IOC Report
http://replicon.coverys.co.uk

Files

File Path

Type

Category

Malicious

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 8 14:49:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 8 14:49:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 8 14:49:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 8 14:49:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 8 14:49:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Chrome Cache Entry: 73

HTML document, ASCII text, with very long lines (2345), with CRLF line terminators

downloaded

Chrome Cache Entry: 74

GIF image data, version 89a, 352 x 3

dropped

Chrome Cache Entry: 75

GIF image data, version 89a, 352 x 3

downloaded

Chrome Cache Entry: 76

PNG image data, 280 x 58, 8-bit colormap, non-interlaced

dropped

Chrome Cache Entry: 77

SVG Scalable Vector Graphics image

downloaded

Chrome Cache Entry: 78

HTML document, ASCII text, with CRLF line terminators

downloaded

Chrome Cache Entry: 79

GIF image data, version 89a, 352 x 3

dropped

Chrome Cache Entry: 80

ASCII text, with very long lines (43896)

downloaded

Chrome Cache Entry: 81

ASCII text, with very long lines (45529)

downloaded

Chrome Cache Entry: 82

MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors

downloaded

Chrome Cache Entry: 83

GIF image data, version 89a, 352 x 3

downloaded

Chrome Cache Entry: 84

SVG Scalable Vector Graphics image

dropped

Chrome Cache Entry: 85

ASCII text, with very long lines (61177)

downloaded

Chrome Cache Entry: 86

ASCII text, with very long lines (14735)

downloaded

Chrome Cache Entry: 87

ASCII text, with no line terminators

downloaded

Chrome Cache Entry: 88

Unicode text, UTF-8 text, with very long lines (32097)

downloaded

Chrome Cache Entry: 89

HTML document, ASCII text, with very long lines (5418), with no line terminators

downloaded

Chrome Cache Entry: 90

ASCII text, with very long lines (64616)

downloaded

Chrome Cache Entry: 91

ASCII text, with very long lines (64612)

downloaded

Chrome Cache Entry: 92

MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors

dropped

Chrome Cache Entry: 93

JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=1080, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=1920], baseline, precision 8, 1920x1080, components 3

dropped

Chrome Cache Entry: 94

JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=1080, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=1920], baseline, precision 8, 1920x1080, components 3

downloaded

Chrome Cache Entry: 95

PNG image data, 280 x 58, 8-bit colormap, non-interlaced

downloaded

There are 20 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	5500
Target ID:	0
Parent PID:	5700
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	17:49:38
Date:	08/05/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Allocates a big amount of memory (probably used for heap spraying)	Software Vulnerabilities	Extra Window Memory Injection
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=2012,i,17688312714450364625,6802732224170712627,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	6004
Target ID:	2
Parent PID:	5500
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=2012,i,17688312714450364625,6802732224170712627,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	17:49:41
Date:	08/05/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Allocates a big amount of memory (probably used for heap spraying)	Software Vulnerabilities	Extra Window Memory Injection
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://replicon.coverys.co.uk"

Details

Is windows:	true
Is dropped:	false
PID:	2364
Target ID:	3
Parent PID:	5700
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://replicon.coverys.co.uk"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	17:49:43
Date:	08/05/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Allocates a big amount of memory (probably used for heap spraying)	Software Vulnerabilities	Extra Window Memory Injection
Spawns processes	System Summary	Process Injection

URLs

Name

IP

Malicious

http://replicon.coverys.co.uk

https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_il6fx5t9s506cdxfu3ywpg2.js

152.199.4.44

https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_IDwaQXicOTFiRVOQGoK9bQ2.js

152.199.4.44

https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2?sso_reload=true

https://aadcdn.msftauthimages.net/c1c6b6c8-9kzmimeijs0-isqbikftbily5afjgythgtjx7dz9tzo/logintenantbranding/0/bannerlogo?ts=637217897975221135

13.107.213.70

https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_Ggyc2EJnCaHFrI6xkBPLcg2.js

152.199.4.44

https://global.replicon.com/favicon.ico

104.16.240.248

https://global.replicon.com/!/saml2/Cmal/sp-sso/post

https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css

152.199.4.44

https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js

152.199.4.44

http://knockoutjs.com/

unknown

https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2

https://github.com/douglascrockford/JSON-js

unknown

https://login.windows-ppe.net

unknown

http://replicon.coverys.co.uk/

15.197.142.173

https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js

152.199.4.44

https://login.microsoftonline.com

unknown

http://www.opensource.org/licenses/mit-license.php)

unknown

https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif

152.199.4.44

https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif

152.199.4.44

https://aadcdn.msftauthimages.net/c1c6b6c8-9kzmimeijs0-isqbikftbily5afjgythgtjx7dz9tzo/logintenantbranding/0/illustration?ts=637215083190613316

13.107.213.70

https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_7c1aa7609345f99e4914.js

152.199.4.44

https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico

152.199.4.44

https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg

152.199.4.44

http://feross.org

unknown

https://autologon.microsoftazuread-sso.com/6ef02721-9d08-4e5a-b493-ca348312dd39/winauth/ssoprobe?client-request-id=c39cabc7-d05b-44f2-80cb-1ea2f657286a&_=1715183396054

20.190.151.70

There are 15 hidden URLs, click here to show them.

Domains

Name

IP

Malicious

bg.microsoft.map.fastly.net

199.232.210.172

cs1100.wpc.omegacdn.net

152.199.4.44

replicon.coverys.co.uk

15.197.142.173

global.replicon.com

104.16.240.248

www.google.com

142.251.215.228

part-0042.t-0009.t-msedge.net

13.107.213.70

fp2e7a.wpc.phicdn.net

192.229.211.108

autologon.microsoftazuread-sso.com

20.190.151.70

identity.nel.measure.office.net

unknown

aadcdn.msftauth.net

unknown

login.microsoftonline.com

unknown

aadcdn.msftauthimages.net

unknown

There are 2 hidden domains, click here to show them.

IPs

IP

Domain

Country

Malicious

15.197.142.173

replicon.coverys.co.uk

United States

152.199.4.44

cs1100.wpc.omegacdn.net

United States

13.107.246.70

unknown

United States

192.168.2.5

unknown

unknown

20.190.151.70

autologon.microsoftazuread-sso.com

United States

104.16.240.248

global.replicon.com

United States

142.251.215.228

www.google.com

United States

239.255.255.250

unknown

Reserved

13.107.213.70

part-0042.t-0009.t-msedge.net

United States

DOM / HTML

URL

Malicious

https://global.replicon.com/!/saml2/Cmal/sp-sso/post

https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2

https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2?sso_reload=true

https://login.microsoftonline.com/6ef02721-9d08-4e5a-b493-ca348312dd39/saml2?sso_reload=true