IOC Report
https://gerflorgroup.sharepoint.com/:f:/r/sites/InternationalFinanceSeminar-June2024/Shared%20Documents/General?csf=1&web=1&e=2fBDL5

loading gif

Files

File Path
Type
Category
Malicious
Chrome Cache Entry: 120
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 850x566, components 3
dropped
Chrome Cache Entry: 121
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
downloaded
Chrome Cache Entry: 122
HTML document, ASCII text, with very long lines (3437), with CRLF line terminators
downloaded
Chrome Cache Entry: 123
JSON data
dropped
Chrome Cache Entry: 124
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
downloaded
Chrome Cache Entry: 125
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1, orientation=upper-left], baseline, precision 8, 184x60, components 3
dropped
Chrome Cache Entry: 126
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113355
downloaded
Chrome Cache Entry: 127
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 128
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15755
downloaded
Chrome Cache Entry: 129
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
dropped
Chrome Cache Entry: 130
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 448825
downloaded
Chrome Cache Entry: 131
GIF image data, version 89a, 352 x 3
dropped
Chrome Cache Entry: 132
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
downloaded
Chrome Cache Entry: 133
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
downloaded
Chrome Cache Entry: 134
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 850x566, components 3
downloaded
Chrome Cache Entry: 135
GIF image data, version 89a, 352 x 3
dropped
Chrome Cache Entry: 136
JSON data
dropped
Chrome Cache Entry: 137
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
downloaded
Chrome Cache Entry: 138
GIF image data, version 89a, 352 x 3
downloaded
Chrome Cache Entry: 139
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1, orientation=upper-left], baseline, precision 8, 184x60, components 3
downloaded
Chrome Cache Entry: 140
GIF image data, version 89a, 352 x 3
downloaded
Chrome Cache Entry: 141
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
dropped
Chrome Cache Entry: 142
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 55504
downloaded
Chrome Cache Entry: 143
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141492
downloaded
There are 15 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2296,i,16793354073530369212,4038901630383471587,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://gerflorgroup.sharepoint.com/:f:/r/sites/InternationalFinanceSeminar-June2024/Shared%20Documents/General?csf=1&web=1&e=2fBDL5"

URLs

Name
IP
Malicious
https://gerflorgroup.sharepoint.com/:f:/r/sites/InternationalFinanceSeminar-June2024/Shared%20Documents/General?csf=1&web=1&e=2fBDL5
https://aadcdn.msauthimages.net/c1c6b6c8-0vkpu4mfgzituy8c7k7w3nv-1ai9iyalimupep6rc6i/logintenantbranding/0/illustration?ts=637486276470461863
152.199.21.175
https://login.microsoftonline.com
unknown
https://gerflorgroup.sharepoint.com/:f:/r/sites/InternationalFinanceSeminar-June2024/Shared%20Documents/General?csf=1&web=1&e=2fBDL5
13.107.136.10
https://login.microsoftonline.com/5638371b-5458-4435-9168-bf28558d5370/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=89A415978CA67BC4C207C162A5652D886813F16C0BA377BE%2D83FA823685898D87B2E594CB2A280779C93357D0093D93305029EA0200C68CA7&redirect%5Furi=https%3A%2F%2Fgerflorgroup%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=8bb838a1%2D402c%2D9000%2D3b57%2Df687b267f4cd&sso_reload=true
https://login.windows-ppe.net
unknown
https://gerflorgroup.sharepoint.com/sites/InternationalFinanceSeminar-June2024/_layouts/15/Authenticate.aspx?Source=%2Fsites%2FInternationalFinanceSeminar%2DJune2024%2FShared%20Documents%2FGeneral%3Fcsf%3D1%26web%3D1%26e%3D2fBDL5%26CID%3D3fe29633%2D5e6a%2D408a%2D829e%2D9afd7241a358
13.107.136.10
https://gerflorgroup.sharepoint.com/sites/InternationalFinanceSeminar-June2024/Shared%20Documents/General?csf=1&web=1&e=2fBDL5&CID=3fe29633-5e6a-408a-829e-9afd7241a358
13.107.136.10
https://login.microsoftonline.com/5638371b-5458-4435-9168-bf28558d5370/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=89A415978CA67BC4C207C162A5652D886813F16C0BA377BE%2D83FA823685898D87B2E594CB2A280779C93357D0093D93305029EA0200C68CA7&redirect%5Furi=https%3A%2F%2Fgerflorgroup%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=8bb838a1%2D402c%2D9000%2D3b57%2Df687b267f4cd
https://gerflorgroup.sharepoint.com/_forms/default.aspx?ReturnUrl=%2fsites%2fInternationalFinanceSeminar-June2024%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fsites%252FInternationalFinanceSeminar%252DJune2024%252FShared%2520Documents%252FGeneral%253Fcsf%253D1%2526web%253D1%2526e%253D2fBDL5%2526CID%253D3fe29633%252D5e6a%252D408a%252D829e%252D9afd7241a358&Source=cookie
13.107.136.10
https://aadcdn.msauthimages.net/c1c6b6c8-0vkpu4mfgzituy8c7k7w3nv-1ai9iyalimupep6rc6i/logintenantbranding/0/bannerlogo?ts=638243219943629081
152.199.21.175

Domains

Name
IP
Malicious
bg.microsoft.map.fastly.net
199.232.210.172
dual-spo-0005.spo-msedge.net
13.107.136.10
sni1gl.wpc.upsiloncdn.net
152.199.21.175
sni1gl.wpc.omegacdn.net
152.199.21.175
www.google.com
142.250.185.68
s-part-0032.t-0009.t-msedge.net
13.107.246.60
fp2e7a.wpc.phicdn.net
192.229.221.95
autologon.microsoftazuread-sso.com
40.126.32.140
aadcdn.msauthimages.net
unknown
identity.nel.measure.office.net
unknown
aadcdn.msftauth.net
unknown
login.microsoftonline.com
unknown
gerflorgroup.sharepoint.com
unknown
There are 3 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
142.250.185.68
www.google.com
United States
13.107.136.10
dual-spo-0005.spo-msedge.net
United States
192.168.2.9
unknown
unknown
192.168.2.4
unknown
unknown
13.107.246.60
s-part-0032.t-0009.t-msedge.net
United States
239.255.255.250
unknown
Reserved
152.199.21.175
sni1gl.wpc.upsiloncdn.net
United States

DOM / HTML

URL
Malicious
https://login.microsoftonline.com/5638371b-5458-4435-9168-bf28558d5370/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=89A415978CA67BC4C207C162A5652D886813F16C0BA377BE%2D83FA823685898D87B2E594CB2A280779C93357D0093D93305029EA0200C68CA7&redirect%5Furi=https%3A%2F%2Fgerflorgroup%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=8bb838a1%2D402c%2D9000%2D3b57%2Df687b267f4cd
https://login.microsoftonline.com/5638371b-5458-4435-9168-bf28558d5370/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=89A415978CA67BC4C207C162A5652D886813F16C0BA377BE%2D83FA823685898D87B2E594CB2A280779C93357D0093D93305029EA0200C68CA7&redirect%5Furi=https%3A%2F%2Fgerflorgroup%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=8bb838a1%2D402c%2D9000%2D3b57%2Df687b267f4cd&sso_reload=true
https://login.microsoftonline.com/5638371b-5458-4435-9168-bf28558d5370/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=89A415978CA67BC4C207C162A5652D886813F16C0BA377BE%2D83FA823685898D87B2E594CB2A280779C93357D0093D93305029EA0200C68CA7&redirect%5Furi=https%3A%2F%2Fgerflorgroup%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=8bb838a1%2D402c%2D9000%2D3b57%2Df687b267f4cd&sso_reload=true
https://login.microsoftonline.com/5638371b-5458-4435-9168-bf28558d5370/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=89A415978CA67BC4C207C162A5652D886813F16C0BA377BE%2D83FA823685898D87B2E594CB2A280779C93357D0093D93305029EA0200C68CA7&redirect%5Furi=https%3A%2F%2Fgerflorgroup%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=8bb838a1%2D402c%2D9000%2D3b57%2Df687b267f4cd&sso_reload=true