IOC Report
https://t.ly/8Lgfk

Files

File Path

Type

Category

Malicious

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 18:38:52 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 18:38:52 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 18:38:51 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 18:38:52 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 18:38:51 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Chrome Cache Entry: 70

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390

dropped

Chrome Cache Entry: 71

ASCII text, with no line terminators

downloaded

Chrome Cache Entry: 72

exported SGML document, Unicode text, UTF-8 text, with very long lines (65506)

dropped

Chrome Cache Entry: 73

HTML document, ASCII text

downloaded

Chrome Cache Entry: 74

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513

dropped

Chrome Cache Entry: 75

PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced

downloaded

Chrome Cache Entry: 76

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513

downloaded

Chrome Cache Entry: 77

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651

dropped

Chrome Cache Entry: 78

ASCII text, with very long lines (49854)

dropped

Chrome Cache Entry: 79

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250

dropped

Chrome Cache Entry: 80

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390

downloaded

Chrome Cache Entry: 81

SVG Scalable Vector Graphics image

downloaded

Chrome Cache Entry: 82

Web Open Font Format (Version 2), TrueType, length 154228, version 769.768

downloaded

Chrome Cache Entry: 83

SVG Scalable Vector Graphics image

dropped

Chrome Cache Entry: 84

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651

downloaded

Chrome Cache Entry: 85

PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced

dropped

Chrome Cache Entry: 86

exported SGML document, Unicode text, UTF-8 text, with very long lines (65506)

downloaded

Chrome Cache Entry: 87

ASCII text, with very long lines (49854)

downloaded

Chrome Cache Entry: 88

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250

downloaded

Chrome Cache Entry: 89

Web Open Font Format (Version 2), TrueType, length 105536, version 769.768

downloaded

Chrome Cache Entry: 90

Unicode text, UTF-8 (with BOM) text

downloaded

Chrome Cache Entry: 91

ASCII text, with very long lines (65317)

downloaded

Chrome Cache Entry: 92

HTML document, ASCII text, with very long lines (7222), with no line terminators

downloaded

Chrome Cache Entry: 93

HTML document, ASCII text, with very long lines (7222), with no line terminators

dropped

There are 21 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	2364
Target ID:	0
Parent PID:	5476
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	15:38:46
Date:	24/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1868,i,16090271239642675543,14371664565641883108,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	5708
Target ID:	2
Parent PID:	2364
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1868,i,16090271239642675543,14371664565641883108,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	15:38:49
Date:	24/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://t.ly/8Lgfk"

Details

Is windows:	true
Is dropped:	false
PID:	2788
Target ID:	3
Parent PID:	5476
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://t.ly/8Lgfk"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	15:38:51
Date:	24/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

IP

Malicious

https://t.ly/8Lgfk

https://aixeliedaily.com/m/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VWxSblFsQT0mdWlkPVVTRVIzMDA5MjAyNFUyNjA5MzA1Mg

https://t.ly/8Lgfk

104.20.7.133

https://fontawesome.com

unknown

https://aixeliedaily.com/favicon.ico

192.254.233.44

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/webfonts/fa-brands-400.woff2

104.17.25.14

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css

104.17.25.14

https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg

152.199.21.175

https://www.w3schools.com/w3css/4/w3.css

192.229.133.221

https://aixeliedaily.com/m/jsv.js

192.254.233.44

https://google.com

unknown

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/webfonts/fa-solid-900.woff2

104.17.25.14

https://cdn.socket.io/4.7.5/socket.io.min.js

18.245.31.33

https://fontawesome.com/license/free

unknown

There are 3 hidden URLs, click here to show them.

Domains

Name

IP

Malicious

s-part-0016.t-0009.t-msedge.net

13.107.246.44

t.ly

104.20.7.133

aixeliedaily.com

192.254.233.44

d2vgu95hoyrpkh.cloudfront.net

18.245.31.33

cs837.wac.edgecastcdn.net

192.229.133.221

cdnjs.cloudflare.com

104.17.25.14

s-part-0017.t-0009.fb-t-msedge.net

13.107.253.45

s-part-0017.t-0009.t-msedge.net

13.107.246.45

sni1gl.wpc.omegacdn.net

152.199.21.175

www.google.com

142.250.185.228

s-part-0032.t-0009.t-msedge.net

13.107.246.60

fp2e7a.wpc.phicdn.net

192.229.221.95

aadcdn.msftauth.net

unknown

www.w3schools.com

unknown

cdn.socket.io

unknown

There are 5 hidden domains, click here to show them.

IPs

IP

Domain

Country

Malicious

142.250.185.228

www.google.com

United States

13.107.246.45

s-part-0017.t-0009.t-msedge.net

United States

13.107.246.44

s-part-0016.t-0009.t-msedge.net

United States

13.107.253.45

s-part-0017.t-0009.fb-t-msedge.net

United States

18.245.31.33

d2vgu95hoyrpkh.cloudfront.net

United States

192.229.133.221

cs837.wac.edgecastcdn.net

United States

192.168.2.5

unknown

unknown

239.255.255.250

unknown

Reserved

18.245.31.5

unknown

United States

152.199.21.175

sni1gl.wpc.omegacdn.net

United States

104.20.7.133

t.ly

United States

104.17.25.14

cdnjs.cloudflare.com

United States

192.254.233.44

aixeliedaily.com

United States

There are 3 hidden IPs, click here to show them.

DOM / HTML

URL

Malicious

https://aixeliedaily.com/m/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VWxSblFsQT0mdWlkPVVTRVIzMDA5MjAyNFUyNjA5MzA1Mg

Details

Filename:	1.0.pages.html.dom
Url:	https://aixeliedaily.com/m/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VWxSblFsQT0mdWlkPVVTRVIzMDA5MjAyNFUyNjA5MzA1Mg
Target ID:	2
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1868,i,16090271239642675543,14371664565641883108,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Yara detected HtmlPhish10	Phishing
Yara detected Mamba 2FA PaaS	Phishing
AI detected landing page (webpage, office document or email)	Persistence and Installation Behavior	Browser Extensions