Edit tour

Windows Analysis Report
http://zzjtcb.com

Overview

General Information

Sample URL:	http://zzjtcb.com
Analysis ID:	1432168
Infos:

Errors URL not reachable

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

No high impact signatures.

Classification

Analysis Advice

Joe Sandbox was unable to browse the URL (domain or webserver down or HTTPS issue), try to browse the URL again later

Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis

Process Tree

System is w10x64

chrome.exe (PID: 6956 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5156 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2028,i,15384808555624051686,6506097262042404534,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2532 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://zzjtcb.com" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown	HTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49723 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	TCP traffic detected without corresponding DNS query: 52.159.127.243
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: zzjtcb.com
Source: global traffic	DNS traffic detected: DNS query: google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.159.127.243:443 -> 192.168.2.6:49723 version: TLS 1.2

Source: classification engine

Classification label: unknown0.win@19/0@13/3

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2028,i,15384808555624051686,6506097262042404534,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://zzjtcb.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2028,i,15384808555624051686,6506097262042404534,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://zzjtcb.com	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse
bg.microsoft.map.fastly.net	0%	Virustotal		Browse

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	0%, Virustotal, Browse	unknown
google.com	172.217.165.206	true	false		high
www.google.com	192.178.50.36	true	false		high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown
zzjtcb.com	unknown	unknown	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.178.50.36	www.google.com	United States		15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved		unknown	unknown	false

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432168
Start date and time:	2024-04-26 16:11:24 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://zzjtcb.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	UNKNOWN
Classification:	unknown0.win@19/0@13/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	URL browsing timeout or error

