Edit tour

Windows Analysis Report
http://https:/e.cdlt.jibjab.com/c2/225:4f16e2ba44501a8a8bf3ed302d09b87f:d240209:65c6bb2428085be667d1bac9:1707522852103/8e54784a?jwtH=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9&jwtP=eyJpYXQiOjE3MDc1MjI5NzQsImNkIjoiLmppYmphYi5jb20iLCJjZSI6ODY0MDAsInRrIjoiamliamFibSIsIm10bElEIjoiNjVjNWRiOTFmNGMwYmEzYjExMGM0Z

Overview

General Information

Sample URL:	http://https:/e.cdlt.jibjab.com/c2/225:4f16e2ba44501a8a8bf3ed302d09b87f:d240209:65c6bb2428085be667d1bac9:1707522852103/8e54784a?jwtH=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9&jwtP=eyJpYXQiOjE3MDc1MjI5NzQsI
Analysis ID:	1391071
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Creates files inside the system directory

Sigma detected: Suspicious Office Token Search Via CLI

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6556 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2132 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 --field-trial-handle=2532,i,1680531711560861017,17543554451149963471,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2316 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "http://https:/e.cdlt.jibjab.com/c2/225:4f16e2ba44501a8a8bf3ed302d09b87f:d240209:65c6bb2428085be667d1bac9:1707522852103/8e54784a?jwtH=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9&jwtP=eyJpYXQiOjE3MDc1MjI5NzQsImNkIjoiLmppYmphYi5jb20iLCJjZSI6ODY0MDAsInRrIjoiamliamFibSIsIm10bElEIjoiNjVjNWRiOTFmNGMwYmEzYjExMGM0ZWU4IiwibGlua1VybCI6Imh0dHBzOlwvXC93d3cuamliamFiLmNvbVwvdmlld1wvbWFrZVwvYWRkaWN0ZWRfdG9fbG92ZV9yb2JlcnRfcGFsbWVyX2Fubml2ZXJzYXJ5XC80M2M2NzZkYi0yY2IxLTQ3Y2EtOTA1NS1iMjg0N2VkNTgyNWY_cmVjaXBpZW50X3Rva2VuPTE2ZjNlOTk0LTBkZDgtNDc5Yi1iOTE3LTRhOTJlN2FiMWQxYyZ1dG1fY2FtcGFpZ249dHhfcmVjaXBpZW50X25vdGlmaWNhdGlvbiZ1dG1fdGVybT0mdXRtX3NvdXJjZT1jb3JkaWFsJnV0bV9tZWRpdW09ZW1haWwifQ&jwtS=eOhWS_qON4C7Pn_vFN9iXDtpYuHwzoYSTCcLc-Ce86o__;!!EhqYCQ!cHK5TxT8glt9qsWTQaBnSDPNius5-SdyQMZ78XjuGJ7hEnpIkoW7Wm8RBPEiYsdL79SvidfZc1DWgCTnKDTKz0SxG5Y$%20urldefense.com MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Suspicious Office Token Search Via CLI

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Program Files\Google\Chrome\Application\chrome.exe" "http://https:/e.cdlt.jibjab.com/c2/225:4f16e2ba44501a8a8bf3ed302d09b87f:d240209:65c6bb2428085be667d1bac9:1707522852103/8e54784a?jwtH=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9&jwtP=eyJpYXQiOjE3MDc1MjI5NzQsImNkIjoiLmppYmphYi5jb20iLCJjZSI6ODY0MDAsInRrIjoiamliamFibSIsIm10bElEIjoiNjVjNWRiOTFmNGMwYmEzYjExMGM0ZWU4IiwibGlua1VybCI6Imh0dHBzOlwvXC93d3cuamliamFiLmNvbVwvdmlld1wvbWFrZVwvYWRkaWN0ZWRfdG9fbG92ZV9yb2JlcnRfcGFsbWVyX2Fubml2ZXJzYXJ5XC80M2M2NzZkYi0yY2IxLTQ3Y2EtOTA1NS1iMjg0N2VkNTgyNWY_cmVjaXBpZW50X3Rva2VuPTE2ZjNlOTk0LTBkZDgtNDc5Yi1iOTE3LTRhOTJlN2FiMWQxYyZ1dG1fY2FtcGFpZ249dHhfcmVjaXBpZW50X25vdGlmaWNhdGlvbiZ1dG1fdGVybT0mdXRtX3NvdXJjZT1jb3JkaWFsJnV0bV9tZWRpdW09ZW1haWwifQ&jwtS=eOhWS_qON4C7Pn_vFN9iXDtpYuHwzoYSTCcLc-Ce86o__;!!EhqYCQ!cHK5TxT8glt9qsWTQaBnSDPNius5-SdyQMZ78XjuGJ7hEnpIkoW7Wm8RBPEiYsdL79SvidfZc1DWgCTnKDTKz0SxG5Y$%20urldefense.com, CommandLine: C:\Program Files\Google\Chrome\Application\chrome.exe" "http://https:/e.cdlt.jibjab.com/c2/225:4f16e2ba44501a8a8bf3ed302d09b87f:d240209:65c6bb2428085be667d1bac9:1707522852103/8e54784a?jwtH=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9&jwtP=eyJpYXQiOjE3MDc1MjI5NzQsImNkIjoiLmppYmphYi5jb20iLCJjZSI6ODY0MDAsInRrIjoiamliamFibSIsIm10bElEIjoiNjVjNWRiOTFmNGMwYmEzYjExMGM0ZWU4IiwibGlua1VybCI6Imh0dHBzOlwvXC93d3cuamliamFiLmNvbVwvdmlld1wvbWFrZVwvYWRkaWN0ZWRfdG9fbG92ZV9yb2JlcnRfcGFsbWVyX2Fubml2ZXJzYXJ5XC80M2M2NzZkYi0yY2IxLTQ3Y2EtOTA1NS1iMjg0N2VkNTgyNWY_cmVjaXBpZW50X3Rva2VuPTE2ZjNlOTk0LTBkZDgtNDc5Yi1iOTE3LTRhOTJlN2FiMWQxYyZ1dG1fY2FtcGFpZ249dHhfcmVjaXBpZW50X25vdGlmaWNhdGlvbiZ1dG1fdGVybT0mdXRtX3NvdXJjZT1jb3JkaWFsJnV0bV9tZWRpdW09ZW1haWwifQ&jwtS=eOhWS_qON4C7Pn_vFN9iXDtpYuHwzoYSTCcLc-Ce86o__;!!EhqYCQ!cHK5TxT8glt9qsWTQaBnSDPNius5-SdyQMZ78XjuGJ7hEnpIkoW7Wm8RBPEiYsdL79SvidfZc1DWgCTnKDTKz0SxG5Y$%20urldefense.com, CommandLine|base64offset|contains: , Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 6108, ProcessCommandLine: C:\Program Files\Google\Chrome\Application\chrome.exe" "http://https:/e.cdlt.jibjab.com/c2/225:4f16e2ba44501a8a8bf3ed302d09b87f:d240209:65c6bb2428085be667d1bac9:1707522852103/8e54784a?jwtH=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9&jwtP=eyJpYXQiOjE3MDc1MjI5NzQsImNkIjoiLmppYmphYi5jb20iLCJjZSI6ODY0MDAsInRrIjoiamliamFibSIsIm10bElEIjoiNjVjNWRiOTFmNGMwYmEzYjExMGM0ZWU4IiwibGlua1VybCI6Imh0dHBzOlwvXC93d3cuamliamFiLmNvbVwvdmlld1wvbWFrZVwvYWRkaWN0ZWRfdG9fbG92ZV9yb2JlcnRfcGFsbWVyX2Fubml2ZXJzYXJ5XC80M2M2NzZkYi0yY2IxLTQ3Y2EtOTA1NS1iMjg0N2VkNTgyNWY_cmVjaXBpZW50X3Rva2VuPTE2ZjNlOTk0LTBkZDgtNDc5Yi1iOTE3LTRhOTJlN2FiMWQxYyZ1dG1fY2FtcGFpZ249dHhfcmVjaXBpZW50X25vdGlmaWNhdGlvbiZ1dG1fdGVybT0mdXRtX3NvdXJjZT1jb3JkaWFsJnV0bV9tZWRpdW09ZW1haWwifQ&jwtS=eOhWS_qON4C7Pn_vFN9iXDtpYuHwzoYSTCcLc-Ce86o__;!!EhqYCQ!cHK5TxT8glt9qsWTQaBnSDPNius5-SdyQMZ78XjuGJ7hEnpIkoW7Wm8RBPEiYsdL79SvidfZc1DWgCTnKD

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown	HTTPS traffic detected: 23.33.136.127:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.33.136.127:443 -> 192.168.2.5:49717 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=00000000000000000000000000000000000000005EF1BFCF85 HTTP/1.1Host: clients1.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 23.33.136.127:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.33.136.127:443 -> 192.168.2.5:49717 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_BITS_6556_52178828

Jump to behavior

Source: classification engine

Classification label: clean1.win@20/6@10/5

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 --field-trial-handle=2532,i,1680531711560861017,17543554451149963471,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "http://https:/e.cdlt.jibjab.com/c2/225:4f16e2ba44501a8a8bf3ed302d09b87f:d240209:65c6bb2428085be667d1bac9:1707522852103/8e54784a?jwtH=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9&jwtP=eyJpYXQiOjE3MDc1MjI5NzQsImNkIjoiLmppYmphYi5jb20iLCJjZSI6ODY0MDAsInRrIjoiamliamFibSIsIm10bElEIjoiNjVjNWRiOTFmNGMwYmEzYjExMGM0ZWU4IiwibGlua1VybCI6Imh0dHBzOlwvXC93d3cuamliamFiLmNvbVwvdmlld1wvbWFrZVwvYWRkaWN0ZWRfdG9fbG92ZV9yb2JlcnRfcGFsbWVyX2Fubml2ZXJzYXJ5XC80M2M2NzZkYi0yY2IxLTQ3Y2EtOTA1NS1iMjg0N2VkNTgyNWY_cmVjaXBpZW50X3Rva2VuPTE2ZjNlOTk0LTBkZDgtNDc5Yi1iOTE3LTRhOTJlN2FiMWQxYyZ1dG1fY2FtcGFpZ249dHhfcmVjaXBpZW50X25vdGlmaWNhdGlvbiZ1dG1fdGVybT0mdXRtX3NvdXJjZT1jb3JkaWFsJnV0bV9tZWRpdW09ZW1haWwifQ&jwtS=eOhWS_qON4C7Pn_vFN9iXDtpYuHwzoYSTCcLc-Ce86o__;!!EhqYCQ!cHK5TxT8glt9qsWTQaBnSDPNius5-SdyQMZ78XjuGJ7hEnpIkoW7Wm8RBPEiYsdL79SvidfZc1DWgCTnKDTKz0SxG5Y$%20urldefense.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 --field-trial-handle=2532,i,1680531711560861017,17543554451149963471,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	11 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph