Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

C:\Users\user\Downloads\24ff2e2c-e9b3-41ce-88c4-8d24dce3b92d.tmp

XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (11393)

dropped

Details

File:	C:\Users\user\Downloads\24ff2e2c-e9b3-41ce-88c4-8d24dce3b92d.tmp
Category:	dropped
Dump:	24ff2e2c-e9b3-41ce-88c4-8d24dce3b92d.tmp.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (11393)
Entropy:	6.084566779155175
Encrypted:	false
Ssdeep:	192:fqxsLbn7efrQLyi1s/x3NefrQLyi1ezIkS5KziirZHRIWOuAbTflVVnJbA:BLbfyiq/lNyi4IkS5n81RIxuSV2
Size:	13596
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the user directory	System Summary	Masquerading

C:\Users\user\Downloads\Unconfirmed 507367.crdownload (copy)

XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (11393)

dropped

Details

File:	C:\Users\user\Downloads\Unconfirmed 507367.crdownload (copy)
Category:	dropped
Dump:	24ff2e2c-e9b3-41ce-88c4-8d24dce3b92d.tmp.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (11393)
Entropy:	6.084566779155175
Encrypted:	false
Ssdeep:	192:fqxsLbn7efrQLyi1s/x3NefrQLyi1ezIkS5KziirZHRIWOuAbTflVVnJbA:BLbfyiq/lNyi4IkS5n81RIxuSV2
Size:	13596
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 43

XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (11393)

downloaded

Details

File:	Chrome Cache Entry: 43
Category:	downloaded
Dump:	chromecache_43.2.dr
ID:	dr_3
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (11393)
Entropy:	6.084566779155175
Encrypted:	false
Ssdeep:	192:fqxsLbn7efrQLyi1s/x3NefrQLyi1ezIkS5KziirZHRIWOuAbTflVVnJbA:BLbfyiq/lNyi4IkS5n81RIxuSV2
Size:	13596
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	7092
Target ID:	0
Parent PID:	5840
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	13:56:21
Date:	30/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6c4390000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=1712,i,10409865053093719078,10940050848297659008,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	3820
Target ID:	2
Parent PID:	7092
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 --field-trial-handle=1712,i,10409865053093719078,10940050848297659008,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	13:56:24
Date:	30/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6c4390000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://deublin.portalapi.us.clicklearn.com/api/Common/DownloadClickLearnStudio?Identification=aHR0cHM6Ly9kZXVibGluLnBvcnRhbGFwaS51cy5jbGlja2xlYXJuLmNvbS98YzMzODdiZmEtOWY2Ny00YzM1LWIxNGYtMzcyYzc4MDczMDNi"

Details

Is windows:	true
Is dropped:	false
PID:	5600
Target ID:	7
Parent PID:	5840
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://deublin.portalapi.us.clicklearn.com/api/Common/DownloadClickLearnStudio?Identification=aHR0cHM6Ly9kZXVibGluLnBvcnRhbGFwaS51cy5jbGlja2xlYXJuLmNvbS98YzMzODdiZmEtOWY2Ny00YzM1LWIxNGYtMzcyYzc4MDczMDNi"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	13:56:26
Date:	30/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6c4390000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://deublin.portalapi.us.clicklearn.com/api/Common/DownloadClickLearnStudio?Identification=aHR0cHM6Ly9kZXVibGluLnBvcnRhbGFwaS51cy5jbGlja2xlYXJuLmNvbS98YzMzODdiZmEtOWY2Ny00YzM1LWIxNGYtMzcyYzc4MDczMDNi

Details

Filetype:	URL
Filename:	https://deublin.portalapi.us.clicklearn.com/api/Common/DownloadClickLearnStudio?Identification=aHR0cHM6Ly9kZXVibGluLnBvcnRhbGFwaS51cy5jbGlja2xlYXJuLmNvbS98YzMzODdiZmEtOWY2Ny00YzM1LWIxNGYtMzcyYzc4MDczMDNi

Signature Hits	Behavior Group	Mitre Attack
Detected non-DNS traffic on DNS port	Networking
Classification label	System Summary
Connects to IPs without corresponding DNS lookups	Networking
Creates files inside the user directory	System Summary	Masquerading
Downloads files from webservers via HTTP	Networking	Non-Application Layer Protocol Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Uses HTTPS	Networking	Encrypted Channel
Uses secure TLS version for HTTPS connections	Compliance, Networking
Found graphical window changes (likely an installer)	System Summary

https://apps.clicklearn.com/Studio12/CLStudio.application?clidentification=aHR0cHM6Ly9kZXVibGluLnBvcnRhbGFwaS51cy5jbGlja2xlYXJuLmNvbS98YzMzODdiZmEtOWY2Ny00YzM1LWIxNGYtMzcyYzc4MDczMDNi

152.199.21.175

http://www.clicklearn.com/

unknown

https://apps.clicklearn.com/Studio12/CLStudio.application

unknown

13.107.246.60

Details

Name:	https://deublin.portalapi.us.clicklearn.com/api/Common/DownloadClickLearnStudio?Identification=aHR0cHM6Ly9kZXVibGluLnBvcnRhbGFwaS51cy5jbGlja2xlYXJuLmNvbS98YzMzODdiZmEtOWY2Ny00YzM1LWIxNGYtMzcyYzc4MDczMDNi
IP:	13.107.246.60
TargetID:	2
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

Domains

Name

Malicious

bg.microsoft.map.fastly.net

199.232.214.172

www.google.com

142.250.186.164

Details

Name:	www.google.com
IP:	142.250.186.164
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com

217.20.57.34

s-part-0032.t-0009.t-msedge.net

13.107.246.60

sni1gl.wpc.deltacdn.net

152.199.21.175

15.164.165.52.in-addr.arpa

unknown

apps.clicklearn.com

unknown

Details

Name:	apps.clicklearn.com
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

deublin.portalapi.us.clicklearn.com

unknown

Details

Name:	deublin.portalapi.us.clicklearn.com
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

IPs

Domain

Country

Malicious

142.250.184.196

unknown

United States

239.255.255.250

unknown

Reserved

152.199.21.175

sni1gl.wpc.deltacdn.net

United States

142.250.186.164

www.google.com

United States

192.168.2.7

unknown

13.107.246.60

s-part-0032.t-0009.t-msedge.net

United States

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://deublin.portalapi.us.clicklearn.com/api/Common/DownloadClickLearnStudio?Identification=aHR0cHM6Ly9kZXVibGluLnBvcnRhbGFwaS51cy5jbGlja2xlYXJuLmNvbS98YzMzODdiZmEtOWY2Ny00YzM1LWIxNGYtMzcyYzc4MDczMDNi

Files

Processes

URLs

Domains

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://deublin.portalapi.us.clicklearn.com/api/Common/DownloadClickLearnStudio?Identification=aHR0cHM6Ly9kZXVibGluLnBvcnRhbGFwaS51cy5jbGlja2xlYXJuLmNvbS98YzMzODdiZmEtOWY2Ny00YzM1LWIxNGYtMzcyYzc4MDczMDNi

Files

Processes

URLs

Domains

IPs

IOC Report
https://deublin.portalapi.us.clicklearn.com/api/Common/DownloadClickLearnStudio?Identification=aHR0cHM6Ly9kZXVibGluLnBvcnRhbGFwaS51cy5jbGlja2xlYXJuLmNvbS98YzMzODdiZmEtOWY2Ny00YzM1LWIxNGYtMzcyYzc4MDczMDNi