IOC Report
https://security.microsoft.com/viewalerts?id=666f3b9d-c5d4-0b2f-5800-08dcfd559561

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 02:38:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 02:38:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 02:38:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 02:38:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 22 02:38:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 100
ASCII text, with very long lines (46591)
dropped
Chrome Cache Entry: 75
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
downloaded
Chrome Cache Entry: 76
HTML document, ASCII text, with very long lines (3450), with CRLF line terminators
downloaded
Chrome Cache Entry: 77
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
dropped
Chrome Cache Entry: 78
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
downloaded
Chrome Cache Entry: 79
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
dropped
Chrome Cache Entry: 80
ASCII text, with very long lines (46591)
downloaded
Chrome Cache Entry: 81
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
downloaded
Chrome Cache Entry: 82
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57443
dropped
Chrome Cache Entry: 83
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
dropped
Chrome Cache Entry: 84
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449972
dropped
Chrome Cache Entry: 85
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449972
downloaded
Chrome Cache Entry: 86
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
downloaded
Chrome Cache Entry: 87
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
downloaded
Chrome Cache Entry: 88
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57443
downloaded
Chrome Cache Entry: 89
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 90
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
dropped
Chrome Cache Entry: 91
GIF image data, version 89a, 352 x 3
dropped
Chrome Cache Entry: 92
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
downloaded
Chrome Cache Entry: 93
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113378
downloaded
Chrome Cache Entry: 94
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
downloaded
Chrome Cache Entry: 95
GIF image data, version 89a, 352 x 3
dropped
Chrome Cache Entry: 96
GIF image data, version 89a, 352 x 3
downloaded
Chrome Cache Entry: 97
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
dropped
Chrome Cache Entry: 98
GIF image data, version 89a, 352 x 3
downloaded
Chrome Cache Entry: 99
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
dropped
There are 23 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2180,i,2201039127049598894,9018802307506963827,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://security.microsoft.com/viewalerts?id=666f3b9d-c5d4-0b2f-5800-08dcfd559561"

URLs

Name
IP
Malicious
https://security.microsoft.com/viewalerts?id=666f3b9d-c5d4-0b2f-5800-08dcfd559561
http://knockoutjs.com/
unknown
https://login.microsoftonline.com
unknown
http://www.opensource.org/licenses/mit-license.php)
unknown
https://github.com/douglascrockford/JSON-js
unknown
https://login.windows-ppe.net
unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js
152.199.21.175

Domains

Name
IP
Malicious
sni1gl.wpc.omegacdn.net
152.199.21.175
www.google.com
142.250.181.100
s-part-0035.t-0009.t-msedge.net
13.107.246.63
identity.nel.measure.office.net
unknown
aadcdn.msftauth.net
unknown
login.microsoftonline.com
unknown

IPs

IP
Domain
Country
Malicious
13.107.246.63
s-part-0035.t-0009.t-msedge.net
United States
192.168.2.5
unknown
unknown
142.250.181.100
www.google.com
United States
239.255.255.250
unknown
Reserved
152.199.21.175
sni1gl.wpc.omegacdn.net
United States

