Automated Malware Analysis IOC Report for

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	7600
Target ID:	0
Parent PID:	5092
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	2509656
MD5:	464953824E644F10FFDC9E093FD18F94
Time:	22:44:23
Date:	18/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff626820000
Modulesize:	2568192
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1644,34356383147248551,10702149225259720885,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	3060
Target ID:	3
Parent PID:	7600
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1644,34356383147248551,10702149225259720885,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 /prefetch:8
Size:	2509656
MD5:	464953824E644F10FFDC9E093FD18F94
Time:	22:44:24
Date:	18/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff626820000
Modulesize:	2568192
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://drive.filen.io/d/86d87964-c23f-4257-ab67-1d3a6a53307f#p6azJi5gS13nDkjcLoSnKfqLeQFJ51Va"

Details

Is windows:	true
Is dropped:	false
PID:	4844
Target ID:	5
Parent PID:	5092
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://drive.filen.io/d/86d87964-c23f-4257-ab67-1d3a6a53307f#p6azJi5gS13nDkjcLoSnKfqLeQFJ51Va"
Size:	2509656
MD5:	464953824E644F10FFDC9E093FD18F94
Time:	22:44:25
Date:	18/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff626820000
Modulesize:	2568192
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=ppapi --field-trial-handle=1644,34356383147248551,10702149225259720885,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=3928 /prefetch:3

Details

Is windows:	true
Is dropped:	false
PID:	4744
Target ID:	7
Parent PID:	7600
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=ppapi --field-trial-handle=1644,34356383147248551,10702149225259720885,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=3928 /prefetch:3
Size:	2509656
MD5:	464953824E644F10FFDC9E093FD18F94
Time:	22:44:56
Date:	18/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0x7ff626820000
Modulesize:	2568192
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://drive.filen.io/d/86d87964-c23f-4257-ab67-1d3a6a53307f#p6azJi5gS13nDkjcLoSnKfqLeQFJ51Va

https://drive.filen.io/static/js/418.b5bed9d9.chunk.js

146.0.41.208

https://drive.filen.io/static/js/758.8a2278ed.chunk.js

146.0.41.208

https://analytics.filen.io/js/plausible.js

146.0.41.206

https://gateway.filen-2.net/v3/file/link/info

146.0.41.208

https://drive.filen.io/d/86d87964-c23f-4257-ab67-1d3a6a53307f

146.0.41.208

https://cdn.filen.io/ht/HackTimer.js

146.0.41.207

https://drive.filen.io/static/js/main.8419430e.js

146.0.41.208

https://drive.filen.io/static/js/208.ecfb968a.chunk.js

146.0.41.208

https://drive.filen.io/static/js/32.1f5639c6.chunk.js

146.0.41.208

https://gateway.filen.io/v3/file/link/password

146.0.41.207

https://socket.filen.io/socket.io/?EIO=3&transport=websocket

146.0.41.207

https://drive.filen.io/static/media/inter-v12-latin-500.c72c72b70c82b1f4bacf.woff2

146.0.41.208

https://drive.filen.io/favicon.ico

146.0.41.208

https://drive.filen.io/webstreams.js

146.0.41.208

https://cdn.filen.io/cfg.json?noCache=1713473073206

146.0.41.207

https://cdn.filen.io/cfg.json?noCache=1713473133215

146.0.41.206

https://drive.filen.io/static/css/main.eeb9c19c.css

146.0.41.208

https://drive.filen.io/static/js/528.6d3a337a.chunk.js

146.0.41.208

https://drive.filen.io/static/js/454.d38d97fe.chunk.js

146.0.41.208

https://drive.filen.io/d/86d87964-c23f-4257-ab67-1d3a6a53307f#p6azJi5gS13nDkjcLoSnKfqLeQFJ51Va

https://drive.filen.io/static/js/153.93ada2fc.chunk.js

146.0.41.208

https://drive.filen.io/static/js/885.04acd75a.chunk.js

146.0.41.208

https://drive.filen.io/static/js/731.c9335a78.chunk.js

146.0.41.208

https://drive.filen.io/static/media/logo_animated.5b2a93fbda359a792c23.gif

146.0.41.208

https://drive.filen.io/static/js/273.97b75179.chunk.js

146.0.41.208

https://drive.filen.io/static/js/107.29c4b0a4.chunk.js

146.0.41.208

https://drive.filen.io/static/js/109.14cb8a71.chunk.js

146.0.41.208

https://drive.filen.io/static/js/592.ab1857e1.chunk.js

146.0.41.208

https://drive.filen.io/static/media/dark_logo.41ab3ed5c0117abdb8e47d6bac43d9ae.svg

146.0.41.208

https://analytics.filen.io/api/event

146.0.41.206

https://drive.filen.io/site.webmanifest

146.0.41.208

https://drive.filen.io/static/js/520.81de291f.chunk.js

146.0.41.208

https://drive.filen.io/swfs.js

146.0.41.208

https://drive.filen.io/static/js/827.d99a6ec2.chunk.js

146.0.41.208

https://egest.filen-4.net/de-1/filen-1013/c326ef2d-8daa-48dd-a726-0a5725d3d183/0

146.0.41.207

There are 25 hidden URLs, click here to show them.

Domains

Name

Malicious

gateway.filen-2.net

146.0.41.208

Details

Name:	gateway.filen-2.net
IP:	146.0.41.208
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

analytics.filen.io

146.0.41.206

Details

Name:	analytics.filen.io
IP:	146.0.41.206
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol

cdn.filen.io

146.0.41.207

Details

Name:	cdn.filen.io
IP:	146.0.41.207
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

socket.filen.io

146.0.41.207

Details

Name:	socket.filen.io
IP:	146.0.41.207
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

www.google.com

142.250.176.4

drive.filen.io

146.0.41.208

Details

Name:	drive.filen.io
IP:	146.0.41.208
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

gateway.filen.io

146.0.41.207

Details

Name:	gateway.filen.io
IP:	146.0.41.207
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

egest.filen-4.net

146.0.41.207

Details

Name:	egest.filen-4.net
IP:	146.0.41.207
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

IPs

Domain

Country

Malicious

192.168.11.20

unknown

239.255.255.250

unknown

Reserved

Details

IP:	239.255.255.250
TargetID:	0
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Country:	Reserved
Countrycode:	ZZZ
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking
Sends SSDP (simple service discovery protocol) broadcast queries	Networking	Network Service Discovery

146.0.41.207

cdn.filen.io

Germany

146.0.41.206

analytics.filen.io

Germany

146.0.41.208

gateway.filen-2.net

Germany

142.250.176.4

www.google.com

United States

DOM / HTML

URL

Malicious

https://drive.filen.io/d/86d87964-c23f-4257-ab67-1d3a6a53307f#p6azJi5gS13nDkjcLoSnKfqLeQFJ51Va

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://drive.filen.io/d/86d87964-c23f-4257-ab67-1d3a6a53307f#p6azJi5gS13nDkjcLoSnKfqLeQFJ51Va

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://drive.filen.io/d/86d87964-c23f-4257-ab67-1d3a6a53307f#p6azJi5gS13nDkjcLoSnKfqLeQFJ51Va

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
https://drive.filen.io/d/86d87964-c23f-4257-ab67-1d3a6a53307f#p6azJi5gS13nDkjcLoSnKfqLeQFJ51Va