Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 05:58:58 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Category:	dropped
Dump:	Docs.lnk.0.dr
ID:	dr_5
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 05:58:58 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	3.9793467302421033
Encrypted:	false
Ssdeep:	48:8n0dHTfzVHvidAKZdA1oehwiZUklqehpy+3:8nk32Oy
Size:	2677
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Category:	dropped
Dump:	Gmail.lnk.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 05:58:58 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	3.9953047677635216
Encrypted:	false
Ssdeep:	48:8g0dHTfzVHvidAKZdA1leh/iZUkAQkqeh+y+2:8gk3U9QDy
Size:	2679
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Category:	dropped
Dump:	Google Drive.lnk.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	4.001277974036047
Encrypted:	false
Ssdeep:	48:8K0dHTfzbHvidAKZdA14t5eh7sFiZUkmgqeh7s4y+BX:8Kk3Gnyy
Size:	2693
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Category:	dropped
Dump:	Sheets.lnk.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 05:58:58 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	3.9909771655117243
Encrypted:	false
Ssdeep:	48:8i0dHTfzVHvidAKZdA16ehDiZUkwqehqy+R:8ik3Pwy
Size:	2681
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Category:	dropped
Dump:	Slides.lnk.0.dr
ID:	dr_4
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 05:58:58 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	3.9804559445728147
Encrypted:	false
Ssdeep:	48:8Z0dHTfzVHvidAKZdA1UehBiZUk1W1qehcy+C:8Zk3P98y
Size:	2681
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Category:	dropped
Dump:	YouTube.lnk.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 14 05:58:58 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Entropy:	3.9889206599202023
Encrypted:	false
Ssdeep:	48:8J0dHTfzVHvidAKZdA1duTrehOuTbbiZUk5OjqehOuTbyy+yT+:8Jk3ITYTbxWOvTbyy7T
Size:	2683
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

Chrome Cache Entry: 59

HTML document, ASCII text

downloaded

Details

File:	Chrome Cache Entry: 59
Category:	downloaded
Dump:	chromecache_59.2.dr
ID:	dr_8
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text
Entropy:	5.3031335142989136
Encrypted:	false
Ssdeep:	96:XQGG3xSMIh79q3bCqbLSJFt1tnMqvsA/J6+nRQd53a:AffIh7g3OqSRLl
Size:	3620
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 60

PNG image data, 119 x 25, 8-bit/color RGBA, non-interlaced

downloaded

Details

File:	Chrome Cache Entry: 60
Category:	downloaded
Dump:	chromecache_60.2.dr
ID:	dr_9
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 119 x 25, 8-bit/color RGBA, non-interlaced
Entropy:	7.728733394584269
Encrypted:	false
Ssdeep:	24:mUXUZng5Iyq9bHo90EXNmE9+est7G/OvdPB1kSnK4QGHvx:1L5Iyq9c90E9mExYXxB+14QGPx
Size:	997
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	5124
Target ID:	0
Parent PID:	6020
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	02:58:52
Date:	14/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff678760000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2024,i,10545202353756497457,5606966805816046588,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	6372
Target ID:	2
Parent PID:	5124
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2024,i,10545202353756497457,5606966805816046588,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	02:58:55
Date:	14/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff678760000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitbKNJ8sYhqlUJYn8yxhWxUA0aJZmY5LVQXtJ_ILTKZZwpaQtRjD_bBhVgez8biuF2oIY1eZ6WWCPDhA-HKNrtaRy0MDNWSYSymAkryTIqgcDmTiUiHO7r7NP2_08OxpqkX5MapWuII64_U3TZwW5nKAxcsmE6qeQ00TkEHz0my6QqYxJ23n8rP2tHtwSf/s1600/jIYQCsK6.png"