DOM / HTML

URL
Malicious
https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DNbHknVYN_nF6BfetfD-nDleSjQKeGypVCRTlEmCB_wRiphoWp7eASX84weo6QSocZ65k_I_grf3j53ZAU5bCyrPpq28RcYNF_LFUu4Slk5kMWcgqZ51WSNcHoo_pvXS9H-PCJucW7ukC1PlPjEWAspwCKDN-07lSy_WvkBGDo87C5oEZlSXVZ6zCShkrTaKU_WHrYmCXoLtsKuFUM_yuVQ&response_mode=form_post&nonce=638678434972763382.MDljYjVhMzQtM2M0Yi00OWM1LWI3NDYtNGM1N2QwYTRkNzg4ZDc3NDhkNGEtZjk2Ny00MmQxLWJlY2EtZTdhNjI2NmQ0Njgw&client-request-id=6618a561-27d3-493a-86dc-4e856c222826&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET461&x-client-ver=7.4.0.0
https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DNbHknVYN_nF6BfetfD-nDleSjQKeGypVCRTlEmCB_wRiphoWp7eASX84weo6QSocZ65k_I_grf3j53ZAU5bCyrPpq28RcYNF_LFUu4Slk5kMWcgqZ51WSNcHoo_pvXS9H-PCJucW7ukC1PlPjEWAspwCKDN-07lSy_WvkBGDo87C5oEZlSXVZ6zCShkrTaKU_WHrYmCXoLtsKuFUM_yuVQ&response_mode=form_post&nonce=638678434972763382.MDljYjVhMzQtM2M0Yi00OWM1LWI3NDYtNGM1N2QwYTRkNzg4ZDc3NDhkNGEtZjk2Ny00MmQxLWJlY2EtZTdhNjI2NmQ0Njgw&client-request-id=6618a561-27d3-493a-86dc-4e856c222826&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET461&x-client-ver=7.4.0.0&sso_reload=true
https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DNbHknVYN_nF6BfetfD-nDleSjQKeGypVCRTlEmCB_wRiphoWp7eASX84weo6QSocZ65k_I_grf3j53ZAU5bCyrPpq28RcYNF_LFUu4Slk5kMWcgqZ51WSNcHoo_pvXS9H-PCJucW7ukC1PlPjEWAspwCKDN-07lSy_WvkBGDo87C5oEZlSXVZ6zCShkrTaKU_WHrYmCXoLtsKuFUM_yuVQ&response_mode=form_post&nonce=638678434972763382.MDljYjVhMzQtM2M0Yi00OWM1LWI3NDYtNGM1N2QwYTRkNzg4ZDc3NDhkNGEtZjk2Ny00MmQxLWJlY2EtZTdhNjI2NmQ0Njgw&client-request-id=6618a561-27d3-493a-86dc-4e856c222826&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET461&x-client-ver=7.4.0.0&sso_reload=true
https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DNbHknVYN_nF6BfetfD-nDleSjQKeGypVCRTlEmCB_wRiphoWp7eASX84weo6QSocZ65k_I_grf3j53ZAU5bCyrPpq28RcYNF_LFUu4Slk5kMWcgqZ51WSNcHoo_pvXS9H-PCJucW7ukC1PlPjEWAspwCKDN-07lSy_WvkBGDo87C5oEZlSXVZ6zCShkrTaKU_WHrYmCXoLtsKuFUM_yuVQ&response_mode=form_post&nonce=638678434972763382.MDljYjVhMzQtM2M0Yi00OWM1LWI3NDYtNGM1N2QwYTRkNzg4ZDc3NDhkNGEtZjk2Ny00MmQxLWJlY2EtZTdhNjI2NmQ0Njgw&client-request-id=6618a561-27d3-493a-86dc-4e856c222826&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET461&x-client-ver=7.4.0.0&sso_reload=true
https://login.microsoftonline.com/common/oauth2/authorize?client_id=80ccca67-54bd-44ab-8625-4b79c4dc7775&response_type=code%20id_token&scope=openid%20profile&state=OpenIdConnect.AuthenticationProperties%3DNbHknVYN_nF6BfetfD-nDleSjQKeGypVCRTlEmCB_wRiphoWp7eASX84weo6QSocZ65k_I_grf3j53ZAU5bCyrPpq28RcYNF_LFUu4Slk5kMWcgqZ51WSNcHoo_pvXS9H-PCJucW7ukC1PlPjEWAspwCKDN-07lSy_WvkBGDo87C5oEZlSXVZ6zCShkrTaKU_WHrYmCXoLtsKuFUM_yuVQ&response_mode=form_post&nonce=638678434972763382.MDljYjVhMzQtM2M0Yi00OWM1LWI3NDYtNGM1N2QwYTRkNzg4ZDc3NDhkNGEtZjk2Ny00MmQxLWJlY2EtZTdhNjI2NmQ0Njgw&client-request-id=6618a561-27d3-493a-86dc-4e856c222826&redirect_uri=https%3A%2F%2Fsecurity.microsoft.com%2F&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=ID_NET461&x-client-ver=7.4.0.0&sso_reload=true