Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Chrome Cache Entry: 84

MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel

dropped

Details

File:	Chrome Cache Entry: 84
Category:	dropped
Dump:	chromecache_84.2.dr
ID:	dr_0
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Entropy:	5.104352236785294
Encrypted:	false
Ssdeep:	384:9FMKxxje8gZryMDXe3ibKSo3MdXA1SPrQHg4M:bpr68gVy1i2SzdXA1wrQHg4M
Size:	32038
Whitelisted:	true
Reputation:	low

Chrome Cache Entry: 85

HTML document, ASCII text, with CRLF line terminators

downloaded

Details

File:	Chrome Cache Entry: 85
Category:	downloaded
Dump:	chromecache_85.2.dr
ID:	dr_3
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with CRLF line terminators
Entropy:	4.297090490066192
Encrypted:	false
Ssdeep:	3:qVZxQXbZ6TBXq/B8ixj0LRaqKBcz:qzxO96TI/RwYqXz
Size:	95
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 86

MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel

downloaded

Details

File:	Chrome Cache Entry: 86
Category:	downloaded
Dump:	chromecache_86.2.dr
ID:	dr_4
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Entropy:	5.104352236785294
Encrypted:	false
Ssdeep:	384:9FMKxxje8gZryMDXe3ibKSo3MdXA1SPrQHg4M:bpr68gVy1i2SzdXA1wrQHg4M
Size:	32038
Whitelisted:	true
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	6832
Target ID:	0
Parent PID:	5860
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	11:49:42
Date:	02/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 --field-trial-handle=2392,i,11199523818883284269,10067761302341695483,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	6412
Target ID:	2
Parent PID:	6832
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 --field-trial-handle=2392,i,11199523818883284269,10067761302341695483,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	11:49:46
Date:	02/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://dne.sendyouropinions.com"

Details

Is windows:	true
Is dropped:	false
PID:	3992
Target ID:	3
Parent PID:	5860
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://dne.sendyouropinions.com"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	11:49:49
Date:	02/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://dne.sendyouropinions.com

https://dne.sendyouropinions.com/favicon.ico

206.126.172.72

https://tse1.mm.bing.net/th?id=OADD2.10239351692183_1GSWAYG616F8PFDNZ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

150.171.28.10

http://dne.sendyouropinions.com/

206.126.172.72

https://tse1.mm.bing.net/th?id=OADD2.10239370639606_1UY6VCV79VNDR5KH5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

150.171.28.10

https://tse1.mm.bing.net/th?id=OADD2.10239395019081_1G8JFT41D9TYPNUJJ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

150.171.28.10

https://tse1.mm.bing.net/th?id=OADD2.10239370639595_1MX6CE6U5QJ1LNKB2&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

150.171.28.10

https://tse1.mm.bing.net/th?id=OADD2.10239351692182_1I6V30R2J66NF61KL&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

150.171.28.10

https://tse1.mm.bing.net/th?id=OADD2.10239395019080_17DEM3LK5H7QUOJTP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

150.171.28.10

https://dne.sendyouropinions.com/

Domains

Name

Malicious

bg.microsoft.map.fastly.net

199.232.214.172

dne.sendyouropinions.com

206.126.172.72

Details

Name:	dne.sendyouropinions.com
IP:	206.126.172.72
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

www.google.com

142.250.184.196

Details

Name:	www.google.com
IP:	142.250.184.196
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

ax-0001.ax-msedge.net

150.171.27.10

IPs

Domain

Country

Malicious

142.250.186.68

unknown

United States

142.250.184.196

www.google.com

United States

239.255.255.250

unknown

Reserved

206.126.172.72

dne.sendyouropinions.com

United States

192.168.2.23

unknown

192.168.2.6

unknown

DOM / HTML

URL

Malicious

https://dne.sendyouropinions.com/

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
http://dne.sendyouropinions.com

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttp://dne.sendyouropinions.com

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
http://dne.sendyouropinions.com