Edit tour

Windows Analysis Report
dms_T_AGM.xml

Overview

General Information

Sample name:	dms_T_AGM.xml
Analysis ID:	1430761
MD5:	30a611030bf0c96b491bdf17f2b75153
SHA1:	b24f5f6c7297218058f1468543de359ff66ced11
SHA256:	245f05645c64668af1e1dbb08e3e078f7e0f30cc831cd984cfdafad0de7856fa
Tags:	jar
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Creates a process in suspended mode (likely to inject code)

IP address seen in connection with other malware

Potential browser exploit detected (process start blacklist hit)

Sigma detected: Use Short Name Path in Command Line

Classification

Process Tree

System is w10x64

MSOXMLED.EXE (PID: 1196 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\user\Desktop\dms_T_AGM.xml" MD5: A2E6E2A1C125973A4967540FD08C9AF0)

iexplore.exe (PID: 6476 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\user\Desktop\dms_T_AGM.xml MD5: CFE2E6942AC1B72981B3105E22D3224E)

iexplore.exe (PID: 5720 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6476 CREDAT:17410 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)

ie_to_edge_stub.exe (PID: 892 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10472 MD5: 89CF8972D683795DAB6901BC9456675D)

msedge.exe (PID: 3712 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10472 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5748 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2080,i,7528755408254883193,15071468154645449224,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

ssvagent.exe (PID: 3608 cmdline: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new MD5: F9A898A606E7F5A1CD7CFFA8079253A0)

msedge.exe (PID: 7232 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10472 --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7540 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2004,i,5886203678267278463,5565217195665006309,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8464 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6236 --field-trial-handle=2004,i,5886203678267278463,5565217195665006309,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Sigma Signatures

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, CommandLine: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, CommandLine|base64offset|contains: w, Image: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, NewProcessName: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, OriginalFileName: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, ParentCommandLine: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6476 CREDAT:17410 /prefetch:2, ParentImage: C:\Program Files (x86)\Internet Explorer\iexplore.exe, ParentProcessId: 5720, ParentProcessName: iexplore.exe, ProcessCommandLine: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, ProcessId: 3608, ProcessName: ssvagent.exe

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Program Files\Internet Explorer\iexplore.exe, ProcessId: 6476, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SecuritySafe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe

Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 172.64.41.3 172.64.41.3

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /crx/blobs/AfQPRnlBHVf9QbAmjPnmJQnDwEcerxafOq8p01cAfJ5QoFk2s6gAMnMY_23BNiizXK2e-3smriJGTe2WOZO9s5X2xejbvoKpPILOKN2-0t9ZbrurACaLAMZSmuXX9slHldVQ07B5bvw6KCm_x6CONA/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_76_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1714539322&P2=404&P3=2&P4=F2otOcUjcWgjzhiB5aEP2XoBBUAteJOArLTi56X2WC%2bFjn3a8tCPuVw1273hF6KyqcIVyVaaNySrJN85mTht4Q%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: ObQOx1Imnt2LjhVimpFDTISec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: 000003.log.9.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log.9.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log.9.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: msapplication.xml1.2.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xafcf6af3,0x01da9603</date><accdate>0xafd1cd0f,0x01da9603</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml6.2.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xafd69192,0x01da9603</date><accdate>0xafd69192,0x01da9603</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml8.2.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xafd8f3bc,0x01da9603</date><accdate>0xafdb565c,0x01da9603</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: clients2.googleusercontent.com

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: msapplication.xml.2.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml2.2.dr	String found in binary or memory: http://www.google.com/
Source: msapplication.xml3.2.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml4.2.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml5.2.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml6.2.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml7.2.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml8.2.dr	String found in binary or memory: http://www.youtube.com/
Source: manifest.json.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: manifest.json0.9.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive.google.com/
Source: 000003.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE "C:\Program Files (x86)\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\user\Desktop\dms_T_AGM.xml"
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\user\Desktop\dms_T_AGM.xml
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6476 CREDAT:17410 /prefetch:2
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10472
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10472
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2080,i,7528755408254883193,15071468154645449224,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10472 --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2004,i,5886203678267278463,5565217195665006309,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6236 --field-trial-handle=2004,i,5886203678267278463,5565217195665006309,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\user\Desktop\dms_T_AGM.xml	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6476 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10472	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10472	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=2080,i,7528755408254883193,15071468154645449224,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2004,i,5886203678267278463,5565217195665006309,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6236 --field-trial-handle=2004,i,5886203678267278463,5565217195665006309,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: appvisvsubsystems32.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: c2r32.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Web Data.9.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.9.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Web Data.9.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.9.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Web Data.9.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.9.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Web Data.9.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Web Data.9.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Web Data.9.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Web Data.9.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Web Data.9.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
chrome.cloudflare-dns.com	0%	Virustotal		Browse
sni1gl.wpc.nucdn.net	0%	Virustotal		Browse

Source	Detection	Scanner	Label
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
http://www.wikipedia.com/	0%	URL Reputation	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	0%, Virustotal, Browse	unknown
googlehosted.l.googleusercontent.com	142.251.2.132	true	false		high
sni1gl.wpc.nucdn.net	152.195.19.97	true	false	0%, Virustotal, Browse	unknown
clients2.googleusercontent.com	unknown	unknown	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
152.195.19.97	sni1gl.wpc.nucdn.net	United States	15133	EDGECASTUS	false
142.251.2.132	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430761
Start date and time:	2024-04-24 06:54:27 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	dms_T_AGM.xml
Detection:	CLEAN
Classification:	clean2.winXML@49/218@8/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .xml

