Windows Analysis Report
T_AGM__1905.xml

Overview

General Information

Sample name: T_AGM__1905.xml
Analysis ID: 1430762
MD5: 46ceb761adb7c723d89d267eb722e6e7
SHA1: 5d790d0e4dee292701e50ddce19b9750bb8c8cfc
SHA256: 7589b7da04afe02e535953f9ecbfeeb81422eda8fcff6a31d83beb21cd2e46af
Tags: jar
Infos:

Detection

Score: 2
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

Creates a process in suspended mode (likely to inject code)
IP address seen in connection with other malware
Potential browser exploit detected (process start blacklist hit)
Sigma detected: Use Short Name Path in Command Line

Classification

Potential browser exploit detected (process start blacklist hit)
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View IP Address: 13.107.246.69 13.107.246.69
Source: Joe Sandbox View IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View IP Address: 172.64.41.3 172.64.41.3
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.69
Source: global traffic HTTP traffic detected: GET /crx/blobs/AfQPRnlBHVf9QbAmjPnmJQnDwEcerxafOq8p01cAfJ5QoFk2s6gAMnMY_23BNiizXK2e-3smriJGTe2WOZO9s5X2xejbvoKpPILOKN2-0t9ZbrurACaLAMZSmuXX9slHldVQ07B5bvw6KCm_x6CONA/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_76_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1714539437&P2=404&P3=2&P4=kVBY5XucgZSzbqI8oXPMOPFaYPQymIx3W%2bJzFDw74FbOzI8m4ZabeD483vK0wpOdnLAoocy2bPo4TO6vxQIO9w%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: yQRbHNvRyR1IPiowYUnZYvSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr=c&sig=R83mlHRCqeHRG9T0loza5cz3U8zjuZzQy2wVvoSHGHw%3D&st=2021-01-01T00%3A00%3A00Z&se=2024-06-30T00%3A00%3A00Z&sp=r&assetgroup=AddressBar HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: AddressBarSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: 000003.log.10.dr, uu_host_config.10.dr String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log.10.dr, uu_host_config.10.dr String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log.10.dr, uu_host_config.10.dr String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: msapplication.xml1.3.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0xf4794dfb,0x01da9603</date><accdate>0xf4794dfb,0x01da9603</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml6.3.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0xf47e1298,0x01da9603</date><accdate>0xf47e1298,0x01da9603</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml8.3.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0xf48074e2,0x01da9603</date><accdate>0xf48074e2,0x01da9603</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: unknown DNS traffic detected: queries for: clients2.googleusercontent.com
Source: unknown HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message
Source: msapplication.xml.3.dr String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml2.3.dr String found in binary or memory: http://www.google.com/
Source: msapplication.xml3.3.dr String found in binary or memory: http://www.live.com/
Source: msapplication.xml4.3.dr String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml5.3.dr String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml6.3.dr String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml7.3.dr String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml8.3.dr String found in binary or memory: http://www.youtube.com/
Source: 94f19356-3775-4c71-ab56-92c65b80abf8.tmp.11.dr String found in binary or memory: https://assets.msn.com
Source: manifest.json.10.dr String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.10.dr String found in binary or memory: https://chromewebstore.google.com/
Source: manifest.json0.10.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: manifest.json0.10.dr String found in binary or memory: https://docs.google.com/
Source: manifest.json0.10.dr String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.10.dr String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.10.dr String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.10.dr String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.10.dr String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.10.dr String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.10.dr String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.10.dr String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.10.dr String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.10.dr String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.10.dr String found in binary or memory: https://drive.google.com/
Source: 000003.log.10.dr String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log.10.dr String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: content.js.10.dr, content_new.js.10.dr String found in binary or memory: https://www.google.com/chrome
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: classification engine Classification label: clean2.winXML@51/223@10/6
Source: C:\Program Files\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DF7B94DF61E77CC8CC.TMP Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE "C:\Program Files (x86)\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\user\Desktop\T_AGM__1905.xml"
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\user\Desktop\T_AGM__1905.xml
Source: C:\Program Files\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7852 CREDAT:17410 /prefetch:2
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10458
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10458
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2088,i,3537742655539462717,4247494418498581012,262144 /prefetch:3
