Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	6812
Target ID:	0
Parent PID:	6116
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	09:00:28
Date:	18/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6c4390000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1896,i,17970763211839399571,7458228957607393587,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	6312
Target ID:	2
Parent PID:	6812
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1896,i,17970763211839399571,7458228957607393587,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	09:00:31
Date:	18/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6c4390000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://hrdnl69e.r.us-east-1.awstrack.me/L0/https:%2F%2Fwww.comodosslstore.com%2Furl1%2Fe3636f2be0%3Futm_source=renewal%26utm_medium=email%26utm_campaign=7day/1/010001929f0eb31e-6c95ec57-b8d1-4cd7-8431-5c555e66ee2b-000000/8tYDjclILWJhIWVdW1jY1ngNwpA=396"

Details

Is windows:	true
Is dropped:	false
PID:	4840
Target ID:	3
Parent PID:	6116
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://hrdnl69e.r.us-east-1.awstrack.me/L0/https:%2F%2Fwww.comodosslstore.com%2Furl1%2Fe3636f2be0%3Futm_source=renewal%26utm_medium=email%26utm_campaign=7day/1/010001929f0eb31e-6c95ec57-b8d1-4cd7-8431-5c555e66ee2b-000000/8tYDjclILWJhIWVdW1jY1ngNwpA=396"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	09:00:33
Date:	18/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6c4390000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://hrdnl69e.r.us-east-1.awstrack.me/L0/https:%2F%2Fwww.comodosslstore.com%2Furl1%2Fe3636f2be0%3Futm_source=renewal%26utm_medium=email%26utm_campaign=7day/1/010001929f0eb31e-6c95ec57-b8d1-4cd7-8431-5c555e66ee2b-000000/8tYDjclILWJhIWVdW1jY1ngNwpA=396

https://comodosslstore.com/css/masterrevisecss?v=ZGjH6Bmrhoy2MFT9_hDGukeMZGsza54e_Z8OauSZqUo1

172.67.28.161

https://comodosslstore.com/images/icon-facebook.svg

172.67.28.161

https://comodosslstore.com/images/close-black.svg

172.67.28.161

https://www.comodosslstore.com/quicklogin.aspx?token=Ams7AEhy5TPAD4miE4vaApwYinXbKnjnfu2isNOtCDIeruMLTtiDdlthYVTjyerHme56OFcx9ulP97HK2nrPowgSLqliZmN7jYvuXmRZm22YwB3XUdzxrWhsGGuaTkxZi3BwXotUhgXX5F5mpIx74hT8UJqaEkQUnK2jrG7mx6KDA%2b5S0skBdWx4V%2ftUNLv%2f&utm_source=renewal&utm_medium=email&utm_campaign=7day&urlid=17993835

104.22.22.204

https://comodosslstore.com/images/logo.svg

172.67.28.161

https://comodosslstore.com/%3C%=Helper.GetApplicationPath()%%3Eimages/comodo-white-logo.svg

172.67.28.161

https://comodosslstore.com/images/icon-linkedin.svg

172.67.28.161

https://comodosslstore.com/scriptresource.axd?d=dwY9oWetJoJoVpgL6Zq8OCPTMtmxJ1Mum9PsV8yunaZ1XewBUlIlke0bjPXNOgvUU5SnLtPhq5kpgwX1jLUV4YieIJDmonx_VhclYBPZcXE67FzVX4b9Tg8IV3fQeYRia8nMkvwjD1pWdqno8txGHab3fW07GrdTbr-V1nyfSMQ1&t=49337fe8

172.67.28.161

54.236.156.105

https://comodosslstore.com/%3C%=Helper.GetApplicationPath()%%3Eimages/30day-guarantee.svg

172.67.28.161

https://comodosslstore.com/WebResource.axd?d=pynGkmcFUV13He1Qd6_TZCE2L4P547hTQlVRZB0U2zoHF4no2m1rpADkLfiNoPH_DTMwr1aDnhxAKmPvH6JOyw2&t=637814473746327080

172.67.28.161

https://comodosslstore.com/%3C%=Helper.GetApplicationPath()%%3Eimages/slide1.webp

172.67.28.161

https://comodosslstore.com/css/checkoutcss?v=qkT-pjDZLa1_DcxMiFxxZFsG7Vvc5qsAOFyIXApqAWg1

172.67.28.161

https://comodosslstore.com/images/icon-twitter.svg

172.67.28.161

https://comodosslstore.com/url1/e3636f2be0?utm_source=renewal&utm_medium=email&utm_campaign=7day

172.67.28.161

https://comodosslstore.com/ScriptResource.axd?d=nv7asgRUU0tRmHNR2D6t1H8aDzggcqye2MBe5YFjAtNj_OKwBPk69ETmUuPNe70S6Z9wsxWl2y2g2dWnpajT0yZjSyPUyi29PNwCXM_9oZXkzDQpXH3svPStQf1f6rWk_UpTQy_hWrEDi_t1I8jbTg2&t=14d69f50

172.67.28.161

https://comodosslstore.com/webresource.axd?d=pynGkmcFUV13He1Qd6_TZCE2L4P547hTQlVRZB0U2zoHF4no2m1rpADkLfiNoPH_DTMwr1aDnhxAKmPvH6JOyw2&t=637814473746327080

