IOC Report
file.exe

Files

File Path

Type

Category

Malicious

file.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 00:23:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 00:23:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 00:23:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 00:23:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 00:23:04 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Chrome Cache Entry: 100

ASCII text, with very long lines (570)

downloaded

Chrome Cache Entry: 101

ASCII text, with very long lines (533)

downloaded

Chrome Cache Entry: 102

ASCII text, with very long lines (755)

downloaded

Chrome Cache Entry: 103

ASCII text, with very long lines (522)

downloaded

Chrome Cache Entry: 104

ASCII text, with very long lines (468)

downloaded

Chrome Cache Entry: 105

ASCII text, with no line terminators

downloaded

Chrome Cache Entry: 106

ASCII text, with very long lines (683)

downloaded

Chrome Cache Entry: 107

ASCII text, with very long lines (2907)

downloaded

Chrome Cache Entry: 108

ASCII text, with very long lines (395)

downloaded

Chrome Cache Entry: 94

HTML document, ASCII text, with very long lines (681)

downloaded

Chrome Cache Entry: 95

ASCII text, with very long lines (1694)

downloaded

Chrome Cache Entry: 96

ASCII text, with very long lines (553)

downloaded

Chrome Cache Entry: 97

MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel

downloaded

Chrome Cache Entry: 98

ASCII text, with very long lines (5693)

downloaded

Chrome Cache Entry: 99

Web Open Font Format (Version 2), TrueType, length 52280, version 1.0

downloaded

There are 12 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\file.exe

"C:\Users\user\Desktop\file.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM chrome.exe /T

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM msedge.exe /T

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM firefox.exe /T

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM opera.exe /T

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM brave.exe /T

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=2020,i,14012305356016186702,9663531477118597042,262144 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5572 --field-trial-handle=2020,i,14012305356016186702,9663531477118597042,262144 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 --field-trial-handle=2020,i,14012305356016186702,9663531477118597042,262144 /prefetch:8

There are 5 hidden processes, click here to show them.

URLs

Name

IP

Malicious

https://play.google/intl/

unknown

https://families.google.com/intl/

unknown

https://youtube.com/t/terms?gl=

unknown

https://policies.google.com/technologies/location-data

unknown

https://www.google.com/intl/

unknown

https://apis.google.com/js/api.js

unknown

https://policies.google.com/privacy/google-partners

unknown

https://play.google.com/work/enroll?identifier=

unknown

https://policies.google.com/terms/service-specific

unknown

https://g.co/recover

unknown

https://policies.google.com/privacy/additional

unknown

https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072

unknown

https://play.google.com/log?format=json&hasfast=true&authuser=0

142.250.185.78

https://policies.google.com/technologies/cookies

unknown

https://www.google.com/favicon.ico

142.250.186.132

https://policies.google.com/terms

unknown

https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=

unknown

https://www.google.com

unknown

https://play.google.com/log?hasfast=true&authuser=0&format=json

142.250.185.78

https://play.google.com/log?format=json&hasfast=true

unknown

https://www.youtube.com/t/terms?chromeless=1&hl=

unknown

https://support.google.com/accounts?hl=

unknown

https://policies.google.com/terms/location

unknown

https://policies.google.com/privacy

unknown

https://support.google.com/accounts?p=new-si-ui

unknown

https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessage

unknown

There are 16 hidden URLs, click here to show them.

Domains

Name

IP

Malicious

youtube-ui.l.google.com

142.250.185.206

www3.l.google.com

216.58.212.174

play.google.com

142.250.185.78

Details

Name:	play.google.com
IP:	142.250.185.78
TargetID:	14
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

www.google.com

142.250.186.132

Details

Name:	www.google.com
IP:	142.250.186.132
TargetID:	14
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Found strings which match to known social media urls	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

youtube.com

142.250.185.238

Details

Name:	youtube.com
IP:	142.250.185.238
TargetID:	14
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Found strings which match to known social media urls	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

accounts.youtube.com

unknown

Details

Name:	accounts.youtube.com
TargetID:	14
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

www.youtube.com

unknown

Details

Name:	www.youtube.com
TargetID:	14
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Found strings which match to known social media urls	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

IP

Domain

Country

Malicious

142.250.185.78

play.google.com

United States

142.250.185.206

youtube-ui.l.google.com

United States

142.250.185.238

youtube.com

United States

192.168.2.5

unknown

unknown

239.255.255.250

unknown

Reserved

142.250.186.132

www.google.com

United States

216.58.212.174

www3.l.google.com

United States

Memdumps

Base Address

Regiontype

Protect

Malicious

11B8000

heap

page read and write

1090000

trusted library allocation

page read and write

C34000

unkown

page readonly

6BA000

stack

page read and write

103F000

stack

page read and write

B61000

unkown

page execute read

BFC000

unkown

page readonly

C22000

unkown

page readonly

7C0000

heap

page read and write

BFC000

unkown

page readonly

101F000

stack

page read and write

104F000

stack

page read and write

3A70000

heap

page read and write

7B4000

heap

page read and write

C34000

unkown

page readonly

B60000

unkown

page readonly

3A71000

heap

page read and write

3A71000

heap

page read and write

C2C000

unkown

page write copy

3720000

heap

page read and write

7B0000

heap

page read and write

7B4000

heap

page read and write

B60000

unkown

page readonly

C22000

unkown

page readonly

11DA000

heap

page read and write

11ED000

heap

page read and write

C30000

unkown

page write copy

1070000

heap

page read and write

100F000

stack

page read and write

11E6000

heap

page read and write

1090000

trusted library allocation

page read and write

3724000

heap

page read and write

720000

heap

page read and write

11E7000

heap

page read and write

11B0000

heap

page read and write

102B000

stack

page read and write

11E7000

heap

page read and write

B61000

unkown

page execute read

1140000

heap

page read and write

7B4000

heap

page read and write

11E9000

heap

page read and write

C2C000

unkown

page read and write

There are 32 hidden memdumps, click here to show them.