Edit tour

Windows Analysis Report
Purchase_Order.html

Overview

General Information

Sample Name:	Purchase_Order.html
Analysis ID:	634547
MD5:	9ad49bf205652c75ea0d39773be570af
SHA1:	ac440ac8e3fbf8a81407ac51bb7380c49fd2849e
SHA256:	ec05d4bcca101434ed9b9a4e8adbf310f7bf60f2d5b7e0c601065da4d3e6fda8
Infos:

Detection

Phisher

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Phisher

HTML document with suspicious name

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3076 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\Purchase_Order.html MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 4472 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1516,15318958304467380805,2454794286047497187,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1916 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Purchase_Order.html	JoeSecurity_Phisher_1	Yara detected Phisher	Joe Security

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 52.6.56.188 52.6.56.188

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v3/__http://localhost/Purchase_Order.zip__;!!EhqYCQ!dfjX4iJSROwj9YE4jHYZJtYnLYdDz3YaC1Gypry5xWistWssa08NbP9PG2PZpLmDV5PD4kC_H5CeLBILP_3fBSo$ HTTP/1.1Host: urldefense.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: 80120ee8-7c94-4706-94df-69aac86e5105.tmp.1.dr, cd054b5d-732b-48ec-bc65-57bbbb7baa21.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 80120ee8-7c94-4706-94df-69aac86e5105.tmp.1.dr, cd054b5d-732b-48ec-bc65-57bbbb7baa21.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 80120ee8-7c94-4706-94df-69aac86e5105.tmp.1.dr, cd054b5d-732b-48ec-bc65-57bbbb7baa21.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.0.dr, manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 80120ee8-7c94-4706-94df-69aac86e5105.tmp.1.dr, cd054b5d-732b-48ec-bc65-57bbbb7baa21.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: 4d8da041-e247-4ca7-8733-90098c4f5123.tmp.1.dr, 868cb552-c630-4332-95b1-5ea2363f0cf4.tmp.1.dr, 80120ee8-7c94-4706-94df-69aac86e5105.tmp.1.dr, cd054b5d-732b-48ec-bc65-57bbbb7baa21.tmp.1.dr	String found in binary or memory: https://dns.google
Source: cd054b5d-732b-48ec-bc65-57bbbb7baa21.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: 80120ee8-7c94-4706-94df-69aac86e5105.tmp.1.dr, cd054b5d-732b-48ec-bc65-57bbbb7baa21.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: 80120ee8-7c94-4706-94df-69aac86e5105.tmp.1.dr, cd054b5d-732b-48ec-bc65-57bbbb7baa21.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 80120ee8-7c94-4706-94df-69aac86e5105.tmp.1.dr, cd054b5d-732b-48ec-bc65-57bbbb7baa21.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: 80120ee8-7c94-4706-94df-69aac86e5105.tmp.1.dr	String found in binary or memory: https://r3---sn-1gi7znek.gvt1.com
Source: 80120ee8-7c94-4706-94df-69aac86e5105.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 80120ee8-7c94-4706-94df-69aac86e5105.tmp.1.dr, cd054b5d-732b-48ec-bc65-57bbbb7baa21.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: Purchase_Order.html	String found in binary or memory: https://urldefense.com/v3/__http://localhost/Purchase_Order.zip__;
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 80120ee8-7c94-4706-94df-69aac86e5105.tmp.1.dr, cd054b5d-732b-48ec-bc65-57bbbb7baa21.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: 80120ee8-7c94-4706-94df-69aac86e5105.tmp.1.dr, craw_window.js.0.dr, craw_background.js.0.dr, cd054b5d-732b-48ec-bc65-57bbbb7baa21.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 80120ee8-7c94-4706-94df-69aac86e5105.tmp.1.dr, cd054b5d-732b-48ec-bc65-57bbbb7baa21.tmp.1.dr	String found in binary or memory: https://www.gstatic.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\Purchase_Order.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1516,15318958304467380805,2454794286047497187,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1916 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1516,15318958304467380805,2454794286047497187,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1916 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\3076_663717991\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\3076_663717991\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\3076_663717991\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\3076_663717991\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\3076_663717991\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\3076_663717991\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\3076_663717991\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\3076_663717991\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\3076_663717991\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
accounts.google.com	142.250.203.109	true	false		high
urldefense.com	52.6.56.188	true	false	0%, Virustotal, Browse	unknown
clients.l.google.com	216.58.215.238	true	false		high
clients2.google.com	unknown	unknown	false		high

