IOC Report
https://wechatunsuscribe.secure.force.com/

Files

File Path

Type

Category

Malicious

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 13:43:59 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 13:43:59 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 13:43:59 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 13:43:59 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 18 13:43:59 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide

dropped

Chrome Cache Entry: 71

Unicode text, UTF-8 text, with very long lines (65504), with no line terminators

downloaded

Chrome Cache Entry: 72

ASCII text

downloaded

Chrome Cache Entry: 73

PNG image data, 48 x 48, 8-bit colormap, non-interlaced

dropped

Chrome Cache Entry: 74

ASCII text, with very long lines (941)

downloaded

Chrome Cache Entry: 75

ASCII text, with very long lines (26453)

downloaded

Chrome Cache Entry: 76

PNG image data, 136 x 37, 8-bit colormap, non-interlaced

dropped

Chrome Cache Entry: 77

PNG image data, 48 x 48, 8-bit colormap, non-interlaced

downloaded

Chrome Cache Entry: 78

ASCII text, with very long lines (65380)

downloaded

Chrome Cache Entry: 79

MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel

downloaded

Chrome Cache Entry: 80

ASCII text, with very long lines (65380)

downloaded

Chrome Cache Entry: 81

MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel

dropped

Chrome Cache Entry: 82

ASCII text, with very long lines (51955)

downloaded

Chrome Cache Entry: 83

PNG image data, 138 x 125, 8-bit/color RGB, non-interlaced

dropped

Chrome Cache Entry: 84

PNG image data, 138 x 125, 8-bit/color RGB, non-interlaced

downloaded

Chrome Cache Entry: 85

ASCII text, with very long lines (21627)

downloaded

Chrome Cache Entry: 86

ASCII text, with very long lines (33778)

downloaded

Chrome Cache Entry: 87

ASCII text, with very long lines (65380)

downloaded

Chrome Cache Entry: 88

ASCII text, with very long lines (47916)

downloaded

Chrome Cache Entry: 89

PNG image data, 136 x 37, 8-bit colormap, non-interlaced

downloaded

There are 16 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://wechatunsuscribe.secure.force.com/

Details

Is windows:	true
Is dropped:	false
PID:	5920
Target ID:	0
Parent PID:	1336
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://wechatunsuscribe.secure.force.com/
Size:	3242272
MD5:	83395EAB5B03DEA9720F8D7AC0D15CAA
Time:	16:43:56
Date:	18/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7d6f10000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1920,i,4531950953507525100,6941954018789879291,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	4472
Target ID:	1
Parent PID:	5920
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1920,i,4531950953507525100,6941954018789879291,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	83395EAB5B03DEA9720F8D7AC0D15CAA
Time:	16:43:57
Date:	18/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7d6f10000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

IP

Malicious

https://wechatunsuscribe.secure.force.com/

http://www.salesforce.com/ui/accent/

unknown

https://goldengoose.my.salesforce-sites.com/sCSS/60.0/sprites/1710411415000/Theme3/00D3X0000047cTS/0057U000001A9O2/gc/dCustom1.css

15.161.0.134

https://goldengoose.my.salesforce-sites.com/GGDBchat/sCSS/60.0/sprites/1705602481000/Theme3/default/gc/setup.css

15.161.0.134

https://goldengoose.my.salesforce-sites.com/GGDBchat/sCSS/60.0/sprites/1705602481000/Theme3/default/gc/zen-componentsCompatible.css

15.161.0.134

https://help.salesforce.com/setSFXCookie?value

unknown

https://goldengoose.my.salesforce-sites.com/GGDBchat/jslibrary/1699262264248/sfdc/main.js

15.161.0.134

https://goldengoose.my.salesforce-sites.com/sCSS/60.0/sprites/1710411415000/Theme3/gc/dStandard.css

15.161.0.134

https://goldengoose.my.salesforce-sites.com/GGDBchat/sCSS/60.0/sprites/1705602481000/Theme3/default/gc/common.css

15.161.0.134

https://goldengoose.my.salesforce-sites.com/sCSS/60.0/sprites/1710411415000/Theme3/00D3X0000047cTS/0057U000001A9O2/gc/dCustom0.css

15.161.0.134

https://goldengoose.my.salesforce-sites.com/favicon.ico

15.161.0.134

https://wechatunsuscribe.secure.force.com/

15.161.0.134

https://goldengoose.my.salesforce-sites.com/

15.161.0.134

https://goldengoose.my.salesforce-sites.com/GGDBchat/resource/1588174741000/SiteSamples/SiteStyles.css

15.161.0.134

https://goldengoose.my.salesforce-sites.com/GGDBchat/sCSS/60.0/sprites/1705602481000/Theme3/default/gc/elements.css

15.161.0.134

https://goldengoose.my.salesforce-sites.com/GGDBchat/sCSS/60.0/sprites/1705602481000/Theme3/default/gc/extended.css

15.161.0.134

https://goldengoose.my.salesforce-sites.com/GGDBchat/jslibrary/jslabels/1713387778000/en_US.js

15.161.0.134

https://goldengoose.my.salesforce-sites.com/GGDBchat/resource/1588174741000/SiteSamples/img/clock.png

15.161.0.134

https://goldengoose.my.salesforce-sites.com/GGDBchat/resource/1588174741000/SiteSamples/img/warning.png

15.161.0.134

https://goldengoose.my.salesforce-sites.com/GGDBchat/static/111213/js/perf/stub.js

15.161.0.134

https://goldengoose.my.salesforce-sites.com/GGDBchat/resource/1588174741000/SiteSamples/img/poweredby.png

15.161.0.134

http://www.mysite.com/myimage.jpg

unknown

https://goldengoose.my.salesforce-sites.com/GGDBchat/

http://www.recaptcha.net

unknown

There are 13 hidden URLs, click here to show them.

Domains

Name

IP

Malicious

ita16.sfdc-3d0u2f.salesforce.com

15.161.0.134

www.google.com

74.125.138.103

goldengoose.my.salesforce-sites.com

unknown

wechatunsuscribe.secure.force.com

unknown

Details

Name:	wechatunsuscribe.secure.force.com
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

IPs

IP

Domain

Country

Malicious

74.125.138.103

www.google.com

United States

239.255.255.250

unknown

Reserved

15.161.0.134

ita16.sfdc-3d0u2f.salesforce.com

United States

192.168.2.17

unknown

unknown

DOM / HTML

URL

Malicious

https://goldengoose.my.salesforce-sites.com/GGDBchat/