IOC Report
https://url.za.m.mimecastprotect.com/s/qGQkCoYKXyfARXLc1f0FpG0Th

Files

File Path

Type

Category

Malicious

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 05:47:34 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 05:47:33 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:56:51 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 05:47:33 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 05:47:33 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 7 05:47:33 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide

dropped

Chrome Cache Entry: 78

ASCII text, with no line terminators

downloaded

Chrome Cache Entry: 79

ASCII text, with very long lines (65536), with no line terminators

dropped

Chrome Cache Entry: 80

MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel

downloaded

Chrome Cache Entry: 81

ASCII text, with very long lines (65536), with no line terminators

downloaded

Chrome Cache Entry: 82

ASCII text, with very long lines (65536), with no line terminators

downloaded

Chrome Cache Entry: 83

HTML document, ASCII text, with very long lines (2088)

downloaded

Chrome Cache Entry: 84

ASCII text, with very long lines (65536), with no line terminators

downloaded

Chrome Cache Entry: 85

ASCII text, with very long lines (1492), with no line terminators

dropped

Chrome Cache Entry: 86

MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel

dropped

Chrome Cache Entry: 87

JSON data

downloaded

Chrome Cache Entry: 88

ASCII text, with very long lines (65536), with no line terminators

dropped

Chrome Cache Entry: 89

PNG image data, 254 x 120, 8-bit/color RGBA, non-interlaced

downloaded

Chrome Cache Entry: 90

JSON data

dropped

Chrome Cache Entry: 91

Web Open Font Format (Version 2), TrueType, length 137104, version 331.-31196

downloaded

Chrome Cache Entry: 92

PNG image data, 254 x 120, 8-bit/color RGBA, non-interlaced

dropped

Chrome Cache Entry: 93

Web Open Font Format (Version 2), TrueType, length 37608, version 1.0

downloaded

Chrome Cache Entry: 94

ASCII text, with very long lines (1492), with no line terminators

downloaded

Chrome Cache Entry: 95

ASCII text, with very long lines (65536), with no line terminators

dropped

There are 15 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	2452
Target ID:	0
Parent PID:	5876
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	02:47:27
Date:	07/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6b2cb0000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1796,i,17245394601777395908,15448899606939963654,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	6996
Target ID:	2
Parent PID:	2452
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1796,i,17245394601777395908,15448899606939963654,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	02:47:31
Date:	07/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6b2cb0000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://url.za.m.mimecastprotect.com/s/qGQkCoYKXyfARXLc1f0FpG0Th"

Details

Is windows:	true
Is dropped:	false
PID:	6328
Target ID:	3
Parent PID:	5876
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://url.za.m.mimecastprotect.com/s/qGQkCoYKXyfARXLc1f0FpG0Th"
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	02:47:33
Date:	07/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6b2cb0000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

IP

Malicious

https://url.za.m.mimecastprotect.com/s/qGQkCoYKXyfARXLc1f0FpG0Th

https://security-za.m.mimecastprotect.com/ttpwp/resources/languages/en.json

41.74.192.87

https://url.za.m.mimecastprotect.com/s/qGQkCoYKXyfARXLc1f0FpG0Th

41.74.196.103

https://security-za.m.mimecastprotect.com/ttpwp/resources/images/favicon.ico

41.74.192.87

https://security-za.m.mimecastprotect.com/ttpwp

41.74.192.87

https://security-za.m.mimecastprotect.com/ttpwp/resources/mimecast-icons.bb1a2cd16db9345fc437.woff2?25417273

41.74.192.87

https://security-za.m.mimecastprotect.com/ttpwp/resources/polyfills.5257ca6e429949972959.js

41.74.192.87

https://security-za.m.mimecastprotect.com/ttpwp/resources/fa-solid-900.54dfc8f551be346014e4.woff2

41.74.192.87

https://security-za.m.mimecastprotect.com/ttpwp/#/enrollment?key=c97c9df3-f0a8-3f1a-9094-f7b2a81cee1c

https://security-za.m.mimecastprotect.com/ttpwp/resources/images/mimecast-logo.png

41.74.192.87

http://www.mimecast.com/

unknown

https://security-za.m.mimecastprotect.com/ttpwp/resources/main.5257ca6e429949972959.js

41.74.192.87

https://security-za.m.mimecastprotect.com/ttpwp/resources/styles.5257ca6e429949972959.js

41.74.192.87

https://security-za.m.mimecastprotect.com/ttpwp/resources/runtime.5257ca6e429949972959.js

41.74.192.87

https://community.mimecast.com/docs/DOC-241

unknown

There are 4 hidden URLs, click here to show them.

Domains

Name

IP

Malicious

bg.microsoft.map.fastly.net

199.232.214.172

www.google.com

142.250.181.228

Details

Name:	www.google.com
IP:	142.250.181.228
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

security-za.m.mimecastprotect.com

41.74.192.87

Details

Name:	security-za.m.mimecastprotect.com
IP:	41.74.192.87
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

fp2e7a.wpc.phicdn.net

192.229.221.95

url.za.m.mimecastprotect.com

41.74.196.103

Details

Name:	url.za.m.mimecastprotect.com
IP:	41.74.196.103
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

windowsupdatebg.s.llnwi.net

87.248.205.0

IPs

IP

Domain

Country

Malicious

41.74.196.87

unknown

South Africa

192.168.2.7

unknown

unknown

41.74.196.103

url.za.m.mimecastprotect.com

South Africa

192.168.2.9

unknown

unknown

192.168.2.4

unknown

unknown

239.255.255.250

unknown

Reserved

142.250.181.228

www.google.com

United States

41.74.192.87

security-za.m.mimecastprotect.com

South Africa

DOM / HTML

URL

Malicious

https://security-za.m.mimecastprotect.com/ttpwp/#/enrollment?key=c97c9df3-f0a8-3f1a-9094-f7b2a81cee1c