Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Chrome Cache Entry: 109

GIF image data, version 89a, 1 x 1

dropped

Details

File:	Chrome Cache Entry: 109
Category:	dropped
Dump:	chromecache_109.2.dr
ID:	dr_8
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	GIF image data, version 89a, 1 x 1
Entropy:	2.7374910194847146
Encrypted:	false
Ssdeep:	3:CU9yltxlHh/:m/
Size:	43
Whitelisted:	true
Reputation:	low

Chrome Cache Entry: 110

GIF image data, version 89a, 1 x 1

downloaded

Details

File:	Chrome Cache Entry: 110
Category:	downloaded
Dump:	chromecache_110.2.dr
ID:	dr_9
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	GIF image data, version 89a, 1 x 1
Entropy:	2.7374910194847146
Encrypted:	false
Ssdeep:	3:CU9yltxlHh/:m/
Size:	43
Whitelisted:	true
Reputation:	low

Chrome Cache Entry: 111

GIF image data, version 89a, 1 x 1

dropped

Details

File:	Chrome Cache Entry: 111
Category:	dropped
Dump:	chromecache_111.2.dr
ID:	dr_1
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	GIF image data, version 89a, 1 x 1
Entropy:	2.9889835948335506
Encrypted:	false
Ssdeep:	3:CUTxl7/lHh/:7lf/
Size:	43
Whitelisted:	true
Reputation:	low

Chrome Cache Entry: 112

PNG image data, 2 x 2, 8-bit/color RGBA, non-interlaced

downloaded

Details

File:	Chrome Cache Entry: 112
Category:	downloaded
Dump:	chromecache_112.2.dr
ID:	dr_10
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 2 x 2, 8-bit/color RGBA, non-interlaced
Entropy:	4.704974133438228
Encrypted:	false
Ssdeep:	3:yionv//thPltRt0LKh/rywOvR/c+Lp/sg14:6v/lhPIWhm139ku4
Size:	101
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 113

GIF image data, version 89a, 1 x 1

downloaded

Details

File:	Chrome Cache Entry: 113
Category:	downloaded
Dump:	chromecache_113.2.dr
ID:	dr_11
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	GIF image data, version 89a, 1 x 1
Entropy:	2.9889835948335506
Encrypted:	false
Ssdeep:	3:CUTxl7/lHh/:7lf/
Size:	43
Whitelisted:	true
Reputation:	low

Chrome Cache Entry: 114

PNG image data, 1080 x 59, 8-bit/color RGB, non-interlaced

dropped

Details

File:	Chrome Cache Entry: 114
Category:	dropped
Dump:	chromecache_114.2.dr
ID:	dr_4
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 1080 x 59, 8-bit/color RGB, non-interlaced
Entropy:	7.994842586870214
Encrypted:	true
Ssdeep:	768:IDonXJmos5LL0GaG2uNkyoygJIYfsRr8iJCTrMFrHlvO0kiWG2UzWw38NeP:IDw5u30GkuPo7qYfor8iGoFzlsOzWwbP
Size:	45236
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 115

HTML document, ASCII text

downloaded

Details

File:	Chrome Cache Entry: 115
Category:	downloaded
Dump:	chromecache_115.2.dr
ID:	dr_12
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text
Entropy:	5.0572271090563765
Encrypted:	false
Ssdeep:	6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoFEHcLgabzjsKtgsg93wzRbKqD:J0+oxBeRmR9etdzRxGezZfCzjsKtgizR
Size:	315
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 116

PNG image data, 1080 x 59, 8-bit/color RGB, non-interlaced

downloaded

Details

File:	Chrome Cache Entry: 116
Category:	downloaded
Dump:	chromecache_116.2.dr
ID:	dr_13
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 1080 x 59, 8-bit/color RGB, non-interlaced
Entropy:	7.994842586870214
Encrypted:	true
Ssdeep:	768:IDonXJmos5LL0GaG2uNkyoygJIYfsRr8iJCTrMFrHlvO0kiWG2UzWw38NeP:IDw5u30GkuPo7qYfor8iGoFzlsOzWwbP
Size:	45236
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 117

HTML document, Unicode text, UTF-8 text, with very long lines (1177)

downloaded

Details

File:	Chrome Cache Entry: 117
Category:	downloaded
Dump:	chromecache_117.2.dr
ID:	dr_14
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1177)
Entropy:	5.135220094947811
Encrypted:	false
Ssdeep:	384:Ah6UYLUexKFEfFHbFyDoFsmdFMrF+OdFeFzFAF+tFRFhFUFEBW7jeZauCwS:A4UT2KFEfF7F3F1FMrFVFeFzFAF+tFRa
Size:	24471
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	2812
Target ID:	0
Parent PID:	6024
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	18:30:27
Date:	25/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 --field-trial-handle=2212,i,15901161456646588290,13050926706308243751,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	2108
Target ID:	2
Parent PID:	2812
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 --field-trial-handle=2212,i,15901161456646588290,13050926706308243751,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	18:30:31
Date:	25/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cdn.usebargains.com/wv/YWE9MzE2NDU5NDEyJnNlaT0yODcyMzgwOCZ0az1VOWlNZ3FLWVNBRTJDUGFRU0FOUSZ0PTMmYz05MGFzODc2ZmQ4OWFzNWZnOGEwOXMmcGw9OTY="

