IOC Report
https://agcompany.sharepoint.com/teams/em/HELENA

loading gif

Files

File Path
Type
Category
Malicious
Chrome Cache Entry: 62
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
dropped
Chrome Cache Entry: 63
HTML document, ASCII text, with very long lines (3450), with CRLF line terminators
downloaded
Chrome Cache Entry: 64
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
downloaded
Chrome Cache Entry: 65
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
dropped
Chrome Cache Entry: 66
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
downloaded
Chrome Cache Entry: 67
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 142367
dropped
Chrome Cache Entry: 68
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449728
downloaded
Chrome Cache Entry: 69
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57443
dropped
Chrome Cache Entry: 70
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
dropped
Chrome Cache Entry: 71
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1024x683, components 3
dropped
Chrome Cache Entry: 72
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
downloaded
Chrome Cache Entry: 73
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
downloaded
Chrome Cache Entry: 74
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15755
dropped
Chrome Cache Entry: 75
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57443
downloaded
Chrome Cache Entry: 76
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 142367
downloaded
Chrome Cache Entry: 77
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 78
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15755
downloaded
Chrome Cache Entry: 79
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
dropped
Chrome Cache Entry: 80
GIF image data, version 89a, 352 x 3
dropped
Chrome Cache Entry: 81
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
downloaded
Chrome Cache Entry: 82
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113378
downloaded
Chrome Cache Entry: 83
GIF image data, version 89a, 352 x 3
dropped
Chrome Cache Entry: 84
GIF image data, version 89a, 352 x 3
downloaded
Chrome Cache Entry: 85
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1024x683, components 3
downloaded
Chrome Cache Entry: 86
gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 449728
dropped
Chrome Cache Entry: 87
GIF image data, version 89a, 352 x 3
downloaded
Chrome Cache Entry: 88
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
dropped
There are 18 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1896,i,12412242935798583819,10466397690930726267,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://agcompany.sharepoint.com/teams/em/HELENA"

URLs

Name
IP
Malicious
https://agcompany.sharepoint.com/teams/em/HELENA
https://aadcdn.msauthimages.net/dbd5a2dd-u9-psfdjtcpbaf2afthgfunhzf-vq4p-n1np9kirb6y/logintenantbranding/0/illustration?ts=636517184236647500
152.199.21.175
https://agcompany.sharepoint.com/teams/em/HELENA
13.107.136.10
https://login.microsoftonline.com
unknown
https://login.windows-ppe.net
unknown
https://agcompany.sharepoint.com/teams/em/HELENA/_layouts/15/Authenticate.aspx?Source=%2Fteams%2Fem%2FHELENA
13.107.136.10
https://login.microsoftonline.com/3e20ecb2-9cb0-4df1-ad7b-914e31dcdda4/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=D844CC28ECF4E5D3F1F50DBFD36299F32521806EB1242574%2D61876DAA5110841FE5FEEC3AC1B1B19D18C3A7B9B0213492410C47E7FE797B00&redirect%5Furi=https%3A%2F%2Fagcompany%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=9d655fa1%2D205a%2D6000%2Dc246%2D1a7260b497cf&sso_reload=true
https://login.microsoftonline.com/3e20ecb2-9cb0-4df1-ad7b-914e31dcdda4/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=D844CC28ECF4E5D3F1F50DBFD36299F32521806EB1242574%2D61876DAA5110841FE5FEEC3AC1B1B19D18C3A7B9B0213492410C47E7FE797B00&redirect%5Furi=https%3A%2F%2Fagcompany%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=9d655fa1%2D205a%2D6000%2Dc246%2D1a7260b497cf
https://agcompany.sharepoint.com/_forms/default.aspx?ReturnUrl=%2fteams%2fem%2fHELENA%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fteams%252Fem%252FHELENA&Source=cookie
13.107.136.10

Domains

Name
IP
Malicious
dual-spo-0005.spo-msedge.net
13.107.136.10
sni1gl.wpc.upsiloncdn.net
152.199.21.175
s-part-0017.t-0009.t-msedge.net
13.107.246.45
sni1gl.wpc.omegacdn.net
152.199.21.175
www.google.com
142.250.185.100
fp2e7a.wpc.phicdn.net
192.229.221.95
autologon.microsoftazuread-sso.com
20.190.159.2
aadcdn.msauthimages.net
unknown
agcompany.sharepoint.com
unknown
identity.nel.measure.office.net
unknown
aadcdn.msftauth.net
unknown
login.microsoftonline.com
unknown
There are 2 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
13.107.136.10
dual-spo-0005.spo-msedge.net
United States
13.107.246.45
s-part-0017.t-0009.t-msedge.net
United States
142.250.185.100
www.google.com
United States
192.168.2.4
unknown
unknown
239.255.255.250
unknown
Reserved
152.199.21.175
sni1gl.wpc.upsiloncdn.net
United States

DOM / HTML

URL
Malicious
https://login.microsoftonline.com/3e20ecb2-9cb0-4df1-ad7b-914e31dcdda4/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=D844CC28ECF4E5D3F1F50DBFD36299F32521806EB1242574%2D61876DAA5110841FE5FEEC3AC1B1B19D18C3A7B9B0213492410C47E7FE797B00&redirect%5Furi=https%3A%2F%2Fagcompany%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=9d655fa1%2D205a%2D6000%2Dc246%2D1a7260b497cf
https://login.microsoftonline.com/3e20ecb2-9cb0-4df1-ad7b-914e31dcdda4/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=D844CC28ECF4E5D3F1F50DBFD36299F32521806EB1242574%2D61876DAA5110841FE5FEEC3AC1B1B19D18C3A7B9B0213492410C47E7FE797B00&redirect%5Furi=https%3A%2F%2Fagcompany%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=9d655fa1%2D205a%2D6000%2Dc246%2D1a7260b497cf&sso_reload=true
https://login.microsoftonline.com/3e20ecb2-9cb0-4df1-ad7b-914e31dcdda4/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=D844CC28ECF4E5D3F1F50DBFD36299F32521806EB1242574%2D61876DAA5110841FE5FEEC3AC1B1B19D18C3A7B9B0213492410C47E7FE797B00&redirect%5Furi=https%3A%2F%2Fagcompany%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=9d655fa1%2D205a%2D6000%2Dc246%2D1a7260b497cf&sso_reload=true
https://login.microsoftonline.com/3e20ecb2-9cb0-4df1-ad7b-914e31dcdda4/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=D844CC28ECF4E5D3F1F50DBFD36299F32521806EB1242574%2D61876DAA5110841FE5FEEC3AC1B1B19D18C3A7B9B0213492410C47E7FE797B00&redirect%5Furi=https%3A%2F%2Fagcompany%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=9d655fa1%2D205a%2D6000%2Dc246%2D1a7260b497cf&sso_reload=true
https://login.microsoftonline.com/3e20ecb2-9cb0-4df1-ad7b-914e31dcdda4/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=D844CC28ECF4E5D3F1F50DBFD36299F32521806EB1242574%2D61876DAA5110841FE5FEEC3AC1B1B19D18C3A7B9B0213492410C47E7FE797B00&redirect%5Furi=https%3A%2F%2Fagcompany%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=9d655fa1%2D205a%2D6000%2Dc246%2D1a7260b497cf&sso_reload=true