Errors

URL not reachable

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.35.238, 108.177.11.84, 192.178.50.35, 34.104.35.123, 23.204.76.112, 192.229.211.108, 20.12.23.50, 199.232.210.172, 13.95.31.18
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wu-bg-shim.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, e16604.g.akamaiedge.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, clients.l.google.com, prod.fs.microsoft.com.akadns.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 16:12:08.679032087 CEST	49674	443	192.168.2.6	173.222.162.64
Apr 26, 2024 16:12:08.679039955 CEST	49673	443	192.168.2.6	173.222.162.64
Apr 26, 2024 16:12:09.647752047 CEST	49672	443	192.168.2.6	173.222.162.64
Apr 26, 2024 16:12:17.071535110 CEST	49716	443	192.168.2.6	192.178.50.36
Apr 26, 2024 16:12:17.071630001 CEST	443	49716	192.178.50.36	192.168.2.6
Apr 26, 2024 16:12:17.071712971 CEST	49716	443	192.168.2.6	192.178.50.36
Apr 26, 2024 16:12:17.071912050 CEST	49716	443	192.168.2.6	192.178.50.36
Apr 26, 2024 16:12:17.071947098 CEST	443	49716	192.178.50.36	192.168.2.6
Apr 26, 2024 16:12:17.466829062 CEST	443	49716	192.178.50.36	192.168.2.6
Apr 26, 2024 16:12:17.467289925 CEST	49716	443	192.168.2.6	192.178.50.36
Apr 26, 2024 16:12:17.467339993 CEST	443	49716	192.178.50.36	192.168.2.6
Apr 26, 2024 16:12:17.468797922 CEST	443	49716	192.178.50.36	192.168.2.6
Apr 26, 2024 16:12:17.468894958 CEST	49716	443	192.168.2.6	192.178.50.36
Apr 26, 2024 16:12:17.470231056 CEST	49716	443	192.168.2.6	192.178.50.36
Apr 26, 2024 16:12:17.470339060 CEST	443	49716	192.178.50.36	192.168.2.6
Apr 26, 2024 16:12:17.680125952 CEST	443	49716	192.178.50.36	192.168.2.6
Apr 26, 2024 16:12:17.680249929 CEST	49716	443	192.168.2.6	192.178.50.36
Apr 26, 2024 16:12:19.254631042 CEST	49672	443	192.168.2.6	173.222.162.64
Apr 26, 2024 16:12:20.668332100 CEST	49720	443	192.168.2.6	52.159.127.243
Apr 26, 2024 16:12:20.668358088 CEST	443	49720	52.159.127.243	192.168.2.6
Apr 26, 2024 16:12:20.668445110 CEST	49720	443	192.168.2.6	52.159.127.243
Apr 26, 2024 16:12:20.669099092 CEST	49720	443	192.168.2.6	52.159.127.243
Apr 26, 2024 16:12:20.669116020 CEST	443	49720	52.159.127.243	192.168.2.6
Apr 26, 2024 16:12:20.739366055 CEST	443	49706	173.222.162.64	192.168.2.6
Apr 26, 2024 16:12:20.739481926 CEST	49706	443	192.168.2.6	173.222.162.64
Apr 26, 2024 16:12:21.160208941 CEST	443	49720	52.159.127.243	192.168.2.6
Apr 26, 2024 16:12:21.160295010 CEST	49720	443	192.168.2.6	52.159.127.243
Apr 26, 2024 16:12:21.173474073 CEST	49720	443	192.168.2.6	52.159.127.243
Apr 26, 2024 16:12:21.173504114 CEST	443	49720	52.159.127.243	192.168.2.6
Apr 26, 2024 16:12:21.173882961 CEST	443	49720	52.159.127.243	192.168.2.6
Apr 26, 2024 16:12:21.215739965 CEST	49720	443	192.168.2.6	52.159.127.243
Apr 26, 2024 16:12:21.248140097 CEST	49720	443	192.168.2.6	52.159.127.243
Apr 26, 2024 16:12:21.248348951 CEST	49720	443	192.168.2.6	52.159.127.243
Apr 26, 2024 16:12:21.248368979 CEST	443	49720	52.159.127.243	192.168.2.6
Apr 26, 2024 16:12:21.248912096 CEST	49720	443	192.168.2.6	52.159.127.243
Apr 26, 2024 16:12:21.296111107 CEST	443	49720	52.159.127.243	192.168.2.6
Apr 26, 2024 16:12:21.409249067 CEST	443	49720	52.159.127.243	192.168.2.6
Apr 26, 2024 16:12:21.409367085 CEST	443	49720	52.159.127.243	192.168.2.6
Apr 26, 2024 16:12:21.409425020 CEST	49720	443	192.168.2.6	52.159.127.243
Apr 26, 2024 16:12:21.410090923 CEST	49720	443	192.168.2.6	52.159.127.243
Apr 26, 2024 16:12:21.410115957 CEST	443	49720	52.159.127.243	192.168.2.6
Apr 26, 2024 16:12:27.445483923 CEST	443	49716	192.178.50.36	192.168.2.6
Apr 26, 2024 16:12:27.445648909 CEST	443	49716	192.178.50.36	192.168.2.6
Apr 26, 2024 16:12:27.445780039 CEST	49716	443	192.168.2.6	192.178.50.36
Apr 26, 2024 16:12:30.983239889 CEST	49723	443	192.168.2.6	52.159.127.243
Apr 26, 2024 16:12:30.983278036 CEST	443	49723	52.159.127.243	192.168.2.6
Apr 26, 2024 16:12:30.983329058 CEST	49723	443	192.168.2.6	52.159.127.243
Apr 26, 2024 16:12:30.984297037 CEST	49723	443	192.168.2.6	52.159.127.243
Apr 26, 2024 16:12:30.984313011 CEST	443	49723	52.159.127.243	192.168.2.6
Apr 26, 2024 16:12:31.077790976 CEST	49716	443	192.168.2.6	192.178.50.36
Apr 26, 2024 16:12:31.077867031 CEST	443	49716	192.178.50.36	192.168.2.6
Apr 26, 2024 16:12:31.475756884 CEST	443	49723	52.159.127.243	192.168.2.6
Apr 26, 2024 16:12:31.475841045 CEST	49723	443	192.168.2.6	52.159.127.243
Apr 26, 2024 16:12:31.480489969 CEST	49723	443	192.168.2.6	52.159.127.243
Apr 26, 2024 16:12:31.480509043 CEST	443	49723	52.159.127.243	192.168.2.6
Apr 26, 2024 16:12:31.481259108 CEST	443	49723	52.159.127.243	192.168.2.6
Apr 26, 2024 16:12:31.484874010 CEST	49723	443	192.168.2.6	52.159.127.243
Apr 26, 2024 16:12:31.484930038 CEST	49723	443	192.168.2.6	52.159.127.243
Apr 26, 2024 16:12:31.485049009 CEST	443	49723	52.159.127.243	192.168.2.6
Apr 26, 2024 16:12:31.485053062 CEST	49723	443	192.168.2.6	52.159.127.243
Apr 26, 2024 16:12:31.528117895 CEST	443	49723	52.159.127.243	192.168.2.6
Apr 26, 2024 16:12:31.649301052 CEST	443	49723	52.159.127.243	192.168.2.6
Apr 26, 2024 16:12:31.650440931 CEST	49723	443	192.168.2.6	52.159.127.243
Apr 26, 2024 16:12:31.650454044 CEST	443	49723	52.159.127.243	192.168.2.6
Apr 26, 2024 16:12:31.650496006 CEST	49723	443	192.168.2.6	52.159.127.243
Apr 26, 2024 16:12:31.650512934 CEST	49723	443	192.168.2.6	52.159.127.243

