Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Chrome Cache Entry: 50

Unicode text, UTF-8 (with BOM) text, with very long lines (523), with CRLF line terminators

downloaded

Details

File:	Chrome Cache Entry: 50
Category:	downloaded
Dump:	chromecache_50.2.dr
ID:	dr_8
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (523), with CRLF line terminators
Entropy:	4.955303456250949
Encrypted:	false
Ssdeep:	384:xIvGjXOmsnslOERMYu+WlB8skn7jobWwUfQ:xICOt6weQ
Size:	31093
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 51

JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1420x946, components 3

downloaded

Details

File:	Chrome Cache Entry: 51
Category:	downloaded
Dump:	chromecache_51.2.dr
ID:	dr_9
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1420x946, components 3
Entropy:	7.939289864264776
Encrypted:	false
Ssdeep:	3072:/va2+tuZ4r9Kon/1qq+neXUoYpKfs/HosKXBwCfsKbmM/MqnDh3MC03+c94:0rKodFhCKfs/Ho9BwCHbVUs5MjH94
Size:	189015
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 52

ASCII text, with no line terminators

downloaded

Details

File:	Chrome Cache Entry: 52
Category:	downloaded
Dump:	chromecache_52.2.dr
ID:	dr_10
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	ASCII text, with no line terminators
Entropy:	4.412814895472355
Encrypted:	false
Ssdeep:	3:kYSLZs/pY1CYYn:2LZsxn
Size:	40
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 53

PNG image data, 383 x 125, 8-bit/color RGBA, non-interlaced

dropped

Details

File:	Chrome Cache Entry: 53
Category:	dropped
Dump:	chromecache_53.2.dr
ID:	dr_3
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 383 x 125, 8-bit/color RGBA, non-interlaced
Entropy:	7.935968032263857
Encrypted:	false
Ssdeep:	96:Wxg07PdtzYA1AoHp8cKTnNsAZTHshJ3/Rq7PG5zCy9TshK7NMh0C1bVN+4gjAl/N:We07wA1Z8cKhsmTMzZrQy9T97NMG54l1
Size:	5935
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 54

JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1420x946, components 3

dropped

Details

File:	Chrome Cache Entry: 54
Category:	dropped
Dump:	chromecache_54.2.dr
ID:	dr_4
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1420x946, components 3
Entropy:	7.939289864264776
Encrypted:	false
Ssdeep:	3072:/va2+tuZ4r9Kon/1qq+neXUoYpKfs/HosKXBwCfsKbmM/MqnDh3MC03+c94:0rKodFhCKfs/Ho9BwCHbVUs5MjH94
Size:	189015
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 55

HTML document, ASCII text, with CRLF line terminators

downloaded

Details

File:	Chrome Cache Entry: 55
Category:	downloaded
Dump:	chromecache_55.2.dr
ID:	dr_11
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with CRLF line terminators
Entropy:	5.38000372032164
Encrypted:	false
Ssdeep:	6:B8FQtuc4svmo9qvyDPdrKFjKek+q2Q8EevWR0NNEXW0YDBOTieUWFLzR/YNe9zoG:BMQt6o9qvyLYF2ek+q2Q8Eepfd6ieUWx
Size:	315
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 56

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141339

downloaded

Details

File:	Chrome Cache Entry: 56
Category:	downloaded
Dump:	chromecache_56.2.dr
ID:	dr_12
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141339
Entropy:	7.995756058904724
Encrypted:	true
Ssdeep:	1536:XOwJxyZ3lV31cfpmHBoep5KvsXS1SbI+o2Rd8yHk0GOmOY:ZJxyZ3lF3HBl5OSo238yE0GOpY
Size:	49632
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 57

PNG image data, 383 x 125, 8-bit/color RGBA, non-interlaced

downloaded

Details

File:	Chrome Cache Entry: 57
Category:	downloaded
Dump:	chromecache_57.2.dr
ID:	dr_13
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	PNG image data, 383 x 125, 8-bit/color RGBA, non-interlaced
Entropy:	7.935968032263857
Encrypted:	false
Ssdeep:	96:Wxg07PdtzYA1AoHp8cKTnNsAZTHshJ3/Rq7PG5zCy9TshK7NMh0C1bVN+4gjAl/N:We07wA1Z8cKhsmTMzZrQy9T97NMG54l1
Size:	5935
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	2704
Target ID:	0
Parent PID:	6140
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	11:50:23
Date:	24/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2180,i,16645406805787686568,15006377985678471521,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	6268
Target ID:	2
Parent PID:	2704
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2180,i,16645406805787686568,15006377985678471521,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	11:50:26
Date:	24/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.maultalk.com/url.php?to=https://www.serserijeans.com/gdy9haBM2BM2Fe5rss3RhBM2i2Pdk17x0qvi2PFe5nnaai2PrpWO3rk17dy9s3RWO3BM2"

Details

Is windows:	true
Is dropped:	false
PID:	6640
Target ID:	3
Parent PID:	6140
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.maultalk.com/url.php?to=https://www.serserijeans.com/gdy9haBM2BM2Fe5rss3RhBM2i2Pdk17x0qvi2PFe5nnaai2PrpWO3rk17dy9s3RWO3BM2"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	11:50:29
Date:	24/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://www.maultalk.com/url.php?to=https://www.serserijeans.com/gdy9haBM2BM2Fe5rss3RhBM2i2Pdk17x0qvi2PFe5nnaai2PrpWO3rk17dy9s3RWO3BM2

172.67.129.156

https://fs.viennaairport.com/adfs/portal/illustration/illustration.jpg?id=118FB0D9D56244BD5AFE03D3F85A97AA9AF77AACF57B15DC95B46DC287C2C180

