Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Chrome Cache Entry: 48

PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced

dropped

Details

File:	Chrome Cache Entry: 48
Category:	dropped
Dump:	chromecache_48.2.dr
ID:	dr_0
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Entropy:	3.990210155325004
Encrypted:	false
Ssdeep:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
Size:	61
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 49

ASCII text, with very long lines (47992), with no line terminators

downloaded

Details

File:	Chrome Cache Entry: 49
Category:	downloaded
Dump:	chromecache_49.2.dr
ID:	dr_9
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (47992), with no line terminators
Entropy:	5.605846858683577
Encrypted:	false
Ssdeep:	768:LuxoaUN4+OIhwP53+e0QfA31jQM9OT81NHv4rnwfe:LuxoaU2+LwB2+G1ZdvCwfe
Size:	47992
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 50

HTML document, ASCII text, with CRLF, LF line terminators

downloaded

Details

File:	Chrome Cache Entry: 50
Category:	downloaded
Dump:	chromecache_50.2.dr
ID:	dr_10
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with CRLF, LF line terminators
Entropy:	5.242453121762845
Encrypted:	false
Ssdeep:	24:hYYIzD6yJRA3ZsjNQCRtgoLY95Mu56+eDHHLFCOXAkRcfRrzd0Ll72rKQk:rq6Kj2CZLY5Mc6NDLYzkYKLlOM
Size:	1249
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 51

PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced

downloaded

Details

File:	Chrome Cache Entry: 51
Category:	downloaded
Dump:	chromecache_51.2.dr
ID:	dr_11
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Entropy:	3.990210155325004
Encrypted:	false
Ssdeep:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
Size:	61
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 52

ASCII text, with very long lines (47261)

dropped

Details

File:	Chrome Cache Entry: 52
Category:	dropped
Dump:	chromecache_52.2.dr
ID:	dr_4
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (47261)
Entropy:	5.3974731018213795
Encrypted:	false
Ssdeep:	768:+CWIsQ06lHHhw+r9sygguSwodvdq3VE3XYdze9Ddre9eom1CQWpKexThupcubvCR:uQflHBN9sygg1WViPreEM
Size:	47262
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 53

ASCII text, with very long lines (47992), with no line terminators

dropped

Details

File:	Chrome Cache Entry: 53
Category:	dropped
Dump:	chromecache_53.2.dr
ID:	dr_5
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (47992), with no line terminators
Entropy:	5.605846858683577
Encrypted:	false
Ssdeep:	768:LuxoaUN4+OIhwP53+e0QfA31jQM9OT81NHv4rnwfe:LuxoaU2+LwB2+G1ZdvCwfe
Size:	47992
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 54

ASCII text, with very long lines (47261)

downloaded

Details

File:	Chrome Cache Entry: 54
Category:	downloaded
Dump:	chromecache_54.2.dr
ID:	dr_12
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (47261)
Entropy:	5.3974731018213795
Encrypted:	false
Ssdeep:	768:+CWIsQ06lHHhw+r9sygguSwodvdq3VE3XYdze9Ddre9eom1CQWpKexThupcubvCR:uQflHBN9sygg1WViPreEM
Size:	47262
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 55

PNG image data, 74 x 85, 8-bit/color RGB, non-interlaced

downloaded

Details

File:	Chrome Cache Entry: 55
Category:	downloaded
Dump:	chromecache_55.2.dr
ID:	dr_13
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 74 x 85, 8-bit/color RGB, non-interlaced
Entropy:	4.068159130770307
Encrypted:	false
Ssdeep:	3:yionv//thPlFuEI/6hkxl/k4E08up:6v/lhPOEdhk7Tp
Size:	61
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 56

