Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Chrome Cache Entry: 46

gzip compressed data, from Unix, original size modulo 2^32 2456

downloaded

Details

File:	Chrome Cache Entry: 46
Category:	downloaded
Dump:	chromecache_46.2.dr
ID:	dr_6
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	gzip compressed data, from Unix, original size modulo 2^32 2456
Entropy:	7.848112150858051
Encrypted:	false
Ssdeep:	24:X1oOl6L30Sl7dH3NMBGwGjacpfmZMjhCHS2GM+F3RF45eCpIlaTOB5h/mkp:X1oN0K93+ckraM+57WpIlaaD+k
Size:	1171
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 47

gzip compressed data, from Unix, original size modulo 2^32 55037

downloaded

Details

File:	Chrome Cache Entry: 47
Category:	downloaded
Dump:	chromecache_47.2.dr
ID:	dr_7
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	gzip compressed data, from Unix, original size modulo 2^32 55037
Entropy:	7.985952129991543
Encrypted:	false
Ssdeep:	384:TwXl87i4naaFtPESJ2DWOq1IcQS0SL7EOONbPHG:TwXW7i4naTSOAszOGb/G
Size:	15776
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 48

MS Windows icon resource - 6 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel

downloaded

Details

File:	Chrome Cache Entry: 48
Category:	downloaded
Dump:	chromecache_48.2.dr
ID:	dr_8
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	MS Windows icon resource - 6 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Entropy:	7.354295352983905
Encrypted:	false
Ssdeep:	24:sb8IQUm7Ar/pPwZRbiHGIc+CozPPdv4CA0H+9dCjnmLr7laO+If7xkLLVP:sbvmiRwZUmD+CoTU0HbEXRzxkLBP
Size:	2279
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 49

gzip compressed data, from Unix, original size modulo 2^32 444333

downloaded

Details

File:	Chrome Cache Entry: 49
Category:	downloaded
Dump:	chromecache_49.2.dr
ID:	dr_9
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	gzip compressed data, from Unix, original size modulo 2^32 444333
Entropy:	7.997339385404732
Encrypted:	true
Ssdeep:	3072:OJO5SnCFpI2NYqAz2ht/WtZe8sxFSfx3jS5lVFQO8zibUIjgojKvT:JQnsh0c8fx+9FpTgWKb
Size:	121267
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 50

gzip compressed data, from Unix, original size modulo 2^32 113084

downloaded

Details

File:	Chrome Cache Entry: 50
Category:	downloaded
Dump:	chromecache_50.2.dr
ID:	dr_10
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	gzip compressed data, from Unix, original size modulo 2^32 113084
Entropy:	7.979532931860973
Encrypted:	false
Ssdeep:	384:VkqQ8rNFEhCgMyL2iww6oIR8mWG+Pu9Z5IM6mxqrghTvUty7T9Q:gCGEiL/w7R8DW9Z5B6AasTv37T9Q
Size:	20314
Whitelisted:	false
Reputation:	low

Chrome Cache Entry: 51

gzip compressed data, from Unix, original size modulo 2^32 141272

downloaded

Details

File:	Chrome Cache Entry: 51
Category:	downloaded
Dump:	chromecache_51.2.dr
ID:	dr_11
Target ID:	2
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	gzip compressed data, from Unix, original size modulo 2^32 141272
Entropy:	7.995283415822979
Encrypted:	true
Ssdeep:	1536:J+Rly7ClHM8uFsPoHZOqk36/liAnSXcOr+/GVHLzbvBP7olfJ:J+RlYgyFtEf36jn0pr+yz6R
Size:	49626
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	6912
Target ID:	0
Parent PID:	5728
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	17:50:48
Date:	26/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=2472,i,3685527749275689148,13619911006940924021,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	5916
Target ID:	2
Parent PID:	6912
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=2472,i,3685527749275689148,13619911006940924021,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	17:50:54
Date:	26/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://relevanteduofficelogin.relevantedu.xyz"

