IOC Report
https://u43957641.ct.sendgrid.net/ls/click?upn=u001.0Q2k6Tkbkoom04JcBCS1bnTFkzW4mU5Ezcfq62d9vtUuGINn2USsIB9YeV8x8Iu5W4FDLy6-2BKqjhTiUn-2FaQ-2BGrq3T-2BGqBAqLUber59up15w-3DVs4O_FXZTG-2Bj8dxNvEuxDJrPqKA8uB9LHQ48OflWnDl8SlkOTiwSdc-2B-2FgPjdAADTWcv8L3HqMFwOmerkXzjwDhJNFd4Lcft0pVsCjftrr0YIbR0wkdFwlzs0ZE-2

Files

File Path

Type

Category

Malicious

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 09:44:49 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 09:44:49 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 09:44:49 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 09:44:49 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 24 09:44:49 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Chrome Cache Entry: 100

PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced

downloaded

Chrome Cache Entry: 101

HTML document, ASCII text, with very long lines (1048)

dropped

Chrome Cache Entry: 73

ASCII text, with very long lines (32030)

downloaded

Chrome Cache Entry: 74

HTML document, ASCII text, with CRLF line terminators

downloaded

Chrome Cache Entry: 75

JSON data

dropped

Chrome Cache Entry: 76

PNG image data, 29 x 56, 8-bit/color RGB, non-interlaced

downloaded

Chrome Cache Entry: 77

HTML document, ASCII text, with very long lines (1048)

dropped

Chrome Cache Entry: 78

troff or preprocessor input, ASCII text, with very long lines (372)

downloaded

Chrome Cache Entry: 79

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 2905

downloaded

Chrome Cache Entry: 80

HTML document, ASCII text, with very long lines (611)

downloaded

Chrome Cache Entry: 81

JSON data

downloaded

Chrome Cache Entry: 82

ASCII text, with CRLF line terminators

downloaded

Chrome Cache Entry: 83

ASCII text, with very long lines (47992), with no line terminators

downloaded

Chrome Cache Entry: 84

HTML document, ASCII text, with very long lines (611)

downloaded

Chrome Cache Entry: 85

HTML document, ASCII text

downloaded

Chrome Cache Entry: 86

PNG image data, 29 x 56, 8-bit/color RGB, non-interlaced

dropped

Chrome Cache Entry: 87

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250

downloaded

Chrome Cache Entry: 88

PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced

dropped

Chrome Cache Entry: 89

HTML document, ASCII text, with very long lines (1048)

downloaded

Chrome Cache Entry: 90

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250

dropped

Chrome Cache Entry: 91

PNG image data, 369 x 136, 8-bit colormap, non-interlaced

dropped

Chrome Cache Entry: 92

HTML document, ASCII text, with very long lines (1874), with no line terminators

downloaded

Chrome Cache Entry: 93

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 2905

dropped

Chrome Cache Entry: 94

HTML document, ASCII text, with CRLF line terminators

downloaded

Chrome Cache Entry: 95

PNG image data, 369 x 136, 8-bit colormap, non-interlaced

downloaded

Chrome Cache Entry: 96

ASCII text, with very long lines (65461)

downloaded

Chrome Cache Entry: 97

ASCII text, with very long lines (42414)

downloaded

Chrome Cache Entry: 98

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390

downloaded

Chrome Cache Entry: 99

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390

dropped

There are 26 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://u43957641.ct.sendgrid.net/ls/click?upn=u001.0Q2k6Tkbkoom04JcBCS1bnTFkzW4mU5Ezcfq62d9vtUuGINn2USsIB9YeV8x8Iu5W4FDLy6-2BKqjhTiUn-2FaQ-2BGrq3T-2BGqBAqLUber59up15w-3DVs4O_FXZTG-2Bj8dxNvEuxDJrPqKA8uB9LHQ48OflWnDl8SlkOTiwSdc-2B-2FgPjdAADTWcv8L3HqMFwOmerkXzjwDhJNFd4Lcft0pVsCjftrr0YIbR0wkdFwlzs0ZE-2BrvH4L4d9bI0UMEtu3I1uFXu2qk2Z9Vv-2BQYvTg83dp-2BaElfQAIu9sqQ8XL3xmmPpa4O2GrYCGQ5LVUy-2Feb-2F2iTllWjhAfn3PA-3D-3D

