IOC Report
Secured_Voice_Transcription_Arnoldclark_847.shtml

Files

File Path

Type

Category

Malicious

Secured_Voice_Transcription_Arnoldclark_847.shtml

HTML document, ASCII text, with very long lines (63965), with CRLF line terminators

initial sample

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 10:17:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 10:17:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 10:17:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 10:17:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 10:17:38 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Chrome Cache Entry: 100

SVG Scalable Vector Graphics image

dropped

Chrome Cache Entry: 101

ASCII text, with very long lines (50758)

downloaded

Chrome Cache Entry: 102

ASCII text, with very long lines (19015)

downloaded

Chrome Cache Entry: 103

ASCII text, with very long lines (65462), with CRLF line terminators

downloaded

Chrome Cache Entry: 104

ASCII text, with very long lines (19015)

dropped

Chrome Cache Entry: 105

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592

dropped

Chrome Cache Entry: 106

ASCII text, with very long lines (48664)

dropped

Chrome Cache Entry: 107

ASCII text, with very long lines (32065)

downloaded

Chrome Cache Entry: 108

MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors

downloaded

Chrome Cache Entry: 91

gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592

downloaded

Chrome Cache Entry: 92

ASCII text, with very long lines (32012)

dropped

Chrome Cache Entry: 93

ASCII text, with very long lines (48664)

downloaded

Chrome Cache Entry: 94

MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors

dropped

Chrome Cache Entry: 95

ASCII text, with very long lines (32012)

downloaded

Chrome Cache Entry: 96

ASCII text, with very long lines (32065)

dropped

Chrome Cache Entry: 97

ASCII text, with very long lines (50758)

dropped

Chrome Cache Entry: 98

ASCII text, with very long lines (65462), with CRLF line terminators

dropped

Chrome Cache Entry: 99

SVG Scalable Vector Graphics image

downloaded

There are 15 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\Secured_Voice_Transcription_Arnoldclark_847.shtml"

Details

Is windows:	true
Is dropped:	false
PID:	1372
Target ID:	0
Parent PID:	5476
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\Secured_Voice_Transcription_Arnoldclark_847.shtml"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	07:17:32
Date:	28/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1784,i,1305048728697144924,11032321387331793717,262144 /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	1164
Target ID:	2
Parent PID:	1372
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1784,i,1305048728697144924,11032321387331793717,262144 /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	07:17:35
Date:	28/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

IP

Malicious

file:///C:/Users/user/Desktop/Secured_Voice_Transcription_Arnoldclark_847.shtml#

file:///C:/Users/user/Desktop/Secured_Voice_Transcription_Arnoldclark_847.shtml

https://5721769962-1323985617.cos.sa-saopaulo.myqcloud.com/attach%2Fbootstrap.min.js

43.157.144.192

https://github.com/twbs/bootstrap/graphs/contributors)

unknown

https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js

104.17.24.14

http://154.12.226.113/5721769962/next.php

154.12.226.113

https://getbootstrap.com)

unknown

https://code.jquery.com/jquery-3.2.1.slim.min.js

151.101.2.137

https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg

152.199.21.175

https://github.com/twbs/bootstrap/blob/master/LICENSE)

unknown

https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js

104.18.10.207

https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js

104.18.11.207

http://opensource.org/licenses/MIT).

unknown

https://getbootstrap.com/)

unknown

There are 4 hidden URLs, click here to show them.

Domains

Name

IP

Malicious

stackpath.bootstrapcdn.com

104.18.10.207

cos.sa-saopaulo.myqcloud.com

43.157.144.192

s-part-0016.t-0009.t-msedge.net

13.107.246.44

code.jquery.com

151.101.2.137

cdnjs.cloudflare.com

104.17.24.14

s-part-0036.t-0009.t-msedge.net

13.107.246.64

maxcdn.bootstrapcdn.com

104.18.11.207

sni1gl.wpc.omegacdn.net

152.199.21.175

www.google.com

142.250.186.164

aadcdn.msftauth.net

unknown

5721769962-1323985617.cos.sa-saopaulo.myqcloud.com

unknown

There are 1 hidden domains, click here to show them.

IPs

IP

Domain

Country

Malicious

104.17.24.14

cdnjs.cloudflare.com

United States

13.107.246.64

s-part-0036.t-0009.t-msedge.net

United States

104.18.10.207

stackpath.bootstrapcdn.com

United States

13.107.246.44

s-part-0016.t-0009.t-msedge.net

United States

43.135.205.247

unknown

Japan

192.168.2.5

unknown

unknown

151.101.2.137

code.jquery.com

United States

104.18.11.207

maxcdn.bootstrapcdn.com

United States

154.12.226.113

unknown

United States

239.255.255.250

unknown

Reserved

43.157.144.192

cos.sa-saopaulo.myqcloud.com

Japan

142.250.186.164

www.google.com

United States

152.199.21.175

sni1gl.wpc.omegacdn.net

United States

151.101.194.137

unknown

United States

There are 4 hidden IPs, click here to show them.

DOM / HTML

URL

Malicious

file:///C:/Users/user/Desktop/Secured_Voice_Transcription_Arnoldclark_847.shtml

file:///C:/Users/user/Desktop/Secured_Voice_Transcription_Arnoldclark_847.shtml#

file:///C:/Users/user/Desktop/Secured_Voice_Transcription_Arnoldclark_847.shtml