Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

C:\Users\eyup\Downloads\9bf54cf1-c50f-4d95-bdf1-4c42a1419cdc.tmp

HTML document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\eyup\Downloads\9bf54cf1-c50f-4d95-bdf1-4c42a1419cdc.tmp
Category:	dropped
Dump:	9bf54cf1-c50f-4d95-bdf1-4c42a1419cdc.tmp.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with CRLF line terminators
Entropy:	5.025274962555434
Encrypted:	false
Size:	98
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the user directory	System Summary	Masquerading

C:\Users\eyup\Downloads\audiomp310032022.html (copy)

HTML document, ASCII text, with very long lines (576), with CRLF line terminators

dropped

Details

File:	C:\Users\eyup\Downloads\audiomp310032022.html (copy)
Category:	dropped
Dump:	audiomp310032022.html.crdownload.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with very long lines (576), with CRLF line terminators
Entropy:	5.043584058554381
Encrypted:	false
Size:	4187
Whitelisted:	false
Reputation:	low

C:\Users\eyup\Downloads\audiomp310032022.html.crdownload

HTML document, ASCII text, with very long lines (576), with CRLF line terminators

dropped

Details

File:	C:\Users\eyup\Downloads\audiomp310032022.html.crdownload
Category:	dropped
Dump:	audiomp310032022.html.crdownload.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text, with very long lines (576), with CRLF line terminators
Entropy:	5.043584058554381
Encrypted:	false
Size:	4187
Whitelisted:	false
Reputation:	low

URLs

Name

Malicious

https://u29271426.ct.sendgrid.net/ls/click?upn=3T7exZ7CPnDMYe213NRbLhq-2B5D4-2BnY-2FiPTzicmL02kUpZ11gmTXTCFRLsy6wjXggLkIYzrB9C24t-2B2-2FWkC5hKNIvF4j-2FvNG-2BV2FxSOqjizVopB7MgrWMoAW0OqtifeU8nsXx_0DZIarqO7rTJkdLOMFYhDD7dyDsIC7p5IrHjuIWYLvkfflMFAz0w3bHha13nk84f2Gg6NRBg3p5GJzNi0w7MkgseIvFKosT9eOBtLlNvwx-2F1e1F3NDnggParWpZFm-2FPSjS1gGUKWYhzU7cFFHD9idZltk1H1NxOa9gNQ5T2Br-2BYl-2BPY4EnDFELBtiHpsENUApjNICGs5jD0cpDtmC-2F5FS9JD8vHdEgDODYsC1TYiABOUpcXaSdgGsL2brbpEnlUGganYnIkydhSLAC7C0gaOWLcpEMrSafFR3ySNWE9FHgqAFx8hnDAwr6Wr2woAk4vGpa8FpMNYu7DPx3rOrMSxQHqV9w7zvcCtIeSVz9yN7VLcIFzjRy5jM4hPDZnSF2gMilUZzuBtx9s8uP-2Fg-2FH-2B3fU1vEBUxtz-2F15OMpp3yc6w5VTJvTiwZodHVKzjAnX1Xe709VhpVo2Lo75G52JsjbSKS-2B-2FkHKf7teOLBNtrScoFbE-2FCoanOGNYnRWJ7mNnwZrYTcwBNA6uvkjVjGPbCjNhDldw643ruGdKMffBTDGB3HragrPRGrrsSdad-2ByG0Gnke298NCaqpC4VkbRSqg-2FEPePxnvrSqgqRLpMcAu0FxIG0vvHLOpBsRKXip-2B1FPI5RG628kNXFkx4uAwwnbg9UJazGaQ3q-2FpSJaSX1514PGquYFWQeIZkiJuklBxoD5ka3LlKUukRTVjBr-2FgVC4Crjm2GBl9-2BXYRN8zX8RR5G4xC-2Fb2qMdgwPEwiR-2Bj9iHttcE-2BbdGkL7O3AjCkoNf4NBinJf4oFKton71fRnwsp0xP-2BR0RGlurfhN1wJrKmK4HnhngB5Dio-2FjoaLb20SMFmnvZrJWuGSYcD8HWbjee65Bcbg-3D

Details

Filetype:

URL

Filename:

Signature Hits	Behavior Group	Mitre Attack
Phishing site detected (based on favicon image match)	Phishing
Yara detected HtmlPhish10	Phishing
Phishing site detected (based on image similarity)	Phishing
HTML body contains low number of good links	Phishing
Found iframes	Phishing	Drive-by Compromise
Suspicious form URL found	Phishing	Obfuscated Files or Information
No HTML title found	Phishing
Submit button contains javascript call	Phishing	Scripting
Performs DNS lookups	Networking	Non-Application Layer Protocol
Classification label	System Summary
Uses HTTPS	Networking	Encrypted Channel Application Layer Protocol
Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis
Spawns processes	System Summary	Process Injection
Connects to IPs without corresponding DNS lookups	Networking
META author tag missing	Phishing
Creates files inside the program directory	System Summary
META copyright tag missing	Phishing
Creates files inside the user directory	System Summary	Masquerading
Creates a directory in C:\Program Files	Compliance, System Summary
Uses secure TLS version for HTTPS connections	Compliance, Networking
Found graphical window changes (likely an installer)	System Summary

https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1

Details

Name:	https://davedinkel.com/teamsmp3/appsuite/index.php?error&id=sucker@sucker.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	browser