Details

Is windows:	true
Is dropped:	false
PID:	6992
Target ID:	0
Parent PID:	5636
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://u43957641.ct.sendgrid.net/ls/click?upn=u001.0Q2k6Tkbkoom04JcBCS1bnTFkzW4mU5Ezcfq62d9vtUuGINn2USsIB9YeV8x8Iu5W4FDLy6-2BKqjhTiUn-2FaQ-2BGrq3T-2BGqBAqLUber59up15w-3DVs4O_FXZTG-2Bj8dxNvEuxDJrPqKA8uB9LHQ48OflWnDl8SlkOTiwSdc-2B-2FgPjdAADTWcv8L3HqMFwOmerkXzjwDhJNFd4Lcft0pVsCjftrr0YIbR0wkdFwlzs0ZE-2BrvH4L4d9bI0UMEtu3I1uFXu2qk2Z9Vv-2BQYvTg83dp-2BaElfQAIu9sqQ8XL3xmmPpa4O2GrYCGQ5LVUy-2Feb-2F2iTllWjhAfn3PA-3D-3D
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	12:44:46
Date:	24/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7f9810000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1912,i,2639048073560229861,14537857960741706661,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	3992
Target ID:	1
Parent PID:	6992
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1912,i,2639048073560229861,14537857960741706661,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	12:44:46
Date:	24/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7f9810000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

IP

Malicious

https://u43957641.ct.sendgrid.net/ls/click?upn=u001.0Q2k6Tkbkoom04JcBCS1bnTFkzW4mU5Ezcfq62d9vtUuGINn2USsIB9YeV8x8Iu5W4FDLy6-2BKqjhTiUn-2FaQ-2BGrq3T-2BGqBAqLUber59up15w-3DVs4O_FXZTG-2Bj8dxNvEuxDJrPqKA8uB9LHQ48OflWnDl8SlkOTiwSdc-2B-2FgPjdAADTWcv8L3HqMFwOmerkXzjwDhJNFd4Lcft0pVsCjftrr0YIbR0wkdFwlzs0ZE-2BrvH4L4d9bI0UMEtu3I1uFXu2qk2Z9Vv-2BQYvTg83dp-2BaElfQAIu9sqQ8XL3xmmPpa4O2GrYCGQ5LVUy-2Feb-2F2iTllWjhAfn3PA-3D-3D

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8795807b4f0b0ad1/1713955508441/HYn2F_Kk2vwS55c

104.17.3.184

http://fontawesome.io

unknown

https://pub-ef73f69a5c714c16850b378a34168a6c.r2.dev/g.html

https://u43957641.ct.sendgrid.net/ls/click?upn=u001.0Q2k6Tkbkoom04JcBCS1bnTFkzW4mU5Ezcfq62d9vtUuGINn2USsIB9YeV8x8Iu5W4FDLy6-2BKqjhTiUn-2FaQ-2BGrq3T-2BGqBAqLUber59up15w-3DVs4O_FXZTG-2Bj8dxNvEuxDJrPqKA8uB9LHQ48OflWnDl8SlkOTiwSdc-2B-2FgPjdAADTWcv8L3HqMFwOmerkXzjwDhJNFd4Lcft0pVsCjftrr0YIbR0wkdFwlzs0ZE-2BrvH4L4d9bI0UMEtu3I1uFXu2qk2Z9Vv-2BQYvTg83dp-2BaElfQAIu9sqQ8XL3xmmPpa4O2GrYCGQ5LVUy-2Feb-2F2iTllWjhAfn3PA-3D-3D

167.89.115.147

https://assets-gbr.mkt.dynamics.com/173157d6-68fd-ee11-9049-0022481aa1a4/digitalassets/standalonefor

unknown

https://public-gbr.mkt.dynamics.com/api/v1.0/orgs/173157d6-68fd-ee11-9049-0022481aa1a4/landingpageforms/forms/b5f42550-0a01-ef11-9f89-6045bdf224a6

20.90.131.0

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css

104.17.24.14

https://public-gbr.mkt.dynamics.com/api/v1.0/orgs/173157d6-68fd-ee11-9049-0022481aa1a4/landingpageforms/forms/b5f42550-0a01-ef11-9f89-6045bdf224a6/visits

20.90.131.0

https://public-gbr.mkt.dynamics.com/api/v1.0/orgs/173157d6-68fd-ee11-9049-0022481aa1a4/landingpagefo

unknown

https://challenges.cloudflare.com/turnstile/v0/b/471dc2adc340/api.js?onload=onloadTurnstileCallback

104.17.2.184

https://code.jquery.com/jquery-3.1.1.min.js

151.101.2.137

https://parokia-mtsimonstock.or.tz/wp/musfg/admin/js/sc.php?r=Iw==

192.185.164.49

https://assets-gbr.mkt.dynamics.com/173157d6-68fd-ee11-9049-0022481aa1a4/digitalassets/images/c7275f

unknown

https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback

104.17.2.184

https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw

142.250.141.106

https://assets-gbr.mkt.dynamics.com/173157d6-68fd-ee11-9049-0022481aa1a4/digitalassets/images/c7275fca-85fe-ee11-a1fe-6045bdf224a6?ts=638491529109248159