Name	Malicious	Antivirus Detection	Reputation
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe URL Reputation: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AfQPRnlBHVf9QbAmjPnmJQnDwEcerxafOq8p01cAfJ5QoFk2s6gAMnMY_23BNiizXK2e-3smriJGTe2WOZO9s5X2xejbvoKpPILOKN2-0t9ZbrurACaLAMZSmuXX9slHldVQ07B5bvw6KCm_x6CONA/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_76_1_0.crx	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.nytimes.com/	msapplication.xml4.2.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.9.dr	false		high
https://drive-autopush.corp.google.com/	manifest.json0.9.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.9.dr	false		high
http://www.amazon.com/	msapplication.xml.2.dr	false		high
http://www.twitter.com/	msapplication.xml6.2.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.9.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.9.dr	false		high
https://docs.google.com/	manifest.json0.9.dr	false		high
https://drive-staging.corp.google.com/	manifest.json0.9.dr	false		high
https://www.google.com/chrome	content_new.js.9.dr, content.js.9.dr	false		high
https://drive-daily-6.corp.google.com/	manifest.json0.9.dr	false		high
https://drive.google.com/	manifest.json0.9.dr	false		high
https://drive-daily-0.corp.google.com/	manifest.json0.9.dr	false		high
http://www.youtube.com/	msapplication.xml8.2.dr	false		high
https://chromewebstore.google.com/	manifest.json.9.dr	false		high
http://www.wikipedia.com/	msapplication.xml7.2.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.9.dr	false		high
http://www.live.com/	msapplication.xml3.2.dr	false		high
https://chrome.google.com/webstore/	manifest.json.9.dr	false		high
http://www.reddit.com/	msapplication.xml5.2.dr	false		high
http://www.google.com/	msapplication.xml2.2.dr	false		high
https://drive-daily-3.corp.google.com/	manifest.json0.9.dr	false		high

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
162.159.61.3	zlONcFaXkc.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse
	ShadowFury.exe	Get hash	malicious	Unknown	Browse
	ShadowFury.exe	Get hash	malicious	Unknown	Browse
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse
	SenPalia.exe	Get hash	malicious	Unknown	Browse
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse
	SenPalia.exe	Get hash	malicious	Unknown	Browse
	UnderWars.exe	Get hash	malicious	Unknown	Browse
	SenPalia.exe	Get hash	malicious	Unknown	Browse
	SenPalia.exe	Get hash	malicious	Unknown	Browse
239.255.255.250	http://rum.browser-intake-foxbusiness.com:443	Get hash	malicious	Unknown	Browse
	http://42.193.223.169/extensioncompabilitynode.exe	Get hash	malicious	Unknown	Browse
	https://d-wz.info/mygov	Get hash	malicious	HTMLPhisher	Browse
	https://www.longin-eki.co.jp.cduhzkc.cn/	Get hash	malicious	Unknown	Browse
	https://www.longin-eki.co.jp.nebxshr.cn/	Get hash	malicious	Unknown	Browse
	https://www.admin-longin.co.jp.mc3lva.cn/	Get hash	malicious	Unknown	Browse
	https://www.longin.co.jp.wiibhaq.cn/	Get hash	malicious	Unknown	Browse
	https://emv1.3rujia.cn/	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse
	https://wmicrosouab-4ba8.udydzj.workers.dev/	Get hash	malicious	HTMLPhisher	Browse
152.195.19.97	SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse
	https://www.jottacloud.com/s/359ee8b110b8ca8464998842a5d227ed979	Get hash	malicious	HTMLPhisher	Browse
	https://tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=remoinmobiliaria.com%2F%40%2FAmericanautoshield/ZwgXU85423ZwgXU85423ZwgXU/bWlrZS5ub3ZpY2tAYW1lcmljYW5hdXRvc2hpZWxkLmNvbQ==	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://wisdomcircle.playbook.ai/cron/click-email/?eid=TmpVMVlXUTRORGM0TUdJMVl3PT0&ru=https://cd14fe4e.2690c0a545a7f22e8ae6844c.workers.dev/?qrc=caroline.picabea@naxicap.com%20https://wisdomcircle.playbook.ai/cron/click-email/?eid=TmpVMVlXUTRORGM0TUdJMVl3PT0&ru=https://cd14fe4e.2690c0a545a7f22e8ae6844c.workers.dev/?qrc=caroline.picabea@naxicap.com	Get hash	malicious	HTMLPhisher	Browse
	https://1drv.ms/o/s!BDwGtOL3Ob0ShA6L6a7ghGOEVOBw?e=-nVgacgL8k2GcXGT6ejjHg&at=9%22)%20and%20ContentType:(%221%22)	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://download-myproposal.xyz	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://cosantinexi.com/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=splendidanimations.com%2F%40%2FBigge/aDRmd79087aDRmd79087aDRmd/ZHN3ZWF6YUBiaWdnZS5jb20=	Get hash	malicious	HTMLPhisher	Browse
	https://tracker.club-os.com/campaign/click?msgId=f8ea317d963149a518aa35e03e5541f797badf3c&target=splendidanimations.com%2F%40%2FC2educate/aEFQv26188aEFQv26188aEFQv/anVsaWUubG9uZ2lub0BjMmVkdWNhdGUuY29t	Get hash	malicious	HTMLPhisher	Browse
	http://t.cm.morganstanley.com/r/?id=h1b92d14%2C134cc33c%2C1356be32&p1=www.saiengroup.com%2Fteaz%2F648c482b60b3906833c9304bab170add%2FJBVNhz%2FYW15LmNoZW5AZG91YmxlbGluZS5jb20=	Get hash	malicious	HTMLPhisher	Browse
172.64.41.3	zlONcFaXkc.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse
	https://netorgft12232017-my.sharepoint.com:443/:f:/g/personal/lisa_imjts_com/EsnpAMoHQfhBluK8Y5tDE68BaHrT-12huxTJR_ZqVWR4tA?e=5%3aZZh3dZ&at=9	Get hash	malicious	Unknown	Browse
	SenPalia.exe	Get hash	malicious	Unknown	Browse
	UnderWars.exe	Get hash	malicious	Unknown	Browse
	SenPalia.exe	Get hash	malicious	Unknown	Browse
	https://edbullardcompany-my.sharepoint.com/:f:/g/personal/eric_rosario_bullard_com/EoLKvcaqSE1Go3fA5to5CQABtxAftKTD0ktrakp7rbi4Xg?e=Mvbf0D	Get hash	malicious	HTMLPhisher	Browse
	SenPalia.exe	Get hash	malicious	Unknown	Browse
	BetaUnfrated.exe	Get hash	malicious	Pafish	Browse
	nsis-installer.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	DHL Shipping doc.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	Reconfirm Details.vbs	Get hash	malicious	AgentTesla	Browse	172.67.215.45
	Remittance-Advice.doc	Get hash	malicious	Unknown	Browse	172.67.175.222
	shipping docs.doc	Get hash	malicious	Unknown	Browse	104.21.74.191
	Invoice.doc	Get hash	malicious	AgentTesla	Browse	172.67.134.136
	Pedido02304024.vbs	Get hash	malicious	FormBook, GuLoader	Browse	172.67.152.117
	purchase order pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	PO 23JC0704-Rollease-B.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.21.65.24
	BARSYL SHIPPING Co (VIETNAM).exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
CLOUDFLARENETUS	DHL Shipping doc.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	Reconfirm Details.vbs	Get hash	malicious	AgentTesla	Browse	172.67.215.45
	Remittance-Advice.doc	Get hash	malicious	Unknown	Browse	172.67.175.222
	shipping docs.doc	Get hash	malicious	Unknown	Browse	104.21.74.191
	Invoice.doc	Get hash	malicious	AgentTesla	Browse	172.67.134.136
	Pedido02304024.vbs	Get hash	malicious	FormBook, GuLoader	Browse	172.67.152.117
	purchase order pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	PO 23JC0704-Rollease-B.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.21.65.24
	BARSYL SHIPPING Co (VIETNAM).exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
EDGECASTUS	SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.21652.15881.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	152.195.19.97
	https://magnisteel.lk/4765445b-32c6-49b0-83e6-1d93765276ca.php	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	https://u44058082.ct.sendgrid.net/ls/click?upn=u001.wjMLvmoK1OC9dTKy5UL4VbqcIJmZWkGKJypB0ZF6j6rXk8HVnxe0g2af-2BenroUoONz6EEWthgE-2Bi2vVRUosKTZRVQ5v63hCdxrdKCztVooIv51imK8tr-2Bb3beAsH6u-2FNluJlUKmd7nST-2B9m-2Bl2Rgv4y6uHLimO0TjhZzZ-2F-2BDlllJQne3tT99z6x4W12pJpddTL-2BoJ2-2Bdo6961pFN3dV2Rg-3D-3DeWGT_h-2FW4DSvZGhKY-2FmU3Rq-2F3L-2FXo2OZSHdaVvlpgAgHQWDXPYB9CNYi-2FcvonFCbsEhjt9RP-2BQa7dTwbMJOOaP3JRnMW6mQAitl6qAb1EkaAR-2BmnZDE6Bi3ooqtCrrMW-2F3TPNMK3AVi1YKIdTOZivmUJGaXdrtbqCykfnTTkN9KMRy80rdRqf6LWUCYWGeeaXb-2BD6jokMbr-2FaJKvKMHDNWAfHyhaE6QO9pw7souFUseKb40g-3D	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	EXTERNAL Bonnie St Dryden is inviting you to collaborate on One_docx(Apr 23) DOC3848493.msg	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Vidar, zgRAT	Browse	192.229.211.108
	https://www.jottacloud.com/s/359ee8b110b8ca8464998842a5d227ed979	Get hash	malicious	HTMLPhisher	Browse	152.195.19.97
	https://assets-usa.mkt.dynamics.com/6f8aa86c-81f8-ee11-a1fa-0022482e8338/digitalassets/standaloneforms/4b367e61-8601-ef11-a1fd-0022482f3701	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	http://divbracket.com	Get hash	malicious	Unknown	Browse	192.229.163.25
	https://www.linkedin.com/redir/redirect?url=https%3A%2F%2Flookerstudio%2Egoogle%2Ecom%2Fs%2FscrHqwjeA3k&urlhash=dcQj&trk=public_profile-settings_topcard-website	Get hash	malicious	Unknown	Browse	152.199.24.163
	https://main-bvxea6i-qhygy63sspp2a.ca-1.platformsh.site/sample-page/	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.8046022951415335
Encrypted:	false
SSDEEP:	24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
MD5:	DA597791BE3B6E732F0BC8B20E38EE62
SHA1:	1125C45D285C360542027D7554A5C442288974DE
SHA-256:	5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
SHA-512:	D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	48748
Entropy (8bit):	6.092660684234132
Encrypted:	false
SSDEEP:	768:SF5kruq4eV5xmx3QzkahFuthDO6vP6Ou9tSzn4PW+pbFo5/sxtdMeYfDrYeMCAoq:SFmi3KDjt6YtSzL50+eWMRoBhu3VlXrB
MD5:	64313EBB1DB079597AD82BFAF7538FEA
SHA1:	AE0BD82EADEA96C7D4D979742B4AD0BA56439474
SHA-256:	3E0115B60E97D3B040E360A7905ACB62292157D7650ABA89D11C619750A73952
SHA-512:	CEC7489C2CD5DC0FD2666CCF3476475576F86645A81A78FA54421447B2A23045B0B893FC097F3EFE605FDB45E345C1074E20B085B2FC35C023FC070FD7850F03
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"2D98E86C22A85D74DE9A317BE284280223E65F75C8F8F93CFC812C09FFD210F4\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7SryFa/rRHiV4wZ+uvybtY2Wh7Fd/gb0+fldJ3u7Afx/X35Qwllv1yGRzCW8Fb10d7yBzu7sI7kDGWAL8LsHer/8881v31zyzc2dsLUUd2vJQ3TyTrSwHk9QR5vk8EDWd2mvjNDwj0P4MeKa17bnCpq+NDKstdoxYfu0budDfIi1sn5CZjbkI/iw3N9tbt7hJP46zeEdTuHwztGMRd1TZ2f0+H43WC9/0nz8WfJ6fDpur5VpChN9RP8CPW6UkU/BwUYWNkuQPd/Bz5IddisRzSuxeMgbhgi5FK/5LVNhCXK