Signature Hits	Behavior Group	Mitre Attack
Phishing site detected (based on favicon image match)	Phishing
Phishing site detected (based on image similarity)	Phishing
Found iframes	Phishing	Drive-by Compromise
HTML body contains low number of good links	Phishing
No HTML title found	Phishing
Submit button contains javascript call	Phishing	Scripting
Suspicious form URL found	Phishing	Obfuscated Files or Information
META author tag missing	Phishing
META copyright tag missing	Phishing

https://davedinkel.com/teamsmp3/appsuite/

Details

Name:	https://davedinkel.com/teamsmp3/appsuite/
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	browser

Signature Hits	Behavior Group	Mitre Attack
Phishing site detected (based on favicon image match)	Phishing
Phishing site detected (based on image similarity)	Phishing
Found iframes	Phishing	Drive-by Compromise
HTML body contains low number of good links	Phishing
No HTML title found	Phishing
Submit button contains javascript call	Phishing	Scripting
Suspicious form URL found	Phishing	Obfuscated Files or Information
META author tag missing	Phishing
META copyright tag missing	Phishing

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le_nU0iAAAAAPmsJQ8BPTLdUr8LuicL6Wf0uvP_&co=aHR0cHM6Ly9pLWFtLW5vdC1hLXJvYm90LTQwY2UwNS53ZWJmbG93LmlvOjQ0Mw..&hl=en&v=a9s0j4pCVT6gaTEkLiFbtZPH&size=normal&cb=dji1q0iloo8x

https://www.google.com/recaptcha/api2/bframe?hl=en&v=a9s0j4pCVT6gaTEkLiFbtZPH&k=6Le_nU0iAAAAAPmsJQ8BPTLdUr8LuicL6Wf0uvP_

file:///C:/Users/eyup/Downloads/audiomp310032022.html

https://davedinkel.com/

Domains

Name

Malicious

d3e54v103j8qbb.cloudfront.net

52.222.232.144

stats-juc1ugur1qwqqqo4.stackpathdns.com

151.139.242.7

accounts.google.com

142.250.186.77

u29271426.ct.sendgrid.net

167.89.118.28

webflow.com

18.214.126.200

matomo-wpmudev-1288779782.us-east-2.elb.amazonaws.com

3.135.11.48

drive.google.com

142.250.185.110

www.google.com

142.250.185.68

clients.l.google.com

172.217.18.14

uploads-ssl.webflow.com

13.225.78.54

davedinkel.com

170.39.79.34

googlehosted.l.googleusercontent.com

142.250.184.193

doc-00-8k-docs.googleusercontent.com

unknown

stats1.wpmudev.com

unknown

i-am-not-a-robot-40ce05.webflow.io

unknown

stats.wpmucdn.com

unknown

clients2.google.com

unknown

secure.aadcdn.microsoftonline-p.com

unknown

code.jquery.com

unknown

There are 9 hidden domains, click here to show them.

IPs

Domain

Country

Malicious

172.217.18.14

clients.l.google.com

United States

18.214.126.200

webflow.com

United States

216.239.32.36

unknown

United States

104.82.137.172

unknown

United States

3.135.11.48

matomo-wpmudev-1288779782.us-east-2.elb.amazonaws.com

United States

142.250.184.227

unknown

United States

142.250.184.228

unknown

United States

142.250.186.136

unknown

United States

142.250.186.77

accounts.google.com

United States

52.222.232.144

d3e54v103j8qbb.cloudfront.net

United States

142.250.186.35

unknown

United States

13.225.78.54

uploads-ssl.webflow.com

United States

172.217.16.202

unknown

United States

34.104.35.123

unknown

United States

151.139.242.7

stats-juc1ugur1qwqqqo4.stackpathdns.com

United States

142.250.184.193

googlehosted.l.googleusercontent.com

United States

142.250.186.163

unknown

United States

167.89.118.28

u29271426.ct.sendgrid.net

United States

172.217.18.3

unknown

United States

142.250.185.110

drive.google.com

United States

69.16.175.42

unknown

United States

239.255.255.250

unknown

Reserved

170.39.79.34

davedinkel.com

Reserved

151.101.2.132

unknown

United States

127.0.0.1

unknown

172.217.16.132

unknown

United States

There are 16 hidden IPs, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Files

URLs

Domains

IPs