Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	6508
Target ID:	0
Parent PID:	5684
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	20:42:26
Date:	28/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2216,i,15688305158043855133,10145687012270612040,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	4060
Target ID:	2
Parent PID:	6508
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2216,i,15688305158043855133,10145687012270612040,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	20:42:30
Date:	28/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://services-accountau.com/"

Details

Is windows:	true
Is dropped:	false
PID:	3080
Target ID:	3
Parent PID:	5684
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://services-accountau.com/"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	20:42:33
Date:	28/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://services-accountau.com/

https://services-accountau.com//Page/current_time

193.143.1.14

https://services-accountau.com/las/mygov-login?execution=e2s1&_eventId=resetpassword

https://services-accountau.com//gov_bank/css/blugov.css

193.143.1.14

https://services-accountau.com//gov_bank/img/myGov-cobranded-logo-black.svg

193.143.1.14

https://services-accountau.com//gov_bank/css/mgv2-application.css

193.143.1.14

https://services-accountau.com//js/option.js

193.143.1.14

https://services-accountau.com//gov_bank/img/myGov-cobranded-logo-white.svg

193.143.1.14

https://services-accountau.com/las/mygov-login?execution=e2s1&_eventId=close

https://services-accountau.com//gov_bank/icons/blugov-left-chevron-dark.svg

193.143.1.14

https://services-accountau.com/mygov/content/mgv2/icons/favicon-32x32.png

193.143.1.14

https://services-accountau.com//js/browser.js

193.143.1.14

https://services-accountau.com/mygov/content/mgv2/icons/favicon-16x16.png

193.143.1.14

https://services-accountau.com/las/mygov-login?execution=e2s1&_eventId=recoverusername

https://services-accountau.com//gov_bank/blugov/M-myGov-Coloured%20Line.svg

193.143.1.14

https://bugs.webkit.org/show_bug.cgi?id=136851

unknown

https://html.spec.whatwg.org/#strip-and-collapse-whitespace

unknown

https://github.com/jquery/sizzle/issues/157)

unknown

https://promisesaplus.com/#point-75

unknown

https://drafts.csswg.org/cssom/#common-serializing-idioms

unknown

https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled

unknown

https://bugs.webkit.org/show_bug.cgi?id=29084

unknown

https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace

unknown

https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled

unknown

https://github.com/jquery/jquery/pull/557)

unknown

https://bugs.chromium.org/p/chromium/issues/detail?id=378607

unknown

https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon

unknown

https://bugzilla.mozilla.org/show_bug.cgi?id=687787

unknown

https://bugs.chromium.org/p/chromium/issues/detail?id=470258

unknown

https://promisesaplus.com/#point-64

unknown

https://promisesaplus.com/#point-61

unknown

https://drafts.csswg.org/cssom/#resolved-values

unknown

https://bugs.chromium.org/p/chromium/issues/detail?id=589347

unknown

https://html.spec.whatwg.org/#nonce-attributes

unknown

https://html.spec.whatwg.org/multipage/syntax.html#attributes-2

unknown

https://promisesaplus.com/#point-59

unknown

https://github.com/harvesthq/chosen

unknown

https://jsperf.com/getall-vs-sizzle/2

unknown

https://promisesaplus.com/#point-57

unknown

https://promisesaplus.com/#point-54

unknown

https://drafts.csswg.org/selectors/#relational

unknown

https://html.spec.whatwg.org/multipage/forms.html#category-listed

unknown

https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled

unknown

https://developer.mozilla.org/en-US/docs/CSS/display

unknown

https://jquery.org/license

unknown

https://github.com/harvesthq/chosen/blob/master/LICENSE.md

unknown

https://jquery.com/

unknown

https://code.jquery.com/jquery-3.7.0.js

151.101.194.137

https://bugs.webkit.org/show_bug.cgi?id=137337

unknown

https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled

unknown

https://promisesaplus.com/#point-48

unknown

https://github.com/jquery/sizzle/issues/299)

unknown

https://github.com/jquery/sizzle/pull/225

unknown

https://github.com/whatwg/html/issues/2369

unknown

https://bugs.chromium.org/p/chromium/issues/detail?id=449857

unknown

http://getharvest.com

unknown

https://bugs.jquery.com/ticket/13393

unknown

There are 47 hidden URLs, click here to show them.

Domains

Name

Malicious

services-accountau.com

193.143.1.14

Details

Name:	services-accountau.com
IP:	193.143.1.14
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
AI detected phishing page	Phishing
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

code.jquery.com

151.101.194.137

Details

Name:	code.jquery.com
IP:	151.101.194.137
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

www.google.com

142.250.186.132

Details

Name:	www.google.com
IP:	142.250.186.132
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

fp2e7a.wpc.phicdn.net

192.229.221.95

IPs

Domain

Country

Malicious

193.143.1.14

services-accountau.com

unknown

192.168.2.4

unknown

192.168.2.6

unknown

151.101.130.137

unknown

United States

239.255.255.250

unknown

Reserved

142.250.186.132

www.google.com

United States

151.101.194.137

code.jquery.com

United States

DOM / HTML

URL

Malicious

https://services-accountau.com/

Details

Filename:	0.0.pages.html.dom
Url:	https://services-accountau.com/
Target ID:	2
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2216,i,15688305158043855133,10145687012270612040,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Signature Hits	Behavior Group	Mitre Attack
AI detected phishing page	Phishing

https://services-accountau.com/

https://services-accountau.com/las/mygov-login?execution=e2s1&_eventId=recoverusername

https://services-accountau.com/las/mygov-login?execution=e2s1&_eventId=resetpassword

https://services-accountau.com/las/mygov-login?execution=e2s1&_eventId=close

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://services-accountau.com/

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://services-accountau.com/

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
https://services-accountau.com/