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17524
Entropy (8bit):	4.340063035506032
Encrypted:	false
SSDEEP:	192:wiuFhk5un5EpDdblzKaz+OJGbiIBJofNbr5/dn82/jqmo3qAi:rq25unWZd9dvJGiIBJoh387oAi
MD5:	03710426AB25AD1280E197F61249F9DE
SHA1:	F5E7A6FD42503AE4758BC36C8DD78D98EFB35047
SHA-256:	21E63F7C77896ED2B5F115957F2448E0A9E2DD738D7D487E471217421F6A93E1
SHA-512:	213CB55B8573335D1384AE704FF4267F224376056F71548660F9B2FDAA1203D8ABDDB787900AAF5D1E0AC6E5BE261F713BDBEFB67643D08E8D3672512A1AF588
Malicious:	false
Preview:	(function()..{.. var XHTML = "http://www.w3.org/1999/xhtml";.. .. // Time slicing constants.. var LIMIT = 10; // Maximum number of nodes to process before checking time.. var DURATION = 200; // Maximum amount of time (ms) to process before unblocking UI.. var DELAY = 15; // Amount of time (ms) to unblock UI.... // Tree building state.. var iterator;.. var nextNode;.. var root;.. var rootFirstChild;.. var time;.. .. // Template References.. var attrTemplate, attrName, attrValue;.. var elmStartTemplate, elmStartName;.. var elmEndTemplate, elmEndName;.. var cdataTemplate, cdataValue;.. var commentTemplate, commentValue;.. var style; .. .. // Only invoke this script if it was injected by our parser. Test for a condition that is.. // impossible for a markup to create - two direct children of the document... var secondRootElement = document.documentElement.nextElementSibling;.. if (secondRootElement == null

