Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Chrome Cache Entry: 44

Web Open Font Format (Version 2), TrueType, length 19196, version 1.0

downloaded

Details

File:	Chrome Cache Entry: 44
Category:	downloaded
Dump:	chromecache_44.2.dr
ID:	dr_8
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	Web Open Font Format (Version 2), TrueType, length 19196, version 1.0
Entropy:	7.989209132268184
Encrypted:	false
Ssdeep:	384:ycYY1hOMLJN/L7kToUe+moQ1MoEw82YJn54T8+74PVGCD7ZFDtWlBYKuHfR:9r1hhJt7mQ1MoEwKnGT74PVGy7ZFDIMX
Size:	19196
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 45

PNG image data, 1 x 1, 1-bit colormap, non-interlaced

downloaded

Details

File:	Chrome Cache Entry: 45
Category:	downloaded
Dump:	chromecache_45.2.dr
ID:	dr_9
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 1 x 1, 1-bit colormap, non-interlaced
Entropy:	4.347811435468635
Encrypted:	false
Ssdeep:	3:yionv//thPlE+kSI+Dtmy/Y+sR3Qhl/Y3WlED//jp:6v/lhPfkCDtmywFghu3WlEDTp
Size:	95
Whitelisted:	true
Reputation:	low

Chrome Cache Entry: 46

Web Open Font Format (Version 2), TrueType, length 48236, version 1.0

downloaded

Details

File:	Chrome Cache Entry: 46
Category:	downloaded
Dump:	chromecache_46.2.dr
ID:	dr_10
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	Web Open Font Format (Version 2), TrueType, length 48236, version 1.0
Entropy:	7.994912604882335
Encrypted:	true
Ssdeep:	768:uj6JxavgLx5rjTH3CdZ3y11o4uMb2IVEhiB6z6GAAHJApICtBgso6HaOjTXHRWK:ujoa4LxZPCdm3B2IVEhiB62apApISxos
Size:	48236
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 47

PNG image data, 1 x 1, 1-bit colormap, non-interlaced

dropped

Details

File:	Chrome Cache Entry: 47
Category:	dropped
Dump:	chromecache_47.2.dr
ID:	dr_3
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 1 x 1, 1-bit colormap, non-interlaced
Entropy:	4.347811435468635
Encrypted:	false
Ssdeep:	3:yionv//thPlE+kSI+Dtmy/Y+sR3Qhl/Y3WlED//jp:6v/lhPfkCDtmywFghu3WlEDTp
Size:	95
Whitelisted:	true
Reputation:	low

Chrome Cache Entry: 48

JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 928x1160, components 3

dropped

Details

File:	Chrome Cache Entry: 48
Category:	dropped
Dump:	chromecache_48.2.dr
ID:	dr_4
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 928x1160, components 3
Entropy:	7.971775240418294
Encrypted:	false
Ssdeep:	1536:hwEUSzJb7KilNM+lBeV6fT7Ru9Sh8n0X3m3rLMlfY9KBmxLovIIG2FA:hw/S198V6nRuI8EuMl8Omxy9BA
Size:	100275
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 49

ASCII text, with very long lines (1572)

downloaded

Details

File:	Chrome Cache Entry: 49
Category:	downloaded
Dump:	chromecache_49.2.dr
ID:	dr_11
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with very long lines (1572)
Entropy:	5.387876962013119
Encrypted:	false
Ssdeep:	192:a/KWbqXV6uyErbqGIwYjc1YT/7Hqqmg6uy5rbqGIwYyx1tFtt+EV1:kaHq9N3gq9uMa
Size:	13020
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 50

ISO Media, AVIF Image

downloaded

Details

File:	Chrome Cache Entry: 50
Category:	downloaded
Dump:	chromecache_50.2.dr
ID:	dr_12
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ISO Media, AVIF Image
Entropy:	7.9590197294333045
Encrypted:	false
Ssdeep:	768:CYyK8HtV7Wle1MlQ9yavX4i7fwXYdIFQLf2L2iqQCavej:CuIjWleBZf4i8iifLWf
Size:	34366
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 51

