IOC Report
I_ REF _ Due Debt 25_03_2024.msg

Files

File Path

Type

Category

Malicious

I_ REF _ Due Debt 25_03_2024.msg

CDFV2 Microsoft Outlook Message

initial sample

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

data

dropped

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

XML 1.0 document, ASCII text, with very long lines (2159), with no line terminators

dropped

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Open Sans\21798841561.ttf

TrueType Font data, digitally signed, 19 tables, 1st "DSIG", 26 names, Macintosh, Digitized data copyright \251 2010-2011, Google Corporation.Open SansRegular1.10;1ASC;OpenSans-R

dropped

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Open Sans\23165521968.ttf

TrueType Font data, digitally signed, 19 tables, 1st "DSIG", 26 names, Macintosh, Digitized data copyright \251 2010-2011, Google Corporation.Open SansBold1.10;1ASC;OpenSans-Bold

dropped

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

data

dropped

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

SQLite Write-Ahead Log, version 3007000

modified

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{387B8817-A3FD-4B84-80D3-6DA5664AFB5D}.tmp

data

modified

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1711614391302179800_6F4D5E05-DECE-4841-9FB6-7264F598FE86.log

ASCII text, with very long lines (28773), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1711614391303030400_6F4D5E05-DECE-4841-9FB6-7264F598FE86.log

data

dropped

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240328T0926310089-6388.etl

data

modified

C:\Users\user\AppData\Local\Temp\~DF94911B7E2FB76FFB.TMP

data

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

data

dropped

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 07:26:40 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 07:26:40 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 07:26:40 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 07:26:40 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 07:26:40 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Microsoft Outlook email folder (>=2003)

dropped

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

data

dropped

Chrome Cache Entry: 74

ASCII text, with no line terminators

downloaded

Chrome Cache Entry: 75

ASCII text

downloaded

Chrome Cache Entry: 76

HTML document, ASCII text, with very long lines (65440), with CRLF line terminators

downloaded

Chrome Cache Entry: 77

ASCII text, with very long lines (60130)

dropped

Chrome Cache Entry: 78

ASCII text, with very long lines (11461)

downloaded

Chrome Cache Entry: 79

Web Open Font Format (Version 2), TrueType, length 78168, version 331.-31196

downloaded

Chrome Cache Entry: 80

PNG image data, 128 x 128, 8-bit/color RGB, non-interlaced

dropped

Chrome Cache Entry: 81

ASCII text, with very long lines (26500)

dropped

Chrome Cache Entry: 82

ASCII text, with very long lines (32065)

downloaded

Chrome Cache Entry: 83

ASCII text, with very long lines (32030)

downloaded

Chrome Cache Entry: 84

MS Windows icon resource - 3 icons, 48x48, 8 bits/pixel, 32x32, 8 bits/pixel

downloaded

There are 23 hidden files, click here to show them.

URLs

Name

IP

Malicious

https://cloudflare-ipfs.com/ipfs/bafybeib66t4ah2ibo6fdsaysddgmzuhfrkaoehx5crfpnarheqsjywdjnu#virginia.scremin@cuzziol.it

Details

Name:	https://cloudflare-ipfs.com/ipfs/bafybeib66t4ah2ibo6fdsaysddgmzuhfrkaoehx5crfpnarheqsjywdjnu#virginia.scremin@cuzziol.it
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Source:	browser

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for domain / URL	AV Detection
Detected hidden input values containing email addresses (often used in phishing pages)	Phishing
HTML body contains low number of good links	Phishing
HTML body contains password input	Phishing
META author tag missing	Phishing
META copyright tag missing	Phishing
Spawns processes	System Summary	Process Injection

Domains

Name

IP

Malicious

cloudflare-ipfs.com

104.17.64.14

d26p066pn2w0s0.cloudfront.net

52.85.151.109

code.jquery.com

151.101.66.137

www.google.com

172.253.115.147

image.thum.io

18.235.6.110

res.cloudinary.com

unknown

ka-f.fontawesome.com

unknown

kit.fontawesome.com

unknown

docucdn-a.akamaihd.net

unknown

logo.clearbit.com

unknown

IPs

IP

Domain

Country

Malicious

104.17.64.14

cloudflare-ipfs.com

United States

23.199.63.178

unknown

United States

142.251.167.101

unknown

United States

104.18.40.68

unknown

United States

192.168.2.16

unknown

unknown

172.253.62.95

unknown

United States

172.253.115.147

www.google.com

United States

172.253.115.101

unknown

United States

151.101.66.137

code.jquery.com

United States

18.235.6.110

image.thum.io

United States

142.251.163.94

unknown

United States

104.21.26.223

unknown

United States

52.113.194.132

unknown

United States

1.1.1.1

unknown

Australia

3.162.174.126

unknown

United States

142.251.111.95

unknown

United States

172.253.63.94

unknown

United States

23.205.104.21

unknown

United States

52.111.230.27

unknown

United States

20.50.80.214

unknown

United States

239.255.255.250

unknown

Reserved

23.221.242.90

unknown

United States

104.19.166.65

unknown

United States

52.85.151.109

d26p066pn2w0s0.cloudfront.net

United States

142.251.163.84

unknown

United States

There are 15 hidden IPs, click here to show them.