Name	Malicious	Antivirus Detection	Reputation
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
216.58.215.238	clients.l.google.com	United States	15169	GOOGLEUS	false
52.6.56.188	urldefense.com	United States	14618	AMAZON-AESUS	false
142.250.203.109	accounts.google.com	United States	15169	GOOGLEUS	false

IP
192.168.2.1
127.0.0.1

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	634547
Start date and time: 26/05/202212:02:50	2022-05-26 12:02:50 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Purchase_Order.html
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.phis.winHTML@29/113@3/6
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .html Adjust boot time Enable AMSI

Match	Associated Sample Name / URL	SHA 256	Detection	Link
239.255.255.250	http://159.223.168.198	Get hash	malicious	Browse
	http://179.60.150.117/data/shi.png	Get hash	malicious	Browse
	http://updates.password-update.com/76aaf4998a4ea5a3?l=13	Get hash	malicious	Browse
	https://apps.redcrossglobal.ga:443/use20/documents/New_RAW.exe	Get hash	malicious	Browse
	http://159.223.168.198/	Get hash	malicious	Browse
	https://www.ftaviation.com.co/gen/geo.htm#jacques.federspiel@hopitauxschuman.lu	Get hash	malicious	Browse
	https://telegra.ph/Income-from-1200-per-day-05-23-4?id79864	Get hash	malicious	Browse
	https://shared-file.wasol.online/office-file	Get hash	malicious	Browse
	https://wildfire.paloaltonetworks.com/panos/sample/cloud/Wi9NUHhlYkdOOWVaNDAxc2s4V1dtRWxPZXZvYUhGUm5UK0lHdC80WCtxSHM1ZnJCVUIrMVQzUkc1Q3JqOUNBTUUyMldobTY2eHl5YkNuQ0c1Z3FYZmQya3NudEJsOGdKRm1FUGtwUWJjMWtTcXhKZEtOdW9qbDRPWUNpOVVwdXZBZjR6NUkxODRVbXlLRUI5YmVrVks3YllvWmUzb1dPdkcxMzVtV1hwd2ZXNzBGTUM0dXFnWWVoUmo1OWc2cjRaQXlldlQ0M2FwWU1vRTNJVUNQSHlhdz09	Get hash	malicious	Browse
	https://katrina-v.company.com	Get hash	malicious	Browse
	ATT00001.htm	Get hash	malicious	Browse
	http://frameboxxindore.com	Get hash	malicious	Browse
	FedExXDocumentXforXinfo@ai.vub.ac.be.HTML	Get hash	malicious	Browse
	https://drive.google.com/uc?export=download&id=1h4ffllxPZx-hG4yuWRFo1vh83jdeXfmO	Get hash	malicious	Browse
	https://drive.google.com/uc?export=download&id=1h4ffllxPZx-hG4yuWRFo1vh83jdeXfmO	Get hash	malicious	Browse
	https://click.alamode.com/?adcode=CPEMAQM0913_1&url=https://beautepure.com/zeg/mic?e=aGFtaXNoLmZpcnRoQGRhdGFjb20uY28ubno	Get hash	malicious	Browse
	http://howtomule.com	Get hash	malicious	Browse
	https://auto-review.w3spaces.com/	Get hash	malicious	Browse
	https://auto-review.w3spaces.com/	Get hash	malicious	Browse
	519616 303414 Your schreiberfoods-7 storage is full 69399.msg	Get hash	malicious	Browse
52.6.56.188	https://uspsincglobaly.com/MYUS	Get hash	malicious	Browse
	Invoice Statement PAYMENT.html	Get hash	malicious	Browse
	https://0pj74.mjt.lu/lnk/AU0AAFCIIqMAAAAAMPoAAAkFxLQAAAAAOQkAAC_WABxQygBiTRtE7HMBohvcR4ytP8r2SBLA1AAbEmk/2/_237Eme3gGjcuQXnfluhzw/aHR0cHM6Ly9rb3BhbGF2aWJlcy5jb20vd3AtYWRtaW4vb21nLmh0bWw	Get hash	malicious	Browse
