Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Integraconnect Play Now 484 484 6292.htm

HTML document, ASCII text, with very long lines (4536), with no line terminators

initial sample

Chrome Cache Entry: 100

ASCII text, with very long lines (45667)

downloaded

Chrome Cache Entry: 101

Web Open Font Format (Version 2), TrueType, length 28000, version 1.66

downloaded

Chrome Cache Entry: 102

ASCII text, with very long lines (1222), with no line terminators

downloaded

Chrome Cache Entry: 103

HTML document, ASCII text, with very long lines (1445), with CRLF line terminators

downloaded

Chrome Cache Entry: 104

PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced

downloaded

Chrome Cache Entry: 105

SVG Scalable Vector Graphics image

downloaded

Chrome Cache Entry: 106

SVG Scalable Vector Graphics image

dropped

Chrome Cache Entry: 107

SVG Scalable Vector Graphics image

dropped

Chrome Cache Entry: 108

PNG image data, 108 x 24, 8-bit/color RGBA, non-interlaced

dropped

Chrome Cache Entry: 109

SVG Scalable Vector Graphics image

dropped

Chrome Cache Entry: 110

ASCII text, with very long lines (23398), with no line terminators

downloaded

Chrome Cache Entry: 111

PNG image data, 40 x 91, 8-bit/color RGB, non-interlaced

downloaded

Chrome Cache Entry: 112

ASCII text, with very long lines (597)

downloaded

Chrome Cache Entry: 113

PNG image data, 40 x 91, 8-bit/color RGB, non-interlaced

dropped

Chrome Cache Entry: 114

PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced

dropped

Chrome Cache Entry: 115

ASCII text, with very long lines (42414)

downloaded

Chrome Cache Entry: 116

PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced

dropped

Chrome Cache Entry: 117

PNG image data, 2160 x 443, 8-bit/color RGBA, non-interlaced

downloaded

Chrome Cache Entry: 118

HTML document, ASCII text, with very long lines (59541), with CRLF line terminators

downloaded

Chrome Cache Entry: 119

SVG Scalable Vector Graphics image

downloaded

Chrome Cache Entry: 120

PNG image data, 108 x 24, 8-bit/color RGBA, non-interlaced

downloaded

Chrome Cache Entry: 121

Web Open Font Format, TrueType, length 35970, version 1.0

downloaded

Chrome Cache Entry: 122

Unicode text, UTF-8 text, with very long lines (65534), with no line terminators

downloaded

Chrome Cache Entry: 123

PNG image data, 506 x 303, 8-bit/color RGBA, non-interlaced

downloaded

Chrome Cache Entry: 124

Web Open Font Format (Version 2), TrueType, length 28584, version 1.66

downloaded

Chrome Cache Entry: 125

PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced

downloaded

Chrome Cache Entry: 126

ASCII text, with very long lines (65447)

downloaded

Chrome Cache Entry: 127

Web Open Font Format, TrueType, length 36696, version 1.0

downloaded

Chrome Cache Entry: 128

SVG Scalable Vector Graphics image

downloaded

Chrome Cache Entry: 129

PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced

downloaded

Chrome Cache Entry: 130

SVG Scalable Vector Graphics image

downloaded

Chrome Cache Entry: 131

PNG image data, 2446 x 899, 8-bit/color RGBA, non-interlaced

dropped

Chrome Cache Entry: 90

PNG image data, 506 x 303, 8-bit/color RGBA, non-interlaced

dropped

Chrome Cache Entry: 91

PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced

dropped

Chrome Cache Entry: 92

ASCII text, with very long lines (1437), with CRLF line terminators

downloaded

Chrome Cache Entry: 93

Web Open Font Format (Version 2), TrueType, length 93276, version 1.0

downloaded

Chrome Cache Entry: 94

SVG Scalable Vector Graphics image

dropped

Chrome Cache Entry: 95

SVG Scalable Vector Graphics image

dropped

Chrome Cache Entry: 96

PNG image data, 2160 x 443, 8-bit/color RGBA, non-interlaced

dropped

Chrome Cache Entry: 97

PNG image data, 2446 x 899, 8-bit/color RGBA, non-interlaced

downloaded

Chrome Cache Entry: 98

SVG Scalable Vector Graphics image

downloaded

Chrome Cache Entry: 99

Web Open Font Format (Version 2), TrueType, length 43596, version 1.0

downloaded

There are 33 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\Integraconnect Play Now 484 484 6292.htm"

