Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Chrome Cache Entry: 42

HTML document, ASCII text, with very long lines (677)

downloaded

Details

File:	Chrome Cache Entry: 42
Category:	downloaded
Dump:	chromecache_42.2.dr
ID:	dr_5
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with very long lines (677)
Entropy:	5.1435496014689335
Encrypted:	false
Ssdeep:	12:kxRVrFjJRrZciWsGXmLFSHDSsz1X8lFamZ6k3hA1ZSZcsLvZ0mzegCoRwFjJUzk:kTlROi+WLojSw1MXlZ6M8QcslLCUzk
Size:	678
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 43

Web Open Font Format (Version 2), TrueType, length 19140, version 1.0

downloaded

Details

File:	Chrome Cache Entry: 43
Category:	downloaded
Dump:	chromecache_43.2.dr
ID:	dr_6
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	Web Open Font Format (Version 2), TrueType, length 19140, version 1.0
Entropy:	7.98695599617926
Encrypted:	false
Ssdeep:	384:oeibUjjYNnNrgPt2WA8klRZjFePRuJmd6Poy5MudXGA4heWhWYMnM9:o/gjMNrgPt2WAjlr8JaAy5MKXOeuW/o
Size:	19140
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 44

ASCII text, with very long lines (585)

downloaded

Details

File:	Chrome Cache Entry: 44
Category:	downloaded
Dump:	chromecache_44.2.dr
ID:	dr_7
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (585)
Entropy:	5.371741301113426
Encrypted:	false
Ssdeep:	192:cSWaqXXbptPAqjxTP8OQo0WrOXXbptPAqjsLmV0tfmWIeXXbptPAqjP/xutYTi2:w3XldBpKXld2t1XldjoYx
Size:	8838
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 45

HTML document, ASCII text, with very long lines (677)

downloaded

Details

File:	Chrome Cache Entry: 45
Category:	downloaded
Dump:	chromecache_45.2.dr
ID:	dr_8
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with very long lines (677)
Entropy:	5.1435496014689335
Encrypted:	false
Ssdeep:	12:kxRVrFjJRrZciWsGXmLFSHDSsz1X8lFamZ6k3hA1ZSZcsLvZ0mzegCoRwFjJUzk:kTlROi+WLojSw1MXlZ6M8QcslLCUzk
Size:	678
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 46

Web Open Font Format (Version 2), TrueType, length 17556, version 1.0

downloaded

Details

File:	Chrome Cache Entry: 46
Category:	downloaded
Dump:	chromecache_46.2.dr
ID:	dr_9
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	Web Open Font Format (Version 2), TrueType, length 17556, version 1.0
Entropy:	7.985973640781479
Encrypted:	false
Ssdeep:	384:IAWAX7otodyzgA8e1fZBmtpUaXovcAgVdXEIlO75sQHTkYmjxYPH+aVS:S64idB3Eu9EoK5lTkYoito
Size:	17556
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	2908
Target ID:	0
Parent PID:	480
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	20:08:28
Date:	10/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1976,i,5788145428539535837,16467479293304238134,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	2504
Target ID:	2
Parent PID:	2908
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1976,i,5788145428539535837,16467479293304238134,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	20:08:31
Date:	10/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://best-received.b-cdn.net/built-in/store-of/the-sys/kbsn2.txt'"

Details

Is windows:	true
Is dropped:	false
PID:	6328
Target ID:	3
Parent PID:	480
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://best-received.b-cdn.net/built-in/store-of/the-sys/kbsn2.txt'"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	20:08:32
Date:	10/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://best-received.b-cdn.net/built-in/store-of/the-sys/kbsn2.txt'

https://fonts.bunny.net/rubik/files/rubik-cyrillic-300-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-latin-500-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-latin-400-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-latin-500-normal.woff2

169.150.247.36

https://fonts.bunny.net/rubik/files/rubik-cyrillic-ext-300-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-latin-ext-500-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-latin-400-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-cyrillic-400-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-arabic-400-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-arabic-300-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-hebrew-500-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-cyrillic-ext-400-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-latin-ext-400-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-cyrillic-ext-500-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-arabic-500-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-latin-ext-300-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-hebrew-400-normal.woff)

unknown

https://fonts.bunny.net/css?family=Rubik:300,400,500

169.150.247.36

https://fonts.bunny.net/rubik/files/rubik-latin-500-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-hebrew-300-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-hebrew-500-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-arabic-500-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-cyrillic-500-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-cyrillic-500-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-latin-300-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-latin-ext-400-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-hebrew-300-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-cyrillic-ext-500-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-cyrillic-400-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-cyrillic-ext-400-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-latin-ext-300-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-cyrillic-ext-300-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-latin-300-normal.woff2

169.150.247.36

https://fonts.bunny.net/rubik/files/rubik-hebrew-400-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-cyrillic-300-normal.woff2)

unknown

https://best-received.b-cdn.net/favicon.ico

143.244.50.83

https://fonts.bunny.net/rubik/files/rubik-arabic-300-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-arabic-400-normal.woff2)

unknown

https://fonts.bunny.net/rubik/files/rubik-latin-ext-500-normal.woff)

unknown

https://fonts.bunny.net/rubik/files/rubik-latin-300-normal.woff)

unknown

There are 31 hidden URLs, click here to show them.

Domains

Name

Malicious

s-part-0017.t-0009.t-msedge.net

13.107.246.45

www.google.com

172.217.18.4

Details

Name:	www.google.com
IP:	172.217.18.4
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

best-received.b-cdn.net

143.244.50.83

Details

Name:	best-received.b-cdn.net
IP:	143.244.50.83
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

bunnyfonts.b-cdn.net

169.150.247.36

fp2e7a.wpc.phicdn.net

192.229.221.95

fonts.bunny.net

unknown

Details

Name:	fonts.bunny.net
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

239.255.255.250

unknown

Reserved

172.217.18.4

www.google.com

United States

142.250.185.132

unknown

United States

192.168.2.4

unknown

143.244.50.83

best-received.b-cdn.net

United States

169.150.247.36

bunnyfonts.b-cdn.net

United States

DOM / HTML

URL

Malicious

https://best-received.b-cdn.net/built-in/store-of/the-sys/kbsn2.txt'

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://best-received.b-cdn.net/built-in/store-of/the-sys/kbsn2.txt'

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://best-received.b-cdn.net/built-in/store-of/the-sys/kbsn2.txt'

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
https://best-received.b-cdn.net/built-in/store-of/the-sys/kbsn2.txt'