	Secured doc.html	Get hash	malicious	Browse
	message_zdm.html	Get hash	malicious	Browse
	Attachments msg.html	Get hash	malicious	Browse
	receipt748.html	Get hash	malicious	Browse
	https://urldefense.com/v3/__http://www.checkster.com/?utm_campaign=Leads20from20Survey&utm_medium=survey&utm_source=Checkup20Status20Report__;JSUlJQ!!NtiiY2Cb8wEFNXI4aQ!5agBBBVa1HCSO0GMqGikH9L-Trri4rjXoWfhqx6zOxLcEWvq4j3mWhJjSY294ktxbQ$	Get hash	malicious	Browse
	https://urldefense.com/v3/__http://link.vetstreetpro.com/u/nrd.php?p=rEZdBfmjQS_237689_130_1_2&ems_l=53&d=aHR0cHM6Ly93d3cudmV0c2VjdXJlLmNvbS9tdGRpYWJsb3ZldGVyaW5hcnltZWRpY2FsY2VudGVyLmNvbQ3D3D7CNDgyMDMwODQ3D7COTk5MDQ5ZTllYmRlNGJjMjhlNzkwYmQ1ZWI0MjAzZWE3D*7C&_esuh=$6$a8d73a809c833c6008dc8597c6d516027e1cab9fd4e36d4d9bf165efbd9bc6dc__;JSUlJSUlJQ!!NDLcIA!aQwQCobjNyU2LNwXtJxvAgDswpaFPitaAdn25EmuZilyoCKbn-f4__2gdOSQml8$	Get hash	malicious	Browse
	https://urldefense.com/v3/__https:/danmoorelaw-my.sharepoint.com/:b:/p/dan/Efr9mTpkPzlAnM7ZA7I-oJ4B6MvAgCYFl48A97Xctc9L7w?e=4*3aYkMW3E&at=9__;JQ!!KzIVK9q-m3Ij!dWrVVRuq0LfSOPU9Q3Ij1JO3LNvaa-miEk4i93fYr9qN8cHjRO-zA6l09wJEy82SJ_7DXvJVug$	Get hash	malicious	Browse
	https://urldefense.com/v3/__https:/xpkrtlavmnkxcmmloavpyrlqitntbudfrfpx-dot-glegen303939423233.ue.r.appspot.com/*gilliamm@monhealthsys.org__;Iw!!NkJaJ5AE!ZKu6ut2hV6WZQ2APFtSnRizFMAXefvmlO5DOyV-wb9Zp9ofkcIm-Aec1RF01wW01$	Get hash	malicious	Browse
	https://urldefense.com/v3/__https://apple.news/AGPZFD4YuSIy7eITrfEq1mg?articleList=A6XW6V9SmTE-026HQxQ2cAw,20ARo9QUzYGSB6T0s_U7bDK2Q,20Ap8lXL9eMRwWn3SAtAyWeJg,*20AATUCcTn5RCi03k4NpTfAkA&campaign_id=E101&campaign_type=65f11974-8154-4e0b-eedc-1e82340945f4&creative_id=summary-4:summary__;JSUl!!NtiiY2Cb8wEFNXI4aQ!8t7teN08v9SPPP4GIT90hbV0N2C4tC85nLqiz4V5Zp99QfolYwN3KpZzlNTuRFuH$	Get hash	malicious	Browse
	https://urldefense.com/v3/__http://url2690.account.zulily.com/ls/click?upn=YGrIHE2m8f3tdBKVUcf13g9i3wXIAUVLt-2Bg-2Fr-2BU63Z695oUW-2FFKbXlCyd2oWKFaEVAYFdjaig7u7ABa934yUK8JVSy4qPYXBIAfkKCvh-2BgG0JsWYz8s9t0zo31NXHd8w11l0_cQzyv1Rm-2FgmKf6OGDG7WygWrUvu3K27kiodlj8e5iA0fNV1JW594PBi7Ai41Fl7DWmaY31Md6XEurKeV-2BuJJ6DkByfOoYKkDjl397yq78Dv96awcs3Scse8LWRTuJ0elGqfxVCWBTU4wipcMZtqTTBp8TCwu6nbWmhBWTJcqtFQQ1mmFq1KD9v5PyU0O2z6KJ-2F-2Fosn07pimTU6PzcjiFpXe2HdwwSNWz2dpQQCqxaI1id45gZ3dzszrYtrPM6zq5__;!!ODYTt7Uqo6LDP14!1Ri6wdbk1OOFOcRB5tCKGeUaYt8C11TgWi3F2Oqn_B5VZtwJRVE_V30xS8oQunlXgVmKJqvEoiQyFrY$	Get hash	malicious	Browse
	https://urldefense.com/v3/__https://compositeap.dropmark.com/767971/21511951__;!!PiRm62aC!H2Lrv7Zd2M3RtyytS1BC2sF9jocm77PwfQMto5LkOVVYpZl3LKrsLdwx5vY2Bsghw2nngQ3W$	Get hash	malicious	Browse
	https://urldefense.com/v3/__http:/bit.do/fca5L__;!8265U9OcugY!hZ-wEKst9cgCrLU60QCeYvUI3ema611DvKVSneyD3byF3MAOqUsoRkso2qqVnpfN5LY$	Get hash	malicious	Browse

