev/

https://www.cloudflare.com/5xx-error-landing

unknown

https://project-may10.pages.dev/favicon.ico

172.66.44.124

Domains

Name

Malicious

bg.microsoft.map.fastly.net

199.232.210.172

www.google.com

142.250.74.196

Details

Name:	www.google.com
IP:	142.250.74.196
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

project-may10.pages.dev

172.66.44.124

Details

Name:	project-may10.pages.dev
IP:	172.66.44.124
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

fp2e7a.wpc.phicdn.net

192.229.221.95

IPs

Domain

Country

Malicious

239.255.255.250

unknown

Reserved

172.66.44.124

project-may10.pages.dev

United States

192.168.2.6

unknown

142.250.74.196

www.google.com

United States

192.168.2.5

unknown

DOM / HTML

URL

Malicious

https://project-may10.pages.dev/

Details

Filename:	0.0.pages.html.dom
Url:	https://project-may10.pages.dev/
Target ID:	2
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1956,i,14141055482816760328,6578647326164265844,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Signature Hits	Behavior Group	Mitre Attack
Yara detected BlockedWebSite	Phishing

https://project-may10.pages.dev/

Details

Filename:	0.1.pages.html.dom
Url:	https://project-may10.pages.dev/
Target ID:	2
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1956,i,14141055482816760328,6578647326164265844,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Signature Hits	Behavior Group	Mitre Attack
Yara detected BlockedWebSite	Phishing

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
http://project-may10.pages.dev/

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttp://project-may10.pages.dev/

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
http://project-may10.pages.dev/