Source: unknown Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10458 --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2092,i,14795131593982425154,17100190454917439701,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6236 --field-trial-handle=2092,i,14795131593982425154,17100190454917439701,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3616 --field-trial-handle=2092,i,14795131593982425154,17100190454917439701,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\user\Desktop\T_AGM__1905.xml Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7852 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10458 Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10458 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2088,i,3537742655539462717,4247494418498581012,262144 /prefetch:3 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2092,i,14795131593982425154,17100190454917439701,262144 /prefetch:3 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6236 --field-trial-handle=2092,i,14795131593982425154,17100190454917439701,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3616 --field-trial-handle=2092,i,14795131593982425154,17100190454917439701,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Section loaded: appvisvsubsystems32.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Section loaded: c2r32.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: slc.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32 Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common Jump to behavior
Source: T_AGM__1905.xml Static file information: File size 2858660 > 1048576
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: Web Data.10.dr Binary or memory string: dev.azure.comVMware20,11696497155j
Source: Web Data.10.dr Binary or memory string: global block list test formVMware20,11696497155
Source: Web Data.10.dr Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: Web Data.10.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: Web Data.10.dr Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: Web Data.10.dr Binary or memory string: secure.bankofamerica.comVMware20,11696497155|UE
Source: Web Data.10.dr Binary or memory string: tasks.office.comVMware20,11696497155o
Source: Web Data.10.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: Web Data.10.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: Web Data.10.dr Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: Web Data.10.dr Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: Web Data.10.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: Web Data.10.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: Web Data.10.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: Web Data.10.dr Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: Web Data.10.dr Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: Web Data.10.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: ie_to_edge_stub.exe, 00000005.00000002.1357507552.0000022331013000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Web Data.10.dr Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: Web Data.10.dr Binary or memory string: AMC password management pageVMware20,11696497155
Source: Web Data.10.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: Web Data.10.dr Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: Web Data.10.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: Web Data.10.dr Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: Web Data.10.dr Binary or memory string: discord.comVMware20,11696497155f
Source: Web Data.10.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: Web Data.10.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: Web Data.10.dr Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: Web Data.10.dr Binary or memory string: outlook.office.comVMware20,11696497155s
Source: Web Data.10.dr Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: Web Data.10.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: Web Data.10.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\user\Desktop\T_AGM__1905.xml Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10458 Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1430762 Sample: T_AGM__1905.xml Startdate: 24/04/2024 Architecture: WINDOWS Score: 2 9 msedge.exe 25 351 2->9         started        12 MSOXMLED.EXE 12 2->12         started        dnsIp3 33 239.255.255.250 unknown Reserved 9->33 14 msedge.exe 21 9->14         started        17 msedge.exe 9->17         started        19 msedge.exe 9->19         started        21 iexplore.exe 69 105 12->21         started        process4 dnsIp5 35 13.107.246.69, 443, 49740 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 14->35 37 googlehosted.l.googleusercontent.com 142.251.2.132, 443, 49712 GOOGLEUS United States 14->37 39 5 other IPs or domains 14->39 23 iexplore.exe 2 22 21->23         started        process6 process7 25 ie_to_edge_stub.exe 1 23->25         started        27 ssvagent.exe 501 23->27         started        process8 29 msedge.exe 11 25->29         started        process9 31 msedge.exe 29->31         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.159.61.3
 chrome.cloudflare-dns.com United States
13335 CLOUDFLARENETUS false
239.255.255.250
 unknown Reserved
unknown unknown false
13.107.246.69
 unknown United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
152.195.19.97
 sni1gl.wpc.nucdn.net United States
15133 EDGECASTUS false
142.251.2.132
 googlehosted.l.googleusercontent.com United States
15169 GOOGLEUS false
172.64.41.3
 unknown United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
chrome.cloudflare-dns.com 162.159.61.3 true
googlehosted.l.googleusercontent.com 142.251.2.132 true
sni1gl.wpc.nucdn.net 152.195.19.97 true
clients2.googleusercontent.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://chrome.cloudflare-dns.com/dns-query false
  • URL Reputation: safe
 unknown
https://clients2.googleusercontent.com/crx/blobs/AfQPRnlBHVf9QbAmjPnmJQnDwEcerxafOq8p01cAfJ5QoFk2s6gAMnMY_23BNiizXK2e-3smriJGTe2WOZO9s5X2xejbvoKpPILOKN2-0t9ZbrurACaLAMZSmuXX9slHldVQ07B5bvw6KCm_x6CONA/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_76_1_0.crx false
    		high