Analysis Report http://x.co/6nfZW

Overview

General Information

Joe Sandbox Version:	25.0.0 Tiger's Eye
Analysis ID:	109769
Start date:	11.02.2019
Start time:	17:37:15
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://x.co/6nfZW
Analysis system description:	Windows 10 64 bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	EGA enabled HDC enabled
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@3/30@4/3
Cookbook Comments:	Adjust boot time Browsing link: https://www.google.com/
Warnings:	Show All Exclude process from analysis (whitelisted): ielowutil.exe, wermgr.exe, conhost.exe, CompatTelRunner.exe, svchost.exe Report size getting too big, too many NtDeviceIoControlFile calls found.

Detection

Strategy	Score	Range	Reporting	Whitelisted	Detection
Threshold	0	0 - 100	Report FP / FN	false

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	4	0 - 5	false

Classification

Analysis Advice

Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control
Valid Accounts	Windows Remote Management	Winlogon Helper DLL	Port Monitors	File System Logical Offsets	Credential Dumping	System Service Discovery	Application Deployment Software	Data from Local System	Data Encrypted1	Standard Non-Application Layer Protocol3
Replication Through Removable Media	Service Execution	Port Monitors	Accessibility Features	Binary Padding	Network Sniffing	Application Window Discovery	Remote Services	Data from Removable Media	Exfiltration Over Other Network Medium	Standard Application Layer Protocol3

Signature Overview

Click to jump to signature section

Networking:

Downloads files from webservers via HTTP

Show sources

Source: global traffic

HTTP traffic detected: GET /6nfZW HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: x.coConnection: Keep-Alive

Found strings which match to known social media urls

Show sources

Source: BRN07A83.htm.3.dr	String found in binary or memory: </script><div class="gb_ab"><div class="gb_ca gb_ba gb_pa" aria-label="Google-Apps" aria-hidden="true" role="region"><ul class="gb_ea gb_7" aria-dropeffect="move"><li class="gb_T" aria-grabbed="false"><a class="gb_O" data-pid="192" draggable="false" href="https://myaccount.google.com/?utm_source=OGB&tab=wk&utm_medium=app" id="gb192"><div class="gb_3"></div><div class="gb_4"></div><div class="gb_5"></div><div class="gb_6"></div><span class="gb_W" style="background-position:0 -69px"></span><span class="gb_Z">Google-Konto</span></a></li><li class="gb_T" aria-grabbed="false"><a class="gb_O" data-pid="1" draggable="false" href="https://www.google.ch/webhp?tab=ww" id="gb1"><div class="gb_3"></div><div class="gb_4"></div><div class="gb_5"></div><div class="gb_6"></div><span class="gb_W" style="background-position:0 -1311px"></span><span class="gb_Z">Suche</span></a></li><li class="gb_T" aria-grabbed="false"><a class="gb_O" data-pid="8" draggable="false" href="https://maps.google.ch/maps?hl=de&tab=wl" id="
Source: msapplication.xml0.2.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xb0e2215e,0x01d4c273</date><accdate>0xb0e2215e,0x01d4c273</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.2.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xb0e2215e,0x01d4c273</date><accdate>0xb0e2215e,0x01d4c273</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.2.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xb0e97ca5,0x01d4c273</date><accdate>0xb0e97ca5,0x01d4c273</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.2.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xb0e97ca5,0x01d4c273</date><accdate>0xb0e97ca5,0x01d4c273</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.2.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xb0ecb4f4,0x01d4c273</date><accdate>0xb0ecb4f4,0x01d4c273</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.2.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xb0ecb4f4,0x01d4c273</date><accdate>0xb0ecb4f4,0x01d4c273</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: x.co

Urls found in memory or binary data

Show sources

Source: cb=gapi[1].js.3.dr	String found in binary or memory: http://csi.gstatic.com/csi
Source: msapplication.xml.2.dr	String found in binary or memory: http://www.amazon.com/
Source: BRN07A83.htm.3.dr	String found in binary or memory: http://www.broofa.com
Source: msapplication.xml1.2.dr	String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.2.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.2.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.2.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.2.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.2.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.2.dr	String found in binary or memory: http://www.youtube.com/
Source: m=sb_wiz,aa,abd,async,dvl,foot,ipv6,lu,m,mu,sf,cbin,tnqaT,cbhb,xz7cCd,WgDvvc[1].js.3.dr	String found in binary or memory: https://accounts.google.com/Login
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://accounts.google.com/ServiceLogin?hl=de&passive=true&continue=https://www.google.com/
Source: cb=gapi[1].js.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: cb=gapi[1].js.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://adservice.google.com/adsid/google/ui
Source: rs=AA2YrTucvJW4VYxHYjgveD4S95ofAjsDkg[1].js.3.dr, cb=gapi[1].js.3.dr, BRN07A83.htm.3.dr	String found in binary or memory: https://apis.google.com
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://apis.google.com/js/api.js
Source: cb=gapi[1].js.3.dr	String found in binary or memory: https://clients6.google.com
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://consent.google.com/status?continue=https://www.google.com&pc=s&timestamp=1549903110&
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://consent.google.com?hl
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://contacts.google.com/?hl=de&tab=wC
Source: cb=gapi[1].js.3.dr	String found in binary or memory: https://content.googleapis.com
Source: cb=gapi[1].js.3.dr	String found in binary or memory: https://csi.gstatic.com/csi
Source: cb=gapi[1].js.3.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://drive.google.com/?tab=wo
Source: cb=gapi[1].js.3.dr	String found in binary or memory: https://gsuite.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://mail.google.com/mail/?tab=wm
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://maps.google.ch/maps?hl=de&tab=wl
Source: {DA4FA68B-2E66-11E9-AADE-9CC1A2A860C6}.dat.2.dr	String found in binary or memory: https://milanomi.xyz/d
Source: ~DFE6B7164BC28D2982.TMP.2.dr	String found in binary or memory: https://milanomi.xyz/dfbd/nanoth/office2018
Source: {DA4FA68B-2E66-11E9-AADE-9CC1A2A860C6}.dat.2.dr	String found in binary or memory: https://milanomi.xyz/dfbd/nanoth/office20180E/d/nanoth/office2018Root
Source: {DA4FA68B-2E66-11E9-AADE-9CC1A2A860C6}.dat.2.dr	String found in binary or memory: https://milanomi.xyz/dfbd/nanoth/office20180ERoot
Source: {DA4FA68B-2E66-11E9-AADE-9CC1A2A860C6}.dat.2.dr	String found in binary or memory: https://milanomi.xyz/dfbd/nanoth/office20180Efbd/nanoth/office2018Root
Source: ~DFE6B7164BC28D2982.TMP.2.dr	String found in binary or memory: https://milanomi.xyz/dfbd/nanoth/office20180Error
Source: {DA4FA68B-2E66-11E9-AADE-9CC1A2A860C6}.dat.2.dr	String found in binary or memory: https://milanomi.xyz/dfbd/nanoth/office2018Root
Source: ~DFE6B7164BC28D2982.TMP.2.dr	String found in binary or memory: https://milanomi.xyz/dfbd/nanoth/office2018x
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://myaccount.google.com/?utm_source=OGB&tab=wk&utm_medium=app
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://news.google.ch/nwshp?hl=de&tab=wn
Source: rs=AA2YrTucvJW4VYxHYjgveD4S95ofAjsDkg[1].js.3.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=drsl&drsl=
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://play.google.com/?hl=de&tab=w8
Source: rs=ACT90oEM3yRzDBSGK2gUq2k5MTuOuzzWzQ[1].js.3.dr, BRN07A83.htm.3.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://play.googleapis.com/staging/log
Source: cb=gapi[1].js.3.dr	String found in binary or memory: https://plus.google.com
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://plus.google.com/?gpsrc=ogpy0&tab=wX
Source: cb=gapi[1].js.3.dr	String found in binary or memory: https://plus.googleapis.com
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://ssl.gstatic.com/gb/images/silhouette_27.png)
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://ssl.gstatic.com/gb/images/silhouette_96.png)
Source: rs=AA2YrTucvJW4VYxHYjgveD4S95ofAjsDkg[1].js.3.dr	String found in binary or memory: https://ssl.gstatic.com/gb/images/spinner_32.gif
Source: cb=gapi[1].js.3.dr	String found in binary or memory: https://ssl.gstatic.com/gb/js/
Source: rs=ACT90oEM3yRzDBSGK2gUq2k5MTuOuzzWzQ[1].js.3.dr	String found in binary or memory: https://support.google.com/websearch/answer/106230
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://support.google.com/websearch/answer/106230?hl=de-CH
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://translate.google.ch/?hl=de&tab=wT
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://www.google.ch/domainless/read?igu
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://www.google.ch/imghp?hl=de&tab=wi
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://www.google.ch/intl/de/about/products?tab=wh
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://www.google.ch/webhp?tab=ww
Source: BRN07A83.htm.3.dr, {DA4FA68B-2E66-11E9-AADE-9CC1A2A860C6}.dat.2.dr	String found in binary or memory: https://www.google.com
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://www.google.com/
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://www.google.com/calendar?tab=wc
Source: ~DFE6B7164BC28D2982.TMP.2.dr	String found in binary or memory: https://www.google.com/d/nanoth/office2018P
Source: imagestore.dat.3.dr	String found in binary or memory: https://www.google.com/favicon.ico
Source: imagestore.dat.3.dr	String found in binary or memory: https://www.google.com/favicon.ico~
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://www.google.com/intl/de_ch/about/?utm_source=google-CH&utm_medium=referral&utm_campai
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://www.google.com/intl/de_ch/ads/?subid=ww-ww-et-g-awa-a-g_hpafoot1_1
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://www.google.com/intl/de_ch/policies/privacy/?fg=1
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://www.google.com/intl/de_ch/policies/terms/?fg=1
Source: rs=ACT90oEM3yRzDBSGK2gUq2k5MTuOuzzWzQ[1].js.3.dr, BRN07A83.htm.3.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://www.google.com/preferences?hl=de
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://www.google.com/preferences?hl=de-CH&fg=1
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://www.google.com/services/?subid=ww-ww-et-g-awa-a-g_hpbfoot1_1
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://www.google.com/setprefs?sig=0_dV4o64gnAQonqo6AQBpqYiKTBWY%3D&hl=en&source=homepage&a
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://www.google.com/setprefs?sig=0_dV4o64gnAQonqo6AQBpqYiKTBWY%3D&hl=fr&source=homepage&a
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://www.google.com/setprefs?sig=0_dV4o64gnAQonqo6AQBpqYiKTBWY%3D&hl=it&source=homepage&a
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://www.google.com/setprefs?sig=0_dV4o64gnAQonqo6AQBpqYiKTBWY%3D&hl=rm&source=homepage&a
Source: rs=AA2YrTucvJW4VYxHYjgveD4S95ofAjsDkg[1].js.3.dr	String found in binary or memory: https://www.google.com/support/profiles/?p=plusone_button_error&hl=en-US
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://www.google.com/url?q=https://www.google.com/chrome/browser/desktop/index.html%3Fbrand%3DOKWM
Source: cb=gapi[1].js.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: cb=gapi[1].js.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: BRN07A83.htm.3.dr	String found in binary or memory: https://www.youtube.com/?gl=CH

Uses HTTPS

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814

System Summary:

Classification label

Show sources

Source: classification engine

Classification label: clean0.win@3/30@4/3

Creates files inside the user directory

Show sources

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Creates temporary files

Show sources

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\CRAIGH~1\AppData\Local\Temp\~DFE5A72D69D0638CBC.TMP

Jump to behavior

Reads ini files

Show sources

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Spawns processes

Show sources

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4648 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4648 CREDAT:17410 /prefetch:2	Jump to behavior

Found graphical window changes (likely an installer)

Show sources

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_171\bin\msvcr100.dll

Jump to behavior

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious

Simulations

Behavior and APIs

No simulations

Antivirus Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://x.co/6nfZW	0%	virustotal		Browse

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link	Download
milanomi.xyz	0%	virustotal		Browse	Download File

URLs

Source	Detection	Scanner	Label	Link	Download
https://milanomi.xyz/d	0%	Avira URL Cloud	safe		Download File
http://x.co/6nfZW	0%	virustotal		Browse	Download File
http://x.co/6nfZW	0%	Avira URL Cloud	safe		Download File
https://milanomi.xyz/dfbd/nanoth/office2018Root	0%	Avira URL Cloud	safe		Download File
https://milanomi.xyz/dfbd/nanoth/office20180ERoot	0%	Avira URL Cloud	safe		Download File
https://milanomi.xyz/dfbd/nanoth/office20180E/d/nanoth/office2018Root	0%	Avira URL Cloud	safe		Download File
https://milanomi.xyz/dfbd/nanoth/office2018x	0%	Avira URL Cloud	safe		Download File
https://milanomi.xyz/dfbd/nanoth/office20180Error	0%	Avira URL Cloud	safe		Download File
https://milanomi.xyz/dfbd/nanoth/office20180Efbd/nanoth/office2018Root	0%	Avira URL Cloud	safe		Download File
https://milanomi.xyz/dfbd/nanoth/office2018	0%	Avira URL Cloud	safe		Download File

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report http://x.co/6nfZW

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Mitre Att&ck Matrix

Signature Overview

Networking:

System Summary:

Behavior Graph

Simulations

Behavior and APIs

Antivirus Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Screenshots

Thumbnails