Name	Source	Malicious	Antivirus Detection	Reputation
https://dns.google	4d8da041-e247-4ca7-8733-90098c4f5123.tmp.1.dr, 868cb552-c630-4332-95b1-5ea2363f0cf4.tmp.1.dr, 80120ee8-7c94-4706-94df-69aac86e5105.tmp.1.dr, cd054b5d-732b-48ec-bc65-57bbbb7baa21.tmp.1.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	80120ee8-7c94-4706-94df-69aac86e5105.tmp.1.dr, cd054b5d-732b-48ec-bc65-57bbbb7baa21.tmp.1.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://play.google.com	80120ee8-7c94-4706-94df-69aac86e5105.tmp.1.dr, cd054b5d-732b-48ec-bc65-57bbbb7baa21.tmp.1.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-llvm.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
http://llvm.org/):	pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	false		high
https://www.google.com	80120ee8-7c94-4706-94df-69aac86e5105.tmp.1.dr, cd054b5d-732b-48ec-bc65-57bbbb7baa21.tmp.1.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry%s:	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://accounts.google.com	80120ee8-7c94-4706-94df-69aac86e5105.tmp.1.dr, cd054b5d-732b-48ec-bc65-57bbbb7baa21.tmp.1.dr	false		high
https://clients2.googleusercontent.com	80120ee8-7c94-4706-94df-69aac86e5105.tmp.1.dr, cd054b5d-732b-48ec-bc65-57bbbb7baa21.tmp.1.dr	false		high
https://apis.google.com	80120ee8-7c94-4706-94df-69aac86e5105.tmp.1.dr, cd054b5d-732b-48ec-bc65-57bbbb7baa21.tmp.1.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-clang.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://clients2.google.com	80120ee8-7c94-4706-94df-69aac86e5105.tmp.1.dr, cd054b5d-732b-48ec-bc65-57bbbb7baa21.tmp.1.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json0.0.dr, manifest.json.0.dr	false		high

