Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Payment Receipt .html

HTML document, ASCII text, with very long lines (696), with CRLF line terminators

initial sample

Chrome Cache Entry: 63

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 360x360, components 3

downloaded

Chrome Cache Entry: 64

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390

dropped

Chrome Cache Entry: 65

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513

dropped

Chrome Cache Entry: 66

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651

dropped

Chrome Cache Entry: 67

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250

dropped

Chrome Cache Entry: 68

PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced

downloaded

Chrome Cache Entry: 69

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651

downloaded

Chrome Cache Entry: 70

RIFF (little-endian) data, Web/P image, VP8 encoding, 75x75, Scaling: [none]x[none], YUV color, decoders should clamp

downloaded

Chrome Cache Entry: 71

SVG Scalable Vector Graphics image

dropped

Chrome Cache Entry: 72

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 360x360, components 3

dropped

Chrome Cache Entry: 73

RIFF (little-endian) data, Web/P image, VP8 encoding, 75x75, Scaling: [none]x[none], YUV color, decoders should clamp

dropped

Chrome Cache Entry: 74

Unicode text, UTF-8 (with BOM) text

downloaded

Chrome Cache Entry: 75

PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced

dropped

Chrome Cache Entry: 76

SVG Scalable Vector Graphics image

downloaded

Chrome Cache Entry: 77

ASCII text, with very long lines (51612)

downloaded

Chrome Cache Entry: 78

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513

downloaded

Chrome Cache Entry: 79

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250

downloaded

Chrome Cache Entry: 80

ASCII text, with very long lines (45667)

downloaded

Chrome Cache Entry: 81

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390

downloaded

There are 10 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\Payment Receipt .html"

Details

Is windows:	true
Is dropped:	false
PID:	5608
Target ID:	0
Parent PID:	4248
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\Payment Receipt .html"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	23:27:02
Date:	18/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2188,i,16813835599702316226,1852677476728942210,262144 /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	2312
Target ID:	2
Parent PID:	5608
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2188,i,16813835599702316226,1852677476728942210,262144 /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	23:27:07
Date:	18/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

file:///C:/Users/user/Desktop/Payment%20Receipt%20.html

Details

Name:	file:///C:/Users/user/Desktop/Payment%20Receipt%20.html
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	browser
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
HTML Script injector detected	Phishing
HTML file submission containing password form	Stealing of Sensitive Information
Phishing site detected (based on image similarity)	Phishing
Phishing site detected (based on logo match)	Phishing
HTML body contains low number of good links	Phishing
HTML body contains password input but no form action	Phishing
HTML title does not match URL	Phishing
Invalid T&C link found	Phishing
None HTTPS page querying sensitive user data (password, username or email)	Phishing
HTML body contains password input	Phishing
HTML page is missing a favicon	Phishing
META author tag missing	Phishing
META copyright tag missing	Phishing

http://www.redbubble.com/people/developerfrida

unknown

https://cdn.socket.io/4.6.0/socket.io.min.js

108.156.152.88

Details

Name:	https://cdn.socket.io/4.6.0/socket.io.min.js
IP:	108.156.152.88
TargetID:	2
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
HTML Script injector detected	Phishing
IP address seen in connection with other malware	Networking
URLs found in memory or binary data	Networking

https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg

152.199.4.44

Details

Name:	https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg
IP:	152.199.4.44
TargetID:	2
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
IP address seen in connection with other malware	Networking

https://www.w3schools.com/w3css/4/w3.css

192.229.173.207

Details

Name:	https://www.w3schools.com/w3css/4/w3.css
IP:	192.229.173.207
TargetID:	2
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
IP address seen in connection with other malware	Networking

https://threemanshop.com/jssp.js

172.67.202.97

https://ih1.redbubble.net/image.3812524360.1168/raf,360x360,075,t,fafafa:ca443f4786.jpg

72.21.91.237

Domains

Name

Malicious

part-0013.t-0009.t-msedge.net

13.107.246.41

cs203.wac.edgecastcdn.net

72.21.91.237

cs1100.wpc.omegacdn.net

152.199.4.44

d2vgu95hoyrpkh.cloudfront.net

108.156.152.88

cs837.wac.edgecastcdn.net

192.229.173.207

threemanshop.com

172.67.202.97

www.google.com

64.233.177.106

ih1.redbubble.net

unknown

aadcdn.msftauth.net

unknown

www.w3schools.com

unknown

cdn.socket.io

unknown

There are 1 hidden domains, click here to show them.

IPs

Domain

Country

Malicious

108.156.152.88

d2vgu95hoyrpkh.cloudfront.net

United States

13.107.246.41

part-0013.t-0009.t-msedge.net

United States

152.199.4.44

cs1100.wpc.omegacdn.net

United States

192.168.2.4

unknown

192.168.2.5

unknown

64.233.177.106

www.google.com

United States

239.255.255.250

unknown

Reserved

192.229.173.207

cs837.wac.edgecastcdn.net

United States

72.21.91.237

cs203.wac.edgecastcdn.net

United States

13.107.213.41

unknown

United States

172.67.202.97

threemanshop.com

United States

There are 1 hidden IPs, click here to show them.

DOM / HTML

URL

Malicious

file:///C:/Users/user/Desktop/Payment%20Receipt%20.html

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
Payment Receipt .html

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportPayment Receipt .html

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
Payment Receipt .html