Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

C:\Users\user\Downloads\643a1987-55d3-4d58-8660-d86b6f576bed.tmp

RAR archive data, v5

dropped

Details

File:	C:\Users\user\Downloads\643a1987-55d3-4d58-8660-d86b6f576bed.tmp
Category:	dropped
Dump:	643a1987-55d3-4d58-8660-d86b6f576bed.tmp.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	RAR archive data, v5
Entropy:	7.953221262357658
Encrypted:	false
Ssdeep:	96:2Fnhs9c5Ix051a55epamHc1EfvL2d+BDSK38VGELy7:whucex0i5QpDvL2sBDb3GGL7
Size:	4208
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the user directory	System Summary	Masquerading

C:\Users\user\Downloads\Mandatory Notice for all December Leave and Vacation application (1).xls.z (copy)

RAR archive data, v5

dropped

Details

File:	C:\Users\user\Downloads\Mandatory Notice for all December Leave and Vacation application (1).xls.z (copy)
Category:	dropped
Dump:	Mandatory Notice for all December Leave and Vacation application (1).xls.z.crdownload.0.dr
ID:	dr_5
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	RAR archive data, v5
Entropy:	7.9996198739596895
Encrypted:	true
Ssdeep:	12288:bFaJBYCt5V6QbqCiYlsVxZoD7hCqRDMI9Vnc4HshMvUWvXF6R+Phccbi0wbBShO:bAYYBb8YKx6Cq1MkSNyJXVbQS4
Size:	700728
Whitelisted:	false
Reputation:	low

C:\Users\user\Downloads\Mandatory Notice for all December Leave and Vacation application (1).xls.z.crdownload

RAR archive data, v5

dropped

Details

File:	C:\Users\user\Downloads\Mandatory Notice for all December Leave and Vacation application (1).xls.z.crdownload
Category:	dropped
Dump:	Mandatory Notice for all December Leave and Vacation application (1).xls.z.crdownload.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	RAR archive data, v5
Entropy:	7.9996198739596895
Encrypted:	true
Ssdeep:	12288:bFaJBYCt5V6QbqCiYlsVxZoD7hCqRDMI9Vnc4HshMvUWvXF6R+Phccbi0wbBShO:bAYYBb8YKx6Cq1MkSNyJXVbQS4
Size:	700728
Whitelisted:	false
Reputation:	low

C:\Users\user\Downloads\Mandatory Notice for all December Leave and Vacation application.xls.z (copy)

RAR archive data, v5

dropped

Details

File:	C:\Users\user\Downloads\Mandatory Notice for all December Leave and Vacation application.xls.z (copy)
Category:	dropped
Dump:	Mandatory Notice for all December Leave and Vacation application.xls.z.crdownload.0.dr
ID:	dr_4
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	RAR archive data, v5
Entropy:	7.9996198739596895
Encrypted:	true
Ssdeep:	12288:bFaJBYCt5V6QbqCiYlsVxZoD7hCqRDMI9Vnc4HshMvUWvXF6R+Phccbi0wbBShO:bAYYBb8YKx6Cq1MkSNyJXVbQS4
Size:	700728
Whitelisted:	false
Reputation:	low

C:\Users\user\Downloads\Mandatory Notice for all December Leave and Vacation application.xls.z.crdownload

RAR archive data, v5

dropped

Details

File:	C:\Users\user\Downloads\Mandatory Notice for all December Leave and Vacation application.xls.z.crdownload
Category:	dropped
Dump:	Mandatory Notice for all December Leave and Vacation application.xls.z.crdownload.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	RAR archive data, v5
Entropy:	7.9996198739596895
Encrypted:	true
Ssdeep:	12288:bFaJBYCt5V6QbqCiYlsVxZoD7hCqRDMI9Vnc4HshMvUWvXF6R+Phccbi0wbBShO:bAYYBb8YKx6Cq1MkSNyJXVbQS4
Size:	700728
Whitelisted:	false
Reputation:	low

C:\Users\user\Downloads\bc926371-fb61-4026-ac03-5bdb9c957e0a.tmp

RAR archive data, v5

dropped

Details

File:	C:\Users\user\Downloads\bc926371-fb61-4026-ac03-5bdb9c957e0a.tmp
Category:	dropped
Dump:	bc926371-fb61-4026-ac03-5bdb9c957e0a.tmp.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	RAR archive data, v5
Entropy:	7.996574483273115
Encrypted:	true
Ssdeep:	1536:TgeghYgyeETaLnpeDZh/HlkqI3vtyuSUsrLTcmYkeKikS7:XAYgyuLgFh/HaqI7SfrokS7
Size:	65536
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	5440
Target ID:	0
Parent PID:	600
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	08:30:35
Date:	21/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=2168,i,1335209173485336982,5855269918199286586,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	1908
Target ID:	2
Parent PID:	5440
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=2168,i,1335209173485336982,5855269918199286586,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	08:30:40
Date:	21/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://url.za.m.mimecastprotect.com/s/NlWWCnZJJxhp2O85HZsWHJcGBn?domain=u48186210.ct.sendgrid.net."

