Edit tour

Windows Analysis Report
https://smincorporation.com/kr.html#sangdon.yeom@hyundaimovex.com

Overview

General Information

Sample URL:	https://smincorporation.com/kr.html#sangdon.yeom@hyundaimovex.com
Analysis ID:	1427679
Infos:

Errors URL not reachable

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Stores files to the Windows start menu directory

URL contains potential PII (phishing indication)

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6516 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=1884,i,5487348509248761327,9377431468014515543,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2612 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://smincorporation.com/kr.html#sangdon.yeom@hyundaimovex.com" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com

Source: unknown	HTTPS traffic detected: 23.201.212.130:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.201.212.130:443 -> 192.168.2.5:49722 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=1884,i,5487348509248761327,9377431468014515543,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://smincorporation.com/kr.html#sangdon.yeom@hyundaimovex.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=1884,i,5487348509248761327,9377431468014515543,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
www.google.com	74.125.138.147	true	false	high
smincorporation.com	103.133.215.160	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
windowsupdatebg.s.llnwi.net	69.164.42.0	true	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
74.125.138.147	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
103.133.215.160	smincorporation.com	India	133643	EWEBGURU-ASEWEBGURUIN	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427679
Start date and time:	2024-04-17 23:52:51 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://smincorporation.com/kr.html#sangdon.yeom@hyundaimovex.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@19/6@4/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	URL browsing timeout or error