Details

Is windows:	true
Is dropped:	false
PID:	6280
Target ID:	3
Parent PID:	6024
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cdn.usebargains.com/wv/YWE9MzE2NDU5NDEyJnNlaT0yODcyMzgwOCZ0az1VOWlNZ3FLWVNBRTJDUGFRU0FOUSZ0PTMmYz05MGFzODc2ZmQ4OWFzNWZnOGEwOXMmcGw9OTY="
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	18:30:34
Date:	25/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://cdn.usebargains.com/wv/YWE9MzE2NDU5NDEyJnNlaT0yODcyMzgwOCZ0az1VOWlNZ3FLWVNBRTJDUGFRU0FOUSZ0PTMmYz05MGFzODc2ZmQ4OWFzNWZnOGEwOXMmcGw9OTY=

https://cdn.usebargains.com/favicon.ico

172.67.183.137

https://cdn.usebargains.com/cdn/29579/mail_3_5_1_1.jpg

unknown

https://a.nel.cloudflare.com/report/v4?s=H2qfB3eMCIi%2BBC4VhBuACs74VbfuKt3tUKCGmKV%2ByjCZ5VAgejoav%2FiPLZjOtKGE3O1Qy3RuczRlLF9Y2jGlCzeM3vea7ZYffTF51sFqEaRQbPJR%2Byd4ifTwx5m3TokiTxv1iHQE

35.190.80.1

https://cdn.usebargains.com/wv/YWE9MzE2NDU5NDEyJnNlaT0yODcyMzgwOCZ0az1VOWlNZ3FLWVNBRTJDUGFRU0FOUSZ0P

unknown

https://cdn.usebargains.com/timg/aHR0cDovL25ld3MubG92dmlzYmVhdXRpZnVsLmNvbS9hZmZfaT9vZmZlcl9pZD0xMDA

unknown

https://cdn.usebargains.com/wv/YWE9MzE2NDU5NDEyJnNlaT0yODcyMzgwOCZ0az1VOWlNZ3FLWVNBRTJDUGFRU0FOUSZ0PTMmYz05MGFzODc2ZmQ4OWFzNWZnOGEwOXMmcGw9OTY=

https://cdn.usebargains.com/cdn/29579/mail_3_5_1_2.jpg

172.67.183.137

https://cdn.usebargains.com/rdr/YWE9MzE2NDU5NDEyJnNlaT0yODcyMzgwOCZ0az1VOWlNZ3FLWVNBRTJDUGFRU0FOUSZ0

unknown

https://cdn.usebargains.com/px/YWE9MzE2NDU5NDEyJnNlaT0yODcyMzgwOCZ0az1VOWlNZ3FLWVNBRTJDUGFRU0FOUSZ0PTEmYz05MGFzODc2ZmQ4OWFzNWZnOGEwOXM=

172.67.183.137

https://cdn.usebargains.com/timg/aHR0cDovL25ld3MubG92dmlzYmVhdXRpZnVsLmNvbS9hZmZfaT9vZmZlcl9pZD0xMDA2JmZpbGVfaWQ9NzgyNyZhZmZfaWQ9MTI3Ng==

172.67.183.137

https://cdn.usebargains.com/px/YWE9MzE2NDU5NDEyJnNlaT0yODcyMzgwOCZ0az1VOWlNZ3FLWVNBRTJDUGFRU0FOUSZ0P

unknown

There are 1 hidden URLs, click here to show them.

Domains

Name

Malicious

bg.microsoft.map.fastly.net

199.232.210.172

a.nel.cloudflare.com

35.190.80.1

Details

Name:	a.nel.cloudflare.com
IP:	35.190.80.1
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

s-part-0017.t-0009.t-msedge.net

13.107.246.45

www.google.com

142.250.185.228

Details

Name:	www.google.com
IP:	142.250.185.228
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

cdn.usebargains.com

172.67.183.137

Details

Name:	cdn.usebargains.com
IP:	172.67.183.137
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

fp2e7a.wpc.phicdn.net

192.229.221.95

s-part-0032.t-0009.t-msedge.net

13.107.246.60

IPs

Domain

Country

Malicious

142.250.185.228

www.google.com

United States

239.255.255.250

unknown

Reserved

172.67.183.137

cdn.usebargains.com

United States

35.190.80.1

a.nel.cloudflare.com

United States

192.168.2.4

unknown

Details

IP:	192.168.2.4
TargetID:	0
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Private:	true

Signature Hits	Behavior Group	Mitre Attack
Detected non-DNS traffic on DNS port	Networking
Uses insecure TLS / SSL version for HTTPS connection	Compliance, Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

192.168.2.6

unknown

DOM / HTML

URL

Malicious

https://cdn.usebargains.com/wv/YWE9MzE2NDU5NDEyJnNlaT0yODcyMzgwOCZ0az1VOWlNZ3FLWVNBRTJDUGFRU0FOUSZ0PTMmYz05MGFzODc2ZmQ4OWFzNWZnOGEwOXMmcGw9OTY=

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://cdn.usebargains.com/wv/YWE9MzE2NDU5NDEyJnNlaT0yODcyMzgwOCZ0az1VOWlNZ3FLWVNBRTJDUGFRU0FOUSZ0PTMmYz05MGFzODc2ZmQ4OWFzNWZnOGEwOXMmcGw9OTY=

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://cdn.usebargains.com/wv/YWE9MzE2NDU5NDEyJnNlaT0yODcyMzgwOCZ0az1VOWlNZ3FLWVNBRTJDUGFRU0FOUSZ0PTMmYz05MGFzODc2ZmQ4OWFzNWZnOGEwOXMmcGw9OTY=

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
https://cdn.usebargains.com/wv/YWE9MzE2NDU5NDEyJnNlaT0yODcyMzgwOCZ0az1VOWlNZ3FLWVNBRTJDUGFRU0FOUSZ0PTMmYz05MGFzODc2ZmQ4OWFzNWZnOGEwOXMmcGw9OTY=