File type:	XML 1.0 document, ASCII text, with CRLF, LF line terminators
Entropy (8bit):	4.892107227168145
TrID:	Generic XML (ASCII) (5005/1) 100.00%
File name:	dms_T_AGM.xml
File size:	709'021 bytes
MD5:	30a611030bf0c96b491bdf17f2b75153
SHA1:	b24f5f6c7297218058f1468543de359ff66ced11
SHA256:	245f05645c64668af1e1dbb08e3e078f7e0f30cc831cd984cfdafad0de7856fa
SHA512:	b3842b7b61cfaac1340694b03ba19d5b18d17da7bda1d4d1bd5427f025147f0f2572eaa3745d9dae285548b605ead5472243086d0a6df648401e0a532e02e564
SSDEEP:	768:bY/iJmI2NHcX4h6CZkzF2D8qhJizswX3YxKwXTMyJrEsbN+udX4WFi51mBamjgeW:AfFva
TLSH:	20E46661EE858D9B3AF3E82D2A427948DD0D35EA614A20EC7E9CB3074F76CF1452B570
File Content Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.<site id="28" description="AGM">.<table name="DMS_DOCUMENT_DETAIL">.<row>.. <coloumn name="UUID" value="e10a183b-15c6-4ce3-80bd-9260f5b2f248"/>.. <coloumn name="FILE_NAME" value

