Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

ATT9873645.htm

HTML document, ASCII text, with very long lines (64487), with CRLF line terminators

initial sample

Details

Filetype:	HTML document, ASCII text, with very long lines (64487), with CRLF line terminators
Entropy:	6.063612367882672
Filename:	ATT9873645.htm
Filesize:	1113680
MD5:	cb5be4c57629182364781024e6fd83d7
SHA1:	b5b617201b0e6992386a4854676903d96b1de0f7
SHA256:	7b98b775c96608b027154e518b723d3d6c8468d8c08925e393d58418f6d384d8
SHA512:	899d14a0048a61fddde01b8998a9831b52171de0eb81e203292da1719f502eb3c82011d74750c591de6bb70b99d709d9aa73575275951baa87e755a5452aef8c
SSDEEP:	24576:zNjx1VWZ9oMsB9U991Q/2qg1A8LGNSpzF+Y:RKsu9m/PF8qsZF3
Preview:	<!DOCTYPE html>..<html id="mainAll" data-emailValue="jcurrent@harrisonst.com" data-fetch="" lang="en">....<head></head>....<body style="display: none;" id="allbody">.. <script>.. const _0x365e9f = _0x24fc;.. (function(_0x151353, _0x28df1e

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
HTML document with suspicious title	System Summary
Phishing site detected (based on image similarity)	Phishing
Sample is known by Antivirus	System Summary
Submission file is bigger than most known malware samples	System Summary

Chrome Cache Entry: 136

SVG Scalable Vector Graphics image

dropped

Details

File:	Chrome Cache Entry: 136
Category:	dropped
Dump:	chromecache_136.1.dr
ID:	dr_0
Target ID:	1
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	SVG Scalable Vector Graphics image
Entropy:	4.720499940334011
Encrypted:	false
Ssdeep:	12:t4BdU/uRqv6DLfBHKFWJCDLfBSU1pRXIFl+MJ4bADc:t4TU/uRff0EcfIU1XXU+t2c
Size:	513
Whitelisted:	false
Reputation:	moderate

Chrome Cache Entry: 137

SVG Scalable Vector Graphics image

dropped

Details

File:	Chrome Cache Entry: 137
Category:	dropped
Dump:	chromecache_137.1.dr
ID:	dr_1
Target ID:	1
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	SVG Scalable Vector Graphics image
Entropy:	3.9986369032270845
Encrypted:	false
Ssdeep:	48:fnPtRGMZvaYm+dN/fltkn9mU6X/pU2Ka1xZXM:XtQIvXHlinn6X/GKm
Size:	1555
Whitelisted:	false
Reputation:	moderate

Chrome Cache Entry: 138

Unicode text, UTF-8 (with BOM) text

downloaded

Details

File:	Chrome Cache Entry: 138
Category:	downloaded
Dump:	chromecache_138.1.dr
ID:	dr_2
Target ID:	1
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	Unicode text, UTF-8 (with BOM) text
Entropy:	5.112735417225198
Encrypted:	false
Ssdeep:	384:1HHLO7eS0F4bBY/fn6jZcy9/cGK1q8CarY64Cb+dOy:1HHCLYXfl1q8CarY64Cb+dl
Size:	23427
Whitelisted:	false
Reputation:	moderate

Chrome Cache Entry: 139

SVG Scalable Vector Graphics image

downloaded

Details

File:	Chrome Cache Entry: 139
Category:	downloaded
Dump:	chromecache_139.1.dr
ID:	dr_3
Target ID:	1
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	SVG Scalable Vector Graphics image
Entropy:	4.720499940334011
Encrypted:	false
Ssdeep:	12:t4BdU/uRqv6DLfBHKFWJCDLfBSU1pRXIFl+MJ4bADc:t4TU/uRff0EcfIU1XXU+t2c
Size:	513
Whitelisted:	false
Reputation:	timeout

Chrome Cache Entry: 140

SVG Scalable Vector Graphics image

downloaded

Details

File:	Chrome Cache Entry: 140
Category:	downloaded
Dump:	chromecache_140.1.dr
ID:	dr_4
Target ID:	1
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	SVG Scalable Vector Graphics image
Entropy:	3.9986369032270845
Encrypted:	false
Ssdeep:	48:fnPtRGMZvaYm+dN/fltkn9mU6X/pU2Ka1xZXM:XtQIvXHlinn6X/GKm
Size:	1555
Whitelisted:	false
Reputation:	timeout

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank

Details

Is windows:	true
Is dropped:	false
PID:	2868
Target ID:	0
Parent PID:	4924
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Size:	2851656
MD5:	0FEC2748F363150DC54C1CAFFB1A9408
Time:	21:59:28
Date:	20/03/2023
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7d31b0000
Modulesize:	2916352
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1976 --field-trial-handle=1788,i,11665051936163555835,8866798666326847203,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	5996
Target ID:	1
Parent PID:	2868
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1976 --field-trial-handle=1788,i,11665051936163555835,8866798666326847203,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Size:	2851656
MD5:	0FEC2748F363150DC54C1CAFFB1A9408
Time:	21:59:29
Date:	20/03/2023
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7d31b0000
Modulesize:	2916352
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\ATT9873645.htm