Details

Is windows:	true
Is dropped:	false
PID:	5320
Target ID:	3
Parent PID:	5728
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://relevanteduofficelogin.relevantedu.xyz"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	17:50:56
Date:	26/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://relevanteduofficelogin.relevantedu.xyz

https://181eeb1c-862723ea.relevantedu.xyz/shared/1.0/content/js/ConvergedLogin_PCore_4aBF4cdky--I3Cpch7JoPw2.js

178.128.58.202

http://relevanteduofficelogin.relevantedu.xyz/

178.128.58.202

https://l1ve.relevantedu.xyz/Me.htm?v=3

178.128.58.202

https://181eeb1c-862723ea.relevantedu.xyz/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico

178.128.58.202

https://b5e70507-862723ea.relevantedu.xyz/api/report?catId=GW+estsfd+ams2

178.128.58.202

https://relevanteduofficelogin.relevantedu.xyz/

https://0ffice.relevantedu.xyz/login

178.128.58.202

https://b72d03ca-862723ea.relevantedu.xyz/shared/1.0/content/js/BssoInterrupt_Core_Ggyc2EJnCaHFrI6xkBPLcg2.js

178.128.58.202

https://relevanteduofficelogin.relevantedu.xyz/favicon.ico

178.128.58.202

https://181eeb1c-862723ea.relevantedu.xyz/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css

178.128.58.202

https://181eeb1c-862723ea.relevantedu.xyz/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js

178.128.58.202

https://relevanteduofficelogin.relevantedu.xyz/862723eaca4a492d82ff65e2c911b8f7/

178.128.58.202

https://181eeb1c-862723ea.relevantedu.xyz/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_0lriinjhzchre9aqecvmpg2.js

178.128.58.202

There are 3 hidden URLs, click here to show them.

Domains

Name

Malicious

l1ve.relevantedu.xyz

178.128.58.202

Details

Name:	l1ve.relevantedu.xyz
IP:	178.128.58.202
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS queries to domains with low reputation	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

relevanteduofficelogin.relevantedu.xyz

178.128.58.202

Details

Name:	relevanteduofficelogin.relevantedu.xyz
IP:	178.128.58.202
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS queries to domains with low reputation	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

0ffice.relevantedu.xyz

178.128.58.202

Details

Name:	0ffice.relevantedu.xyz
IP:	178.128.58.202
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS queries to domains with low reputation	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

b72d03ca-862723ea.relevantedu.xyz

178.128.58.202

Details

Name:	b72d03ca-862723ea.relevantedu.xyz
IP:	178.128.58.202
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS queries to domains with low reputation	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

b5e70507-862723ea.relevantedu.xyz

178.128.58.202

Details

Name:	b5e70507-862723ea.relevantedu.xyz
IP:	178.128.58.202
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS queries to domains with low reputation	Networking
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

181eeb1c-862723ea.relevantedu.xyz

178.128.58.202

Details

Name:	181eeb1c-862723ea.relevantedu.xyz
IP:	178.128.58.202
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS queries to domains with low reputation	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

bg.microsoft.map.fastly.net

199.232.214.172

www.google.com

142.250.217.196

Details

Name:	www.google.com
IP:	142.250.217.196
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

