IOC Report
https://australianfoodandfibre.servicedeskplus.net.au/app/itdesk/ui/requests/867000003351579/details

loading gif

Files

File Path
Type
Category
Malicious
Chrome Cache Entry: 60
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
downloaded
Chrome Cache Entry: 61
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141866
dropped
Chrome Cache Entry: 62
HTML document, ASCII text, with very long lines (3450), with CRLF line terminators
downloaded
Chrome Cache Entry: 63
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
dropped
Chrome Cache Entry: 64
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
downloaded
Chrome Cache Entry: 65
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1017x678, components 3
dropped
Chrome Cache Entry: 66
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
dropped
Chrome Cache Entry: 67
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113401
downloaded
Chrome Cache Entry: 68
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449540
downloaded
Chrome Cache Entry: 69
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449540
dropped
Chrome Cache Entry: 70
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
downloaded
Chrome Cache Entry: 71
JSON data
dropped
Chrome Cache Entry: 72
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
dropped
Chrome Cache Entry: 73
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 141866
downloaded
Chrome Cache Entry: 74
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 75
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15755
downloaded
Chrome Cache Entry: 76
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
dropped
Chrome Cache Entry: 77
GIF image data, version 89a, 352 x 3
dropped
Chrome Cache Entry: 78
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
downloaded
Chrome Cache Entry: 79
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
downloaded
Chrome Cache Entry: 80
GIF image data, version 89a, 352 x 3
dropped
Chrome Cache Entry: 81
JSON data
dropped
Chrome Cache Entry: 82
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 56391
downloaded
Chrome Cache Entry: 83
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1017x678, components 3
downloaded
Chrome Cache Entry: 84
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
downloaded
Chrome Cache Entry: 85
GIF image data, version 89a, 352 x 3
downloaded
Chrome Cache Entry: 86
GIF image data, version 89a, 352 x 3
downloaded
Chrome Cache Entry: 87
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
dropped
Chrome Cache Entry: 88
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 56391
dropped
Chrome Cache Entry: 89
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15755
dropped
There are 21 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 --field-trial-handle=2208,i,972951138316772105,17389294996650650195,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://australianfoodandfibre.servicedeskplus.net.au/app/itdesk/ui/requests/867000003351579/details"

URLs

Name
IP
Malicious
https://australianfoodandfibre.servicedeskplus.net.au/app/itdesk/ui/requests/867000003351579/details
https://australianfoodandfibre.servicedeskplus.net.au/Login.jsp?serviceurl=%2Fapp%2Fitdesk%2Fui%2Frequests%2F867000003351579%2Fdetails
103.138.128.66
https://login.microsoftonline.com
unknown
https://accounts.zoho.com.au/samlauthrequest/aff-limited.com.au?serviceurl=https%3A%2F%2Faustralianfoodandfibre.servicedeskplus.net.au%2Fapp%2Fitdesk%2Fui%2Frequests%2F867000003351579%2Fdetails&servicename=SDPOnDemand&portal_id=7001242490&hide_signup=false
103.138.128.66
https://login.windows-ppe.net
unknown
https://aadcdn.msauthimages.net/81d6b03a-0oaqvemumiggapupispz73q-euqm382uqpsqys7gkkc/logintenantbranding/0/illustration?ts=637640617494988131
152.199.21.175
https://australianfoodandfibre.servicedeskplus.net.au/app/itdesk/ui/requests/867000003351579/details
103.138.128.66
https://autologon.microsoftazuread-sso.com/b2a7b211-552b-4fc5-ad0d-b35b3a237e3e/winauth/ssoprobe?client-request-id=de01a722-6f49-4599-ab7d-ff51aec23674&_=1724906554053
40.126.28.18

Domains

Name
IP
Malicious
bg.microsoft.map.fastly.net
199.232.214.172
zs-au1-lc1-h2.servicedeskplus.net.au
103.138.128.66
sni1gl.wpc.upsiloncdn.net
152.199.21.175
sni1gl.wpc.omegacdn.net
152.199.21.175
www.google.com
142.250.186.164
s-part-0045.t-0009.t-msedge.net
13.107.246.73
zs-au1-lc1-h2.zoho.com.au
103.138.128.66
s-part-0032.t-0009.t-msedge.net
13.107.246.60
fp2e7a.wpc.phicdn.net
192.229.221.95
autologon.microsoftazuread-sso.com
40.126.28.18
aadcdn.msauthimages.net
unknown
identity.nel.measure.office.net
unknown
aadcdn.msftauth.net
unknown
accounts.zoho.com.au
unknown
login.microsoftonline.com
unknown
australianfoodandfibre.servicedeskplus.net.au
unknown
There are 6 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
103.138.128.66
zs-au1-lc1-h2.servicedeskplus.net.au
Australia
13.107.246.73
s-part-0045.t-0009.t-msedge.net
United States
40.126.28.18
autologon.microsoftazuread-sso.com
United States
192.168.2.4
unknown
unknown
13.107.246.60
s-part-0032.t-0009.t-msedge.net
United States
239.255.255.250
unknown
Reserved
142.250.186.164
www.google.com
United States
152.199.21.175
sni1gl.wpc.upsiloncdn.net
United States

DOM / HTML

URL
Malicious
https://login.microsoftonline.com/b2a7b211-552b-4fc5-ad0d-b35b3a237e3e/saml2?SAMLRequest=fVLbjpswEP0V5HfAGAMbK0SiG1WNtG3RJu3DvlTGDIklsKnHpJevL7DdVaSq%2B3rGc27jLcqhH0U1%2BYt5hO8ToA9%2BDr1BsQ5KMjkjrESNwsgBUHgljtXHB8EiKkZnvVW2J8FhX5JvjbrLoMnyjvKUd63aNHLDgaa8UG3BcpoUjG9oToKv4FBbU5KZZN5FnOBg0EvjZ4gyHtK7kG1OlAvOBMujPEufSPDeOgWr0ZJ0skdYVmuJqK%2FwitR%2FLb3TptXm%2FLb%2F5vkRig%2BnUx3Wn48nElSI4Pzs7t4anAZwR3BXreDL40NJLt6PKOJYKmUn4zH6bS82UnaI5BSjPhtt4qU3HOOC0oTxJTAJ9nOr2ki%2FZn7h6O1Zm2jQylm0nbem1wYWrrhhsmhYkoRZxpqQdyoLZUvbsEmzJpUsLSCFVYatea%2B6BfdpDleSp9kO2W2XmVhrdTfHfLsL%2BZKb7G5CbeMbrmfiUSxah31te61%2BBVXf2x%2F3DqSf9b2bYD3UIP3%2F5ZIoWRHdht36VMAgdV%2B1rQPE2X%2F8r84rePtTd38A&RelayState=aHR0cHM6Ly9hdXN0cmFsaWFuZm9vZGFuZGZpYnJlLnNlcnZpY2VkZXNrcGx1cy5uZXQuYXUvYXBwL2l0ZGVzay91aS9yZXF1ZXN0cy84NjcwMDAwMDMzNTE1NzkvZGV0YWlsc19fSUFNX19TRFBPbkRlbWFuZF9fSUFNX19fX0lBTV9fZmFsc2U%3D
https://login.microsoftonline.com/b2a7b211-552b-4fc5-ad0d-b35b3a237e3e/saml2?SAMLRequest=fVLbjpswEP0V5HfAGAMbK0SiG1WNtG3RJu3DvlTGDIklsKnHpJevL7DdVaSq%2B3rGc27jLcqhH0U1%2BYt5hO8ToA9%2BDr1BsQ5KMjkjrESNwsgBUHgljtXHB8EiKkZnvVW2J8FhX5JvjbrLoMnyjvKUd63aNHLDgaa8UG3BcpoUjG9oToKv4FBbU5KZZN5FnOBg0EvjZ4gyHtK7kG1OlAvOBMujPEufSPDeOgWr0ZJ0skdYVmuJqK%2FwitR%2FLb3TptXm%2FLb%2F5vkRig%2BnUx3Wn48nElSI4Pzs7t4anAZwR3BXreDL40NJLt6PKOJYKmUn4zH6bS82UnaI5BSjPhtt4qU3HOOC0oTxJTAJ9nOr2ki%2FZn7h6O1Zm2jQylm0nbem1wYWrrhhsmhYkoRZxpqQdyoLZUvbsEmzJpUsLSCFVYatea%2B6BfdpDleSp9kO2W2XmVhrdTfHfLsL%2BZKb7G5CbeMbrmfiUSxah31te61%2BBVXf2x%2F3DqSf9b2bYD3UIP3%2F5ZIoWRHdht36VMAgdV%2B1rQPE2X%2F8r84rePtTd38A&RelayState=aHR0cHM6Ly9hdXN0cmFsaWFuZm9vZGFuZGZpYnJlLnNlcnZpY2VkZXNrcGx1cy5uZXQuYXUvYXBwL2l0ZGVzay91aS9yZXF1ZXN0cy84NjcwMDAwMDMzNTE1NzkvZGV0YWlsc19fSUFNX19TRFBPbkRlbWFuZF9fSUFNX19fX0lBTV9fZmFsc2U%3D&sso_reload=true
https://login.microsoftonline.com/b2a7b211-552b-4fc5-ad0d-b35b3a237e3e/saml2?SAMLRequest=fVLbjpswEP0V5HfAGAMbK0SiG1WNtG3RJu3DvlTGDIklsKnHpJevL7DdVaSq%2B3rGc27jLcqhH0U1%2BYt5hO8ToA9%2BDr1BsQ5KMjkjrESNwsgBUHgljtXHB8EiKkZnvVW2J8FhX5JvjbrLoMnyjvKUd63aNHLDgaa8UG3BcpoUjG9oToKv4FBbU5KZZN5FnOBg0EvjZ4gyHtK7kG1OlAvOBMujPEufSPDeOgWr0ZJ0skdYVmuJqK%2FwitR%2FLb3TptXm%2FLb%2F5vkRig%2BnUx3Wn48nElSI4Pzs7t4anAZwR3BXreDL40NJLt6PKOJYKmUn4zH6bS82UnaI5BSjPhtt4qU3HOOC0oTxJTAJ9nOr2ki%2FZn7h6O1Zm2jQylm0nbem1wYWrrhhsmhYkoRZxpqQdyoLZUvbsEmzJpUsLSCFVYatea%2B6BfdpDleSp9kO2W2XmVhrdTfHfLsL%2BZKb7G5CbeMbrmfiUSxah31te61%2BBVXf2x%2F3DqSf9b2bYD3UIP3%2F5ZIoWRHdht36VMAgdV%2B1rQPE2X%2F8r84rePtTd38A&RelayState=aHR0cHM6Ly9hdXN0cmFsaWFuZm9vZGFuZGZpYnJlLnNlcnZpY2VkZXNrcGx1cy5uZXQuYXUvYXBwL2l0ZGVzay91aS9yZXF1ZXN0cy84NjcwMDAwMDMzNTE1NzkvZGV0YWlsc19fSUFNX19TRFBPbkRlbWFuZF9fSUFNX19fX0lBTV9fZmFsc2U%3D&sso_reload=true