Details

Is windows:	true
Is dropped:	false
PID:	6324
Target ID:	2
Parent PID:	4924
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\ATT9873645.htm
Size:	2851656
MD5:	0FEC2748F363150DC54C1CAFFB1A9408
Time:	21:59:30
Date:	20/03/2023
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7d31b0000
Modulesize:	2916352
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

file:///C:/Users/user/Desktop/ATT9873645.htm

Details

Name:	file:///C:/Users/user/Desktop/ATT9873645.htm
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	browser
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
HTML document with suspicious title	System Summary
Phishing site detected (based on image similarity)	Phishing
Sample is known by Antivirus	System Summary
Submission file is bigger than most known malware samples	System Summary

https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1

142.250.203.110

https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard

142.250.203.109

https://www.w3schools.com/w3css/4/w3.css

192.229.133.221

Domains

Name

Malicious

accounts.google.com

142.250.203.109

Details

Name:	accounts.google.com
IP:	142.250.203.109
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol

cs837.wac.edgecastcdn.net

192.229.133.221

cs1227.wpc.alphacdn.net

192.229.221.185

www.google.com

142.250.203.100

Details

Name:	www.google.com
IP:	142.250.203.100
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol

clients.l.google.com

142.250.203.110

clients2.google.com

unknown

Details

Name:	clients2.google.com
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

www.w3schools.com

unknown

Details

Name:	www.w3schools.com
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

IPs

Domain

Country

Malicious

192.168.2.1

unknown

239.255.255.250

unknown

Reserved

192.229.221.185

cs1227.wpc.alphacdn.net

United States

142.250.203.100

www.google.com

United States

142.250.203.110

clients.l.google.com

United States

192.229.133.221

cs837.wac.edgecastcdn.net

United States

127.0.0.1

unknown

142.250.203.109

accounts.google.com

United States

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings

ahfgeienlihckogmohjhadlkjgocpleb

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings

gdaefkejpgkiemlaofpalmlakkmbjdnl

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings

kmendfapggjehodndflmmgagdbamhnfd

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings

mhjfbmdgcfjbbpaeojofohoefgiehjai

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings

neajdppkdcdipfabeoofebfddakdcjhd

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings

nkeimhogjdpnpccoofpliimaahmaaome

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default

prefs.preference_reset_time

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\LastWasDefault

S-1-5-21-3853321935-2125563209-4053062332-1002

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings

gdaefkejpgkiemlaofpalmlakkmbjdnl

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings

kmendfapggjehodndflmmgagdbamhnfd

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings

neajdppkdcdipfabeoofebfddakdcjhd

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings

nkeimhogjdpnpccoofpliimaahmaaome

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings

nmmhkkegccagdldgiimedpiccmgmieda

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings

nmmhkkegccagdldgiimedpiccmgmieda

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings

nmmhkkegccagdldgiimedpiccmgmieda

HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon

state

HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty

StatusCodes

HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty

StatusCodes

HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon

state

HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}

HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics

user_experience_metrics.stability.exited_cleanly

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default

media.cdm.origin_data

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default

software_reporter.reporting

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default

media.storage_id_salt

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default

google.services.last_account_id

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default

google.services.account_id

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default

settings_reset_prompt.last_triggered_for_startup_urls

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default

settings_reset_prompt.last_triggered_for_homepage

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default

module_blocklist_cache_md5_digest

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default

software_reporter.prompt_seed

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default

default_search_provider_data.template_url_data

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default

safebrowsing.incidents_sent

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default

pinned_tabs

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default

browser.show_home_button

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default

search_provider_overrides

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default

settings_reset_prompt.last_triggered_for_default_search

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default

prefs.preference_reset_time

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default

software_reporter.prompt_version

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default

google.services.last_username

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default

session.startup_urls

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default

session.restore_on_startup

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default

settings_reset_prompt.prompt_wave

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default

homepage

HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default

homepage_is_newtabpage

HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}

lastrun

HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}

lastrun

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8

Blob

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8

Blob

HKEY_USERSS-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry

TraceTimeLast

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\LastWasDefault

S-1-5-21-3853321935-2125563209-4053062332-1002

HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon

state

HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty

StatusCodes

HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty

StatusCodes

HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon

state

There are 44 hidden registries, click here to show them.

DOM / HTML

URL

Malicious

file:///C:/Users/user/Desktop/ATT9873645.htm

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
ATT9873645.htm

Files

Processes

URLs

Domains

IPs

Registry

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportATT9873645.htm

Files

Processes

URLs

Domains

IPs

Registry

DOM / HTML

IOC Report
ATT9873645.htm