PNG image data, 74 x 85, 8-bit/color RGB, non-interlaced

dropped

Details

File:	Chrome Cache Entry: 56
Category:	dropped
Dump:	chromecache_56.2.dr
ID:	dr_8
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 74 x 85, 8-bit/color RGB, non-interlaced
Entropy:	4.068159130770307
Encrypted:	false
Ssdeep:	3:yionv//thPlFuEI/6hkxl/k4E08up:6v/lhPOEdhk7Tp
Size:	61
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	4228
Target ID:	0
Parent PID:	764
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	21:10:51
Date:	07/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1904,i,15969946830578283457,6811293747423805759,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	5020
Target ID:	2
Parent PID:	4228
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1904,i,15969946830578283457,6811293747423805759,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	21:10:54
Date:	07/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://starylasfe.com.de/6SZZr/"

Details

Is windows:	true
Is dropped:	false
PID:	6264
Target ID:	3
Parent PID:	764
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://starylasfe.com.de/6SZZr/"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	21:10:56
Date:	07/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://starylasfe.com.de/6SZZr/

https://challenges.cloudflare.com/turnstile/v0/g/ec4b873d446c/api.js

104.18.94.41

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/16fte/0x4AAAAAAAwpsNMf0WGEUjzJ/auto/fbE/normal/auto/

104.18.95.41

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8cf2412a1a537293&lang=auto

104.18.95.41

https://challenges.cloudflare.com/turnstile/v0/api.js

104.18.94.41

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/8cf2412a1a537293/1728349864326/8f9f27265746ec1dcad7e91d1ca9931a28d36285bddc52ea2dc0b8f5902921b8/3Enx3o_KCRjDtSd

104.18.95.41

https://km3r-groupgi.ru//

188.114.96.3

https://starylasfe.com.de/favicon.ico

104.21.39.227

https://a.nel.cloudflare.com/report/v4?s=b7hBr54Io0VATmgd6hrDgYK4nwypyBoh0vQRXTLKQizChh9ZrhanDd%2FDUP3Il8JCg1y5HKITC3No9ulVBvhJIv30nv%2FPLpRuIkpUUTBW2WnZY%2BfGFmftST3nu0LOXv%2FPGXGq7A%3D%3D

35.190.80.1

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D

104.18.95.41

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/794737412:1728347140:klwzcMa-b_YoaFYvvKaoLrq4GD2_T9tGZtpkTEveqyA/8cf2412a1a537293/4fc26e5f4f7eeee

104.18.95.41

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8cf2412a1a537293/1728349864318/0kQCGr59qge9TB6

104.18.95.41

https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js

104.17.24.14

There are 3 hidden URLs, click here to show them.

Domains

Name

Malicious

bg.microsoft.map.fastly.net

199.232.214.172

a.nel.cloudflare.com

35.190.80.1

km3r-groupgi.ru

188.114.96.3

cdnjs.cloudflare.com

104.17.24.14

challenges.cloudflare.com

104.18.94.41

s-part-0017.t-0009.t-msedge.net

13.107.246.45

www.google.com

142.250.186.68

starylasfe.com.de

104.21.39.227

fp2e7a.wpc.phicdn.net

192.229.221.95

s-part-0032.t-0009.t-msedge.net

13.107.246.60

IPs

Domain

Country

Malicious

142.250.186.68

www.google.com

United States

104.17.24.14

cdnjs.cloudflare.com

United States

104.18.94.41

challenges.cloudflare.com

United States

104.18.95.41

unknown

United States

192.168.2.4

unknown

239.255.255.250

unknown

Reserved

188.114.96.3

km3r-groupgi.ru

European Union

104.21.39.227

starylasfe.com.de

United States

35.190.80.1

a.nel.cloudflare.com

United States

104.17.25.14

unknown

United States

DOM / HTML

URL

Malicious

https://starylasfe.com.de/6SZZr/

Details

Filename:	0.2.pages.html.dom
Url:	https://starylasfe.com.de/6SZZr/
Target ID:	2
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1904,i,15969946830578283457,6811293747423805759,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Signature Hits	Behavior Group	Mitre Attack
Yara detected HtmlPhish70	Phishing

https://starylasfe.com.de/6SZZr/

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://starylasfe.com.de/6SZZr/

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://starylasfe.com.de/6SZZr/

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
https://starylasfe.com.de/6SZZr/