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 17 20:53:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9861216401477404
Encrypted:	false
SSDEEP:	48:8Wd3Tv7lHqidAKZdA19ehwiZUklqehly+3:8mfSqy
MD5:	9E58161E133D95E6F593629C55B3009A
SHA1:	BCA27879B223CED2297D86AAFFA41BC3B8A60F54
SHA-256:	C6B4E15CA756EB888083151DF4A93DDE04BD0894769E9AA2622C4E2220C1A943
SHA-512:	A9BD59B9CAE2F80B33B3A6C1799EE24038A3D60FC439B67E82B7ADB43643CFDA975B51FA24B301337AECA316ABCA48145FCCF9104AB8757B1BE414A08FFF8136
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,............N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............:.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 17 20:53:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9979075900510455
Encrypted:	false
SSDEEP:	48:8cd3Tv7lHqidAKZdA1weh/iZUkAQkqehay+2:8kfI9Qny
MD5:	FA0945364A0FC25EBF49224B676F723C
SHA1:	75A8B13C31EA189D3EDB5F88A4DF23292B7DFB0D
SHA-256:	3E810C63975A15118639418CB7C50F97F2B5E513D9963F06CC29EF48F8E0EE2C
SHA-512:	CA8D2B0BF2EEE05BE0FC1C2A3012C16ECDB08877DE2416307D1AC606346A41AD030B516BC15A36668AB18A9191D8F575325905E4A1FF4B612E0699024A207CEE
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....1......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............:.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.012661401595142
Encrypted:	false
SSDEEP:	48:8xUd3Tv7sHqidAKZdA14tseh7sFiZUkmgqeh7sMy+BX:8xMfXnmy
MD5:	1BED92AF51315CB50579E0B0FBD3E69F
SHA1:	46AB500D2316B1FA08E561DEBE49E8D48E616573
SHA-256:	685CEE5240172EB6C20E5DA3612FEFC414449BAB0EC1B786003EE96D868B9DF8
SHA-512:	6FC5CFC3B77F853C24B9E3B78893FEBEDC7E6B6169B7C8357098D7075BAB56FF34E7782E6CF6189A98A0A7390ACAFD6D3E9484D7CA01BCDBC284B5E89B16AD5C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............:.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 17 20:53:44 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.998200717065137
Encrypted:	false
SSDEEP:	48:8Ld3Tv7lHqidAKZdA1vehDiZUkwqehey+R:8dfTky
MD5:	5053129FC9FC397BBCC1E4FB7C230EB7
SHA1:	25BA457D7B4289D4D64DCC80C69FD0FA3731F9EA
SHA-256:	20D04E60128A06242BC2EA09D3E16C92BCF455B82A41938BB2AE0C33AECBD811
SHA-512:	41914F5A15D52EF8D94665CD2014768E5E0693D4C0AFAA92C16EE0FFD2509FEB8739C088E0F09612A61AF2B7268B604A51BA289C24764B0AE9E091585872783F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...._p......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............:.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 17, 2024 23:53:35.905186892 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 17, 2024 23:53:35.905312061 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 17, 2024 23:53:36.030211926 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 17, 2024 23:53:44.241363049 CEST	49712	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:44.241409063 CEST	443	49712	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:44.241473913 CEST	49712	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:44.242095947 CEST	49713	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:44.242177010 CEST	443	49713	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:44.242247105 CEST	49713	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:44.242610931 CEST	49712	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:44.242638111 CEST	443	49712	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:44.242729902 CEST	49713	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:44.242763996 CEST	443	49713	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:44.617706060 CEST	443	49712	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:44.618246078 CEST	49714	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:44.618283033 CEST	443	49714	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:44.618357897 CEST	49714	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:44.618521929 CEST	49714	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:44.618532896 CEST	443	49714	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:44.624772072 CEST	443	49713	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:44.631221056 CEST	49715	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:44.631299973 CEST	443	49715	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:44.631398916 CEST	49715	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:44.631577969 CEST	49715	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:44.631613016 CEST	443	49715	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:44.990633011 CEST	443	49714	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:45.009335995 CEST	443	49715	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:45.130302906 CEST	49716	443	192.168.2.5	74.125.138.147
Apr 17, 2024 23:53:45.130387068 CEST	443	49716	74.125.138.147	192.168.2.5
Apr 17, 2024 23:53:45.130496025 CEST	49716	443	192.168.2.5	74.125.138.147
Apr 17, 2024 23:53:45.130702019 CEST	49716	443	192.168.2.5	74.125.138.147
Apr 17, 2024 23:53:45.130742073 CEST	443	49716	74.125.138.147	192.168.2.5
Apr 17, 2024 23:53:45.352912903 CEST	443	49716	74.125.138.147	192.168.2.5
Apr 17, 2024 23:53:45.353203058 CEST	49716	443	192.168.2.5	74.125.138.147
Apr 17, 2024 23:53:45.353244066 CEST	443	49716	74.125.138.147	192.168.2.5
Apr 17, 2024 23:53:45.354937077 CEST	443	49716	74.125.138.147	192.168.2.5
Apr 17, 2024 23:53:45.355025053 CEST	49716	443	192.168.2.5	74.125.138.147
Apr 17, 2024 23:53:45.355977058 CEST	49716	443	192.168.2.5	74.125.138.147
Apr 17, 2024 23:53:45.356079102 CEST	443	49716	74.125.138.147	192.168.2.5
Apr 17, 2024 23:53:45.406375885 CEST	49716	443	192.168.2.5	74.125.138.147
Apr 17, 2024 23:53:45.406431913 CEST	443	49716	74.125.138.147	192.168.2.5
Apr 17, 2024 23:53:45.453046083 CEST	49716	443	192.168.2.5	74.125.138.147
Apr 17, 2024 23:53:45.515536070 CEST	49674	443	192.168.2.5	23.1.237.91
Apr 17, 2024 23:53:45.640547037 CEST	49675	443	192.168.2.5	23.1.237.91
Apr 17, 2024 23:53:45.640693903 CEST	49673	443	192.168.2.5	23.1.237.91
Apr 17, 2024 23:53:46.024000883 CEST	49717	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:46.024048090 CEST	443	49717	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:46.024202108 CEST	49717	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:46.024219990 CEST	49718	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:46.024322033 CEST	443	49718	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:46.024383068 CEST	49718	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:46.024837017 CEST	49718	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:46.024888992 CEST	443	49718	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:46.024946928 CEST	49717	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:46.024969101 CEST	443	49717	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:46.393650055 CEST	443	49718	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:46.394298077 CEST	49719	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:46.394376993 CEST	443	49719	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:46.394484997 CEST	49719	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:46.394670963 CEST	49719	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:46.394692898 CEST	443	49719	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:46.409986973 CEST	443	49717	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:46.410429955 CEST	49720	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:46.410454988 CEST	443	49720	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:46.410620928 CEST	49720	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:46.410790920 CEST	49720	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:46.410801888 CEST	443	49720	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:46.430037022 CEST	49721	443	192.168.2.5	23.201.212.130