Details

Is windows:	true
Is dropped:	false
PID:	6360
Target ID:	3
Parent PID:	600
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://url.za.m.mimecastprotect.com/s/NlWWCnZJJxhp2O85HZsWHJcGBn?domain=u48186210.ct.sendgrid.net."
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	08:30:42
Date:	21/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://url.za.m.mimecastprotect.com/s/NlWWCnZJJxhp2O85HZsWHJcGBn?domain=u48186210.ct.sendgrid.net.

https://security-za.m.mimecastprotect.com/ttpwp/resources/languages/en.json

41.74.192.87

https://cdn.discordapp.com/attachments/1309071256703991839/1309114652906491935/Mandatory_Notice_for_all_December_Leave_and_Vacation_application.xls.z?ex=67406787&is=673f1607&hm=7cc1154f0d5655485232483d18f50467f8f6693e8153e451db4924feef63cd2f&

162.159.135.233

https://security-za.m.mimecastprotect.com/ttpwp/resources/images/favicon.ico

41.74.192.87

https://security-za.m.mimecastprotect.com/ttpwp

41.74.192.87

https://security-za.m.mimecastprotect.com/ttpwp/resources/mimecast-icons.bb1a2cd16db9345fc437.woff2?25417273

41.74.192.87

https://security-za.m.mimecastprotect.com/ttpwp/resources/polyfills.5257ca6e429949972959.js

41.74.192.87

https://security-za.m.mimecastprotect.com/ttpwp/resources/fa-solid-900.54dfc8f551be346014e4.woff2

41.74.192.87

https://security-za.m.mimecastprotect.com/ttpwp/resources/images/mimecast-logo.png

41.74.192.87

https://security-za.m.mimecastprotect.com/ttpwp/#/warn?key=iYdOYhcvEkJvUfK4yzEM9De1GfmHAN4wVuzBJ69YZiEiWV9jbiuYp1ZjRWFgT6TeWNDU0F0xCIi-moTToqioFKe4tfzO0FCg9o5OxrqUUZUEVx0gU6CZyVRitWXYTJx7

https://security-za.m.mimecastprotect.com/ttpwp/resources/main.5257ca6e429949972959.js

41.74.192.87

https://security-za.m.mimecastprotect.com/ttpwp/resources/styles.5257ca6e429949972959.js

41.74.192.87

https://security-za.m.mimecastprotect.com/ttpwp/resources/runtime.5257ca6e429949972959.js

41.74.192.87

https://security-za.m.mimecastprotect.com/api/ttp/url/get-page-data

41.74.192.87

https://url.za.m.mimecastprotect.com/s/NlWWCnZJJxhp2O85HZsWHJcGBn?domain=u48186210.ct.sendgrid.net.

41.74.196.103

There are 4 hidden URLs, click here to show them.

Domains

Name

Malicious

cdn.discordapp.com

162.159.135.233

Details

Name:	cdn.discordapp.com
IP:	162.159.135.233
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Detected suspicious crossdomain redirect	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

www.google.com

172.217.16.132

Details

Name:	www.google.com
IP:	172.217.16.132
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

security-za.m.mimecastprotect.com

41.74.192.87

Details

Name:	security-za.m.mimecastprotect.com
IP:	41.74.192.87
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol

url.za.m.mimecastprotect.com

41.74.196.103

Details

Name:	url.za.m.mimecastprotect.com
IP:	41.74.196.103
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

u48186210.ct.sendgrid.net

unknown

Details

Name:	u48186210.ct.sendgrid.net
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Detected suspicious crossdomain redirect	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

IPs

Domain

Country

Malicious

167.89.123.122

unknown

United States

Details

IP:	167.89.123.122
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Country:	United States
Countrycode:	USA
ASN number:	11377
ASN name:	SENDGRIDUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

41.74.196.103

url.za.m.mimecastprotect.com

South Africa

192.168.2.4

unknown

162.159.135.233

cdn.discordapp.com

United States

192.168.2.5

unknown

239.255.255.250

unknown

Reserved

41.74.192.87

security-za.m.mimecastprotect.com

South Africa

172.217.16.132

www.google.com

United States

DOM / HTML

URL

Malicious

https://security-za.m.mimecastprotect.com/ttpwp/#/warn?key=iYdOYhcvEkJvUfK4yzEM9De1GfmHAN4wVuzBJ69YZiEiWV9jbiuYp1ZjRWFgT6TeWNDU0F0xCIi-moTToqioFKe4tfzO0FCg9o5OxrqUUZUEVx0gU6CZyVRitWXYTJx7

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://url.za.m.mimecastprotect.com/s/NlWWCnZJJxhp2O85HZsWHJcGBn?domain=u48186210.ct.sendgrid.net.

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://url.za.m.mimecastprotect.com/s/NlWWCnZJJxhp2O85HZsWHJcGBn?domain=u48186210.ct.sendgrid.net.

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
https://url.za.m.mimecastprotect.com/s/NlWWCnZJJxhp2O85HZsWHJcGBn?domain=u48186210.ct.sendgrid.net.