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
urldefense.com	https://s.gosite.com/mvhtfrn2	Get hash	malicious	Browse	52.6.56.188
	https://uspsincglobaly.com/MYUS	Get hash	malicious	Browse	52.6.56.188
	Invoice Statement PAYMENT.html	Get hash	malicious	Browse	52.6.56.188
	https://0pj74.mjt.lu/lnk/AU0AAFCIIqMAAAAAMPoAAAkFxLQAAAAAOQkAAC_WABxQygBiTRtE7HMBohvcR4ytP8r2SBLA1AAbEmk/2/_237Eme3gGjcuQXnfluhzw/aHR0cHM6Ly9rb3BhbGF2aWJlcy5jb20vd3AtYWRtaW4vb21nLmh0bWw	Get hash	malicious	Browse	52.6.56.188
	Secured doc.html	Get hash	malicious	Browse	52.6.56.188
	Secured doc.html	Get hash	malicious	Browse	52.71.28.102
	https://link.zixcentral.com/u/06726fd4/5vJfkaeu7BGylhalIYY8jw?u=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2F%2F1drv.ms%3A443%2Fo%2Fs%21BKOXJ4VuWEi1mxzaJGKALDpVa3U-%3Fe%3Dr9PrIMnCg0OxsKivFhh_UA%26at%3D9__%3B%21%21GPGxl0X-aILuSw%21lkIkA5o9EiCWQTI_jGf2xQr8AwVYTMEINP1jxXgpOmmTKd8pHjh8IVpA1pd7VVs_dHFdmY1quXmEuktr5b-ldms-gO8fnA%24	Get hash	malicious	Browse	52.204.90.22
	DHL Online Receipt.html	Get hash	malicious	Browse	52.71.28.102
	message_zdm.html	Get hash	malicious	Browse	52.6.56.188
	Attachments msg.html	Get hash	malicious	Browse	52.6.56.188
	Documents.htm	Get hash	malicious	Browse	52.204.90.22
	Joseph_Pereira.html	Get hash	malicious	Browse	52.71.28.102
	Joseph_Pereira.html	Get hash	malicious	Browse	52.204.90.22
	receipt748.html	Get hash	malicious	Browse	52.6.56.188
	https://urldefense.com/v3/__https://survey.alchemer.com/s3/6096273/Lightwave-Management-Resources__;!!MdZ9-hZ0wg!ZsukVhRZ7xT3x54Pydo35VzWljNY3CYbQVC8tMv2Hk8oY7kQ0tTRv__oXNBaP2L9$	Get hash	malicious	Browse	52.71.28.102
	https://urldefense.com/v3/__https://our4home.weebly.com/__;!!Mih3wA!Qz0aR1KaZW-jrB9FELx-FwKRvoLP2Tej_V_sM6iMx39anDNA-j7H7Aog9Wq1X_HWkx4j$	Get hash	malicious	Browse	52.71.28.102
	https://urldefense.com/v3/__http://links.metlife-online.com/els/v1/RLL4SyZb*mME/YmczRU5oSVRyZnJqTms5QnF0bEFkVkVKR1JWRVZTa0xIQlYrM3hiK0FaUkxiTjRtNmUwSE9OODJQTDZ2T1dPSEx2R0RwRGVsUzMrL1hNck1oWXZOUHB1R204TTRQY1hxY2pFNDNYRzZOaDA9S0/N1JrZ0tqanVkbVNBd0FObkxhaFZibllqOGlnRE5JS3RRK1dXOFpxaEV5Yz0S1__;fg!!OfrnovttFxw!8NdYUIu-wZBrmkShbThB_nggutnqknc1-bWA6aQTDBJuEp-3GmqGULvqBH6UuhLX7PaLsgb8zbvKB6oZMb6E0uECgA$	Get hash	malicious	Browse	52.71.28.102
	https://urldefense.com/v3/__http://www.checkster.com/?utm_campaign=Leads20from20Survey&utm_medium=survey&utm_source=Checkup20Status20Report__;JSUlJQ!!NtiiY2Cb8wEFNXI4aQ!5agBBBVa1HCSO0GMqGikH9L-Trri4rjXoWfhqx6zOxLcEWvq4j3mWhJjSY294ktxbQ$	Get hash	malicious	Browse	52.6.56.188
	https://urldefense.com/v3/__https://app.checkster.com:443/ind/turnOffDailyReportFromEmail.php?XSsT2AERVToPPyeVRusc2RJRD0xMjQxMjQ3JmlkPTEyNDEyNDcmY0lEPTg0ODM5MQ==XFsI2NESVHoPPyeVRus__;!!NtiiY2Cb8wEFNXI4aQ!5agBBBVa1HCSO0GMqGikH9L-Trri4rjXoWfhqx6zOxLcEWvq4j3mWhJjSY38cppbJw$	Get hash	malicious	Browse	52.71.28.102
	https://urldefense.com/v3/__http://link.vetstreetpro.com/u/nrd.php?p=rEZdBfmjQS_237689_130_1_5&ems_l=53&d=aHR0cDovL3d3dy5tdGRpYWJsb3ZldGVyaW5hcnltZWRpY2FsY2VudGVyLmNvbS83D7C&_esuh=$6$4a14f039827be505ebbc8d7bf96cd9011002248b014647270e29bd1907495902__;JSU!!NDLcIA!aQwQCobjNyU2LNwXtJxvAgDswpaFPitaAdn25EmuZilyoCKbn-f4__2ggiRuuNw$	Get hash	malicious	Browse	52.204.90.22