Details

Is windows:	true
Is dropped:	false
PID:	5460
Target ID:	0
Parent PID:	4484
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\Integraconnect Play Now 484 484 6292.htm"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	14:36:48
Date:	23/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2000,i,829850008273557891,11942607362507623547,262144 /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	5968
Target ID:	2
Parent PID:	5460
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2000,i,829850008273557891,11942607362507623547,262144 /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	14:36:50
Date:	23/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://aq38e.ishuter.com/kUNZy5W/

172.67.197.95

https://aq38e.ishuter.com/kUNZy5W/#Hmelanie.mcclannan@integraconnect.com

https://aq38e.ishuter.com/1303648218011338311063032pBluSckRQXEXDSNBUDUNLOUZOTQHFOVHNNHKOJUMLKQUUZGOIXUHMMPNY?smVDNiDmOLwWGqFeokfSHkCXSabKXVGHMFTUYATNRBOJEOJAOPJUGUBS#

file:///C:/Users/user/Desktop/Integraconnect%20Play%20Now%20484%20484%206292.htm

https://aq38e.ishuter.com/1303648218011338311063032pBluSckRQXEXDSNBUDUNLOUZOTQHFOVHNNHKOJUMLKQUUZGOIXUHMMPNY?smVDNiDmOLwWGqFeokfSHkCXSabKXVGHMFTUYATNRBOJEOJAOPJUGUBS

https://aq38e.ishuter.com/op3AxGuP48aCiTtE2SxuqObmnVSkPtX479dK4Hy345140

172.67.197.95

https://code.jquery.com/jquery-3.6.0.min.js

151.101.194.137

https://developers.google.com/recaptcha/docs/faq#localhost_support

unknown

https://support.google.com/recaptcha#6262736

unknown

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=878de6e2c85d53fd

104.17.2.184

https://aq38e.ishuter.com/56sesJTzfcmAxabyrLWvP6714

172.67.197.95

https://aq38e.ishuter.com/efTE8AlmmIvzAV3K8o5AQVlqPzZXuvN1itvkp3chH0f3H2ddHeF6Q78150

172.67.197.95

https://support.google.com/recaptcha/?hl=en#6223828

unknown

https://cloud.google.com/contact

unknown

https://aq38e.ishuter.com/12vnCRlKsTzZjVT56pR4oFqr50

172.67.197.95

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/q8pou/0x4AAAAAAAWqRpkP_ZLY4a7j/auto/normal

https://aq38e.ishuter.com/ijl0PP777HVrHScMXgR7gTyo5xyJytwxts14f1CtGh1mtT9V78170

172.67.197.95

https://www.google.com/recaptcha/api.js

74.125.136.99

https://support.google.com/recaptcha/#6175971

unknown

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D

104.17.2.184

https://aq38e.ishuter.com/90j1eG3tSaytCwjrXzICsMuefyQpW4g8SFab80

172.67.197.95

https://aq38e.ishuter.com/34xSwtQgKAp3oNRo2XIhbcuyRLwijd5xR6ILW2Mj67102

172.67.197.95

https://aq38e.ishuter.com/fqHhVLOh6q8XmxqdbOrt7KC699a

172.67.197.95

https://www.google.com/recaptcha/api2/

unknown

https://aq38e.ishuter.com/opv9cDxdvE9KLbZgJXc9zuRkMs5LLj0LyAUVLuisuvLGVVluCJfp1hAwWWTAAq09EWXsw1hMtNJ7UWrHef240