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 16:12:16.654443979 CEST	53	57097	1.1.1.1	192.168.2.6
Apr 26, 2024 16:12:16.705643892 CEST	53	61116	1.1.1.1	192.168.2.6
Apr 26, 2024 16:12:16.944442034 CEST	54691	53	192.168.2.6	1.1.1.1
Apr 26, 2024 16:12:16.944658041 CEST	50281	53	192.168.2.6	1.1.1.1
Apr 26, 2024 16:12:17.069514036 CEST	53	54691	1.1.1.1	192.168.2.6
Apr 26, 2024 16:12:17.070523024 CEST	53	50281	1.1.1.1	192.168.2.6
Apr 26, 2024 16:12:17.504610062 CEST	53	50390	1.1.1.1	192.168.2.6
Apr 26, 2024 16:12:17.872494936 CEST	54378	53	192.168.2.6	1.1.1.1
Apr 26, 2024 16:12:17.873044014 CEST	49760	53	192.168.2.6	1.1.1.1
Apr 26, 2024 16:12:18.533708096 CEST	53	49760	1.1.1.1	192.168.2.6
Apr 26, 2024 16:12:18.571480036 CEST	53	54378	1.1.1.1	192.168.2.6
Apr 26, 2024 16:12:18.572474003 CEST	50266	53	192.168.2.6	1.1.1.1
Apr 26, 2024 16:12:19.241467953 CEST	53	50266	1.1.1.1	192.168.2.6
Apr 26, 2024 16:12:19.961668015 CEST	50266	53	192.168.2.6	1.1.1.1
Apr 26, 2024 16:12:20.087474108 CEST	53	50266	1.1.1.1	192.168.2.6
Apr 26, 2024 16:12:20.135267973 CEST	51938	53	192.168.2.6	8.8.8.8
Apr 26, 2024 16:12:20.135921955 CEST	62001	53	192.168.2.6	1.1.1.1
Apr 26, 2024 16:12:20.260962009 CEST	53	62001	1.1.1.1	192.168.2.6
Apr 26, 2024 16:12:20.291726112 CEST	53	51938	8.8.8.8	192.168.2.6
Apr 26, 2024 16:12:21.128701925 CEST	51186	53	192.168.2.6	1.1.1.1
Apr 26, 2024 16:12:21.133419037 CEST	58608	53	192.168.2.6	1.1.1.1
Apr 26, 2024 16:12:21.779207945 CEST	53	51186	1.1.1.1	192.168.2.6
Apr 26, 2024 16:12:21.787961006 CEST	53	58608	1.1.1.1	192.168.2.6
Apr 26, 2024 16:12:27.249041080 CEST	55984	53	192.168.2.6	1.1.1.1
Apr 26, 2024 16:12:27.249701023 CEST	57795	53	192.168.2.6	1.1.1.1
Apr 26, 2024 16:12:27.998004913 CEST	53	55984	1.1.1.1	192.168.2.6
Apr 26, 2024 16:12:28.056488991 CEST	54220	53	192.168.2.6	1.1.1.1
Apr 26, 2024 16:12:28.097918987 CEST	53	57795	1.1.1.1	192.168.2.6
Apr 26, 2024 16:12:28.721147060 CEST	53	54220	1.1.1.1	192.168.2.6

