Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

product1122.html

HTML document, ASCII text, with very long lines (65311), with CRLF line terminators

initial sample

Details

Filetype:	HTML document, ASCII text, with very long lines (65311), with CRLF line terminators
Entropy:	5.95707030525115
Filename:	product1122.html
Filesize:	1034319
MD5:	61728329516b48e684e53bf8c05c213d
SHA1:	5b1b9ef4cb22cae4e6ed7b8078049230e656796c
SHA256:	15dc91b3d82d1cdfc355e3e43d6cb4bb163d9cb4aa7cbfb0eb6eb081d56fdc63
SHA512:	f12a17846810bb0ed36d46a181c14a2170c84f880eabcc734130ed735211ec0f6080126c252d7fe1e9c92ec9312a71ae23d29c545d53d2aa4ec669e6b24c51bb
SSDEEP:	24576:+v5KfSjcJKuGkfXQx/dl9p2VPqieAQ7jomNQr1CoD:FfcyXQH2PlyEMQr1P
Preview:	<!DOCTYPE html>..<html>..<head>..<meta charset="utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1" />..</head>..<body>.. [start] The relevant script will be copied between the "body" tags! -->....<script> var xywrf27y=xywrf27y

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Detected javascript redirector / loader	Phishing
Suspicious Javascript code found in HTML file	Phishing
HTML page is missing a favicon	Phishing
Sample is known by Antivirus	System Summary

C:\Users\user\Downloads\Unconfirmed 163765.crdownload (copy)

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

Details

File:	C:\Users\user\Downloads\Unconfirmed 163765.crdownload (copy)
Category:	dropped
Dump:	c46b6438-bd12-465d-b351-51dc91ef4986.tmp.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.889102009770903
Encrypted:	false
Ssdeep:	12288:hCK/pbMrRwwAFua+bT/gUDSXN057FQdMvMOKI4uko5QLaBKJAWnGtMm8WxTlEA3J:hCiMrgeX5S+5xeMp4xoQaWAWGtMm8WxP
Size:	774144
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior

C:\Users\user\Downloads\Unconfirmed 462822.crdownload (copy)

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

Details

File:	C:\Users\user\Downloads\Unconfirmed 462822.crdownload (copy)
Category:	dropped
Dump:	d384f462-4692-49be-a501-11ea5575a036.tmp.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.889102009770903
Encrypted:	false
Ssdeep:	12288:hCK/pbMrRwwAFua+bT/gUDSXN057FQdMvMOKI4uko5QLaBKJAWnGtMm8WxTlEA3J:hCiMrgeX5S+5xeMp4xoQaWAWGtMm8WxP
Size:	774144
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior

C:\Users\user\Downloads\c46b6438-bd12-465d-b351-51dc91ef4986.tmp

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

Details

File:	C:\Users\user\Downloads\c46b6438-bd12-465d-b351-51dc91ef4986.tmp
Category:	dropped
Dump:	c46b6438-bd12-465d-b351-51dc91ef4986.tmp.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.889102009770903
Encrypted:	false
Ssdeep:	12288:hCK/pbMrRwwAFua+bT/gUDSXN057FQdMvMOKI4uko5QLaBKJAWnGtMm8WxTlEA3J:hCiMrgeX5S+5xeMp4xoQaWAWGtMm8WxP
Size:	774144
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for dropped file	AV Detection
Drops PE files	Persistence and Installation Behavior
Creates files inside the user directory	System Summary	Masquerading

C:\Users\user\Downloads\d384f462-4692-49be-a501-11ea5575a036.tmp

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

Details

File:	C:\Users\user\Downloads\d384f462-4692-49be-a501-11ea5575a036.tmp
Category:	dropped
Dump:	d384f462-4692-49be-a501-11ea5575a036.tmp.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.889102009770903
Encrypted:	false
Ssdeep:	12288:hCK/pbMrRwwAFua+bT/gUDSXN057FQdMvMOKI4uko5QLaBKJAWnGtMm8WxTlEA3J:hCiMrgeX5S+5xeMp4xoQaWAWGtMm8WxP
Size:	774144
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for dropped file	AV Detection
Drops PE files	Persistence and Installation Behavior

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\product1122.html"

Details

Is windows:	true
Is dropped:	false
PID:	6932
Target ID:	0
Parent PID:	5884
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\product1122.html"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	11:16:56
Date:	18/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2200,i,12531877602374010323,3505977888523723621,262144 /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	6524
Target ID:	2
Parent PID:	6932
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2200,i,12531877602374010323,3505977888523723621,262144 /prefetch:8
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	11:17:01
Date:	18/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5072 --field-trial-handle=2200,i,12531877602374010323,3505977888523723621,262144 /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	2924
Target ID:	3
Parent PID:	6932
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5072 --field-trial-handle=2200,i,12531877602374010323,3505977888523723621,262144 /prefetch:8
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	11:17:02
Date:	18/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	false
Is elevated:	false
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

IP

Malicious

http://www.ctvnews.ca/rss/business/ctv-news-business-headlines-1.867648

unknown

http://www.ctvnews.ca/rss/ctvnews-ca-top-stories-public-rss-1.822009

unknown

http://xml.weather.yahoo.com/ns/rss/1.0

unknown

file:///C:/Users/user/Desktop/product1122.html

Details

Name:	file:///C:/Users/user/Desktop/product1122.html
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	browser
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Detected javascript redirector / loader	Phishing
Suspicious Javascript code found in HTML file	Phishing
HTML page is missing a favicon	Phishing
Sample is known by Antivirus	System Summary

http://weather.yahooapis.com/forecastrss?w=4118

unknown

Domains

Name

IP

Malicious

www.google.com

64.233.176.99

Details

Name:	www.google.com
IP:	64.233.176.99
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

IP

Domain

Country

Malicious

239.255.255.250

unknown

Reserved

64.233.176.99

www.google.com

United States

192.168.2.16

unknown

192.168.2.4

unknown

192.168.2.6

unknown

DOM / HTML

URL

Malicious

file:///C:/Users/user/Desktop/product1122.html

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
product1122.html

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportproduct1122.html

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
product1122.html