13.107.246.69

http://fontawesome.io/license

unknown

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8795807b4f0b0ad1

104.17.3.184

https://parokia-mtsimonstock.or.tz/wp/musfg/de67687.php

192.185.164.49

https://assets-gbr.mkt.dynamics.com/173157d6-68fd-ee11-9049-0022481aa1a4/digitalassets/standaloneforms/b5f42550-0a01-ef11-9f89-6045bdf224a6

https://pub-ef73f69a5c714c16850b378a34168a6c.r2.dev/favicon.ico

104.18.2.35

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D

104.17.3.184

https://assets-gbr.mkt.dynamics.com/173157d6-68fd-ee11-9049-0022481aa1a4/digitalassets/forms/b5f42550-0a01-ef11-9f89-6045bdf224a6

13.107.246.69

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/445651145:1713953640:go-S-wt3yiBXQIEgthywWp1dKiDuhBLiOfq_N5jIeK4/8795807b4f0b0ad1/ab0b7803abd47a9

104.17.3.184

https://www.cloudflare.com/favicon.ico

unknown

https://pub-cdefd7cb5c8b410d9801ebe4ba3a8918.r2.dev/favicon.ico

104.18.3.35

https://developers.cloudflare.com/r2/data-access/public-buckets/

unknown

https://assets-gbr.mkt.dynamics.com/173157d6-68fd-ee11-9049-0022481aa1a4/digitalassets/forms/b5f4255

unknown

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/8795807b4f0b0ad1/1713955508444/3e59dd0cb308041e0b62bfa72842bb1c6c2ccf2ce6f307b9c76c007bbe6bce05/-lb7zYH8PMbp9b-

104.17.3.184

https://assets-gbr.mkt.dynamics.com/favicon.ico

13.107.246.69

https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js

104.17.24.14

There are 21 hidden URLs, click here to show them.

Domains

Name

IP

Malicious

code.jquery.com

151.101.2.137

part-0041.t-0009.t-msedge.net

13.107.246.69

cdnjs.cloudflare.com

104.17.24.14

prdia888suk0aks.mkt.dynamics.com

20.90.131.0

challenges.cloudflare.com

104.17.2.184

www.google.com

142.250.141.106

u43957641.ct.sendgrid.net

167.89.115.147

pub-cdefd7cb5c8b410d9801ebe4ba3a8918.r2.dev

104.18.3.35

parokia-mtsimonstock.or.tz

192.185.164.49

pub-ef73f69a5c714c16850b378a34168a6c.r2.dev

104.18.2.35

assets-gbr.mkt.dynamics.com

unknown

public-gbr.mkt.dynamics.com

unknown

There are 2 hidden domains, click here to show them.

IPs

IP

Domain

Country

Malicious

104.17.24.14

cdnjs.cloudflare.com

United States

104.18.3.35

pub-cdefd7cb5c8b410d9801ebe4ba3a8918.r2.dev

United States

104.18.2.35

pub-ef73f69a5c714c16850b378a34168a6c.r2.dev

United States

13.107.246.69

part-0041.t-0009.t-msedge.net

United States

167.89.115.147

u43957641.ct.sendgrid.net

United States

192.168.2.16

unknown

unknown

104.17.3.184

unknown

United States

13.107.213.69

unknown

United States

151.101.2.137

code.jquery.com

United States

239.255.255.250

unknown

Reserved

192.185.164.49

parokia-mtsimonstock.or.tz

United States

142.250.141.106

www.google.com

United States

20.90.131.0

prdia888suk0aks.mkt.dynamics.com

United States

104.17.2.184

challenges.cloudflare.com

United States

There are 4 hidden IPs, click here to show them.

DOM / HTML

URL

Malicious

https://pub-cdefd7cb5c8b410d9801ebe4ba3a8918.r2.dev/docuexpressignaturerequested.html

https://pub-ef73f69a5c714c16850b378a34168a6c.r2.dev/g.html

https://assets-gbr.mkt.dynamics.com/173157d6-68fd-ee11-9049-0022481aa1a4/digitalassets/standaloneforms/b5f42550-0a01-ef11-9f89-6045bdf224a6

https://assets-gbr.mkt.dynamics.com/173157d6-68fd-ee11-9049-0022481aa1a4/digitalassets/standaloneforms/b5f42550-0a01-ef11-9f89-6045bdf224a6

https://pub-cdefd7cb5c8b410d9801ebe4ba3a8918.r2.dev/docuexpressignaturerequested.html

https://pub-cdefd7cb5c8b410d9801ebe4ba3a8918.r2.dev/docuexpressignaturerequested.html

https://pub-cdefd7cb5c8b410d9801ebe4ba3a8918.r2.dev/docuexpressignaturerequested.html

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/aa5u0/0x4AAAAAAAXpDkyFjKTy9u3O/auto/normal

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/aa5u0/0x4AAAAAAAXpDkyFjKTy9u3O/auto/normal

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/aa5u0/0x4AAAAAAAXpDkyFjKTy9u3O/auto/normal