Apr 17, 2024 23:53:46.430071115 CEST	443	49721	23.201.212.130	192.168.2.5
Apr 17, 2024 23:53:46.430174112 CEST	49721	443	192.168.2.5	23.201.212.130
Apr 17, 2024 23:53:46.431937933 CEST	49721	443	192.168.2.5	23.201.212.130
Apr 17, 2024 23:53:46.431953907 CEST	443	49721	23.201.212.130	192.168.2.5
Apr 17, 2024 23:53:46.662017107 CEST	443	49721	23.201.212.130	192.168.2.5
Apr 17, 2024 23:53:46.662106991 CEST	49721	443	192.168.2.5	23.201.212.130
Apr 17, 2024 23:53:46.664551020 CEST	49721	443	192.168.2.5	23.201.212.130
Apr 17, 2024 23:53:46.664570093 CEST	443	49721	23.201.212.130	192.168.2.5
Apr 17, 2024 23:53:46.664984941 CEST	443	49721	23.201.212.130	192.168.2.5
Apr 17, 2024 23:53:46.704844952 CEST	49721	443	192.168.2.5	23.201.212.130
Apr 17, 2024 23:53:46.752115965 CEST	443	49721	23.201.212.130	192.168.2.5
Apr 17, 2024 23:53:46.776381969 CEST	443	49719	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:46.781595945 CEST	443	49720	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:46.854983091 CEST	443	49721	23.201.212.130	192.168.2.5
Apr 17, 2024 23:53:46.855127096 CEST	443	49721	23.201.212.130	192.168.2.5
Apr 17, 2024 23:53:46.855309010 CEST	49721	443	192.168.2.5	23.201.212.130
Apr 17, 2024 23:53:46.871830940 CEST	49721	443	192.168.2.5	23.201.212.130
Apr 17, 2024 23:53:46.871892929 CEST	443	49721	23.201.212.130	192.168.2.5
Apr 17, 2024 23:53:47.002569914 CEST	49722	443	192.168.2.5	23.201.212.130
Apr 17, 2024 23:53:47.002590895 CEST	443	49722	23.201.212.130	192.168.2.5
Apr 17, 2024 23:53:47.002667904 CEST	49722	443	192.168.2.5	23.201.212.130
Apr 17, 2024 23:53:47.003061056 CEST	49722	443	192.168.2.5	23.201.212.130
Apr 17, 2024 23:53:47.003071070 CEST	443	49722	23.201.212.130	192.168.2.5
Apr 17, 2024 23:53:47.003647089 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 17, 2024 23:53:47.003731966 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 17, 2024 23:53:47.223189116 CEST	443	49722	23.201.212.130	192.168.2.5
Apr 17, 2024 23:53:47.223261118 CEST	49722	443	192.168.2.5	23.201.212.130
Apr 17, 2024 23:53:47.243333101 CEST	49722	443	192.168.2.5	23.201.212.130
Apr 17, 2024 23:53:47.243346930 CEST	443	49722	23.201.212.130	192.168.2.5
Apr 17, 2024 23:53:47.244097948 CEST	443	49722	23.201.212.130	192.168.2.5
Apr 17, 2024 23:53:47.247389078 CEST	49722	443	192.168.2.5	23.201.212.130
Apr 17, 2024 23:53:47.288160086 CEST	443	49722	23.201.212.130	192.168.2.5
Apr 17, 2024 23:53:47.427916050 CEST	443	49722	23.201.212.130	192.168.2.5
Apr 17, 2024 23:53:47.428071976 CEST	443	49722	23.201.212.130	192.168.2.5
Apr 17, 2024 23:53:47.428210974 CEST	49722	443	192.168.2.5	23.201.212.130
Apr 17, 2024 23:53:47.429011106 CEST	49722	443	192.168.2.5	23.201.212.130
Apr 17, 2024 23:53:47.429011106 CEST	49722	443	192.168.2.5	23.201.212.130
Apr 17, 2024 23:53:47.429028034 CEST	443	49722	23.201.212.130	192.168.2.5
Apr 17, 2024 23:53:47.429040909 CEST	443	49722	23.201.212.130	192.168.2.5
Apr 17, 2024 23:53:52.121643066 CEST	49723	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:52.121726036 CEST	443	49723	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:52.121798992 CEST	49723	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:52.121864080 CEST	49724	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:52.121927977 CEST	443	49724	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:52.121980906 CEST	49724	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:52.122163057 CEST	49723	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:52.122200012 CEST	443	49723	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:52.122520924 CEST	49724	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:52.122550964 CEST	443	49724	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:52.507046938 CEST	443	49724	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:52.510098934 CEST	443	49723	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:53.431845903 CEST	49725	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:53.431930065 CEST	443	49725	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:53.432039022 CEST	49725	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:53.432550907 CEST	49726	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:53.432595015 CEST	443	49726	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:53.432648897 CEST	49726	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:53.433029890 CEST	49727	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:53.433124065 CEST	443	49727	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:53.433185101 CEST	49727	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:53.433446884 CEST	49725	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:53.433480978 CEST	443	49725	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:53.433691978 CEST	49726	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:53.433716059 CEST	443	49726	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:53.433851004 CEST	49727	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:53.433886051 CEST	443	49727	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:53.811774015 CEST	443	49726	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:53.816180944 CEST	443	49727	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:53.816963911 CEST	443	49725	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:53.819164038 CEST	49728	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:53.819202900 CEST	443	49728	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:53.819263935 CEST	49728	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:53.819865942 CEST	49728	443	192.168.2.5	103.133.215.160
Apr 17, 2024 23:53:53.819886923 CEST	443	49728	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:54.205454111 CEST	443	49728	103.133.215.160	192.168.2.5
Apr 17, 2024 23:53:55.364079952 CEST	443	49716	74.125.138.147	192.168.2.5
Apr 17, 2024 23:53:55.364243031 CEST	443	49716	74.125.138.147	192.168.2.5
Apr 17, 2024 23:53:55.364316940 CEST	49716	443	192.168.2.5	74.125.138.147
Apr 17, 2024 23:53:56.047593117 CEST	49716	443	192.168.2.5	74.125.138.147
Apr 17, 2024 23:53:56.047631025 CEST	443	49716	74.125.138.147	192.168.2.5
Apr 17, 2024 23:53:56.991744041 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 17, 2024 23:53:56.991821051 CEST	49703	443	192.168.2.5	23.1.237.91
Apr 17, 2024 23:53:56.992052078 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 17, 2024 23:53:56.992105007 CEST	443	49733	23.1.237.91	192.168.2.5
Apr 17, 2024 23:53:56.992290020 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 17, 2024 23:53:56.992436886 CEST	49733	443	192.168.2.5	23.1.237.91
Apr 17, 2024 23:53:56.992450953 CEST	443	49733	23.1.237.91	192.168.2.5
Apr 17, 2024 23:53:57.144980907 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 17, 2024 23:53:57.145030975 CEST	443	49703	23.1.237.91	192.168.2.5
Apr 17, 2024 23:53:57.326070070 CEST	443	49733	23.1.237.91	192.168.2.5
Apr 17, 2024 23:53:57.326143026 CEST	49733	443	192.168.2.5	23.1.237.91

