IOC Report
https://url.uk.m.mimecastprotect.com/s/QizLC2vk6UDrKEinf6F5M4b3?domain=tqaun.us12.list-manage.com

Files

File Path

Type

Category

Malicious

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 14:13:12 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 14:13:12 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 08:59:33 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 14:13:12 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 14:13:12 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 2 14:13:12 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide

dropped

Chrome Cache Entry: 72

MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel

dropped

Chrome Cache Entry: 73

ASCII text, with very long lines (65536), with no line terminators

dropped

Chrome Cache Entry: 74

Web Open Font Format (Version 2), TrueType, length 137104, version 331.-31196

downloaded

Chrome Cache Entry: 75

ASCII text, with very long lines (1492), with no line terminators

downloaded

Chrome Cache Entry: 76

HTML document, ASCII text, with very long lines (2088)

downloaded

Chrome Cache Entry: 77

JSON data

downloaded

Chrome Cache Entry: 78

Web Open Font Format (Version 2), TrueType, length 37608, version 1.0

downloaded

Chrome Cache Entry: 79

ASCII text, with very long lines (65536), with no line terminators

downloaded

Chrome Cache Entry: 80

ASCII text, with very long lines (65536), with no line terminators

downloaded

Chrome Cache Entry: 81

PNG image data, 254 x 120, 8-bit/color RGBA, non-interlaced

downloaded

Chrome Cache Entry: 82

MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel

downloaded

Chrome Cache Entry: 83

ASCII text, with very long lines (1492), with no line terminators

dropped

Chrome Cache Entry: 84

PNG image data, 254 x 120, 8-bit/color RGBA, non-interlaced

dropped

Chrome Cache Entry: 85

ASCII text, with very long lines (65536), with no line terminators

downloaded

Chrome Cache Entry: 86

ASCII text, with very long lines (65536), with no line terminators

dropped

Chrome Cache Entry: 87

HTML document, ASCII text

dropped

Chrome Cache Entry: 88

JSON data

dropped

Chrome Cache Entry: 89

ASCII text, with very long lines (65536), with no line terminators

dropped

There are 15 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	6424
Target ID:	4
Parent PID:	3196
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	83395EAB5B03DEA9720F8D7AC0D15CAA
Time:	11:13:07
Date:	02/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6c5c30000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2024,i,14144066786699680077,1103834911799437713,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	3464
Target ID:	6
Parent PID:	6424
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2024,i,14144066786699680077,1103834911799437713,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	83395EAB5B03DEA9720F8D7AC0D15CAA
Time:	11:13:09
Date:	02/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6c5c30000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://url.uk.m.mimecastprotect.com/s/QizLC2vk6UDrKEinf6F5M4b3?domain=tqaun.us12.list-manage.com"

Details

Is windows:	true
Is dropped:	false
PID:	7096
Target ID:	10
Parent PID:	3196
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://url.uk.m.mimecastprotect.com/s/QizLC2vk6UDrKEinf6F5M4b3?domain=tqaun.us12.list-manage.com"
Size:	3242272
MD5:	83395EAB5B03DEA9720F8D7AC0D15CAA
Time:	11:13:12
Date:	02/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6c5c30000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

IP

Malicious

https://url.uk.m.mimecastprotect.com/s/QizLC2vk6UDrKEinf6F5M4b3?domain=tqaun.us12.list-manage.com

https://security-uk.m.mimecastprotect.com/ttpwp/resources/styles.5257ca6e429949972959.js

91.220.42.89

https://security-uk.m.mimecastprotect.com/ttpwp/resources/runtime.5257ca6e429949972959.js

91.220.42.89

https://security-uk.m.mimecastprotect.com/ttpwp/resources/mimecast-icons.bb1a2cd16db9345fc437.woff2?25417273

91.220.42.89

https://security-uk.m.mimecastprotect.com/ttpwp/resources/languages/en.json

91.220.42.89

https://security-uk.m.mimecastprotect.com/ttpwp/resources/fa-solid-900.54dfc8f551be346014e4.woff2

91.220.42.89

https://security-uk.m.mimecastprotect.com/ttpwp/resources/images/mimecast-logo.png

91.220.42.89

https://security-uk.m.mimecastprotect.com/ttpwp/resources/main.5257ca6e429949972959.js

91.220.42.89

http://www.mimecast.com/

unknown

https://security-uk.m.mimecastprotect.com/ttpwp

91.220.42.89

https://security-uk.m.mimecastprotect.com/api/ttp/url/get-page-data

91.220.42.89

https://security-uk.m.mimecastprotect.com/ttpwp/#/block?key=OAPaJlOWQcvgsrT_iXGbgjqjmbEBF-q-27kltg4x8dCyP-6B1_VS26x_b-3_IKLQqjh-Lh5MBe7BzMhURffLVHCtnhl_FVakOs4kvrR7JeHTZSJ2pGXx3oDPk5DdH_P_

https://url.uk.m.mimecastprotect.com/s/QizLC2vk6UDrKEinf6F5M4b3?domain=tqaun.us12.list-manage.com

91.220.42.235

https://security-uk.m.mimecastprotect.com/ttpwp/resources/polyfills.5257ca6e429949972959.js

91.220.42.89

https://security-uk.m.mimecastprotect.com/ttpwp/resources/images/favicon.ico

91.220.42.89

https://community.mimecast.com/docs/DOC-241

unknown

There are 5 hidden URLs, click here to show them.

Domains

Name

IP

Malicious

bg.microsoft.map.fastly.net

199.232.210.172

url.uk.m.mimecastprotect.com

91.220.42.235

Details

Name:	url.uk.m.mimecastprotect.com
IP:	91.220.42.235
TargetID:	6
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

security-uk.m.mimecastprotect.com

91.220.42.89

Details

Name:	security-uk.m.mimecastprotect.com
IP:	91.220.42.89
TargetID:	6
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol

www.google.com

216.58.206.36

Details

Name:	www.google.com
IP:	216.58.206.36
TargetID:	6
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com

217.20.57.42

IPs

IP

Domain

Country

Malicious

91.220.42.89

security-uk.m.mimecastprotect.com

United Kingdom

192.168.2.10

unknown

unknown

239.255.255.250

unknown

Reserved

91.220.42.235

url.uk.m.mimecastprotect.com

United Kingdom

195.130.217.89

unknown

United Kingdom

216.58.206.36

www.google.com

United States

DOM / HTML

URL

Malicious

https://security-uk.m.mimecastprotect.com/ttpwp/#/block?key=OAPaJlOWQcvgsrT_iXGbgjqjmbEBF-q-27kltg4x8dCyP-6B1_VS26x_b-3_IKLQqjh-Lh5MBe7BzMhURffLVHCtnhl_FVakOs4kvrR7JeHTZSJ2pGXx3oDPk5DdH_P_

https://security-uk.m.mimecastprotect.com/ttpwp/#/block?key=OAPaJlOWQcvgsrT_iXGbgjqjmbEBF-q-27kltg4x8dCyP-6B1_VS26x_b-3_IKLQqjh-Lh5MBe7BzMhURffLVHCtnhl_FVakOs4kvrR7JeHTZSJ2pGXx3oDPk5DdH_P_

https://security-uk.m.mimecastprotect.com/ttpwp/#/block?key=OAPaJlOWQcvgsrT_iXGbgjqjmbEBF-q-27kltg4x8dCyP-6B1_VS26x_b-3_IKLQqjh-Lh5MBe7BzMhURffLVHCtnhl_FVakOs4kvrR7JeHTZSJ2pGXx3oDPk5DdH_P_