Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Fax_Message_04 September, 202411_21_58 AM_564308269612697.htm

HTML document, Unicode text, UTF-8 text, with very long lines (3853), with CRLF line terminators

initial sample

Details

Filetype:	HTML document, Unicode text, UTF-8 text, with very long lines (3853), with CRLF line terminators
Entropy:	5.4616223295757695
Filename:	Fax_Message_04 September, 202411_21_58 AM_564308269612697.htm
Filesize:	7768
MD5:	3cea7f8f758ab8a3d16a1d5b5e5a2b1b
SHA1:	f208e64c61f0bbd1625db42a358d176a6c693366
SHA256:	a4d30d77f7daf1408293e74f03dfab0e6d3e5909d1c19cd1366dbc4184713f5f
SHA512:	e71c63ede12cd72b9212a204793a9f2f93a7c352d04a87fb4e5f3c66cc57d7409cac78c84b43f57116925917290cf7b5f1607e020d4c9aa793315775a54a565e
SSDEEP:	192:rl/JT3p7ED/rvi7Nb5wlqUTURzWTsmiw5wDi:rxl3pQrbiZbmlqUTURzWomB5we
Preview:	<html>....... .. .. <head>..... <title>...</title>.. . <meta......name="viewport" . ..content="width=device-width,.initial-scale=1.0">.... . <script ..src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js"></script>.........

Signature Hits	Behavior Group	Mitre Attack
Suspicious Javascript code found in HTML file	Phishing
HTML page contains hidden javascript code	Phishing
HTML page is missing a favicon	Phishing
URLs found in memory or binary data	Networking

Chrome Cache Entry: 65

ASCII text, with very long lines (47992), with no line terminators

dropped

Details

File:	Chrome Cache Entry: 65
Category:	dropped
Dump:	chromecache_65.2.dr
ID:	dr_0
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (47992), with no line terminators
Entropy:	5.605846858683577
Encrypted:	false
Ssdeep:	768:LuxoaUN4+OIhwP53+e0QfA31jQM9OT81NHv4rnwfe:LuxoaU2+LwB2+G1ZdvCwfe
Size:	47992
Whitelisted:	false
Reputation:	high

Chrome Cache Entry: 66

ASCII text, with very long lines (47992), with no line terminators

downloaded

Details

File:	Chrome Cache Entry: 66
Category:	downloaded
Dump:	chromecache_66.2.dr
ID:	dr_2
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (47992), with no line terminators
Entropy:	5.605846858683577
Encrypted:	false
Ssdeep:	768:LuxoaUN4+OIhwP53+e0QfA31jQM9OT81NHv4rnwfe:LuxoaU2+LwB2+G1ZdvCwfe
Size:	47992
Whitelisted:	false
Reputation:	high

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\Fax_Message_04 September, 202411_21_58 AM_564308269612697.htm"

Details

Is windows:	true
Is dropped:	false
PID:	332
Target ID:	0
Parent PID:	1928
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\Fax_Message_04 September, 202411_21_58 AM_564308269612697.htm"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	07:03:20
Date:	25/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1968,i,3813573641665666415,12442729027054868266,262144 /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	980
Target ID:	2
Parent PID:	332
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1968,i,3813573641665666415,12442729027054868266,262144 /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	07:03:25
Date:	25/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://shih-tzu-fancierson.ru//

188.114.96.3

https://a.nel.cloudflare.com/report/v4?s=BKEuNysdOlkONFSQ8y8j37eYZ%2Fx0chGl5GUF%2Fb0eq1c%2FVCInKH7nBSYolJs3eAC19VP%2FZMRM%2B9a9k4YvhrNikV5w%2F%2FylKgKrwYwU7cie89WDqYEP8doMWDq6EaHtIh3hkphgJu2zW%2BrE

35.190.80.1

file:///C:/Users/user/Desktop/Fax_Message_04%20September,%20202411_21_58%20AM_564308269612697.htm#oZnJhbmNvaXMucml2YXJkQGlubm9jYXAuY29t

Details

Name:	file:///C:/Users/user/Desktop/Fax_Message_04%20September,%20202411_21_58%20AM_564308269612697.htm#oZnJhbmNvaXMucml2YXJkQGlubm9jYXAuY29t
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	browser

Signature Hits	Behavior Group	Mitre Attack
Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)	Phishing	Scripting Deobfuscate/Decode Files or Information
HTML page is missing a favicon	Phishing

https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js

104.17.25.14

Details

Name:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
IP:	104.17.25.14
TargetID:	2
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

shih-tzu-fancierson.ru

188.114.96.3

Details

Name:	shih-tzu-fancierson.ru
IP:	188.114.96.3
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol

a.nel.cloudflare.com

35.190.80.1

Details

Name:	a.nel.cloudflare.com
IP:	35.190.80.1
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

cdnjs.cloudflare.com

104.17.25.14

Details

Name:	cdnjs.cloudflare.com
IP:	104.17.25.14
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

s-part-0036.t-0009.t-msedge.net

13.107.246.64

s-part-0017.t-0009.fb-t-msedge.net

13.107.253.45

s-part-0017.t-0009.t-msedge.net

13.107.246.45

www.google.com

142.250.184.228

Details

Name:	www.google.com
IP:	142.250.184.228
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

s-part-0039.t-0009.t-msedge.net

13.107.246.67

IPs

Domain

Country

Malicious

104.17.24.14

unknown

United States

192.168.2.4

unknown

192.168.2.5

unknown

239.255.255.250

unknown

Reserved

188.114.96.3

shih-tzu-fancierson.ru

European Union

35.190.80.1

a.nel.cloudflare.com

United States

142.250.184.228

www.google.com

United States

104.17.25.14

cdnjs.cloudflare.com

United States

DOM / HTML

URL

Malicious

file:///C:/Users/user/Desktop/Fax_Message_04%20September,%20202411_21_58%20AM_564308269612697.htm#oZnJhbmNvaXMucml2YXJkQGlubm9jYXAuY29t

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
Fax_Message_04 September, 202411_21_58 AM_564308269612697.htm

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportFax_Message_04 September, 202411_21_58 AM_564308269612697.htm

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
Fax_Message_04 September, 202411_21_58 AM_564308269612697.htm