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AMAZON-AESUS	OxjB95ogxT	Get hash	malicious	Browse	54.83.30.8
	http://updates.password-update.com/76aaf4998a4ea5a3?l=13	Get hash	malicious	Browse	50.19.214.83
	SSH	Get hash	malicious	Browse	18.207.93.251
	yO81hWrF4h	Get hash	malicious	Browse	35.175.60.234
	MD1ZUNXPbl	Get hash	malicious	Browse	18.214.110.69
	http://frameboxxindore.com	Get hash	malicious	Browse	35.168.124.79
	519616 303414 Your schreiberfoods-7 storage is full 69399.msg	Get hash	malicious	Browse	52.205.130.166
	4Ki8Jrjp7t	Get hash	malicious	Browse	99.77.128.113
	HW24PyRaNs	Get hash	malicious	Browse	54.23.16.208
	https://businesproposal.net	Get hash	malicious	Browse	18.215.110.221
	http://947.pichyrsts.com./#.656975/Y2hhcmxlc19zdGFubGV5QGJheWxvci5lZHUN/3683/aHR0cHM6Ly9maWVyY2VlLnoxMy53ZWIuY29yZS53aW5kb3dzLm5ldC8jY2hhcmxlc19zdGFubGV5QGJheWxvci5lZHUN/947	Get hash	malicious	Browse	35.153.119.107
	s9mCq5RmCm	Get hash	malicious	Browse	18.232.119.242
	3dxS85LHSh	Get hash	malicious	Browse	54.22.37.214
	bfztL1sfab	Get hash	malicious	Browse	34.203.79.104
	http://bit.do/fUj2g	Get hash	malicious	Browse	54.83.52.76
	https://irenstyling.com/hud-file/Doc/	Get hash	malicious	Browse	52.87.65.167
	http://core.prodibi.com	Get hash	malicious	Browse	34.193.113.164
	https://rebrand.ly/1fmdad4	Get hash	malicious	Browse	35.173.170.44
	https://www.evernote.com/shard/s440/sh/22d4cf06-6514-e56f-fbf4-32d904787ae2/3807919a58a19590ad4302023af1bd2b/res/8b2b610d-772a-ec3e-9cdc-2eb0fc928b33	Get hash	malicious	Browse	23.23.138.147
	SecuriteInfo.com.Variant.Strictor.270431.21119.exe	Get hash	malicious	Browse	52.20.84.62

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	high, very likely benign file
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.749175065278439
TrID:	HyperText Markup Language (5005/1) 100.00%
File name:	Purchase_Order.html
File size:	213
MD5:	9ad49bf205652c75ea0d39773be570af
SHA1:	ac440ac8e3fbf8a81407ac51bb7380c49fd2849e
SHA256:	ec05d4bcca101434ed9b9a4e8adbf310f7bf60f2d5b7e0c601065da4d3e6fda8
SHA512:	1938dedb70e8268375ef0ba689a944e2a15ce903a2c1babde59076e1ec808d0092f48dfce86e7e9de8b6d1fdf06e1ea1b6271630440590b2e5a2bd5302caee96
SSDEEP:	6:GMRJXRvH1JtIrhGdEJ7AKOLvBxva8DhLU2JDESz0O:GM9/10F7AKOZx/ZUcDV0O
TLSH:	8CD023C21CA1806593A4D66465C95C5DC01960C1F52C0C4C9C2047F95561F08DBC3913
File Content Preview:	<meta http-equiv="refresh" content="2;url='https://urldefense.com/v3/__http://localhost/Purchase_Order.zip__;!!EhqYCQ!dfjX4iJSROwj9YE4jHYZJtYnLYdDz3YaC1Gypry5xWistWssa08NbP9PG2PZpLmDV5PD4kC_H5CeLBILP_3fBSo$'" />..

