IOC Report
http://href.li

Files

File Path

Type

Category

Malicious

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 17:14:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 17:14:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 17:14:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 17:14:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 17:14:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Chrome Cache Entry: 70

SVG Scalable Vector Graphics image

downloaded

Chrome Cache Entry: 71

MS Windows icon resource - 3 icons, 16x16, 8 bits/pixel, 32x32, 8 bits/pixel

downloaded

Chrome Cache Entry: 72

ASCII text, with no line terminators

downloaded

Chrome Cache Entry: 73

Unicode text, UTF-8 text

downloaded

Chrome Cache Entry: 74

HTML document, Unicode text, UTF-8 text

downloaded

Chrome Cache Entry: 75

Web Open Font Format, TrueType, length 157504, version 1.0

downloaded

Chrome Cache Entry: 76

HTML document, ASCII text, with very long lines (485)

dropped

Chrome Cache Entry: 77

ASCII text, with very long lines (65447)

downloaded

Chrome Cache Entry: 78

gzip compressed data, last modified: Sat Oct 12 03:26:51 2024, from Unix, original size modulo 2^32 1256

downloaded

Chrome Cache Entry: 79

Web Open Font Format, CFF, length 89024, version 2.10

downloaded

Chrome Cache Entry: 80

ASCII text, with very long lines (65447)

downloaded

Chrome Cache Entry: 81

gzip compressed data, from Unix, original size modulo 2^32 4747

downloaded

Chrome Cache Entry: 82

MS Windows icon resource - 3 icons, 16x16, 8 bits/pixel, 32x32, 8 bits/pixel

dropped

Chrome Cache Entry: 83

ASCII text, with no line terminators

downloaded

Chrome Cache Entry: 84

Unicode text, UTF-8 text

downloaded

Chrome Cache Entry: 85

HTML document, ASCII text

downloaded

Chrome Cache Entry: 86

ASCII text, with very long lines (1603), with no line terminators

downloaded

Chrome Cache Entry: 87

ASCII text

dropped

Chrome Cache Entry: 88

gzip compressed data, last modified: Thu Oct 17 07:18:26 2019, from Unix, original size modulo 2^32 1256

downloaded

Chrome Cache Entry: 89

ASCII text

downloaded

Chrome Cache Entry: 90

HTML document, ASCII text, with very long lines (485)

downloaded

Chrome Cache Entry: 91

HTML document, ASCII text, with very long lines (485)

downloaded

Chrome Cache Entry: 92

ASCII text, with very long lines (65447)

dropped

Chrome Cache Entry: 93

Web Open Font Format, TrueType, length 156596, version 1.0

downloaded

Chrome Cache Entry: 94

ASCII text

downloaded

Chrome Cache Entry: 95

MS Windows icon resource - 3 icons, 16x16, 8 bits/pixel, 32x32, 8 bits/pixel

downloaded

Chrome Cache Entry: 96

SVG Scalable Vector Graphics image

downloaded

Chrome Cache Entry: 97

SVG Scalable Vector Graphics image

dropped

There are 25 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	3640
Target ID:	0
Parent PID:	5752
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	14:14:41
Date:	23/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1988,i,16412764010248436443,6342601332625472580,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	6580
Target ID:	2
Parent PID:	3640
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1988,i,16412764010248436443,6342601332625472580,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	14:14:44
Date:	23/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://href.li"

Details

Is windows:	true
Is dropped:	false
PID:	3748
Target ID:	3
Parent PID:	5752
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://href.li"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	14:14:46
Date:	23/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

IP

Malicious

http://href.li

https://www.iana.org/_img/2022/fonts/SourceCodePro-Regular.woff

192.0.33.8

https://href.li/?url=

unknown

http://www.iana.org/help/example-domains

http://href.li/

192.0.78.27

https://www.iana.org/_img/2022/iana-logo-header.svg

192.0.33.8

https://www.iana.org/_img/bookmark_icon.ico

192.0.33.8

https://www.iana.org/_css/2022/iana_website.css

192.0.33.8

https://href.li/?http://example.com/

192.0.78.26

http://pti.icann.org

unknown

http://www.icann.org/

unknown

https://www.iana.org/domains/reserved

https://www.iana.org/_img/2022/fonts/NotoSans-Bold.woff

192.0.33.8

http://www.icann.org/en/registries/agreements.htm

unknown

https://href.li/href.css?v=3

192.0.78.26

http://example.com/favicon.ico

93.184.215.14

https://www.icann.org/privacy/policy

unknown

https://www.icann.org/privacy/tos

unknown

https://href.li/

https://href.li/favicon.ico

192.0.78.26

https://www.iana.org/_js/iana.js

192.0.33.8

https://www.iana.org/_img/2022/fonts/NotoSans-Regular.woff

192.0.33.8

http://example.com/

http://www.icann.org/topics/idn/

unknown

https://www.iana.org/domains/example

192.0.33.8

https://www.iana.org/_js/jquery.js

192.0.33.8

There are 15 hidden URLs, click here to show them.

Domains

Name

IP

Malicious

s-part-0044.t-0009.fb-t-msedge.net

13.107.253.72

s-part-0017.t-0009.t-msedge.net

13.107.246.45

s-part-0017.t-0009.fb-t-msedge.net

13.107.253.45

www.google.com

142.250.184.196

example.com

93.184.215.14

ianawww.vip.icann.org

192.0.46.8

href.li

192.0.78.27

fp2e7a.wpc.phicdn.net

192.229.221.95

windowsupdatebg.s.llnwi.net

87.248.204.0

www.iana.org

unknown

IPs

IP

Domain

Country

Malicious

192.0.46.8

ianawww.vip.icann.org

United States

142.250.184.196

www.google.com

United States

192.0.33.8

unknown

United States

192.0.78.27

href.li

United States

192.168.2.5

unknown

unknown

192.0.78.26

unknown

United States

239.255.255.250

unknown

Reserved

93.184.215.14

example.com

European Union

DOM / HTML

URL

Malicious

https://href.li/

https://href.li/

http://example.com/

http://www.iana.org/help/example-domains

https://www.iana.org/domains/reserved