Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

C:\Users\user\Desktop\cmdline.out

ASCII text, with CRLF line terminators

modified

Details

File:	C:\Users\user\Desktop\cmdline.out
Category:	modified
Dump:	cmdline.out.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Windows\SysWOW64\cmd.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.209882337046131
Encrypted:	false
Ssdeep:	12:HRoeQmcLVt6nqINy7/T1De5RhKkk1DbfbKjAAVt6C7SNSifbKjAAVt6CJ8r:xgLVkxsvxePgJ1XbWpVb6SKbWpVbW
Size:	584
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the user directory	System Summary	Masquerading

C:\Users\user\Desktop\download\index.html@690si1i5lvsbaxkx8x7o&af=105612

HTML document, Unicode text, UTF-8 text

dropped

Details

File:	C:\Users\user\Desktop\download\index.html@690si1i5lvsbaxkx8x7o&af=105612
Category:	dropped
Dump:	index.html@690si1i5lvsbaxkx8x7o&af=105612.2.dr
ID:	dr_1
Target ID:	2
Process:	C:\Windows\SysWOW64\wget.exe
Type:	HTML document, Unicode text, UTF-8 text
Entropy:	5.2445752286593175
Encrypted:	false
Ssdeep:	96:gsLuty0hcFUULU3IJe1EJ3IJk1CZ9oXEluzbYdrdHdQdTd9dsZJdvJdFdD:gsR0RULdJkEiJWCPoXE4nIZLP
Size:	5289
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

Chrome Cache Entry: 58

ASCII text, with very long lines (755)

dropped

Details

File:	Chrome Cache Entry: 58
Category:	dropped
Dump:	chromecache_58.5.dr
ID:	dr_2
Target ID:	5
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (755)
Entropy:	5.307889594504572
Encrypted:	false
Ssdeep:	3072:Rr+YqYAQ2l+mn3Q/k+Y38ZlZclS/p5KZBETPHgPI3aeUfQb:wRhBn3Q/VY38ZlGY/quAPo
Size:	259036
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 59

ASCII text, with very long lines (24940)

downloaded

Details

File:	Chrome Cache Entry: 59
Category:	downloaded
Dump:	chromecache_59.5.dr
ID:	dr_9
Target ID:	5
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (24940)
Entropy:	5.01065643893867
Encrypted:	false
Ssdeep:	384:uVvLJCbSp5+zI9A+Me6G8gjiSc7nfZBhValBu:skbS3+zqoe6G8gj2Bhh
Size:	27617
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 60

PNG image data, 375 x 109, 8-bit/color RGBA, non-interlaced

dropped

Details

File:	Chrome Cache Entry: 60
Category:	dropped
Dump:	chromecache_60.5.dr
ID:	dr_4
Target ID:	5
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 375 x 109, 8-bit/color RGBA, non-interlaced
Entropy:	7.970338503340766
Encrypted:	false
Ssdeep:	384:Lcn7qmsx8+Y783ii55gz2JiKPQfLmhsm5Jvi:Lc7Z68J83iiDgzxK6as1
Size:	17372
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 61

ASCII text, with very long lines (755)

downloaded

Details

File:	Chrome Cache Entry: 61
Category:	downloaded
Dump:	chromecache_61.5.dr
ID:	dr_10
Target ID:	5
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (755)
Entropy:	5.307889594504572
Encrypted:	false
Ssdeep:	3072:Rr+YqYAQ2l+mn3Q/k+Y38ZlZclS/p5KZBETPHgPI3aeUfQb:wRhBn3Q/VY38ZlGY/quAPo
Size:	259036
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 62

PNG image data, 200 x 58, 8-bit/color RGBA, non-interlaced

dropped

Details

File:	Chrome Cache Entry: 62
Category:	dropped
Dump:	chromecache_62.5.dr
ID:	dr_6
Target ID:	5
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 200 x 58, 8-bit/color RGBA, non-interlaced
Entropy:	7.9184973315117055
Encrypted:	false
Ssdeep:	192:1vkn7sY/sWB2J2YGKNVPxR+A4Pu2/oh+V+82LX3TEgzYBm8FyjaZ7K:1cn7XsWB2IYGcVPD+A4OhQ2LcB7ex
Size:	8236
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 63

PNG image data, 25 x 25, 8-bit/color RGBA, non-interlaced

dropped

Details

File:	Chrome Cache Entry: 63
Category:	dropped
Dump:	chromecache_63.5.dr
ID:	dr_7
Target ID:	5
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 25 x 25, 8-bit/color RGBA, non-interlaced
Entropy:	7.740455499527118
Encrypted:	false
Ssdeep:	24:Va/6F6nR4e2of1UuDV9Mlsa5rksNlGo64bcm+s/It0lipK071dLXbCO+Kghz:Va/6F6Rsu1UuR9MlowlGo64om+s/zipC
Size:	1184
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 64

ASCII text, with very long lines (10194), with no line terminators

downloaded

Details

File:	Chrome Cache Entry: 64
Category:	downloaded
Dump:	chromecache_64.5.dr
ID:	dr_11
Target ID:	5
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (10194), with no line terminators
Entropy:	5.063687531597331
Encrypted:	false
Ssdeep:	192:iaOuM67cgTnJceG5QjCjoKJZbqdM0O9EW:ia5zo5QjCYdM0GB
Size:	10194
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://1fichier.com/?690si1i5lvsbaxkx8x7o&af=105612" > cmdline.out 2>&1

