IOC Report
https://clienti.documentipostali.it/#/public/email/a703266c-62aa-4024-8f0c-254725c31c25-DD0015830773-D0002973415

Files

File Path

Type

Category

Malicious

C:\Users\user\Downloads\P00002.pdf (copy)

PDF document, version 1.4, 1 pages

dropped

C:\Users\user\Downloads\P00002.pdf.crdownload (copy)

PDF document, version 1.4, 1 pages

dropped

C:\Users\user\Downloads\allegati_comunicazione.zip (copy)

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 29 18:16:54 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 29 18:16:54 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 29 18:16:54 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 29 18:16:54 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 29 18:16:54 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\Downloads\2c3fc3a5-37d8-41ea-b29b-c7004ddd1cc2.tmp

PDF document, version 1.4, 1 pages

dropped

C:\Users\user\Downloads\7972eb78-9921-464b-8695-b67cbc8d09a2.tmp

PDF document, version 1.4, 1 pages

dropped

C:\Users\user\Downloads\ad2fe5bb-7848-49f6-80d8-80ef56ba2691.tmp

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

C:\Users\user\Downloads\allegati_comunicazione.zip.crdownload (copy)

Zip archive data, at least v2.0 to extract, compression method=deflate

dropped

Chrome Cache Entry: 100

ASCII text, with very long lines (18186), with no line terminators

dropped

Chrome Cache Entry: 101

Unicode text, UTF-8 text, with very long lines (64737)

downloaded

Chrome Cache Entry: 102

PNG image data, 200 x 101, 8-bit/color RGBA, non-interlaced

dropped

Chrome Cache Entry: 103

ASCII text, with very long lines (65536), with no line terminators

dropped

Chrome Cache Entry: 104

Unicode text, UTF-8 text, with very long lines (65534), with no line terminators

downloaded

Chrome Cache Entry: 84

ASCII text, with very long lines (2480), with no line terminators

downloaded

Chrome Cache Entry: 85

ASCII text, with very long lines (2480), with no line terminators

dropped

Chrome Cache Entry: 86

Unicode text, UTF-8 text, with very long lines (64737)

dropped

Chrome Cache Entry: 87

ASCII text, with very long lines (18186), with no line terminators

downloaded

Chrome Cache Entry: 88

ASCII text, with very long lines (65536), with no line terminators

downloaded

Chrome Cache Entry: 89

Unicode text, UTF-8 (with BOM) text, with very long lines (586), with CRLF line terminators

downloaded

Chrome Cache Entry: 90

Web Open Font Format (Version 2), TrueType, length 77160, version 4.459

downloaded

Chrome Cache Entry: 91

Unicode text, UTF-8 (with BOM) text, with very long lines (586), with CRLF line terminators

dropped

Chrome Cache Entry: 92

PNG image data, 200 x 101, 8-bit/color RGBA, non-interlaced

downloaded

Chrome Cache Entry: 93

ASCII text, with very long lines (37691), with no line terminators

dropped

Chrome Cache Entry: 94

ASCII text, with very long lines (65536), with no line terminators

dropped

Chrome Cache Entry: 95

HTML document, ASCII text, with very long lines (664), with CRLF, LF line terminators

downloaded

Chrome Cache Entry: 96

Unicode text, UTF-8 text, with very long lines (65534), with no line terminators

dropped

Chrome Cache Entry: 97

ASCII text, with very long lines (65536), with no line terminators

downloaded

Chrome Cache Entry: 98

ASCII text, with very long lines (37691), with no line terminators

downloaded

Chrome Cache Entry: 99

Unicode text, UTF-8 text, with very long lines (64006)

downloaded

There are 25 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	1316
Target ID:	0
Parent PID:	1036
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	14:16:51
Date:	29/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7f9810000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2024,i,7664804515315866365,6801560600046413987,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	7032
Target ID:	1
Parent PID:	1316
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2024,i,7664804515315866365,6801560600046413987,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	14:16:51
Date:	29/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7f9810000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://clienti.documentipostali.it/#/public/email/a703266c-62aa-4024-8f0c-254725c31c25-DD0015830773-D0002973415"

