IOC Report
https://www.njcourts.gov/faq/my-employer-required-pay-me-when-i-have-jury-service

Files

File Path

Type

Category

Malicious

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 11 17:25:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 11 17:25:52 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 11 17:25:52 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 11 17:25:52 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 11 17:25:52 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Chrome Cache Entry: 57

assembler source, ASCII text, with very long lines (14445)

downloaded

Chrome Cache Entry: 58

PNG image data, 228 x 52, 8-bit colormap, non-interlaced

downloaded

Chrome Cache Entry: 59

PNG image data, 70 x 44, 8-bit/color RGBA, non-interlaced

dropped

Chrome Cache Entry: 60

ASCII text

downloaded

Chrome Cache Entry: 61

PNG image data, 70 x 44, 8-bit/color RGBA, non-interlaced

dropped

Chrome Cache Entry: 62

PNG image data, 70 x 44, 8-bit/color RGBA, non-interlaced

downloaded

Chrome Cache Entry: 63

PNG image data, 70 x 44, 8-bit/color RGBA, non-interlaced

dropped

Chrome Cache Entry: 64

PNG image data, 70 x 44, 8-bit/color RGBA, non-interlaced

dropped

Chrome Cache Entry: 65

Unicode text, UTF-8 text, with very long lines (64509)

downloaded

Chrome Cache Entry: 66

ASCII text, with very long lines (58392)

downloaded

Chrome Cache Entry: 67

PNG image data, 228 x 52, 8-bit colormap, non-interlaced

dropped

Chrome Cache Entry: 68

ASCII text, with very long lines (12028)

downloaded

Chrome Cache Entry: 69

ASCII text, with very long lines (65536), with no line terminators

downloaded

Chrome Cache Entry: 70

exported SGML document, ASCII text

dropped

Chrome Cache Entry: 71

PNG image data, 70 x 44, 8-bit/color RGBA, non-interlaced

downloaded

Chrome Cache Entry: 72

PNG image data, 70 x 44, 8-bit/color RGBA, non-interlaced

downloaded

Chrome Cache Entry: 73

exported SGML document, ASCII text

downloaded

Chrome Cache Entry: 74

PNG image data, 303 x 100, 8-bit/color RGBA, non-interlaced

dropped

Chrome Cache Entry: 75

ASCII text, with very long lines (65536), with no line terminators

dropped

Chrome Cache Entry: 76

PNG image data, 303 x 100, 8-bit/color RGBA, non-interlaced

downloaded

Chrome Cache Entry: 77

PNG image data, 70 x 44, 8-bit/color RGBA, non-interlaced

downloaded

There are 18 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	1732
Target ID:	0
Parent PID:	5712
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	14:25:45
Date:	11/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2012,i,2653518078357357922,11174048245510253135,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	2584
Target ID:	2
Parent PID:	1732
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2012,i,2653518078357357922,11174048245510253135,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	14:25:49
Date:	11/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.njcourts.gov/faq/my-employer-required-pay-me-when-i-have-jury-service"

Details

Is windows:	true
Is dropped:	false
PID:	1680
Target ID:	3
Parent PID:	5712
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.njcourts.gov/faq/my-employer-required-pay-me-when-i-have-jury-service"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	14:25:52
Date:	11/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

IP

Malicious

https://www.njcourts.gov/faq/my-employer-required-pay-me-when-i-have-jury-service

https://www.njcourts.gov/themes/custom/njcourts/images/footer/ensuring.png

45.60.243.243

https://fontawesome.com

unknown

https://www.drupal.org/licensing/faq

unknown

https://www.njcourts.gov/modules/contrib/seckit/css/seckit.no_body.css

45.60.243.243

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/all.min.css

104.17.25.14

https://www.njcourts.gov/n-Was-pull-Y-Serprizd-the-them-whith-few-Rance-E

45.60.243.243

https://www.njcourts.gov/faq/my-employer-required-pay-me-when-i-have-jury-service

45.60.243.243

https://raw.githubusercontent.com/jquery/jquery-ui/1.13.2/LICENSE.txt

unknown

https://www.njcourts.gov/themes/custom/njcourts/images/logo.png

45.60.243.243

https://www.njcourts.gov/themes/custom/njcourts/images/mobile-menu-logo.png

45.60.243.243

https://www.njcourts.gov/modules/contrib/seckit/js/seckit.document_write.js

45.60.243.243

https://www.njcourts.gov/themes/custom/njcourts/images/footer/sign.png

45.60.243.243

https://www.njcourts.gov/themes/custom/njcourts/images/footer/ada.png

45.60.243.243

https://www.njcourts.gov/themes/custom/njcourts/images/footer/interpreter.png

45.60.243.243

https://fontawesome.com/license/free

unknown

There are 5 hidden URLs, click here to show them.

Domains

Name

IP

Malicious

9abkszr.impervadns.net

45.60.243.243

cdnjs.cloudflare.com

104.17.25.14

Details

Name:	cdnjs.cloudflare.com
IP:	104.17.25.14
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

www.google.com

172.217.23.100

Details

Name:	www.google.com
IP:	172.217.23.100
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

fp2e7a.wpc.phicdn.net

192.229.221.95

windowsupdatebg.s.llnwi.net

87.248.205.0

www.njcourts.gov

unknown

Details

Name:	www.njcourts.gov
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

IPs

IP

Domain

Country

Malicious

45.60.243.243

9abkszr.impervadns.net

United States

239.255.255.250

unknown

Reserved

172.217.23.100

www.google.com

United States

104.17.25.14

cdnjs.cloudflare.com

United States

192.168.2.5

unknown

unknown