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 26, 2022 12:04:07.057749987 CEST	49719	443	192.168.2.3	216.58.215.238
May 26, 2022 12:04:07.057787895 CEST	443	49719	216.58.215.238	192.168.2.3
May 26, 2022 12:04:07.057862997 CEST	49719	443	192.168.2.3	216.58.215.238
May 26, 2022 12:04:07.059171915 CEST	49721	443	192.168.2.3	142.250.203.109
May 26, 2022 12:04:07.059216022 CEST	443	49721	142.250.203.109	192.168.2.3
May 26, 2022 12:04:07.059278011 CEST	49721	443	192.168.2.3	142.250.203.109
May 26, 2022 12:04:07.060234070 CEST	49719	443	192.168.2.3	216.58.215.238
May 26, 2022 12:04:07.060255051 CEST	443	49719	216.58.215.238	192.168.2.3
May 26, 2022 12:04:07.060905933 CEST	49721	443	192.168.2.3	142.250.203.109
May 26, 2022 12:04:07.060918093 CEST	443	49721	142.250.203.109	192.168.2.3
May 26, 2022 12:04:07.116275072 CEST	443	49719	216.58.215.238	192.168.2.3
May 26, 2022 12:04:07.119124889 CEST	443	49721	142.250.203.109	192.168.2.3
May 26, 2022 12:04:07.124814987 CEST	49721	443	192.168.2.3	142.250.203.109
May 26, 2022 12:04:07.124844074 CEST	443	49721	142.250.203.109	192.168.2.3
May 26, 2022 12:04:07.125020981 CEST	49719	443	192.168.2.3	216.58.215.238
May 26, 2022 12:04:07.125052929 CEST	443	49719	216.58.215.238	192.168.2.3
May 26, 2022 12:04:07.125430107 CEST	443	49719	216.58.215.238	192.168.2.3
May 26, 2022 12:04:07.125516891 CEST	49719	443	192.168.2.3	216.58.215.238
May 26, 2022 12:04:07.125969887 CEST	443	49721	142.250.203.109	192.168.2.3
May 26, 2022 12:04:07.126086950 CEST	49721	443	192.168.2.3	142.250.203.109
May 26, 2022 12:04:07.126223087 CEST	443	49719	216.58.215.238	192.168.2.3
May 26, 2022 12:04:07.126272917 CEST	49719	443	192.168.2.3	216.58.215.238
May 26, 2022 12:04:07.301120996 CEST	49719	443	192.168.2.3	216.58.215.238
May 26, 2022 12:04:07.301290035 CEST	443	49719	216.58.215.238	192.168.2.3
May 26, 2022 12:04:07.301338911 CEST	49721	443	192.168.2.3	142.250.203.109
May 26, 2022 12:04:07.301597118 CEST	443	49721	142.250.203.109	192.168.2.3
May 26, 2022 12:04:07.301856041 CEST	49719	443	192.168.2.3	216.58.215.238
May 26, 2022 12:04:07.301883936 CEST	443	49719	216.58.215.238	192.168.2.3
May 26, 2022 12:04:07.301984072 CEST	49721	443	192.168.2.3	142.250.203.109
May 26, 2022 12:04:07.302009106 CEST	443	49721	142.250.203.109	192.168.2.3
May 26, 2022 12:04:07.337486982 CEST	443	49719	216.58.215.238	192.168.2.3
May 26, 2022 12:04:07.337593079 CEST	49719	443	192.168.2.3	216.58.215.238
May 26, 2022 12:04:07.337624073 CEST	443	49719	216.58.215.238	192.168.2.3
May 26, 2022 12:04:07.337709904 CEST	443	49719	216.58.215.238	192.168.2.3
May 26, 2022 12:04:07.337774992 CEST	49719	443	192.168.2.3	216.58.215.238
May 26, 2022 12:04:07.346620083 CEST	49719	443	192.168.2.3	216.58.215.238
May 26, 2022 12:04:07.346657991 CEST	443	49719	216.58.215.238	192.168.2.3
May 26, 2022 12:04:07.355293989 CEST	49721	443	192.168.2.3	142.250.203.109
May 26, 2022 12:04:07.356334925 CEST	443	49721	142.250.203.109	192.168.2.3
May 26, 2022 12:04:07.356585026 CEST	443	49721	142.250.203.109	192.168.2.3
May 26, 2022 12:04:07.356667042 CEST	49721	443	192.168.2.3	142.250.203.109
May 26, 2022 12:04:07.374248028 CEST	49721	443	192.168.2.3	142.250.203.109
May 26, 2022 12:04:07.374291897 CEST	443	49721	142.250.203.109	192.168.2.3
May 26, 2022 12:04:08.950427055 CEST	49738	443	192.168.2.3	52.6.56.188