Details

Is windows:	true
Is dropped:	false
PID:	6640
Target ID:	2
Parent PID:	1036
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://clienti.documentipostali.it/#/public/email/a703266c-62aa-4024-8f0c-254725c31c25-DD0015830773-D0002973415"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	14:16:52
Date:	29/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7f9810000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	1956
Target ID:	13
Parent PID:	804
Name:	rundll32.exe
Class:	rundll32
Path:	C:\Windows\System32\rundll32.exe
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Size:	71680
MD5:	EF3179D498793BF4234F708D3BE28633
Time:	14:18:52
Date:	29/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0x7ff6854d0000
Modulesize:	94208
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Runs a DLL by calling functions	System Summary	Rundll32
Spawns processes	System Summary	Process Injection

URLs

Name

IP

Malicious

https://clienti.documentipostali.it/#/public/email/a703266c-62aa-4024-8f0c-254725c31c25-DD0015830773-D0002973415

https://github.com/twbs/bootstrap/blob/master/LICENSE)

unknown

http://fontawesome.io

unknown

http://www.apache.org/licenses/LICENSE-2.0

unknown

http://www.wptools.de)

unknown

https://getbootstrap.com/)

unknown

https://clienti.documentipostali.it/#/public/email/a703266c-62aa-4024-8f0c-254725c31c25-DD0015830773-D0002973415

http://docs.ckeditor.com/#

unknown

https://cdnjs.cloudflare.com/ajax/libs/pdf.js/2.4.456/pdf.worker.min.js

104.17.24.14

http://www.wptools.de

unknown

http://ckeditor.com/license

unknown

file:///C:/Users/user/Downloads/P00002.pdf

http://fontawesome.io/license

unknown

There are 2 hidden URLs, click here to show them.

Domains

Name

IP

Malicious

cdnjs.cloudflare.com

104.17.24.14

Details

Name:	cdnjs.cloudflare.com
IP:	104.17.24.14
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

www.google.com

142.250.181.100

Details

Name:	www.google.com
IP:	142.250.181.100
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

clienti.documentipostali.it

unknown

Details

Name:	clienti.documentipostali.it
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Blob-based file download detected	System Summary
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

IPs

IP

Domain

Country

Malicious

104.17.24.14

cdnjs.cloudflare.com

United States

239.255.255.250

unknown

Reserved

192.168.2.16

unknown

unknown

104.17.25.14

unknown

United States

142.250.181.100

www.google.com

United States

Memdumps

Base Address

Regiontype

Protect

Malicious

283A0540000

heap

page read and write

BA3BB6E000

stack

page read and write

2839EDF5000

heap

page read and write

2839E9D0000

heap

page read and write

2839EB09000

heap

page read and write

BA3BAEC000

stack

page read and write

2839EDF0000

heap

page read and write

BA3BBEE000

stack

page read and write

BA3BE7F000

stack

page read and write

2839EAD0000

heap

page read and write

2839EAB0000

heap

page read and write

2839EB00000

heap

page read and write

There are 2 hidden memdumps, click here to show them.

DOM / HTML

URL

Malicious

https://clienti.documentipostali.it/#/public/email/a703266c-62aa-4024-8f0c-254725c31c25-DD0015830773-D0002973415

https://clienti.documentipostali.it/#/public/email/a703266c-62aa-4024-8f0c-254725c31c25-DD0015830773-D0002973415

https://clienti.documentipostali.it/#/public/email/a703266c-62aa-4024-8f0c-254725c31c25-DD0015830773-D0002973415

file:///C:/Users/user/Downloads/P00002.pdf

file:///C:/Users/user/Downloads/P00002.pdf