Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

razer-partners.com.html

data

initial sample

Details

Filetype:	data
Entropy:	6.214102991925758
Filename:	razer-partners.com.html
Filesize:	11800
MD5:	2b3a90534ef53c03b7e8ac359aa0f78c
SHA1:	f2e80fd65fe6d858f06b3b06276321f1d3ca9b05
SHA256:	2c4864c86db7b66f1410dbd57e7a94131659c32daba1e1daabb20eb1128e88e0
SHA512:	032f78f2a4d2139016a41143eb03c695d2a8f7ddd982b756c30120aaf2866511f7997dc9ab139a01f309607d0dfb4d208525e727280ca8b86948bb8a0f0cce83
SSDEEP:	192:rgtXSLY6hR8MojFNpGnlt690kAj0XqcnHHBj8MPDX9stP8EAYunDhxvf5THP444B:rgtCLY6hJofUnC97Ain586hJhlxhHPYp
Preview:	<html><head>.<meta http-equiv="content-type" content="text/html; charset=UTF-8"><script></script></head><body>................................................................</body>l1l=document.all;var .a8b9f=true;ll1=document.layers;lll=window.sidebar;a8

Signature Hits	Behavior Group	Mitre Attack
Detected javascript redirector / loader	Phishing

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 16:31:18 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Category:	dropped
Dump:	Docs.lnk.0.dr
ID:	dr_5
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 16:31:18 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Entropy:	3.9832019159750094
Encrypted:	false
Ssdeep:	48:85wbd6T4ebH/ZidAKZdA1uehwiZUklqehYgy+3:85Nsesfgy
Size:	2673
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Category:	dropped
Dump:	Gmail.lnk.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 16:31:18 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Entropy:	4.003601213528309
Encrypted:	false
Ssdeep:	48:8bwbd6T4ebH/ZidAKZdA1Heh/iZUkAQkqehPgy+2:8bNsey9Qagy
Size:	2675
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 08:59:33 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Category:	dropped
Dump:	Google Drive.lnk.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 08:59:33 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Entropy:	4.011008658842348
Encrypted:	false
Ssdeep:	48:8Fwbd6T4bH/ZidAKZdA149eh7sFiZUkmgqeh7sxgy+BX:8FNsGnDgy
Size:	2689
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Category:	dropped
Dump:	Sheets.lnk.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 16:31:18 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Entropy:	3.9982362199647907
Encrypted:	false
Ssdeep:	48:8xwbd6T4ebH/ZidAKZdA14ehDiZUkwqehbgy+R:8xNsepJgy
Size:	2677
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Category:	dropped
Dump:	Slides.lnk.0.dr
ID:	dr_4
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 16:31:18 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Entropy:	3.9881469636052476
Encrypted:	false
Ssdeep:	48:8Mwbd6T4ebH/ZidAKZdA1mehBiZUk1W1qeh1gy+C:8MNseJ9Vgy
Size:	2677
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Category:	dropped
Dump:	YouTube.lnk.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 16:31:18 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Entropy:	3.998678128939221
Encrypted:	false
Ssdeep:	48:8iwbd6T4ebH/ZidAKZdA1duT1ehOuTbbiZUk5OjqehOuTbDgy+yT+:8iNsegTyTbxWOvTbDgy7T
Size:	2679
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\razer-partners.com.html"

Details

Is windows:	true
Is dropped:	false
PID:	6900
Target ID:	0
Parent PID:	4100
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\razer-partners.com.html"
Size:	3242272
MD5:	83395EAB5B03DEA9720F8D7AC0D15CAA
Time:	12:31:12
Date:	15/01/2025
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6c5c30000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1968,i,7308265894918338194,7020277294823495674,262144 /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	4036
Target ID:	2
Parent PID:	6900
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1968,i,7308265894918338194,7020277294823495674,262144 /prefetch:8
Size:	3242272
MD5:	83395EAB5B03DEA9720F8D7AC0D15CAA
Time:	12:31:15
Date:	15/01/2025
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6c5c30000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

file:///C:/Users/user/Desktop/razer-partners.com.html

Domains

Name

Malicious

s-part-0017.t-0009.t-msedge.net

13.107.246.45

www.google.com

172.217.16.196

Details

Name:	www.google.com
IP:	172.217.16.196
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Malicious

192.168.2.10

unknown

239.255.255.250

unknown

Reserved

172.217.16.196

www.google.com

United States

DOM / HTML

URL

Malicious

file:///C:/Users/user/Desktop/razer-partners.com.html

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
razer-partners.com.html

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportrazer-partners.com.html

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
razer-partners.com.html