Windows Analysis Report
https://liquidfiles.cooley.com/filedrop/jochoa@cooley.com

Overview

General Information

Sample URL:	https://liquidfiles.cooley.com/filedrop/jochoa@cooley.com
Analysis ID:	1432135

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Detected hidden input values containing email addresses (often used in phishing pages)

Stores files to the Windows start menu directory

URL contains potential PII (phishing indication)

Classification

Signatures

Detected hidden input values containing email addresses (often used in phishing pages)

Source: https://liquidfiles.cooley.com/filedrop/jochoa@cooley.com

HTTP Parser: jochoa@cooley.com

URL contains potential PII (phishing indication)

Source: https://liquidfiles.cooley.com/filedrop/jochoa@cooley.com	Sample URL: PII: jochoa@cooley.com
Source: https://liquidfiles.cooley.com/filedrop/jochoa@cooley.com	Sample URL: PII: jochoa@cooley.com
Source: https://liquidfiles.cooley.com/filedrop/jochoa@cooley.com	Sample URL: PII: jochoa@cooley.com
Source: https://liquidfiles.cooley.com/filedrop/jochoa@cooley.com	Sample URL: PII: jochoa@cooley.com
Source: https://liquidfiles.cooley.com/filedrop/jochoa@cooley.com	Sample URL: PII: jochoa@cooley.com
Source: https://liquidfiles.cooley.com/filedrop/jochoa@cooley.com	Sample URL: PII: jochoa@cooley.com
Source: https://liquidfiles.cooley.com/filedrop/jochoa@cooley.com	Sample URL: PII: jochoa@cooley.com
Source: https://liquidfiles.cooley.com/filedrop/jochoa@cooley.com	Sample URL: PII: jochoa@cooley.com
Source: https://liquidfiles.cooley.com/filedrop/jochoa@cooley.com	Sample URL: PII: jochoa@cooley.com
Source: https://liquidfiles.cooley.com/filedrop/jochoa@cooley.com	Sample URL: PII: jochoa@cooley.com
Source: https://liquidfiles.cooley.com/filedrop/jochoa@cooley.com	Sample URL: PII: jochoa@cooley.com
Source: https://liquidfiles.cooley.com/filedrop/jochoa@cooley.com	Sample URL: PII: jochoa@cooley.com
Source: https://liquidfiles.cooley.com/filedrop/jochoa@cooley.com	Sample URL: PII: jochoa@cooley.com

Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49730 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.50.112.6
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.76.112
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: global traffic	DNS traffic detected: DNS query: liquidfiles.cooley.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725

Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.16:49730 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@14/15@6/123

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://liquidfiles.cooley.com/filedrop/jochoa@cooley.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1976,i,9340924207331991144,4946239053874065700,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1976,i,9340924207331991144,4946239053874065700,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.178.50.36	www.google.com	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.64.227	unknown	United States	15169	GOOGLEUS	false
142.250.217.238	unknown	United States	15169	GOOGLEUS	false
108.177.11.84	unknown	United States	15169	GOOGLEUS	false
173.227.174.84	liquidfiles.cooley.com	United States	54571	COOLEYUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.35.238	unknown	United States	15169	GOOGLEUS	false
142.250.64.170	unknown	United States	15169	GOOGLEUS	false
142.250.217.195	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.8
192.168.2.16
192.168.2.7
192.168.2.4
192.168.2.5

Contacted Domains

Name	IP	Active
liquidfiles.cooley.com	173.227.174.84	true
www.google.com	192.178.50.36	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://liquidfiles.cooley.com/filedrop/jochoa@cooley.com	false		high