172.67.197.95

https://support.google.com/recaptcha

unknown

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/878de6e2c85d53fd/1713875817250/e5c240b8191900b2cbaaefac1be4efa61ef98d4c9007858c1ece2e7ba2dc91bc/CJgA4Ja9szWo5NH

104.17.2.184

https://aq38e.ishuter.com/efj0QgJZW9JHw4OAoXd1z56cqQUjXMUU7UYjkl98

172.67.197.95

https://aq38e.ishuter.com/ghvgAmR5Qv9HxnvpSMeJiR9aips0krQYtT0TR2Q7vJzrmn0rwwTpSoAeQyYK83VKxzfef210

172.67.197.95

https://aq38e.ishuter.com/xyAK1toOKhpqHsIagh28

172.67.197.95

https://cloud.google.com/recaptcha-enterprise/billing-information

unknown

https://aq38e.ishuter.com/wx6hFLBxsRd99C5DxuUMgquYKDqrJqNXasAmjDrY34q34130

172.67.197.95

https://recaptcha.net

unknown

https://aq38e.ishuter.com/opXVk7AzekvB1YjzS6f4vb7LaJyrg7QL7V3pAuvDuTp365ElnuOfEIxkiTuef200

172.67.197.95

https://www.apache.org/licenses/

unknown

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/225845573:1713874485:F_Nkq0K6BeHcnYnKlLfkKCGW9ARvswhJrmlvFkrLy44/878de6e2c85d53fd/e22adde551fe489

104.17.2.184

https://aq38e.ishuter.com/stCaYd6VnU0XYxLpqaoDbZJYHmD3Wcmj35vGNvAEby25KwkIS454ZqSSQ7vRTC4xt8UDSyugh254

172.67.197.95

https://www.gstatic.c..?/recaptcha/releases/QoukH5jSO3sKFzVEA7Vc8VgC/recaptcha__.

unknown

https://aq38e.ishuter.com/kUNZy5W/?RHmelanie.mcclannan@integraconnect.com

172.67.197.95

https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que

unknown

https://aq38e.ishuter.com/ij2sblMB9uqRjaOCX3GLDMFudJ9UX7uSjqrfiXIVkWLVfU15bvUBz0mm7jEqSMMnyz223

172.67.197.95

https://play.google.com/log?format=json&hasfast=true

unknown

https://aq38e.ishuter.com/pqqina5J9anrX4T34Ynnre0Muv34

172.67.197.95

https://aq38e.ishuter.com/wxQoa3PcacIN8l8eONdRTNb66TopfTiEuESXYXn0nGBjbi90179

172.67.197.95

https://aq38e.ishuter.com/uj6UsCyNIXCVmrr31WJxQqiQZWdn6ed34u1ckScrYpe6rK0x8Jdn7cq

172.67.197.95

https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca

unknown

https://cdn.socket.io/4.6.0/socket.io.min.js

108.156.152.88

https://aq38e.ishuter.com/mnvbpQOE60x1oduwW74f9kgGveqT1ssLtsdOI8pK2fRRfijnjLtgfSwfseVvon0PCZ4xLaFgKTGwx215

172.67.197.95

https://aq38e.ishuter.com/web8socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket

172.67.197.95

https://aq38e.ishuter.com/90sTUkiyH4245xrUlst59

172.67.197.95

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/878de6e2c85d53fd/1713875817253/nRZ54r9PpQeWAjN

104.17.2.184

https://aq38e.ishuter.com/45OnLaTWZs2qgYabuINgL4dvw64

172.67.197.95

https://a.nel.cloudflare.com/report/v4?s=EQj1iT8gNoKt600dftUU5CFs8U%2FyRe4rYdALqcH2LBjz4fF2fPNqDbN6qZ%2FejwcRJ1Uoqj5qeAonpCosQHGwZiQYeRExCZ5xGFdLNyYUtr%2FEXJH%2FDQov%2FFEM0E8vVQ%3D%3D

35.190.80.1

There are 43 hidden URLs, click here to show them.

Domains

Name

Malicious

aq38e.ishuter.com

172.67.197.95

Details

Name:	aq38e.ishuter.com
IP:	172.67.197.95
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
HTML file submission requesting Cloudflare captcha challenge	Data Obfuscation
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

a.nel.cloudflare.com

35.190.80.1

Details

Name:	a.nel.cloudflare.com
IP:	35.190.80.1
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

code.jquery.com

151.101.194.137

Details

Name:	code.jquery.com
IP:	151.101.194.137
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
HTML page contains hidden URLs or javascript code	Phishing
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

d2vgu95hoyrpkh.cloudfront.net

108.156.152.88

challenges.cloudflare.com

104.17.2.184

Details

Name:	challenges.cloudflare.com
IP:	104.17.2.184
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
HTML page contains hidden URLs or javascript code	Phishing
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol

www.google.com

142.251.15.106

Details

Name:	www.google.com
IP:	142.251.15.106
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking

cdn.socket.io

unknown

Details

Name:	cdn.socket.io
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

IPs

Domain

Country

Malicious

172.67.197.95

aq38e.ishuter.com

United States

108.156.152.88

d2vgu95hoyrpkh.cloudfront.net

United States

74.125.136.99

unknown

United States

192.168.2.4

unknown

239.255.255.250

unknown

Reserved

142.251.15.106

www.google.com

United States

151.101.194.137

code.jquery.com

United States

104.21.84.216

unknown

United States

35.190.80.1

a.nel.cloudflare.com

United States

104.17.2.184

challenges.cloudflare.com

United States

DOM / HTML

URL

Malicious

https://aq38e.ishuter.com/1303648218011338311063032pBluSckRQXEXDSNBUDUNLOUZOTQHFOVHNNHKOJUMLKQUUZGOIXUHMMPNY?smVDNiDmOLwWGqFeokfSHkCXSabKXVGHMFTUYATNRBOJEOJAOPJUGUBS

Details

Filename:	3.4.pages.html.dom
Url:	https://aq38e.ishuter.com/1303648218011338311063032pBluSckRQXEXDSNBUDUNLOUZOTQHFOVHNNHKOJUMLKQUUZGOIXUHMMPNY?smVDNiDmOLwWGqFeokfSHkCXSabKXVGHMFTUYATNRBOJEOJAOPJUGUBS
Target ID:	2
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2000,i,829850008273557891,11942607362507623547,262144 /prefetch:8

Signature Hits	Behavior Group	Mitre Attack
Yara detected HtmlPhish10	Phishing

https://aq38e.ishuter.com/1303648218011338311063032pBluSckRQXEXDSNBUDUNLOUZOTQHFOVHNNHKOJUMLKQUUZGOIXUHMMPNY?smVDNiDmOLwWGqFeokfSHkCXSabKXVGHMFTUYATNRBOJEOJAOPJUGUBS#

Details

Filename:	4.5.pages.html.dom
Url:	https://aq38e.ishuter.com/1303648218011338311063032pBluSckRQXEXDSNBUDUNLOUZOTQHFOVHNNHKOJUMLKQUUZGOIXUHMMPNY?smVDNiDmOLwWGqFeokfSHkCXSabKXVGHMFTUYATNRBOJEOJAOPJUGUBS#
Target ID:	2
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2000,i,829850008273557891,11942607362507623547,262144 /prefetch:8

Signature Hits	Behavior Group	Mitre Attack
Yara detected HtmlPhish10	Phishing

file:///C:/Users/user/Desktop/Integraconnect%20Play%20Now%20484%20484%206292.htm

https://aq38e.ishuter.com/kUNZy5W/#Hmelanie.mcclannan@integraconnect.com

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/q8pou/0x4AAAAAAAWqRpkP_ZLY4a7j/auto/normal

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
Integraconnect Play Now 484 484 6292.htm

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportIntegraconnect Play Now 484 484 6292.htm

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
Integraconnect Play Now 484 484 6292.htm