172.67.28.161

https://www.comodosslstore.com/url1/e3636f2be0?utm_source=renewal&utm_medium=email&utm_campaign=7day

104.22.22.204

https://comodosslstore.com/scriptresource.axd?d=nv7asgRUU0tRmHNR2D6t1H8aDzggcqye2MBe5YFjAtNj_OKwBPk69ETmUuPNe70S6Z9wsxWl2y2g2dWnpajT0yZjSyPUyi29PNwCXM_9oZXkzDQpXH3svPStQf1f6rWk_UpTQy_hWrEDi_t1I8jbTg2&t=14d69f50

172.67.28.161

https://comodosslstore.com/checkout.aspx?utm_source=renewal&utm_medium=email&utm_campaign=7day

172.67.28.161

https://comodosslstore.com/ScriptResource.axd?d=dwY9oWetJoJoVpgL6Zq8OCPTMtmxJ1Mum9PsV8yunaZ1XewBUlIlke0bjPXNOgvUU5SnLtPhq5kpgwX1jLUV4YieIJDmonx_VhclYBPZcXE67FzVX4b9Tg8IV3fQeYRia8nMkvwjD1pWdqno8txGHab3fW07GrdTbr-V1nyfSMQ1&t=49337fe8

172.67.28.161

https://www.comodosslstore.com/QuickLogin.aspx?token=Ams7AEhy5TPAD4miE4vaApwYinXbKnjnfu2isNOtCDIeruMLTtiDdlthYVTjyerHme56OFcx9ulP97HK2nrPowgSLqliZmN7jYvuXmRZm22YwB3XUdzxrWhsGGuaTkxZi3BwXotUhgXX5F5mpIx74hT8UJqaEkQUnK2jrG7mx6KDA%2b5S0skBdWx4V%2ftUNLv%2f&utm_source=renewal&utm_medium=email&utm_campaign=7day&urlid=17993835

104.22.22.204

https://comodosslstore.com/quicklogin.aspx?token=Ams7AEhy5TPAD4miE4vaApwYinXbKnjnfu2isNOtCDIeruMLTtiDdlthYVTjyerHme56OFcx9ulP97HK2nrPowgSLqliZmN7jYvuXmRZm22YwB3XUdzxrWhsGGuaTkxZi3BwXotUhgXX5F5mpIx74hT8UJqaEkQUnK2jrG7mx6KDA%2b5S0skBdWx4V%2ftUNLv%2f&utm_source=renewal&utm_medium=email&utm_campaign=7day&urlid=17993835

172.67.28.161

There are 13 hidden URLs, click here to show them.

Domains

Name

Malicious

comodosslstore.com

172.67.28.161

Details

Name:	comodosslstore.com
IP:	172.67.28.161
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Detected suspicious crossdomain redirect	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

bg.microsoft.map.fastly.net

199.232.214.172

www.comodosslstore.com

104.22.22.204

Details

Name:	www.comodosslstore.com
IP:	104.22.22.204
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Detected suspicious crossdomain redirect	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

www.google.com

142.250.186.68

Details

Name:	www.google.com
IP:	142.250.186.68
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

baconredirects-elb-1w79jy7i6g0wf-1154668140.us-east-1.elb.amazonaws.com

54.236.156.105

hrdnl69e.r.us-east-1.awstrack.me

unknown

Details

Name:	hrdnl69e.r.us-east-1.awstrack.me
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Detected suspicious crossdomain redirect	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

IPs

Domain

Country

Malicious

142.250.186.68

www.google.com

United States

239.255.255.250

unknown

Reserved

54.236.156.105

baconredirects-elb-1w79jy7i6g0wf-1154668140.us-east-1.elb.amazonaws.com

United States

104.22.22.204

www.comodosslstore.com

United States

172.67.28.161

comodosslstore.com

United States

192.168.2.7

unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://hrdnl69e.r.us-east-1.awstrack.me/L0/https:%2F%2Fwww.comodosslstore.com%2Furl1%2Fe3636f2be0%3Futm_source=renewal%26utm_medium=email%26utm_campaign=7day/1/010001929f0eb31e-6c95ec57-b8d1-4cd7-8431-5c555e66ee2b-000000/8tYDjclILWJhIWVdW1jY1ngNwpA=396

Files

Processes

URLs

Domains

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://hrdnl69e.r.us-east-1.awstrack.me/L0/https:%2F%2Fwww.comodosslstore.com%2Furl1%2Fe3636f2be0%3Futm_source=renewal%26utm_medium=email%26utm_campaign=7day/1/010001929f0eb31e-6c95ec57-b8d1-4cd7-8431-5c555e66ee2b-000000/8tYDjclILWJhIWVdW1jY1ngNwpA=396

Files

Processes

URLs

Domains

IPs

IOC Report
https://hrdnl69e.r.us-east-1.awstrack.me/L0/https:%2F%2Fwww.comodosslstore.com%2Furl1%2Fe3636f2be0%3Futm_source=renewal%26utm_medium=email%26utm_campaign=7day/1/010001929f0eb31e-6c95ec57-b8d1-4cd7-8431-5c555e66ee2b-000000/8tYDjclILWJhIWVdW1jY1ngNwpA=396