fp2e7a.wpc.phicdn.net

192.229.211.108

IPs

Domain

Country

Malicious

178.128.58.202

l1ve.relevantedu.xyz

Netherlands

239.255.255.250

unknown

Reserved

142.250.217.228

unknown

United States

192.168.2.6

unknown

192.168.2.5

unknown

DOM / HTML

URL

Malicious

https://relevanteduofficelogin.relevantedu.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.relevantedu.xyz%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.relevantedu.xyz%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638497434879938985.OTMyZmM3YzEtY2MyMi00ZmU5LTkxMTQtMWMyYmUxMzYyYzk4OTQ3NDFiZTItZTk1Yi00YmUzLTg0NTItYzljYzJmODhkMTg5&ui_locales=en-US&mkt=en-US&client-request-id=a4b512c3-a4a0-416b-b35b-186efbe5fd83&state=z_lP4Q7OlsbDNVLBmi5Sby8cvacKieMrTNK4rEt0GbamdiB8wnIxsYcFX-rFgHWE_Ru2xu_bmjibdV8Ddj3tloQQaAJAjps-zHUvR0J7MIwpLI1Y0mPgnAQw4mD5QWLEl5GuAesYSybJvS4VEOlwn1h8fvgK1g1vCRIePf0_pCHGdDqF5ULOxPc1BylSBOJ3E7LyUlGJCUjO87Y6yncYfdeUHtqs7BjUgu0zRe2oX7FTvRghQR51J1XPJez2jEdriWD-Zask3nenOQMdGQWWVw&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0

Details

Filename:	1.2.pages.html.dom
Url:	https://relevanteduofficelogin.relevantedu.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.relevantedu.xyz%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.relevantedu.xyz%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638497434879938985.OTMyZmM3YzEtY2MyMi00ZmU5LTkxMTQtMWMyYmUxMzYyYzk4OTQ3NDFiZTItZTk1Yi00YmUzLTg0NTItYzljYzJmODhkMTg5&ui_locales=en-US&mkt=en-US&client-request-id=a4b512c3-a4a0-416b-b35b-186efbe5fd83&state=z_lP4Q7OlsbDNVLBmi5Sby8cvacKieMrTNK4rEt0GbamdiB8wnIxsYcFX-rFgHWE_Ru2xu_bmjibdV8Ddj3tloQQaAJAjps-zHUvR0J7MIwpLI1Y0mPgnAQw4mD5QWLEl5GuAesYSybJvS4VEOlwn1h8fvgK1g1vCRIePf0_pCHGdDqF5ULOxPc1BylSBOJ3E7LyUlGJCUjO87Y6yncYfdeUHtqs7BjUgu0zRe2oX7FTvRghQR51J1XPJez2jEdriWD-Zask3nenOQMdGQWWVw&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0
Target ID:	2
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=2472,i,3685527749275689148,13619911006940924021,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Signature Hits	Behavior Group	Mitre Attack
Yara detected HtmlPhish54	Phishing

Details

Filename:	2.3.pages.html.dom
Url:	https://relevanteduofficelogin.relevantedu.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2F0ffice.relevantedu.xyz%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2F0ffice.relevantedu.xyz%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638497434879938985.OTMyZmM3YzEtY2MyMi00ZmU5LTkxMTQtMWMyYmUxMzYyYzk4OTQ3NDFiZTItZTk1Yi00YmUzLTg0NTItYzljYzJmODhkMTg5&ui_locales=en-US&mkt=en-US&client-request-id=a4b512c3-a4a0-416b-b35b-186efbe5fd83&state=z_lP4Q7OlsbDNVLBmi5Sby8cvacKieMrTNK4rEt0GbamdiB8wnIxsYcFX-rFgHWE_Ru2xu_bmjibdV8Ddj3tloQQaAJAjps-zHUvR0J7MIwpLI1Y0mPgnAQw4mD5QWLEl5GuAesYSybJvS4VEOlwn1h8fvgK1g1vCRIePf0_pCHGdDqF5ULOxPc1BylSBOJ3E7LyUlGJCUjO87Y6yncYfdeUHtqs7BjUgu0zRe2oX7FTvRghQR51J1XPJez2jEdriWD-Zask3nenOQMdGQWWVw&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true
Target ID:	2
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=2472,i,3685527749275689148,13619911006940924021,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Signature Hits	Behavior Group	Mitre Attack
Yara detected HtmlPhish54	Phishing

https://relevanteduofficelogin.relevantedu.xyz/

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
http://relevanteduofficelogin.relevantedu.xyz

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttp://relevanteduofficelogin.relevantedu.xyz

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
http://relevanteduofficelogin.relevantedu.xyz