Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1940,i,4945317571024713380,2874552796453635385,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://jeevankiranfoundationcenter.co.in/css/rrp.htm"

C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe

"C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe

"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe

"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfozupfk.exe"

C:\Windows\SysWOW64\unarchiver.exe

"C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Tax Payment Challan.zip"

C:\Windows\SysWOW64\7za.exe

"C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\e3mjp5er.s51" "C:\Users\user\Downloads\Tax Payment Challan.zip"

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C "C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\Tax Payment Challan.exe"

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c C:\Users\user\AppData\Local\Temp\NewBitmapImage.bmp

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

There are 3 hidden processes, click here to show them.

URLs

Name

Malicious

http://jeevankiranfoundationcenter.co.in/css/rrp.htm

Details

Filetype:	URL
Filename:	http://jeevankiranfoundationcenter.co.in/css/rrp.htm

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for dropped file	AV Detection
Multi AV Scanner detection for domain / URL	AV Detection
Multi AV Scanner detection for dropped file	AV Detection	Masquerading
Yara detected Kutaki Keylogger	Key, Mouse, Clipboard, Microphone and Screen Capturing
Downloads suspicious files via Chrome	System Summary
Drops PE files to the startup folder	Boot Survival
Machine Learning detection for dropped file	AV Detection
AV process strings found (often used to terminate AV products)	Lowering of HIPS / PFW / Operating System Security Settings
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Creates a start menu entry (Start Menu\Programs\Startup)	Boot Survival
Detected non-DNS traffic on DNS port	Networking
Drops PE files	Persistence and Installation Behavior
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
PE file contains an invalid checksum	Data Obfuscation
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
Sample execution stops while process was sleeping (likely an evasion)	Malware Analysis System Evasion
Sigma detected: Startup Folder File Write	System Summary
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder
Binary contains paths to development resources	System Summary
Classification label	System Summary
Connects to IPs without corresponding DNS lookups	Networking
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Creates mutexes	System Summary
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Downloads compressed data via HTTP	Networking
Downloads files from webservers via HTTP	Networking	Ingress Tool Transfer
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
Performs DNS lookups	Networking	Non-Application Layer Protocol Application Layer Protocol
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	System Information Discovery
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary
Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior
Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.
Spawns processes	System Summary	Process Injection
Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)	Networking
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Uses HTTPS	Networking	Encrypted Channel
Uses an in-process (OLE) Automation server	System Summary
Uses new MSVCR Dlls	Compliance, System Summary
Uses secure TLS version for HTTPS connections	Compliance, Networking
Found graphical window changes (likely an installer)	System Summary

http://upx.sf.net

unknown

http://justwantlove.lol/wp-content/Tax%20Payment%20Challan.zip

23.94.221.14

http://jeevankiranfoundationcenter.co.in/favicon.ico

103.21.58.228

http://jeevankiranfoundationcenter.co.in/css/rrp.htm

Details

Name:	http://jeevankiranfoundationcenter.co.in/css/rrp.htm
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	browser

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Spawns processes	System Summary	Process Injection

Domains

Name

Malicious

justwantlove.lol

23.94.221.14

Details

Name:	justwantlove.lol
IP:	23.94.221.14
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

jeevankiranfoundationcenter.co.in

103.21.58.228

Details

Name:	jeevankiranfoundationcenter.co.in
IP:	103.21.58.228
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

www.google.com

142.250.74.196

Details

Name:	www.google.com
IP:	142.250.74.196
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

fp2e7a.wpc.phicdn.net

192.229.221.95

241.42.69.40.in-addr.arpa

unknown

IPs

Domain

Country

Malicious

23.94.221.14

justwantlove.lol

United States

239.255.255.250

unknown

Reserved

103.21.58.228

jeevankiranfoundationcenter.co.in

United Arab Emirates

142.250.185.132

unknown

United States

192.168.2.4

unknown

142.250.74.196

www.google.com

United States

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\C:\Users\user\AppData\Local\Temp\e3mjp5er.s51\namebro

namebro

HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\namebro

namebro

HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vbnbnbv

vbnbnbv