ID:	1432135
Product:	CloudBasic
Start time:	15:14:06
Start date:	26.04.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 12:14:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	40E5247017E3E3350AD52FCFF3482C33	B8F0603C6055152417E2F56D4632F6D0EEE3AB4F	6DCF8F71D6F80FB895E0A99044D1A8FF63BC211E7664A4FC3512C9DD20395916
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 12:14:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	255C383D2E350A0EE6D24BACFFFAAE49	C45FCC8FD1D28621E6C6DBF76723C938FDE0A640	EC8B78B87E670DCE87034557C552D790BF61A50B9EE5284353FE9E62A7B5D8F1
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	205A076D6C78685E3C6A6B3CE1E5C8C1	EB1EC81BCFA8710EE49AF82352776B41A7968181	801B5F5C1E1ACDB53CE51366ABC1185F4F24E32C95397039665EA97C1C6E4254
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 12:14:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	97BDA51223492C3640F679F3E5B82791	DE1CDC4C06CB54E7B386885494A5740037D53300	66855F0795323EE54B49287D02E9A32BD79D5946E6C41AEA144C05C78D2CF360
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 12:14:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	A3ADFB7C5EE471BC540B73A52315A6D8	0442E2FA4988B79E805632199679C15DBB1D1E1B	A5D81FA8404D599141D2B9485F20B473E75AA57D21B2AB267759232D6A644E64
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 12:14:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	EAD0A9FB43CB2A77331E735A1EFAAE2E	91E5136EC5C1280AE600B04C9487D5547CC15946	E519B536CABBC3F759EB9004D1C9EF16937A339C0EC698C5A7EAF3FA4928B5E1
Chrome Cache Entry: 65	GIF image data, version 89a, 1 x 1	A484EA6CB73E277B9AA3086F01FCD766	7D47FF94C7397594FE4608C80BA2A9026C2F80CF	D2437DDF45AA84303D14CC4569941C1AE58E8ACCCA92216349C1332794015C6F
Chrome Cache Entry: 68	ASCII text, with no line terminators	69E30378B2D2666B5AC929951F70E993	FC932B5CDFDA226D07623EED538AC3F0AF213A6A	68B3264ADD8FDC0AC1786C50F0AF8EBA4FA4F34221D4907CBD04038A3E07E528
Chrome Cache Entry: 69	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	EA43A0A9648C8CD424EE4CAF791B1C5C	00185E473BA8AD183E4B080C0A20EC98CD1773FC	3E0A13A05F89E505BB0C309E990AF71BAC4E1D1433DFAAB11D336D35608483ED
Chrome Cache Entry: 70	ASCII text, with very long lines (32767)	C004882181021C5E402B6E14F0864304	92C256B6A21710D74C79B14D56F5567D7EFD5B6F	960C913208A60AEAAC47E0CE652F8F74A8171677EDCF98749ACC107B911FEA2D
Chrome Cache Entry: 71	Web Open Font Format (Version 2), TrueType, length 80300, version 331.-31392	8E1ED89B6CCB8CE41FAF5CB672677105	9B592048B9062B00F0B2DD782D70A95B7DC69B83	6B555920E358F8A25A422988B448615C33BCCCB4F932E8331CEBFC8E2A737FC7
Chrome Cache Entry: 72	PNG image data, 482 x 100, 8-bit/color RGBA, non-interlaced	72C83C9CCB68474B90E20EF1E0F38E72	123B95B15CCEF3190B0717B244FE12D14ECA8B1A	6290F8CA4D1C39AC4E06FA63F6DD4C50A8DE9B711D6F4457D92C13D7311D6B35
Chrome Cache Entry: 73	ASCII text, with no line terminators	F903A4028D316A2DDD219D1F06D2BCC6	57742CC934C0861BB4A13CABF0FBD082EEDCEE71	8A476DB890E9BF6CA646670D54F7A474CE73FEBE0708951456458FBC19816A8A
Chrome Cache Entry: 74	ASCII text, with very long lines (65317)	0114615AC5A88F1E7B8AF0E38438756D	292128B156189F43FEE47B244ABE9102CDB64A47	2F676140147F8A571DA8125FFA620FD1458ECD643AFCA955A42E8D3DE1FDAA63
Chrome Cache Entry: 75	Web Open Font Format (Version 2), TrueType, length 6948, version 1.0	265E4CBAA04991D0D14AD908780835E9	E42083235ED94BD4AFAF1A952962719D642764A6	17AFF42970B1DBE2386C2251F0742F468BF55CF7C6C636231973549C4B5A9B98

Windows Analysis Report
https://liquidfiles.cooley.com/filedrop/jochoa@cooley.com

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://liquidfiles.cooley.com/filedrop/jochoa@cooley.com

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://liquidfiles.cooley.com/filedrop/jochoa@cooley.com