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 06:55:21.839936972 CEST	56781	53	192.168.2.5	1.1.1.1
Apr 24, 2024 06:55:21.840065002 CEST	64883	53	192.168.2.5	1.1.1.1
Apr 24, 2024 06:55:21.993436098 CEST	53	56781	1.1.1.1	192.168.2.5
Apr 24, 2024 06:55:21.994261980 CEST	53	64883	1.1.1.1	192.168.2.5
Apr 24, 2024 06:55:25.158579111 CEST	62654	53	192.168.2.5	1.1.1.1
Apr 24, 2024 06:55:25.158921957 CEST	64250	53	192.168.2.5	1.1.1.1
Apr 24, 2024 06:55:25.159368992 CEST	61959	53	192.168.2.5	1.1.1.1
Apr 24, 2024 06:55:25.159528971 CEST	63879	53	192.168.2.5	1.1.1.1
Apr 24, 2024 06:55:25.170799971 CEST	59507	53	192.168.2.5	1.1.1.1
Apr 24, 2024 06:55:25.170933962 CEST	62932	53	192.168.2.5	1.1.1.1
Apr 24, 2024 06:55:25.312047958 CEST	53	64250	1.1.1.1	192.168.2.5
Apr 24, 2024 06:55:25.312067032 CEST	53	62654	1.1.1.1	192.168.2.5
Apr 24, 2024 06:55:25.312774897 CEST	53	61959	1.1.1.1	192.168.2.5
Apr 24, 2024 06:55:25.312993050 CEST	53	63879	1.1.1.1	192.168.2.5
Apr 24, 2024 06:55:25.324120045 CEST	53	59507	1.1.1.1	192.168.2.5
Apr 24, 2024 06:55:25.324346066 CEST	53	62932	1.1.1.1	192.168.2.5
Apr 24, 2024 06:55:26.381444931 CEST	52629	443	192.168.2.5	172.64.41.3
Apr 24, 2024 06:55:26.535682917 CEST	443	52629	172.64.41.3	192.168.2.5
Apr 24, 2024 06:55:26.536233902 CEST	443	52629	172.64.41.3	192.168.2.5
Apr 24, 2024 06:55:26.536256075 CEST	443	52629	172.64.41.3	192.168.2.5
Apr 24, 2024 06:55:26.537359953 CEST	52629	443	192.168.2.5	172.64.41.3
Apr 24, 2024 06:55:26.538471937 CEST	52629	443	192.168.2.5	172.64.41.3
Apr 24, 2024 06:55:26.538829088 CEST	52629	443	192.168.2.5	172.64.41.3
Apr 24, 2024 06:55:26.539422989 CEST	52629	443	192.168.2.5	172.64.41.3
Apr 24, 2024 06:55:26.539582014 CEST	52629	443	192.168.2.5	172.64.41.3
Apr 24, 2024 06:55:26.692492962 CEST	443	52629	172.64.41.3	192.168.2.5
Apr 24, 2024 06:55:26.692521095 CEST	443	52629	172.64.41.3	192.168.2.5
Apr 24, 2024 06:55:26.692536116 CEST	443	52629	172.64.41.3	192.168.2.5
Apr 24, 2024 06:55:26.692552090 CEST	443	52629	172.64.41.3	192.168.2.5
Apr 24, 2024 06:55:26.692807913 CEST	443	52629	172.64.41.3	192.168.2.5
Apr 24, 2024 06:55:26.693124056 CEST	52629	443	192.168.2.5	172.64.41.3
Apr 24, 2024 06:55:26.693420887 CEST	52629	443	192.168.2.5	172.64.41.3
Apr 24, 2024 06:55:26.694119930 CEST	443	52629	172.64.41.3	192.168.2.5
Apr 24, 2024 06:55:26.695768118 CEST	443	52629	172.64.41.3	192.168.2.5
Apr 24, 2024 06:55:26.696110010 CEST	443	52629	172.64.41.3	192.168.2.5
Apr 24, 2024 06:55:26.696686029 CEST	52629	443	192.168.2.5	172.64.41.3
Apr 24, 2024 06:55:26.846779108 CEST	443	52629	172.64.41.3	192.168.2.5
Apr 24, 2024 06:55:26.876935005 CEST	52629	443	192.168.2.5	172.64.41.3
Apr 24, 2024 06:55:28.118765116 CEST	52629	443	192.168.2.5	172.64.41.3
Apr 24, 2024 06:55:28.119810104 CEST	52629	443	192.168.2.5	172.64.41.3
Apr 24, 2024 06:55:28.124846935 CEST	50545	443	192.168.2.5	162.159.61.3
Apr 24, 2024 06:55:28.277103901 CEST	443	52629	172.64.41.3	192.168.2.5
Apr 24, 2024 06:55:28.277143002 CEST	443	52629	172.64.41.3	192.168.2.5
Apr 24, 2024 06:55:28.277156115 CEST	443	52629	172.64.41.3	192.168.2.5
Apr 24, 2024 06:55:28.277477026 CEST	443	52629	172.64.41.3	192.168.2.5
Apr 24, 2024 06:55:28.278083086 CEST	52629	443	192.168.2.5	172.64.41.3
Apr 24, 2024 06:55:28.282602072 CEST	443	50545	162.159.61.3	192.168.2.5
Apr 24, 2024 06:55:28.282756090 CEST	443	50545	162.159.61.3	192.168.2.5
Apr 24, 2024 06:55:28.282938004 CEST	443	50545	162.159.61.3	192.168.2.5
Apr 24, 2024 06:55:28.283564091 CEST	50545	443	192.168.2.5	162.159.61.3
Apr 24, 2024 06:55:28.284519911 CEST	50545	443	192.168.2.5	162.159.61.3
Apr 24, 2024 06:55:28.284641981 CEST	50545	443	192.168.2.5	162.159.61.3
Apr 24, 2024 06:55:28.284847021 CEST	50545	443	192.168.2.5	162.159.61.3
Apr 24, 2024 06:55:28.284923077 CEST	50545	443	192.168.2.5	162.159.61.3
Apr 24, 2024 06:55:28.437784910 CEST	443	50545	162.159.61.3	192.168.2.5
Apr 24, 2024 06:55:28.437828064 CEST	443	50545	162.159.61.3	192.168.2.5
Apr 24, 2024 06:55:28.437896967 CEST	443	50545	162.159.61.3	192.168.2.5
Apr 24, 2024 06:55:28.437911987 CEST	443	50545	162.159.61.3	192.168.2.5
Apr 24, 2024 06:55:28.437923908 CEST	443	50545	162.159.61.3	192.168.2.5
Apr 24, 2024 06:55:28.438231945 CEST	50545	443	192.168.2.5	162.159.61.3
Apr 24, 2024 06:55:28.438416004 CEST	50545	443	192.168.2.5	162.159.61.3
Apr 24, 2024 06:55:28.438775063 CEST	443	50545	162.159.61.3	192.168.2.5
Apr 24, 2024 06:55:28.439426899 CEST	443	50545	162.159.61.3	192.168.2.5
Apr 24, 2024 06:55:28.439822912 CEST	443	50545	162.159.61.3	192.168.2.5
Apr 24, 2024 06:55:28.440696001 CEST	50545	443	192.168.2.5	162.159.61.3
Apr 24, 2024 06:55:28.591273069 CEST	443	50545	162.159.61.3	192.168.2.5
Apr 24, 2024 06:55:28.619049072 CEST	50545	443	192.168.2.5	162.159.61.3
Apr 24, 2024 06:56:37.644470930 CEST	51530	443	192.168.2.5	162.159.61.3
Apr 24, 2024 06:56:37.644629002 CEST	51530	443	192.168.2.5	162.159.61.3
Apr 24, 2024 06:56:37.644851923 CEST	51530	443	192.168.2.5	162.159.61.3
Apr 24, 2024 06:56:37.644933939 CEST	51530	443	192.168.2.5	162.159.61.3
Apr 24, 2024 06:56:37.799331903 CEST	443	51530	162.159.61.3	192.168.2.5
Apr 24, 2024 06:56:37.799880981 CEST	443	51530	162.159.61.3	192.168.2.5
Apr 24, 2024 06:56:37.799896002 CEST	443	51530	162.159.61.3	192.168.2.5
Apr 24, 2024 06:56:37.800013065 CEST	51530	443	192.168.2.5	162.159.61.3
Apr 24, 2024 06:56:37.800070047 CEST	443	51530	162.159.61.3	192.168.2.5
Apr 24, 2024 06:56:37.800081968 CEST	443	51530	162.159.61.3	192.168.2.5
Apr 24, 2024 06:56:37.800163031 CEST	51530	443	192.168.2.5	162.159.61.3
Apr 24, 2024 06:56:37.800234079 CEST	51530	443	192.168.2.5	162.159.61.3
Apr 24, 2024 06:56:37.800277948 CEST	51530	443	192.168.2.5	162.159.61.3
Apr 24, 2024 06:56:37.800945044 CEST	443	51530	162.159.61.3	192.168.2.5
Apr 24, 2024 06:56:37.800961018 CEST	443	51530	162.159.61.3	192.168.2.5
Apr 24, 2024 06:56:37.801224947 CEST	51530	443	192.168.2.5	162.159.61.3
Apr 24, 2024 06:56:37.953423977 CEST	443	51530	162.159.61.3	192.168.2.5
Apr 24, 2024 06:56:37.953457117 CEST	443	51530	162.159.61.3	192.168.2.5
Apr 24, 2024 06:56:37.953903913 CEST	51530	443	192.168.2.5	162.159.61.3

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report dms_T_AGM.xml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2f08dac6-bc55-45f7-8dac-1d20ec10a201.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3205e6ae-baec-4cd5-840a-8933582cfc91.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\32320585-f739-46a2-97bc-296d4e5952bd.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4bd04d04-fd2f-4f8b-b1a3-f57771e487a4.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\78a19062-a1a3-4f82-9925-96e673e7c34f.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9da009c6-832b-4fc4-a482-ba7e6d587ff9.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\c23d4b9c-937b-4d65-8940-017bc996f00b.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-662890B6-1C40.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\554a6002-4137-45df-8cee-dcb854e30ed5.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6dbaeea5-e0e5-4701-8cda-22fc99b2a0d0.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Windows Analysis Report
dms_T_AGM.xml