HTML document, ASCII text, with very long lines (309)

downloaded

Details

File:	Chrome Cache Entry: 51
Category:	downloaded
Dump:	chromecache_51.2.dr
ID:	dr_13
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with very long lines (309)
Entropy:	5.135252550076797
Encrypted:	false
Ssdeep:	96:f7jVHAUWHywcr+6V8gWODU70oiQ8GDiBzZqu/rChNsYShTvtGaS8UeUmOPS+M:TOEvVm8T1rONuhTEed4M
Size:	4924
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	5580
Target ID:	0
Parent PID:	1928
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	21:58:14
Date:	23/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1968,i,9740115810024139992,438052550857420297,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	5516
Target ID:	2
Parent PID:	5580
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1968,i,9740115810024139992,438052550857420297,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	21:58:17
Date:	23/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://proofpoint.onelogin.sso-signon.com/"

Details

Is windows:	true
Is dropped:	false
PID:	6416
Target ID:	3
Parent PID:	1928
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://proofpoint.onelogin.sso-signon.com/"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	21:58:19
Date:	23/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://proofpoint.onelogin.sso-signon.com/

Details

Filetype:	URL
Filename:	https://proofpoint.onelogin.sso-signon.com/

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Antivirus detection for URL or domain	AV Detection
Classification label	System Summary
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Non-Application Layer Protocol Ingress Tool Transfer
HTML page is missing a favicon	Phishing
Performs DNS lookups	Networking
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Uses HTTPS	Networking	Encrypted Channel Application Layer Protocol
Uses secure TLS version for HTTPS connections	Compliance, Networking
Found graphical window changes (likely an installer)	System Summary

https://proofpoint.onelogin.sso-signon.com/

Details

Name:	https://proofpoint.onelogin.sso-signon.com/
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	browser

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
HTML page is missing a favicon	Phishing
Spawns processes	System Summary	Process Injection

https://proofpoint.onelogin.sso-signon.com/favicon.ico

3.144.141.109

Details

Name:	https://proofpoint.onelogin.sso-signon.com/favicon.ico
IP:	3.144.141.109
TargetID:	2
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
HTML page is missing a favicon	Phishing

https://images.unsplash.com/photo-1525547719571-a2d4ac8945e2?ixlib=rb-1.2.1&ixid=MnwxMjA3fDB8MHxwaG9

unknown

Details

Name:	https://images.unsplash.com/photo-1525547719571-a2d4ac8945e2?ixlib=rb-1.2.1&ixid=MnwxMjA3fDB8MHxwaG9
TargetID:	2
From Memory:	true
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	chromecache_51.2.dr
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://images.unsplash.com/photo-1525547719571-a2d4ac8945e2?ixlib=rb-1.2.1&ixid=MnwxMjA3fDB8MHxwaG90by1wYWdlfHx8fGVufDB8fHx8&auto=format&fit=crop&w=928&q=80

151.101.2.208

Domains

Name

Malicious

bg.microsoft.map.fastly.net

199.232.214.172

www.google.com

74.125.136.103

proofpoint.onelogin.sso-signon.com

3.144.141.109

Details

Name:	proofpoint.onelogin.sso-signon.com
IP:	3.144.141.109
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

dualstack.com.imgix.map.fastly.net

151.101.2.208

fp2e7a.wpc.phicdn.net

192.229.211.108

images.unsplash.com

unknown

Details

Name:	images.unsplash.com
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

3.144.141.109

proofpoint.onelogin.sso-signon.com

United States

192.168.2.4

unknown

151.101.2.208

dualstack.com.imgix.map.fastly.net

United States

239.255.255.250

unknown

Reserved

151.101.66.208

unknown

United States

74.125.136.103

www.google.com

United States

DOM / HTML

URL

Malicious

https://proofpoint.onelogin.sso-signon.com/

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://proofpoint.onelogin.sso-signon.com/

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://proofpoint.onelogin.sso-signon.com/

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
https://proofpoint.onelogin.sso-signon.com/