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 26, 2024 16:12:20.087560892 CEST	192.168.2.6	1.1.1.1	c230	(Port unreachable)	Destination Unreachable
Apr 26, 2024 16:12:28.098010063 CEST	192.168.2.6	1.1.1.1	c230	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 16:12:16.944442034 CEST	192.168.2.6	1.1.1.1	0xd5da	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 16:12:16.944658041 CEST	192.168.2.6	1.1.1.1	0x97e6	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 26, 2024 16:12:17.872494936 CEST	192.168.2.6	1.1.1.1	0x58ee	Standard query (0)	zzjtcb.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 16:12:17.873044014 CEST	192.168.2.6	1.1.1.1	0x3ba	Standard query (0)	zzjtcb.com	65	IN (0x0001)	false
Apr 26, 2024 16:12:18.572474003 CEST	192.168.2.6	1.1.1.1	0xf96d	Standard query (0)	zzjtcb.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 16:12:19.961668015 CEST	192.168.2.6	1.1.1.1	0xf96d	Standard query (0)	zzjtcb.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 16:12:20.135267973 CEST	192.168.2.6	8.8.8.8	0x3222	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 16:12:20.135921955 CEST	192.168.2.6	1.1.1.1	0x2845	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 16:12:21.128701925 CEST	192.168.2.6	1.1.1.1	0xacbc	Standard query (0)	zzjtcb.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 16:12:21.133419037 CEST	192.168.2.6	1.1.1.1	0xb6a9	Standard query (0)	zzjtcb.com	65	IN (0x0001)	false
Apr 26, 2024 16:12:27.249041080 CEST	192.168.2.6	1.1.1.1	0x60f6	Standard query (0)	zzjtcb.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 16:12:27.249701023 CEST	192.168.2.6	1.1.1.1	0x5732	Standard query (0)	zzjtcb.com	65	IN (0x0001)	false
Apr 26, 2024 16:12:28.056488991 CEST	192.168.2.6	1.1.1.1	0x2592	Standard query (0)	zzjtcb.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 16:12:17.069514036 CEST	1.1.1.1	192.168.2.6	0xd5da	No error (0)	www.google.com		192.178.50.36	A (IP address)	IN (0x0001)	false
Apr 26, 2024 16:12:17.070523024 CEST	1.1.1.1	192.168.2.6	0x97e6	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 26, 2024 16:12:20.260962009 CEST	1.1.1.1	192.168.2.6	0x2845	No error (0)	google.com		172.217.165.206	A (IP address)	IN (0x0001)	false
Apr 26, 2024 16:12:20.291726112 CEST	8.8.8.8	192.168.2.6	0x3222	No error (0)	google.com		142.250.113.138	A (IP address)	IN (0x0001)	false
Apr 26, 2024 16:12:20.291726112 CEST	8.8.8.8	192.168.2.6	0x3222	No error (0)	google.com		142.250.113.100	A (IP address)	IN (0x0001)	false
Apr 26, 2024 16:12:20.291726112 CEST	8.8.8.8	192.168.2.6	0x3222	No error (0)	google.com		142.250.113.113	A (IP address)	IN (0x0001)	false
Apr 26, 2024 16:12:20.291726112 CEST	8.8.8.8	192.168.2.6	0x3222	No error (0)	google.com		142.250.113.101	A (IP address)	IN (0x0001)	false
Apr 26, 2024 16:12:20.291726112 CEST	8.8.8.8	192.168.2.6	0x3222	No error (0)	google.com		142.250.113.102	A (IP address)	IN (0x0001)	false
Apr 26, 2024 16:12:20.291726112 CEST	8.8.8.8	192.168.2.6	0x3222	No error (0)	google.com		142.250.113.139	A (IP address)	IN (0x0001)	false
Apr 26, 2024 16:12:31.346879959 CEST	1.1.1.1	192.168.2.6	0x477b	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 26, 2024 16:12:31.346879959 CEST	1.1.1.1	192.168.2.6	0x477b	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Apr 26, 2024 16:12:32.077388048 CEST	1.1.1.1	192.168.2.6	0x293f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 26, 2024 16:12:32.077388048 CEST	1.1.1.1	192.168.2.6	0x293f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49720	52.159.127.243	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 14:12:21 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4f 2b 33 34 44 66 56 73 46 6b 69 33 36 67 48 77 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 36 30 32 32 61 38 62 35 65 33 65 35 33 35 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: O+34DfVsFki36gHw.1Context: 96022a8b5e3e535b