Timestamp	Bytes transferred	Direction	Data
2024-04-24 04:55:22 UTC	580	OUT	GET /crx/blobs/AfQPRnlBHVf9QbAmjPnmJQnDwEcerxafOq8p01cAfJ5QoFk2s6gAMnMY_23BNiizXK2e-3smriJGTe2WOZO9s5X2xejbvoKpPILOKN2-0t9ZbrurACaLAMZSmuXX9slHldVQ07B5bvw6KCm_x6CONA/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_76_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-24 04:55:22 UTC	565	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ABPtcPo2-V4lhx-W63GzLJn6NxO_0IMSY1--mxf6UfpAIrrBS81DJnIlwmra5z4e7r-VbgWREQ Accept-Ranges: bytes Content-Length: 139091 X-Goog-Hash: crc32c=H9/qeQ== Server: UploadServer Date: Tue, 23 Apr 2024 18:32:03 GMT Expires: Wed, 23 Apr 2025 18:32:03 GMT Cache-Control: public, max-age=31536000 Age: 37399 Last-Modified: Thu, 18 Apr 2024 18:31:51 GMT ETag: 82b50a01_49fb4719_dae394b7_fbc972d4_42d9e512 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-24 04:55:22 UTC	690	IN	Data Raw: 43 72 32 34 03 00 00 00 f3 22 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr24"0"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-04-24 04:55:22 UTC	1255	IN	Data Raw: d2 9f 7a 6c 80 d0 71 98 9f 7a 7b 13 b7 05 9c d7 02 20 17 3b cc 01 6f 51 2a 66 e2 83 e7 11 83 e2 b3 53 9d d5 24 e1 bb 2f bc cc d3 09 89 36 87 72 b7 81 22 82 40 1f 8b 08 00 00 00 00 00 00 ff bd 7c 5b 73 ab 3a ba ed 5f d9 b5 9e 77 57 21 30 5e d3 fb 6d 12 10 98 58 22 08 5d 40 bb 76 75 01 22 c1 20 30 89 49 8c e9 ea ff 7e 94 d5 bd bb eb 74 f5 74 d9 0f e7 bc 64 c6 99 dc 86 be cb 18 43 42 fe ef bf fc a6 9a 73 fd 71 9c e6 e3 69 fc ed bf 7e 9b 3f 9a a6 2d cf ed 7f 4c cd c7 7f bc 1e 75 f3 db 7f fe 76 3e be 8d 8d fa 73 7d 1a e7 66 9c 7f fb af bf fc 36 95 57 7d 2a 95 39 be b9 c6 5d 65 bb 96 14 ae 95 db 6d 5b db ad ae af fb ad 70 ce c7 62 58 be 0a 7b 7e ad 6d bd 95 d9 7e 8b fd 9f 2e 3e 5e 8e 32 d4 a3 cc b1 b5 ef 4e 47 73 7c 8b 3a 66 ef bf ff 3e e8 b3 cc d1 31 d1 f3 ef Data Ascii: zlqz{ ;oQfS$/6r"@\|[s:_wW!0^mX"]@vu" 0I~ttdCBsqi~?-Luv>s}f6W}9]em[pbX{~m~.>^2NGs\|:f>1
2024-04-24 04:55:22 UTC	1255	IN	Data Raw: 05 ba ab f8 8e ca 80 f7 32 52 2b 03 d0 13 e3 cf 4d f9 00 3e 34 b8 61 1d 10 8b 73 6c ba 88 f7 42 2d b0 52 b8 2b a5 b5 40 c3 39 ef a9 e5 3e 15 54 43 c1 76 09 f5 25 64 0c 5d 69 80 5f 93 a7 5f e2 eb ef cd cf 2a b0 56 93 eb 52 39 38 af 35 44 86 eb 7b ca dc b2 0e 6b a0 68 61 d7 a2 5f 98 03 73 66 e3 58 69 b2 f0 20 06 a2 77 ed 47 f8 4f 59 f3 35 63 3a e1 63 60 25 7c fa 6c a8 9a 2b 4e 26 9e c7 7b 11 c6 8e 61 f3 98 84 81 9b 09 09 38 9b 7c c4 0c ff d9 e0 49 fe ba bf f4 f7 f2 43 96 f3 43 6a eb 57 d4 a9 4f 02 e1 8b 64 b0 cd 34 06 69 cf 0f 89 88 e3 72 fd 39 13 a3 33 aa 70 3e f0 4e b5 88 f2 57 66 13 fa 48 7f 91 9d 89 d9 1f 39 02 bb 0c ea d0 e8 bc c8 5c 7f 83 6d f8 82 87 d3 86 6b 7e a6 91 d7 97 ce 4f 5b f8 e4 54 db e9 a2 56 cd 6e c4 4f 57 4f f7 e1 2b ec 1f 57 9a cb 82 08 Data Ascii: 2R+M>4aslB-R+@9>TCv%d]i__*VR985D{kha_sfXi wGOY5c:c`%\|l+N&{a8\|ICCjWOd4ir93p>NWfH9\mk~O[TVnOWO+W
2024-04-24 04:55:22 UTC	1255	IN	Data Raw: eb 1f bd 89 14 2b 5f 64 de 8e 48 13 1b 5b 96 c3 38 2c 55 80 c3 ca 87 69 19 61 82 74 e0 a8 a1 7d 22 01 e4 88 c5 a4 36 e3 4f 2c f5 b5 1f ad f3 f7 7c 6e 21 dc af 6a d0 df fd ed f5 8f 71 d4 bb 7f bd c7 45 f8 4a fe d1 23 3b 49 ea d1 3b 55 d6 4e b3 2e 0e a5 e3 71 93 fb 56 aa a5 2d ad f8 a5 c9 c0 0b e6 ed 67 b9 7a 1f c4 9a e3 3f fa 7e 08 ad 3f c6 49 ef ce 95 6d c6 31 34 78 6c 79 bd 13 5f d9 04 3f ae 15 8d 5d 29 14 4a 33 e0 d7 3e 3c 48 1d e7 e9 70 71 48 f0 e6 64 39 0c 59 a0 58 9a c7 8e c9 87 27 33 1e 1c 51 cf 79 00 5f 60 7c c9 95 33 f5 22 81 d7 a9 3e 0e 8a 4e 85 5c b7 af 55 e4 1d 13 fa d3 35 bc bf 6d b8 7e 42 81 e9 a3 0c cd ca 99 82 1a 78 e3 2d 7c b9 85 bd 3b 31 5e 71 a8 bb 2c e4 96 1a e6 8f 92 ab bd a9 11 64 3c dc 13 1e d4 58 e8 36 2c b5 ce eb 30 ee 89 6e 33 a3 Data Ascii: +_dH[8,Uiat}"6O,\|n!jqEJ#;I;UN.qV-gz?~?Im14xly_?])J3><HpqHd9YX'3Qy_`\|3">N\U5m~Bx-\|;1^q,d<X6,0n3
2024-04-24 04:55:22 UTC	1255	IN	Data Raw: 24 0f c4 6f bf c9 84 12 25 e3 a7 2c 57 5b c4 c0 20 2d 45 58 0f a3 ca e8 6d 31 92 8c 53 e2 24 21 08 70 de 5e 1a bd df 30 3b e6 bc 87 eb af f1 cd f7 e2 c3 99 00 48 75 30 4a 28 94 68 9c ce b9 e1 5b 12 29 29 99 75 a1 02 be 18 8d d6 19 3d 3b 19 7f 56 c8 11 b9 68 44 a0 1a b5 7c 20 7e 16 77 8c f7 08 71 8e c3 e9 9d 0c 1c 16 b6 de 53 d0 9e d4 88 9c 32 df cf 3c e4 a0 ee 02 53 ff 72 e6 86 0b f1 8a 1c 25 da af 1b f8 3e ee c4 27 32 8a a3 86 d7 56 13 ee f2 66 98 84 a9 7b 61 ea 64 6c 46 1c 63 e7 34 e3 41 bf d2 bc a5 8c 81 23 b3 c1 49 68 a5 a9 23 1f e1 87 4d a3 09 16 14 53 b2 b6 2b 8a da 77 2c 60 57 db 1b 97 32 ee a1 60 72 08 d3 59 1d 71 8b 83 bd 23 fd c0 f8 cf 5d 81 47 7e c3 23 cd f3 9d f8 2e 65 a0 d2 d4 ae 57 d3 c3 75 da b5 9e d4 6c 83 72 69 31 5f 71 16 2e 8c 74 9a a1 Data Ascii: $o%,W[ -EXm1S$!p^0;Hu0J(h[))u=;VhD\| ~wqS2<Sr%>'2Vf{adlFc4A#Ih#MS+w,`W2`rYq#]G~#.eWulri1_q.t