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 17, 2024 23:53:41.238065004 CEST	53	53952	1.1.1.1	192.168.2.5
Apr 17, 2024 23:53:41.394654036 CEST	53	54300	1.1.1.1	192.168.2.5
Apr 17, 2024 23:53:42.080964088 CEST	53	60265	1.1.1.1	192.168.2.5
Apr 17, 2024 23:53:43.660743952 CEST	64710	53	192.168.2.5	1.1.1.1
Apr 17, 2024 23:53:43.661072016 CEST	58700	53	192.168.2.5	1.1.1.1
Apr 17, 2024 23:53:44.235286951 CEST	53	64710	1.1.1.1	192.168.2.5
Apr 17, 2024 23:53:44.240714073 CEST	53	58700	1.1.1.1	192.168.2.5
Apr 17, 2024 23:53:45.023367882 CEST	55510	53	192.168.2.5	1.1.1.1
Apr 17, 2024 23:53:45.023487091 CEST	61988	53	192.168.2.5	1.1.1.1
Apr 17, 2024 23:53:45.128911972 CEST	53	55510	1.1.1.1	192.168.2.5
Apr 17, 2024 23:53:45.129522085 CEST	53	61988	1.1.1.1	192.168.2.5

Timestamp	Bytes transferred	Direction	Data
2024-04-17 21:53:46 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-17 21:53:46 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/079C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Cache-Control: public, max-age=32943 Date: Wed, 17 Apr 2024 21:53:46 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-04-17 21:53:47 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-17 21:53:47 UTC	530	IN	HTTP/1.1 200 OK Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Content-Type: application/octet-stream ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0rcGnYgAAAAANOnx9vccHTr21ROgX9ESTU0pDRURHRTAzMDkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=32985 Date: Wed, 17 Apr 2024 21:53:47 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-17 21:53:47 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Target ID:	0
Start time:	23:53:36
Start date:	17/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	23:53:39
Start date:	17/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=1884,i,5487348509248761327,9377431468014515543,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	23:53:42
Start date:	17/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://smincorporation.com/kr.html#sangdon.yeom@hyundaimovex.com"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://smincorporation.com/kr.html#sangdon.yeom@hyundaimovex.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Errors

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 6848, Parent PID: 1012

General

Chronological Activities

Analysis Process: chrome.exePID: 6516, Parent PID: 6848

General

Chronological Activities

Analysis Process: chrome.exePID: 2612, Parent PID: 1012

General

Windows Analysis Report
https://smincorporation.com/kr.html#sangdon.yeom@hyundaimovex.com

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre