Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Chrome Cache Entry: 30

ASCII text, with very long lines (5006)

downloaded

Details

File:	Chrome Cache Entry: 30
Category:	downloaded
Dump:	chromecache_30.2.dr
ID:	dr_7
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (5006)
Entropy:	5.338925561800521
Encrypted:	false
Ssdeep:	96:dxfaWGm0pOBE7XLEC1abXCap7ZDkwlNFrblUdI0p:d54TpOVfVFr5/+
Size:	5122
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 31

Unicode text, UTF-8 text

downloaded

Details

File:	Chrome Cache Entry: 31
Category:	downloaded
Dump:	chromecache_31.2.dr
ID:	dr_8
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	Unicode text, UTF-8 text
Entropy:	4.6855072377778395
Encrypted:	false
Ssdeep:	384:vY3WxmQbmLb14ipxWofYn3tIIhZuEHXFVTvya:aWxmMipYhtIyZTVh
Size:	13810
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 32

ASCII text, with very long lines (5945)

downloaded

Details

File:	Chrome Cache Entry: 32
Category:	downloaded
Dump:	chromecache_32.2.dr
ID:	dr_9
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (5945)
Entropy:	5.587054789680738
Encrypted:	false
Ssdeep:	6144:k4Q3Ro3k4am58Bvi8ECFqXk9nR+iFBBNy2U7W:NQ32krmmBK+W6
Size:	320016
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 33

ASCII text

downloaded

Details

File:	Chrome Cache Entry: 33
Category:	downloaded
Dump:	chromecache_33.2.dr
ID:	dr_10
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text
Entropy:	5.475078871877558
Encrypted:	false
Ssdeep:	192:MFclkG43BPWOYKDTup43arDh9XN55N+NRNY3qNkNCXNlNOQNNNiNk3XNPN4qNYaK:gsWxOWi5fUH2QieLOeD4CdFRlU7tyF0N
Size:	12049
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 34

Unicode text, UTF-8 text, with very long lines (516)

downloaded

Details

File:	Chrome Cache Entry: 34
Category:	downloaded
Dump:	chromecache_34.2.dr
ID:	dr_11
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	Unicode text, UTF-8 text, with very long lines (516)
Entropy:	5.249260577706305
Encrypted:	false
Ssdeep:	48:35Y2zQVEjHYRhEGJ8Gxy+GmM8GOGpGkMmGFG0G7Mb4GeGjGxMbm0:pbzQNM/M6MUMV
Size:	3276
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 35

ASCII text

downloaded

Details

File:	Chrome Cache Entry: 35
Category:	downloaded
Dump:	chromecache_35.2.dr
ID:	dr_12
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text
Entropy:	1.5219280948873621
Encrypted:	false
Ssdeep:	3:U8n:U8n
Size:	5
Whitelisted:	true
Reputation:	low

Chrome Cache Entry: 36

ASCII text, with very long lines (5945)

dropped

Details

File:	Chrome Cache Entry: 36
Category:	dropped
Dump:	chromecache_36.2.dr
ID:	dr_6
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (5945)
Entropy:	5.587013123517144
Encrypted:	false
Ssdeep:	6144:k4Q3Ro3k4aE58Bvi8ECFqXk9nR+iFBBNy2U7B:NQ32krEmBK+WN
Size:	320010
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	2532
Target ID:	0
Parent PID:	5932
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	09:36:30
Date:	24/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=1932,i,14772466053438159034,17090495882435461407,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	4916
Target ID:	2
Parent PID:	2532
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=1932,i,14772466053438159034,17090495882435461407,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	09:36:32
Date:	24/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://usito.usherbrooke.ca/"

Details

Is windows:	true
Is dropped:	false
PID:	3840
Target ID:	3
Parent PID:	5932
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://usito.usherbrooke.ca/"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	09:36:35
Date:	24/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://usito.usherbrooke.ca/

https://usito.usherbrooke.ca/scripts/bluebird.core.min.js

132.210.3.192

https://usito.usherbrooke.ca/scripts/utilitaires.js

132.210.3.192

https://use.typekit.net/af/3e30bd/000000000000000077359949/30/d?primer=7cdcb44be4a7db8877ffa5c0007b8

unknown

https://stats.g.doubleclick.net/g/collect

unknown

https://use.typekit.net/af/2dc4e0/000000000000000077359952/30/d?primer=7cdcb44be4a7db8877ffa5c0007b8

unknown

https://usito.usherbrooke.ca/

132.210.3.192

https://usito.usherbrooke.ca/scripts/popper/popper.min.js

132.210.3.192

https://p.typekit.net/p.css?s=1&k=wdg0ygm&ht=tk&f=1982.1983.8543.8544&a=12232367&app=typekit&e=css

unknown

https://use.typekit.net/af/8a79e7/000000000000000000011b24/27/a?primer=7cdcb44be4a7db8877ffa5c0007b8

unknown

https://use.typekit.net/af/d23205/000000000000000077359947/30/a?primer=7cdcb44be4a7db8877ffa5c0007b8

unknown

https://usito.usherbrooke.ca/udes-icons/css/udes-icons.css

132.210.3.192

https://cct.google/taggy/agent.js

unknown

http://typekit.com/eulas/000000000000000077359947

unknown

https://usito.usherbrooke.ca/scripts/usito.js

132.210.3.192

http://typekit.com/eulas/000000000000000077359949

unknown

https://www.google.com

unknown

https://www.youtube.com/iframe_api

unknown

https://usito.usherbrooke.ca/scripts/jquery.min.js

132.210.3.192

https://use.typekit.net/af/2dc4e0/000000000000000077359952/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8

unknown

https://use.typekit.net/af/3e30bd/000000000000000077359949/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8

unknown

https://td.doubleclick.net

unknown

https://use.typekit.net/af/2dc4e0/000000000000000077359952/30/a?primer=7cdcb44be4a7db8877ffa5c0007b8

unknown

https://usito.usherbrooke.ca/css/styles.css

132.210.3.192

https://usito.usherbrooke.ca/scripts/commun.js

132.210.3.192

https://www.merchant-center-analytics.goog

unknown

https://use.typekit.net/af/8a79e7/000000000000000000011b24/27/d?primer=7cdcb44be4a7db8877ffa5c0007b8

unknown

https://use.typekit.net/af/d23205/000000000000000077359947/30/d?primer=7cdcb44be4a7db8877ffa5c0007b8

unknown

https://usito.usherbrooke.ca/css/font-usito/style.css

132.210.3.192

http://typekit.com/eulas/000000000000000000011b24

unknown

http://typekit.com/eulas/000000000000000077359952

unknown

https://usito.usherbrooke.ca/scripts/jquery-ui-1.10.4.custom/js/jquery-ui-1.10.4.custom.min.js

132.210.3.192

https://use.typekit.net/af/3e30bd/000000000000000077359949/30/a?primer=7cdcb44be4a7db8877ffa5c0007b8

unknown

https://use.typekit.net/af/8a79e7/000000000000000000011b24/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8

unknown

https://adservice.google.com/pagead/regclk?

unknown

https://use.typekit.net/af/d23205/000000000000000077359947/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8

unknown

https://usito.usherbrooke.ca/scripts/jquery-ui-1.10.4.custom/css/smoothness/jquery-ui-1.10.4.custom.min.css

132.210.3.192

There are 26 hidden URLs, click here to show them.

Domains

Name

Malicious

usito.usherbrooke.ca

132.210.3.192

Details

Name:	usito.usherbrooke.ca
IP:	132.210.3.192
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

www.google.com

172.217.18.4

Details

Name:	www.google.com
IP:	172.217.18.4
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

fp2e7a.wpc.phicdn.net

192.229.221.95

use.typekit.net

unknown

p.typekit.net

unknown

IPs

Domain

Country

Malicious

172.217.18.4

www.google.com

United States

192.168.2.6

unknown

132.210.3.192

usito.usherbrooke.ca

Canada

239.255.255.250

unknown

Reserved

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://usito.usherbrooke.ca/

Files

Processes

URLs

Domains

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://usito.usherbrooke.ca/

Files

Processes

URLs

Domains

IPs

IOC Report
https://usito.usherbrooke.ca/