193.43.158.108

https://login.microsoftonline.com/?organisation=viennaairport.com&username=g.hammerschmidt%40viennaairport.com#/common/authorize?document=0.71510277768369-0ff1-0.88917616609911&auth=10.66378078081821-0.23214203409485

https://fs.viennaairport.com/adfs/portal/logo/logo.png?id=D116A9A391AA333DE42BBDB7F41A6EE30B0FEB4A9E4F4B333B5655A8428A5362

193.43.158.108

https://esign.joahelms.design/?organisation=viennaairport.com&dse=Zy5oYW1tZXJzY2htaWR0QHZpZW5uYWFpcnBvcnQuY29t#/common/authorize?document=0.71510277768369-0ff1-0.88917616609911&auth=10.66378078081821-0.23214203409485

https://fs.viennaairport.com/adfs/ls/?login_hint=g.hammerschmidt%40viennaairport.com&client-request-id=e4661904-c8f1-440d-98e1-717e5bb7657e&username=g.hammerschmidt%40viennaairport.com&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuARYJNOefDzB6zLjYWFd9PbUulWMyoSN0L_AyPiCkXESk2K6XkZibm5qUXFyRm5mSolDWWZqXl5iYmYRSDNI6S0mQf-idM-U8GK31JTUosSSzPy8R8yE9V1gEXjFwmPAbMXBwSXAIMGgwPCDhXERK9DFQt_0z6ZbrfbqKP_Q-fiNCMMpVn1PV98I_bzE4mxfx4giE9PS4KCo5Aojv_Jy_wxDp6ycYssk7cSgZJ_ULM9IWwMrwwlsQhPYmE6xMXxgY-xgZ5jFznCAk_EAL8MPviv9nesPdMx857FBgAEA0&pullStatus=0

https://fs.viennaairport.com/favicon.ico

193.43.158.108

https://www.serserijeans.com/gdy9haBM2BM2Fe5rss3RhBM2i2Pdk17x0qvi2PFe5nnaai2PrpWO3rk17dy9s3RWO3BM2

185.106.211.102

193.43.158.108

https://serserijeans.com/gdy9haBM2BM2Fe5rss3RhBM2i2Pdk17x0qvi2PFe5nnaai2PrpWO3rk17dy9s3RWO3BM2

185.106.211.102

https://esign.joahelms.design/?organisation=viennaairport.com&dse=Zy5oYW1tZXJzY2htaWR0QHZpZW5uYWFpcnBvcnQuY29t

89.187.28.219

https://fs.viennaairport.com/adfs/portal/css/style.css?id=36478A6D134BE3AAFBB086EE217D3815A49AC0E7AA0A3FD8DA2403A595467E17

193.43.158.108

There are 2 hidden URLs, click here to show them.

Domains

Name

Malicious

bg.microsoft.map.fastly.net

199.232.214.172

fs.viennaairport.com

193.43.158.108

www.maultalk.com

172.67.129.156

esign.joahelms.design

89.187.28.219

part-0041.t-0009.t-msedge.net

13.107.213.69

serserijeans.com

185.106.211.102

www.google.com

142.250.101.105

fp2e7a.wpc.phicdn.net

192.229.211.108

identity.nel.measure.office.net

unknown

www.serserijeans.com

unknown

There are 1 hidden domains, click here to show them.

IPs

Domain

Country

Malicious

142.250.101.105

www.google.com

United States

192.168.2.6

unknown

89.187.28.219

esign.joahelms.design

Ukraine

13.107.213.69

part-0041.t-0009.t-msedge.net

United States

239.255.255.250

unknown

Reserved

172.67.129.156

www.maultalk.com

United States

185.106.211.102

serserijeans.com

Turkey

193.43.158.108

fs.viennaairport.com

Austria

DOM / HTML

URL

Malicious

Details

Filename:	3.3.pages.html.dom
Url:	https://fs.viennaairport.com/adfs/ls/?login_hint=g.hammerschmidt%40viennaairport.com&client-request-id=e4661904-c8f1-440d-98e1-717e5bb7657e&username=g.hammerschmidt%40viennaairport.com&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuARYJNOefDzB6zLjYWFd9PbUulWMyoSN0L_AyPiCkXESk2K6XkZibm5qUXFyRm5mSolDWWZqXl5iYmYRSDNI6S0mQf-idM-U8GK31JTUosSSzPy8R8yE9V1gEXjFwmPAbMXBwSXAIMGgwPCDhXERK9DFQt_0z6ZbrfbqKP_Q-fiNCMMpVn1PV98I_bzE4mxfx4giE9PS4KCo5Aojv_Jy_wxDp6ycYssk7cSgZJ_ULM9IWwMrwwlsQhPYmE6xMXxgY-xgZ5jFznCAk_EAL8MPviv9nesPdMx857FBgAEA0&pullStatus=0
Target ID:	2
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2180,i,16645406805787686568,15006377985678471521,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://www.maultalk.com/url.php?to=https://www.serserijeans.com/gdy9haBM2BM2Fe5rss3RhBM2i2Pdk17x0qvi2PFe5nnaai2PrpWO3rk17dy9s3RWO3BM2

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://www.maultalk.com/url.php?to=https://www.serserijeans.com/gdy9haBM2BM2Fe5rss3RhBM2i2Pdk17x0qvi2PFe5nnaai2PrpWO3rk17dy9s3RWO3BM2

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
https://www.maultalk.com/url.php?to=https://www.serserijeans.com/gdy9haBM2BM2Fe5rss3RhBM2i2Pdk17x0qvi2PFe5nnaai2PrpWO3rk17dy9s3RWO3BM2