Details

Is windows:	true
Is dropped:	false
PID:	5668
Target ID:	0
Parent PID:	4464
Name:	cmd.exe
Class:	cmd
Path:	C:\Windows\SysWOW64\cmd.exe
Commandline:	C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://1fichier.com/?690si1i5lvsbaxkx8x7o&af=105612" > cmdline.out 2>&1
Size:	236544
MD5:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Time:	10:01:26
Date:	11/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x240000
Modulesize:	368640
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Usage Of Web Request Commands And Cmdlets	System Summary
Very long cmdline option found, this is very uncommon (may be encrypted or packed)	HIPS / PFW / Operating System Protection Evasion	Command and Scripting Interpreter
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	4956
Target ID:	1
Parent PID:	5668
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	10:01:26
Date:	11/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7699e0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\wget.exe

wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://1fichier.com/?690si1i5lvsbaxkx8x7o&af=105612"

Details

Is windows:	true
Is dropped:	false
PID:	2500
Target ID:	2
Parent PID:	5668
Name:	wget.exe
Path:	C:\Windows\SysWOW64\wget.exe
Commandline:	wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://1fichier.com/?690si1i5lvsbaxkx8x7o&af=105612"
Size:	3895184
MD5:	3DADB6E2ECE9C4B3E1E322E617658B60
Time:	10:01:26
Date:	11/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	3956736
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\download\index.html@690si1i5lvsbaxkx8x7o&af=105612.html

Details

Is windows:	true
Is dropped:	false
PID:	6172
Target ID:	3
Parent PID:	2580
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\download\index.html@690si1i5lvsbaxkx8x7o&af=105612.html
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	10:01:29
Date:	11/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2020,i,7518735245940088784,2414757051384116955,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	7184
Target ID:	5
Parent PID:	6172
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2020,i,7518735245940088784,2414757051384116955,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	10:01:30
Date:	11/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://1fichier.com/?690si1i5lvsbaxkx8x7o&af=105612

https://img.1fichier.com/favicon.png

unknown

https://1fichier.com/cgu.html

unknown

https://1fichier.com/?690si1i5lvsbaxkx8x7o&af=105612

5.39.224.140

https://img.1fichier.com/logo.png

5.39.224.141

https://1fichier.com

unknown

https://1fichier.com/login.pl

unknown

https://img.1fichier.com/logo-footer.png

5.39.224.141

http://jqueryui.com

unknown

https://img.1fichier.com/js/jquery.js

5.39.224.141

https://1fichier.com/abus.html

unknown

https://1fichier.com/api.html

unknown

https://img.1fichier.com/css/jquery.ui.css

5.39.224.141

https://1fichier.com/?690si1i5lvsbaxkx8x7o&af=105612VE

unknown

https://dstorage.fr

unknown

https://1fichier.com/hlp.html

unknown

https://1fichier.com/network.html

unknown

https://twitter.com/1fichiercom

unknown

https://img.1fichier.com/twitter.png

5.39.224.141

https://1fichier.com/tarifs.html

unknown

https://1fichier.com/revendeurs.html

unknown

https://img.1fichier.com/flags/en.png

unknown

https://1fichier.com/contact.html

unknown

https://img.1fichier.com/css/style.css

5.39.224.141

https://img.1fichier.com/flags/fr.png

unknown

https://1fichier.com/register.pl

unknown

https://img.1fichier.com/favicon.ico

unknown

https://img.1fichier.com/facebook.png

5.39.224.141

There are 17 hidden URLs, click here to show them.

Domains

Name

Malicious

1fichier.com

5.39.224.140

Details

Name:	1fichier.com
IP:	5.39.224.140
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Usage Of Web Request Commands And Cmdlets	System Summary
Very long cmdline option found, this is very uncommon (may be encrypted or packed)	HIPS / PFW / Operating System Protection Evasion	Command and Scripting Interpreter
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

img.1fichier.com

5.39.224.141

Details

Name:	img.1fichier.com
IP:	5.39.224.141
TargetID:	5
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

www.google.com

142.250.181.228

Details

Name:	www.google.com
IP:	142.250.181.228
TargetID:	5
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Malicious

239.255.255.250

unknown

Reserved

142.250.181.228

www.google.com

United States

192.168.2.16

unknown

5.39.224.141

img.1fichier.com

France

5.39.224.140

1fichier.com

France

Details

IP:	5.39.224.140
TargetID:	2
Current Path:	C:\Windows\SysWOW64\wget.exe
Country:	France
Countrycode:	FRA
ASN number:	198792
ASN name:	DSTORAGEFR
Private:	false
Domain:	1fichier.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

192.168.2.4

unknown

Memdumps

Base Address

Regiontype

Protect

Malicious

2DEF000

stack

page read and write

2BEE000

stack

page read and write

9CD000

stack

page read and write

9C000

stack

page read and write

A10000

heap

page read and write

1150000

heap

page read and write

FBF000

stack

page read and write

A72000

heap

page read and write

2ABD000

heap

page read and write

A20000

heap

page read and write

1155000

heap

page read and write

2AE6000

heap

page read and write

B7E000

stack

page read and write

2AB0000

heap

page read and write

1E0000

heap

page read and write

115C000

heap

page read and write

BB0000

heap

page read and write

A0E000

stack

page read and write

DBF000

stack

page read and write

2ABA000

heap

page read and write

A48000

heap

page read and write

2AEA000

heap

page read and write

A40000

heap

page read and write

115B000

heap

page read and write

2AEE000

heap

page read and write

2AF2000

heap

page read and write

BB6000

heap

page read and write

100000

heap

page read and write

There are 18 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://1fichier.com/?690si1i5lvsbaxkx8x7o&af=105612

Files

Processes

URLs

Domains

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://1fichier.com/?690si1i5lvsbaxkx8x7o&af=105612

Files

Processes

URLs

Domains

IPs

Memdumps

IOC Report
https://1fichier.com/?690si1i5lvsbaxkx8x7o&af=105612