2024-04-24 04:55:22 UTC	1255	IN	Data Raw: 55 a7 4f 68 b0 1e e0 bf 78 9b 0d a0 6b 60 60 d5 3c 6e 79 88 fb 82 42 88 46 78 ce 18 36 de d3 b8 7a a7 be d4 c3 8f b9 19 63 a0 42 b8 25 3e 27 d8 de dd 98 df 75 ef ec 9f 7b 5b e4 6d 97 db da 38 32 cb dc 9f bc 57 fd c9 28 24 93 35 c1 65 31 7d e6 50 41 cf 78 b6 b8 c8 2d fe 52 0a fd 8a 38 3e 28 30 3d d0 5f f6 cb 81 15 97 34 df bb df ef b8 96 3e d6 d2 6f b3 8a b9 2d ea 27 50 c1 f8 50 31 b8 a7 91 1c b8 43 a0 f1 fa 22 e3 de 36 1d e0 2d 7c f7 ea 97 f5 90 4f 93 e4 13 c1 d6 8c 4b ad 85 cc 75 64 72 71 5b 05 3f dc 03 8d 2f ca 78 11 02 15 47 0c ef 8d 37 34 7d 88 0c 12 c6 8f e0 9b 0b 47 2d 19 35 fc 6a 69 ca 73 7c 96 83 bb 64 fd e4 d4 9d e1 27 aa 58 22 f0 47 ed 90 01 33 bd 94 39 b4 aa b0 b6 89 86 bf 9e df 75 bc 7b fd 1f 48 d8 c6 65 22 1e a4 d8 03 0a f8 3b ee a7 c0 68 c5 Data Ascii: UOhxk``<nyBFx6zcB%>'u{[m82W($5e1}PAx-R8>(0=_4>o-'PP1C"6-\|OKudrq[?/xG74}G-5jis\|d'X"G39u{He";h
2024-04-24 04:55:22 UTC	1255	IN	Data Raw: 01 47 06 6e 54 b1 78 cb 05 79 49 c2 02 c8 f0 87 25 60 7c 92 06 5b da ab 77 e4 fc 7c c4 47 8c 46 bf ba 05 6d c3 26 dc 09 14 f1 d7 74 84 a6 6f bb 76 c1 77 9f 32 a8 2f 28 24 56 06 a6 89 da b8 54 bc 7d 26 ab c4 e6 99 7e 3d 8f ed 90 7b 75 68 6a 9e 7f 29 ba fd a2 20 e7 b5 19 d3 0c f2 e7 7a 65 6e 39 a8 b4 f1 c9 d1 f4 1d 5c 07 cb 4c 06 d7 4d 7b 6e 1c f9 0e 48 2e 1f e2 07 62 3c ca 81 ed 4a 1e c1 59 86 6a ce a0 7c 3a f0 dd ca 23 d2 f1 91 6c 69 38 9f 8a 15 1f 8a b5 cd 89 75 71 0a dd 2e e5 9a de e8 2f e4 5e 1f f8 61 6a ea 50 8a f9 42 c7 e2 62 3c 4c 90 6a 7c 12 42 5e 6b 0e 23 bc f2 0b e9 7f ac c2 f7 5c e4 78 4c d9 46 0f 84 f0 ab 84 d3 03 f3 d8 f1 98 50 e4 10 c7 cb 14 53 ba 61 f3 73 39 40 50 45 53 51 e6 38 26 be 1e 90 c6 25 86 8a e0 3c b8 a0 d5 db 70 7b 9a ab 48 ff 7a Data Ascii: GnTxyI%`\|[w\|GFm&tovw2/($VT}&~={uhj) zen9\LM{nH.b<JYj\|:#li8uq./^ajPBb<Lj\|B^k#\xLFPSas9@PESQ8&%<p{Hz
2024-04-24 04:55:22 UTC	1255	IN	Data Raw: 31 96 3d 7f 02 23 a6 86 1b fb 5d f7 af 71 34 7a 60 a8 6d 7c 35 5e fd 53 86 bb 4e 09 a0 ab 91 bc 56 86 48 ab a3 c1 7e fd 77 fb 17 e2 05 85 aa e0 d0 68 44 c8 e7 cc 68 8c 03 d3 8c 85 64 4b 06 f9 29 f3 e9 bd b2 e4 33 13 e4 15 1b 5d c2 8d ce 32 79 f7 55 8b bf ef 3f f9 e7 38 5f be f7 63 e5 b6 c9 9b 81 f7 b9 f3 3d 06 fa f2 c7 98 ff bb fb 0e 68 a6 96 7e a7 86 87 71 c0 9f 0b e0 d1 03 73 f7 55 ee b9 c6 3b 69 d6 63 8f 44 6c ad 46 6c 08 b4 58 88 ff d3 c9 78 dc e5 ff bb 6f e9 9f f7 5d 65 1e db a5 c0 3a 77 d4 57 3d cc ba d6 bb 63 29 4c 3e 45 f1 97 fc e5 fd 77 83 39 27 ca 81 f1 92 5d 6b fc 56 0c a9 38 bb a5 15 6f 32 d6 26 28 2f ec 84 b5 a7 2c 04 25 07 4a 23 a3 fd ca b5 b6 ab ee ed f8 ca ad f3 7e 90 e6 5e 46 0b fe 6d ff c9 f7 98 ff 2d 97 4c 6e fd 71 0f b8 3b 7e ef e9 2a Data Ascii: 1=#]q4z`m\|5^SNVH~whDhdK)3]2yU?8_c=h~qsU;icDlFlXxo]e:wW=c)L>Ew9']kV8o2&(/,%J#~^Fm-Lnq;~*
2024-04-24 04:55:22 UTC	1255	IN	Data Raw: 76 d5 ab f1 d4 d9 78 ea 7c 3c f5 72 3c f5 f5 78 ea 9b f1 d4 ab 31 d4 10 a1 9c ea 08 6a ca a2 d5 ae 7d 86 ba 42 6e 80 68 75 4a da bb e1 e8 a5 d1 a1 f1 22 aa af 20 14 89 3d 01 df a3 ce 40 48 ef 8c b6 b8 56 cb ec a3 68 81 ad 8e 8d 95 40 f6 c8 dc f1 e0 8d 96 bb e2 2d b8 c7 12 f5 e0 01 f9 a9 d8 54 46 1d 72 95 a2 9c 5c 24 30 eb 8b b7 13 df dc 82 3c 86 8a 61 15 ac 45 6f 32 37 5e 0a 03 b4 15 1c ff b6 64 a5 34 a8 a0 30 e1 9c 7f 5e 7e e2 d8 eb 23 e2 9c 13 83 1a 47 27 8c d9 71 9c cf a1 bc 68 8a c8 7f bf ff 8b 7e 27 3f 75 3e 65 7e ee fa bf 35 00 25 48 cb 41 65 cf 66 f3 05 f9 10 7f ea e0 da e2 5e 2b 9c 5e 03 76 dc 40 4c 83 4f 2f 09 d6 4e db de 72 d9 45 6f e1 a8 c8 16 0b 6a e9 84 85 13 4b 7f 41 60 b0 f4 f9 e8 c2 88 68 13 55 d2 43 1c 9f 8b 28 62 7e bd c6 b8 00 b8 32 f5 Data Ascii: vx\|<r<x1j}BnhuJ" =@HVh@-TFr\$0<aEo27^d40^~#G'qh~'?u>e~5%HAef^+^v@LO/NrEojKA`hUC(b~2
2024-04-24 04:55:22 UTC	1255	IN	Data Raw: b3 a5 0a 7f b3 78 7a 9c 1c a7 27 27 91 4d cc d4 d6 05 cc 34 af 37 f4 5b b3 00 80 c8 84 b3 d6 ab 9b 61 ef 2a 01 e6 40 a6 e4 36 05 c4 0e 96 9a 94 59 bb 96 4b 52 f6 6b c4 2f e6 5d a0 72 ec b8 02 f6 93 b8 9e 33 2c 0d 69 34 94 31 67 16 47 61 80 1b 3f 62 66 50 b8 cf 04 8d 10 1f 12 d3 80 2e 71 66 38 8b 77 36 12 b4 3d 33 70 12 43 db dc ac 0c 71 73 73 75 d4 11 11 22 85 86 ad 94 95 25 b4 8d 6f bd d1 d9 30 e1 53 43 4e 15 29 91 a5 25 28 70 26 cb c8 a6 8b 62 63 c0 eb a6 a7 f7 f3 a8 41 3d c2 4a 34 c6 d3 06 61 c9 e1 e0 1b 47 42 a9 27 35 60 12 cb 37 7c 66 53 0c 2a 1d 20 f4 71 da 06 b9 01 b5 8e 4f a2 0d 3f 01 d2 89 63 f1 83 a0 85 9c 32 0a 60 a3 9e cd fa 7e 22 78 53 00 7b 25 35 ab 8a 75 4f af 62 a1 29 50 d1 39 ef 39 bf ba 6b 68 1c 88 09 89 c1 c0 98 d9 94 2a 59 86 df 58 74 Data Ascii: xz''M47[a@6YKRk/]r3,i41gGa?bfP.qf8w6=3pCqssu"%o0SCN)%(p&bcA=J4aGB'5`7\|fS qO?c2`~"xS{%5uOb)P99kh*YXt

Timestamp	Bytes transferred	Direction	Data
2024-04-24 04:55:25 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-04-24 04:55:25 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-04-24 04:55:25 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 24 Apr 2024 04:55:25 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 87938042ff060a03-LAS alt-svc: h3=":443"; ma=86400
2024-04-24 04:55:25 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 22 00 04 8e fb 02 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom"^)

Timestamp	Bytes transferred	Direction	Data
2024-04-24 04:55:27 UTC	614	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1714539322&P2=404&P3=2&P4=F2otOcUjcWgjzhiB5aEP2XoBBUAteJOArLTi56X2WC%2bFjn3a8tCPuVw1273hF6KyqcIVyVaaNySrJN85mTht4Q%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: ObQOx1Imnt2LjhVimpFDTI Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-24 04:55:27 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2651280 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Wed, 24 Apr 2024 04:55:27 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: 85b1e032-fe38-4340-aae6-56a69bbd869b MS-CV: r2zNKFAig7Iv/pcatn3sa1.0 MS-RequestId: 3e56e8fe-67e8-4bc3-894a-1119d936dd99 Server: ECAcc (lac/558D) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-04-24 04:55:27 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Target ID:	0
Start time:	06:55:15
Start date:	24/04/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\user\Desktop\dms_T_AGM.xml"
Imagebase:	0xc80000
File size:	225'176 bytes
MD5 hash:	A2E6E2A1C125973A4967540FD08C9AF0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	2
Start time:	06:55:16
Start date:	24/04/2024
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\user\Desktop\dms_T_AGM.xml
Imagebase:	0x7ff71ca10000
File size:	834'512 bytes
MD5 hash:	CFE2E6942AC1B72981B3105E22D3224E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	4
Start time:	06:55:17
Start date:	24/04/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10472
Imagebase:	0x7ff672140000
File size:	540'712 bytes
MD5 hash:	89CF8972D683795DAB6901BC9456675D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	9
Start time:	06:55:18
Start date:	24/04/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10472 --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Target ID:	13
Start time:	06:55:22
Start date:	24/04/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6236 --field-trial-handle=2004,i,5886203678267278463,5565217195665006309,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre