IOC Report
https://docs.google.com/drawings/d/1rnJTD83ySW2kuilnF4J1ffAp0B5BM7BM0Nvi8F8BbSI/preview?pli=1HeatherMitchell-andrew.tokar@overlakehospital.org

Files

File Path

Type

Category

Malicious

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 22:17:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Chrome Cache Entry: 102

SVG Scalable Vector Graphics image

downloaded

Chrome Cache Entry: 103

ASCII text, with very long lines (65536), with no line terminators

downloaded

Chrome Cache Entry: 104

PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced

downloaded

Chrome Cache Entry: 105

HTML document, ASCII text, with very long lines (1899)

downloaded

Chrome Cache Entry: 107

PNG image data, 1600 x 818, 8-bit/color RGB, non-interlaced

dropped

Chrome Cache Entry: 108

ASCII text, with very long lines (6898)

dropped

Chrome Cache Entry: 109

GIF image data, version 89a, 352 x 3

downloaded

Chrome Cache Entry: 110

GIF image data, version 89a, 352 x 3

downloaded

Chrome Cache Entry: 111

ASCII text, with very long lines (65536), with no line terminators

downloaded

Chrome Cache Entry: 112

ASCII text

downloaded

Chrome Cache Entry: 113

Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators

downloaded

Chrome Cache Entry: 114

ASCII text, with very long lines (61177)

downloaded

Chrome Cache Entry: 117

Unicode text, UTF-8 (with BOM) text, with very long lines (59783), with CRLF line terminators

downloaded

Chrome Cache Entry: 118

JSON data

downloaded

Chrome Cache Entry: 119

SVG Scalable Vector Graphics image

dropped

Chrome Cache Entry: 120

ASCII text, with very long lines (47694)

dropped

Chrome Cache Entry: 122

MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel

downloaded

Chrome Cache Entry: 123

Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators

downloaded

Chrome Cache Entry: 124

Web Open Font Format (Version 2), TrueType, length 15344, version 1.0

downloaded

Chrome Cache Entry: 125

ASCII text, with no line terminators

downloaded

Chrome Cache Entry: 126

HTML document, ASCII text, with very long lines (3450), with CRLF line terminators

downloaded

Chrome Cache Entry: 127

Unicode text, UTF-8 text, with very long lines (32016)

downloaded

Chrome Cache Entry: 128

HTML document, ASCII text, with very long lines (394)

downloaded

Chrome Cache Entry: 129

JPEG image data, baseline, precision 8, 1920x1080, components 3

dropped

Chrome Cache Entry: 130

PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced

dropped

Chrome Cache Entry: 132

JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=2, software=paint.net 4.2.9], baseline, precision 8, 50x28, components 3

downloaded

Chrome Cache Entry: 136

ASCII text, with very long lines (24050)

downloaded

Chrome Cache Entry: 86

PNG image data, 600 x 1, 8-bit/color RGBA, non-interlaced

downloaded

Chrome Cache Entry: 87

MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors

downloaded

Chrome Cache Entry: 90

ASCII text, with very long lines (32960)

dropped

Chrome Cache Entry: 93

PNG image data, 59 x 42, 8-bit/color RGB, non-interlaced

dropped

Chrome Cache Entry: 94

PNG image data, 54 x 54, 8-bit colormap, non-interlaced

dropped

Chrome Cache Entry: 97

ASCII text, with very long lines (994), with no line terminators

downloaded

Chrome Cache Entry: 99

Unicode text, UTF-8 (with BOM) text, with very long lines (65339), with CRLF line terminators

downloaded

There are 26 hidden files, click here to show them.

URLs

Name

IP

Malicious

https://docs.google.com/drawings/d/1rnJTD83ySW2kuilnF4J1ffAp0B5BM7BM0Nvi8F8BbSI/preview?pli=1HeatherMitchell-andrew.tokar@overlakehospital.org

Details

Filetype:	URL
Filename:	https://docs.google.com/drawings/d/1rnJTD83ySW2kuilnF4J1ffAp0B5BM7BM0Nvi8F8BbSI/preview?pli=1HeatherMitchell-andrew.tokar@overlakehospital.org

Signature Hits	Behavior Group	Mitre Attack
AI detected phishing page	Phishing
Yara detected BlockedWebSite	Phishing
Yara detected HtmlPhish54	Phishing	Non-Application Layer Protocol
HTML body contains low number of good links	Phishing
HTML page contains hidden javascript code	Phishing
HTML page contains obfuscated script src	Phishing
Stores files to the Windows start menu directory	Boot Survival	Registry Run Keys / Startup Folder
URL contains potential PII (phishing indication)	Phishing
Uses insecure TLS / SSL version for HTTPS connection	Compliance, Networking
Classification label	System Summary
Connects to IPs without corresponding DNS lookups	Networking
Creates files inside the user directory	System Summary	Masquerading
Found iframes	Phishing	Drive-by Compromise
HTML body contains password input	Phishing
HTML page is missing a favicon	Phishing
META author tag missing	Phishing
META copyright tag missing	Phishing
Performs DNS lookups	Networking	Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection
Uses HTTPS	Networking	Application Layer Protocol
Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis		Encrypted Channel
Uses secure TLS version for HTTPS connections	Compliance, Networking
Found graphical window changes (likely an installer)	System Summary

https://2f8d0761.71b8ca7cfce14e662138104d.workers.dev/

https://docs.google.com/drawings/d/1rnJTD83ySW2kuilnF4J1ffAp0B5BM7BM0Nvi8F8BbSI/preview?pli=1HeatherMitchell-andrew.tokar@overlakehospital.org

Details

Name:	https://docs.google.com/drawings/d/1rnJTD83ySW2kuilnF4J1ffAp0B5BM7BM0Nvi8F8BbSI/preview?pli=1HeatherMitchell-andrew.tokar@overlakehospital.org
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Source:	browser

Signature Hits	Behavior Group	Mitre Attack
URL contains potential PII (phishing indication)	Phishing
Spawns processes	System Summary	Process Injection

Domains

Name

IP

Malicious

bastionbrands.org

147.45.178.112

docs.google.com

172.217.19.238

ooc-g2.tm-4.office.com

52.98.61.50

a.nel.cloudflare.com

35.190.80.1

2f8d0761.71b8ca7cfce14e662138104d.workers.dev

172.67.193.18

challenges.cloudflare.com

104.18.94.41

9213myi3lra.emersomnasonry.com

147.45.178.112

sni1gl.wpc.omegacdn.net

152.199.21.175

www.google.com

142.250.181.100

lifelinegrant.com

147.45.178.112

s-part-0035.t-0009.t-msedge.net

13.107.246.63

googlehosted.l.googleusercontent.com

142.250.181.97

r4.res.office365.com

unknown

aadcdn.msftauth.net

unknown

lh7-rt.googleusercontent.com

unknown

outlook.office365.com

unknown

There are 6 hidden domains, click here to show them.

IPs

IP

Domain

Country

Malicious

147.45.178.112

bastionbrands.org

Russian Federation

172.217.19.238

docs.google.com

United States

13.107.246.63

s-part-0035.t-0009.t-msedge.net

United States

1.1.1.1

unknown

Australia

172.217.17.67

unknown

United States

172.217.17.78

unknown

United States

172.217.17.35

unknown

United States

2.22.245.208

unknown

European Union

104.21.73.233

unknown

United States

104.18.94.41

challenges.cloudflare.com

United States

192.168.2.16

unknown

unknown

216.58.208.227

unknown

United States

104.18.95.41

unknown

United States

142.250.181.100

www.google.com

United States

20.190.181.23

unknown

United States

74.125.205.84

unknown

United States

239.255.255.250

unknown

Reserved

172.67.193.18

2f8d0761.71b8ca7cfce14e662138104d.workers.dev

United States

152.199.21.175

sni1gl.wpc.omegacdn.net

United States

35.190.80.1

a.nel.cloudflare.com

United States

52.98.61.50

ooc-g2.tm-4.office.com

United States

172.217.17.42

unknown

United States

142.250.181.97

googlehosted.l.googleusercontent.com

United States

There are 13 hidden IPs, click here to show them.