Details

Is windows:	true
Is dropped:	false
PID:	1196
Target ID:	3
Parent PID:	6020
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitbKNJ8sYhqlUJYn8yxhWxUA0aJZmY5LVQXtJ_ILTKZZwpaQtRjD_bBhVgez8biuF2oIY1eZ6WWCPDhA-HKNrtaRy0MDNWSYSymAkryTIqgcDmTiUiHO7r7NP2_08OxpqkX5MapWuII64_U3TZwW5nKAxcsmE6qeQ00TkEHz0my6QqYxJ23n8rP2tHtwSf/s1600/jIYQCsK6.png"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	02:58:57
Date:	14/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff678760000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitbKNJ8sYhqlUJYn8yxhWxUA0aJZmY5LVQXtJ_ILTKZZwpaQtRjD_bBhVgez8biuF2oIY1eZ6WWCPDhA-HKNrtaRy0MDNWSYSymAkryTIqgcDmTiUiHO7r7NP2_08OxpqkX5MapWuII64_U3TZwW5nKAxcsmE6qeQ00TkEHz0my6QqYxJ23n8rP2tHtwSf/s1600/jIYQCsK6.png

https://www.blogger.com/go/contentpolicy

unknown

https://www.blogger.com/go/buzz

unknown

https://www.blogger.com

unknown

https://www.blogger.com/go/privacy

unknown

https://www.blogger.com/go/devapi

unknown

https://www.blogger.com/static/v1/jsbin/671481879-analytics_autotrack.js

unknown

https://www.blogger.com/static/v1/v-css/3896558673-new_ui_static_pages.css

unknown

https://www.blogger.com/static/v1/v-css/2223071481-static_pages.css

unknown

https://www.blogger.com/go/helpcenter

unknown

https://www.blogger.com/go/terms

unknown

https://www.blogger.com/go/tutorials

unknown

https://blogger.googleusercontent.com/favicon.ico

142.250.185.129

https://www.blogger.com/go/devforum

unknown

https://resources.blogblog.com/img/blogger-logo-small.png

unknown

https://www.blogger.com/go/discuss

unknown

There are 5 hidden URLs, click here to show them.

Domains

Name

Malicious

www.google.com

216.58.206.68

Details

Name:	www.google.com
IP:	216.58.206.68
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

googlehosted.l.googleusercontent.com

142.250.185.129

fp2e7a.wpc.phicdn.net

192.229.221.95

s-part-0032.t-0009.t-msedge.net

13.107.246.60

blogger.googleusercontent.com

unknown

Details

Name:	blogger.googleusercontent.com
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

IPs

Domain

Country

Malicious

142.250.185.129

googlehosted.l.googleusercontent.com

United States

239.255.255.250

unknown

Reserved

192.168.2.8

unknown

192.168.2.9

unknown

216.58.206.68

www.google.com

United States

DOM / HTML

URL

Malicious

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitbKNJ8sYhqlUJYn8yxhWxUA0aJZmY5LVQXtJ_ILTKZZwpaQtRjD_bBhVgez8biuF2oIY1eZ6WWCPDhA-HKNrtaRy0MDNWSYSymAkryTIqgcDmTiUiHO7r7NP2_08OxpqkX5MapWuII64_U3TZwW5nKAxcsmE6qeQ00TkEHz0my6QqYxJ23n8rP2tHtwSf/s1600/jIYQCsK6.png

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitbKNJ8sYhqlUJYn8yxhWxUA0aJZmY5LVQXtJ_ILTKZZwpaQtRjD_bBhVgez8biuF2oIY1eZ6WWCPDhA-HKNrtaRy0MDNWSYSymAkryTIqgcDmTiUiHO7r7NP2_08OxpqkX5MapWuII64_U3TZwW5nKAxcsmE6qeQ00TkEHz0my6QqYxJ23n8rP2tHtwSf/s1600/jIYQCsK6.png

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitbKNJ8sYhqlUJYn8yxhWxUA0aJZmY5LVQXtJ_ILTKZZwpaQtRjD_bBhVgez8biuF2oIY1eZ6WWCPDhA-HKNrtaRy0MDNWSYSymAkryTIqgcDmTiUiHO7r7NP2_08OxpqkX5MapWuII64_U3TZwW5nKAxcsmE6qeQ00TkEHz0my6QqYxJ23n8rP2tHtwSf/s1600/jIYQCsK6.png