2024-04-26 14:12:21 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-26 14:12:21 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 4f 2b 33 34 44 66 56 73 46 6b 69 33 36 67 48 77 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 36 30 32 32 61 38 62 35 65 33 65 35 33 35 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 6b 76 4a 2f 43 43 4b 4d 6c 4f 41 30 65 57 6a 79 63 50 50 76 6c 49 4a 30 38 68 2f 6b 58 5a 55 6c 38 77 4c 36 72 47 6c 2f 5a 34 49 74 2f 74 58 68 6a 57 61 4b 42 32 6b 78 56 38 34 5a 5a 4c 49 31 58 63 31 34 38 2f 50 44 33 6d 62 68 38 37 6d 59 7a 31 4a 59 6c 38 69 75 54 43 75 42 38 76 47 36 51 57 44 44 72 5a 46 69 4e 42 52 67 Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: O+34DfVsFki36gHw.2Context: 96022a8b5e3e535b<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbkvJ/CCKMlOA0eWjycPPvlIJ08h/kXZUl8wL6rGl/Z4It/tXhjWaKB2kxV84ZZLI1Xc148/PD3mbh87mYz1JYl8iuTCuB8vG6QWDDrZFiNBRg
2024-04-26 14:12:21 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4f 2b 33 34 44 66 56 73 46 6b 69 33 36 67 48 77 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 36 30 32 32 61 38 62 35 65 33 65 35 33 35 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: O+34DfVsFki36gHw.3Context: 96022a8b5e3e535b<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-26 14:12:21 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-26 14:12:21 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 44 33 59 61 65 52 4c 6e 57 30 57 72 39 55 59 69 39 4b 62 54 59 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: D3YaeRLnW0Wr9UYi9KbTYg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49723	52.159.127.243	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 14:12:31 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6c 68 59 75 31 2f 71 34 2b 6b 2b 6b 34 34 53 35 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 30 63 37 66 33 65 34 34 36 34 61 37 32 63 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: lhYu1/q4+k+k44S5.1Context: 40c7f3e4464a72c7
2024-04-26 14:12:31 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-04-26 14:12:31 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 6c 68 59 75 31 2f 71 34 2b 6b 2b 6b 34 34 53 35 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 30 63 37 66 33 65 34 34 36 34 61 37 32 63 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 6b 76 4a 2f 43 43 4b 4d 6c 4f 41 30 65 57 6a 79 63 50 50 76 6c 49 4a 30 38 68 2f 6b 58 5a 55 6c 38 77 4c 36 72 47 6c 2f 5a 34 49 74 2f 74 58 68 6a 57 61 4b 42 32 6b 78 56 38 34 5a 5a 4c 49 31 58 63 31 34 38 2f 50 44 33 6d 62 68 38 37 6d 59 7a 31 4a 59 6c 38 69 75 54 43 75 42 38 76 47 36 51 57 44 44 72 5a 46 69 4e 42 52 67 Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: lhYu1/q4+k+k44S5.2Context: 40c7f3e4464a72c7<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbkvJ/CCKMlOA0eWjycPPvlIJ08h/kXZUl8wL6rGl/Z4It/tXhjWaKB2kxV84ZZLI1Xc148/PD3mbh87mYz1JYl8iuTCuB8vG6QWDDrZFiNBRg
2024-04-26 14:12:31 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6c 68 59 75 31 2f 71 34 2b 6b 2b 6b 34 34 53 35 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 30 63 37 66 33 65 34 34 36 34 61 37 32 63 37 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: lhYu1/q4+k+k44S5.3Context: 40c7f3e4464a72c7<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-04-26 14:12:31 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-04-26 14:12:31 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 70 65 2b 5a 53 2b 66 71 6d 30 57 4a 56 46 2b 74 32 5a 4d 32 66 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: pe+ZS+fqm0WJVF+t2ZM2fA.0Payload parsing failed.

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 6956, Parent PID: 5808

General

Target ID:	0
Start time:	16:12:08
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5156, Parent PID: 6956

General

Target ID:	2
Start time:	16:12:10
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2028,i,15384808555624051686,6506097262042404534,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 2532, Parent PID: 5808

General

Target ID:	3
Start time:	16:12:16
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://zzjtcb.com"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://zzjtcb.com

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Errors

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 6956, Parent PID: 5808

General

Chronological Activities

Analysis Process: chrome.exePID: 5156, Parent PID: 6956

General

Chronological Activities

Analysis Process: chrome.exePID: 2532, Parent PID: 5808

General

Chronological Activities

Disassembly

Windows Analysis Report
http://zzjtcb.com