Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Chrome Cache Entry: 43

Web Open Font Format (Version 2), TrueType, length 19140, version 1.0

downloaded

Details

File:	Chrome Cache Entry: 43
Category:	downloaded
Dump:	chromecache_43.2.dr
ID:	dr_5
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	Web Open Font Format (Version 2), TrueType, length 19140, version 1.0
Entropy:	7.98695599617926
Encrypted:	false
Ssdeep:	384:oeibUjjYNnNrgPt2WA8klRZjFePRuJmd6Poy5MudXGA4heWhWYMnM9:o/gjMNrgPt2WAjlr8JaAy5MKXOeuW/o
Size:	19140
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 44

ASCII text, with very long lines (585)

downloaded

Details

File:	Chrome Cache Entry: 44
Category:	downloaded
Dump:	chromecache_44.2.dr
ID:	dr_6
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (585)
Entropy:	5.371741301113426
Encrypted:	false
Ssdeep:	192:cSWaqXXbptPAqjxTP8OQo0WrOXXbptPAqjsLmV0tfmWIeXXbptPAqjP/xutYTi2:w3XldBpKXld2t1XldjoYx
Size:	8838
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 45

HTML document, ASCII text, with very long lines (677)

downloaded

Details

File:	Chrome Cache Entry: 45
Category:	downloaded
Dump:	chromecache_45.2.dr
ID:	dr_7
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with very long lines (677)
Entropy:	5.1435496014689335
Encrypted:	false
Ssdeep:	12:kxRVrFjJRrZciWsGXmLFSHDSsz1X8lFamZ6k3hA1ZSZcsLvZ0mzegCoRwFjJUzk:kTlROi+WLojSw1MXlZ6M8QcslLCUzk
Size:	678
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 46

Web Open Font Format (Version 2), TrueType, length 17556, version 1.0

downloaded

Details

File:	Chrome Cache Entry: 46
Category:	downloaded
Dump:	chromecache_46.2.dr
ID:	dr_8
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	Web Open Font Format (Version 2), TrueType, length 17556, version 1.0
Entropy:	7.985973640781479
Encrypted:	false
Ssdeep:	384:IAWAX7otodyzgA8e1fZBmtpUaXovcAgVdXEIlO75sQHTkYmjxYPH+aVS:S64idB3Eu9EoK5lTkYoito
Size:	17556
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 47

HTML document, ASCII text, with very long lines (2334), with no line terminators

downloaded

Details

File:	Chrome Cache Entry: 47
Category:	downloaded
Dump:	chromecache_47.2.dr
ID:	dr_9
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with very long lines (2334), with no line terminators
Entropy:	5.810445084750524
Encrypted:	false
Ssdeep:	48:Q+1jSG5d4XREec7rxE49iFLBiQZFrxytYhcB0ZrZv4CO+8K:Q+1WsyqeurxudCyh/nOi
Size:	2334
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	2008
Target ID:	0
Parent PID:	4488
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	21:03:12
Date:	02/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1840,i,11791121761724155368,16919539677854534214,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	3548
Target ID:	2
Parent PID:	2008
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1840,i,11791121761724155368,16919539677854534214,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	21:03:15
Date:	02/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://fast.b-cdn.net"

Details

Is windows:	true
Is dropped:	false
PID:	6404
Target ID:	3
Parent PID:	4488
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://fast.b-cdn.net"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	21:03:17
Date:	02/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://fast.b-cdn.net

https://fonts.bunny.net/rubik/files/rubik-cyrillic-300-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-latin-500-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-latin-400-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-latin-500-normal.woff2

169.150.247.37

https://fonts.bunny.net/rubik/files/rubik-cyrillic-ext-300-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-latin-ext-500-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-latin-400-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-cyrillic-400-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-arabic-400-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-arabic-300-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-hebrew-500-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-cyrillic-ext-400-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-latin-ext-400-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-cyrillic-ext-500-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-arabic-500-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-latin-ext-300-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-hebrew-400-normal.woff)

unknown

https://fonts.bunny.net/css?family=Rubik:300,400,500

169.150.247.37

https://fonts.bunny.net/rubik/files/rubik-latin-500-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-hebrew-300-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-hebrew-500-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-arabic-500-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-cyrillic-500-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-cyrillic-500-normal.woff2)

unknown

https://fast.b-cdn.net/

https://fonts.bunny.net/rubik/files/rubik-latin-300-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-latin-ext-400-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-hebrew-300-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-cyrillic-ext-500-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-cyrillic-400-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-cyrillic-ext-400-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-latin-ext-300-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-cyrillic-ext-300-normal.woff2)

unknown

https://fast.b-cdn.net/favicon.ico

169.150.247.39

https://fonts.bunny.net/rubik/files/rubik-latin-300-normal.woff2

169.150.247.37

https://fonts.bunny.net/rubik/files/rubik-hebrew-400-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-cyrillic-300-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-arabic-300-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-arabic-400-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-latin-ext-500-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-latin-300-normal.woff)

unknown

There are 31 hidden URLs, click here to show them.

Domains

Name

Malicious

bg.microsoft.map.fastly.net

199.232.214.172

fast.b-cdn.net

169.150.247.39

Details

Name:	fast.b-cdn.net
IP:	169.150.247.39
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

www.google.com

142.250.185.228

Details

Name:	www.google.com
IP:	142.250.185.228
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

bunnyfonts.b-cdn.net

169.150.247.37

fp2e7a.wpc.phicdn.net

192.229.221.95

fonts.bunny.net

unknown

Details

Name:	fonts.bunny.net
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

142.250.184.196

unknown

United States

142.250.185.228

www.google.com

United States

239.255.255.250

unknown

Reserved

192.168.2.4

unknown

169.150.247.39

fast.b-cdn.net

United States

169.150.247.37

bunnyfonts.b-cdn.net

United States

DOM / HTML

URL

Malicious

https://fast.b-cdn.net/

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://fast.b-cdn.net

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://fast.b-cdn.net

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
https://fast.b-cdn.net