Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	1544
Target ID:	0
Parent PID:	5764
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	13:15:53
Date:	24/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 --field-trial-handle=2244,i,13643226679431463270,17493560958199353772,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	5172
Target ID:	1
Parent PID:	1544
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 --field-trial-handle=2244,i,13643226679431463270,17493560958199353772,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	13:15:56
Date:	24/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://nitftts.com/"

Details

Is windows:	true
Is dropped:	false
PID:	6428
Target ID:	3
Parent PID:	5764
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://nitftts.com/"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	13:15:58
Date:	24/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://nitftts.com/

https://nitftts.com/024407056a4bd44a76e3518653fce74f6628ea0fabd71LOG024407056a4bd44a76e3518653fce74f6628ea0fabd72#

https://nitftts.com/024407056a4bd44a76e3518653fce74f6628ea0fabd71LOG024407056a4bd44a76e3518653fce74f6628ea0fabd72

https://nitftts.com/

https://nitftts.com/captcha/logo.svg

172.67.130.113

https://nitftts.com/js/50a7606a8c86a1db2bb01d897809a42f6628ea102bdae

172.67.130.113

https://code.jquery.com/jquery-3.6.0.min.js

151.101.194.137

https://a.nel.cloudflare.com/report/v4?s=ipSIby7098fLCsp%2Bf%2Fsy9Qd9vCf%2BJdeRQIobrjoSpsK3T2u7YXuM0fi1mJ2ysEYRzoxCqxemxfpZqAvv64XUBB7l9kdi0ijO92%2FNICRUJk0R0WV%2FNdYTV2IYRV8tuQ%3D%3D

35.190.80.1

https://nitftts.com/ASSETS/img/sig-op.svg

172.67.130.113

https://nitftts.com/captcha/style.css

172.67.130.113

https://nitftts.com/CAPQU1Xc1dVRXRSSzFVNjFi

172.67.130.113

https://nitftts.com/jq/50a7606a8c86a1db2bb01d897809a42f6628ea102bdaa

172.67.130.113

https://nitftts.com/boot/50a7606a8c86a1db2bb01d897809a42f6628ea102bdad

172.67.130.113

https://getbootstrap.com/)

unknown

https://nitftts.com/ASSETS/img/m_.svg

172.67.130.113

https://nitftts.com/cdn-cgi/challenge-platform/h/b/rc/8795adcf5e2909ef

172.67.130.113

https://nitftts.com/favicon.ico

172.67.130.113

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8795adcf5e2909ef

104.17.2.184

https://nitftts.com/x/50a7606a8c86a1db2bb01d897809a42f6628ea1289346

172.67.130.113

https://nitftts.com/APP-50a7606a8c86a1db2bb01d897809a42f6628ea128933f/50a7606a8c86a1db2bb01d897809a42f6628ea1289341

172.67.130.113

https://nitftts.com/o/50a7606a8c86a1db2bb01d897809a42f6628ea1289368

172.67.130.113

https://github.com/twbs/bootstrap/graphs/contributors)

unknown

https://nitftts.com/1

172.67.130.113

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D

104.17.2.184

https://github.com/twbs/bootstrap/blob/master/LICENSE)

unknown

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/177504864:1713953655:1-kQE4z2DtYF_KYErIBhkhFNwz7cGxKXdgqBf6ZSgzY/8795adcf5e2909ef/5d2bd94c96bf356

104.17.2.184

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/7if7r/0x4AAAAAAAYGcVauMJH_lBO9/auto/normal

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/8795adcf5e2909ef/1713957366113/84f88a0c89df63f7cdf084e844a1fd21c6dd4d0dcab5ab55090a93a557e868a2/XHZ0rMU7K6gyIab

104.17.2.184

There are 17 hidden URLs, click here to show them.

Domains

Name

Malicious

a.nel.cloudflare.com

35.190.80.1

Details

Name:	a.nel.cloudflare.com
IP:	35.190.80.1
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

code.jquery.com

151.101.194.137

Details

Name:	code.jquery.com
IP:	151.101.194.137
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

nitftts.com

172.67.130.113

Details

Name:	nitftts.com
IP:	172.67.130.113
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

challenges.cloudflare.com

104.17.3.184

Details

Name:	challenges.cloudflare.com
IP:	104.17.3.184
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
HTML page contains hidden URLs or javascript code	Phishing
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol

www.google.com

142.250.141.104

fp2e7a.wpc.phicdn.net

192.229.211.108

IPs

Domain

Country

Malicious

104.21.8.118

unknown

United States

192.168.2.4

unknown

104.17.3.184

challenges.cloudflare.com

United States

239.255.255.250

unknown

Reserved

172.67.130.113

nitftts.com

United States

151.101.194.137

code.jquery.com

United States

35.190.80.1

a.nel.cloudflare.com

United States

142.250.141.104

www.google.com

United States

104.17.2.184

unknown

United States

DOM / HTML

URL

Malicious

https://nitftts.com/024407056a4bd44a76e3518653fce74f6628ea0fabd71LOG024407056a4bd44a76e3518653fce74f6628ea0fabd72

Details

Filename:	2.5.pages.html.dom
Url:	https://nitftts.com/024407056a4bd44a76e3518653fce74f6628ea0fabd71LOG024407056a4bd44a76e3518653fce74f6628ea0fabd72
Target ID:	1
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 --field-trial-handle=2244,i,13643226679431463270,17493560958199353772,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Signature Hits	Behavior Group	Mitre Attack
Yara detected Html Dropper	Data Obfuscation
Yara detected HtmlPhish10	Phishing

https://nitftts.com/024407056a4bd44a76e3518653fce74f6628ea0fabd71LOG024407056a4bd44a76e3518653fce74f6628ea0fabd72#

Details

Filename:	3.6.pages.html.dom
Url:	https://nitftts.com/024407056a4bd44a76e3518653fce74f6628ea0fabd71LOG024407056a4bd44a76e3518653fce74f6628ea0fabd72#
Target ID:	1
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 --field-trial-handle=2244,i,13643226679431463270,17493560958199353772,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Signature Hits	Behavior Group	Mitre Attack
Yara detected Html Dropper	Data Obfuscation
Yara detected HtmlPhish10	Phishing

https://nitftts.com/

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/7if7r/0x4AAAAAAAYGcVauMJH_lBO9/auto/normal

https://nitftts.com/024407056a4bd44a76e3518653fce74f6628ea0fabd71LOG024407056a4bd44a76e3518653fce74f6628ea0fabd72

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://nitftts.com/

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://nitftts.com/

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
https://nitftts.com/