May 26, 2022 12:04:08.950474977 CEST	443	49738	52.6.56.188	192.168.2.3
May 26, 2022 12:04:08.950547934 CEST	49738	443	192.168.2.3	52.6.56.188
May 26, 2022 12:04:08.950970888 CEST	49739	443	192.168.2.3	52.6.56.188
May 26, 2022 12:04:08.951006889 CEST	443	49739	52.6.56.188	192.168.2.3
May 26, 2022 12:04:08.951067924 CEST	49739	443	192.168.2.3	52.6.56.188
May 26, 2022 12:04:08.951420069 CEST	49739	443	192.168.2.3	52.6.56.188
May 26, 2022 12:04:08.951432943 CEST	443	49739	52.6.56.188	192.168.2.3
May 26, 2022 12:04:08.951592922 CEST	49738	443	192.168.2.3	52.6.56.188
May 26, 2022 12:04:08.951608896 CEST	443	49738	52.6.56.188	192.168.2.3
May 26, 2022 12:04:09.391716003 CEST	443	49739	52.6.56.188	192.168.2.3
May 26, 2022 12:04:09.394762993 CEST	443	49738	52.6.56.188	192.168.2.3
May 26, 2022 12:04:09.442065954 CEST	49738	443	192.168.2.3	52.6.56.188
May 26, 2022 12:04:09.451133966 CEST	49739	443	192.168.2.3	52.6.56.188
May 26, 2022 12:04:09.451165915 CEST	443	49739	52.6.56.188	192.168.2.3
May 26, 2022 12:04:09.451320887 CEST	49738	443	192.168.2.3	52.6.56.188
May 26, 2022 12:04:09.451333046 CEST	443	49738	52.6.56.188	192.168.2.3
May 26, 2022 12:04:09.454135895 CEST	443	49739	52.6.56.188	192.168.2.3
May 26, 2022 12:04:09.454159975 CEST	443	49739	52.6.56.188	192.168.2.3
May 26, 2022 12:04:09.454273939 CEST	49739	443	192.168.2.3	52.6.56.188
May 26, 2022 12:04:09.454334021 CEST	443	49738	52.6.56.188	192.168.2.3
May 26, 2022 12:04:09.454365015 CEST	443	49738	52.6.56.188	192.168.2.3
May 26, 2022 12:04:09.454411030 CEST	49738	443	192.168.2.3	52.6.56.188
May 26, 2022 12:04:09.458255053 CEST	49739	443	192.168.2.3	52.6.56.188
May 26, 2022 12:04:09.458410978 CEST	49738	443	192.168.2.3	52.6.56.188
May 26, 2022 12:04:09.458451986 CEST	443	49739	52.6.56.188	192.168.2.3
May 26, 2022 12:04:09.458667994 CEST	443	49738	52.6.56.188	192.168.2.3
May 26, 2022 12:04:09.458780050 CEST	49739	443	192.168.2.3	52.6.56.188
May 26, 2022 12:04:09.458791971 CEST	443	49739	52.6.56.188	192.168.2.3
May 26, 2022 12:04:09.542083025 CEST	49738	443	192.168.2.3	52.6.56.188
May 26, 2022 12:04:09.542125940 CEST	443	49738	52.6.56.188	192.168.2.3
May 26, 2022 12:04:09.567110062 CEST	49739	443	192.168.2.3	52.6.56.188
May 26, 2022 12:04:09.603699923 CEST	443	49739	52.6.56.188	192.168.2.3
May 26, 2022 12:04:09.603854895 CEST	443	49739	52.6.56.188	192.168.2.3
May 26, 2022 12:04:09.603938103 CEST	49739	443	192.168.2.3	52.6.56.188
May 26, 2022 12:04:09.642126083 CEST	49738	443	192.168.2.3	52.6.56.188
May 26, 2022 12:04:09.659889936 CEST	49739	443	192.168.2.3	52.6.56.188
May 26, 2022 12:04:09.659919977 CEST	443	49739	52.6.56.188	192.168.2.3
May 26, 2022 12:04:21.394495964 CEST	49738	443	192.168.2.3	52.6.56.188
May 26, 2022 12:04:21.394787073 CEST	443	49738	52.6.56.188	192.168.2.3
May 26, 2022 12:04:21.394821882 CEST	443	49738	52.6.56.188	192.168.2.3
May 26, 2022 12:04:21.394874096 CEST	49738	443	192.168.2.3	52.6.56.188
May 26, 2022 12:04:21.394906044 CEST	49738	443	192.168.2.3	52.6.56.188

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 26, 2022 12:04:07.000020027 CEST	55923	53	192.168.2.3	8.8.8.8
May 26, 2022 12:04:07.011049032 CEST	57421	53	192.168.2.3	8.8.8.8
May 26, 2022 12:04:07.032320976 CEST	53	57421	8.8.8.8	192.168.2.3
May 26, 2022 12:04:07.032916069 CEST	53	55923	8.8.8.8	192.168.2.3
May 26, 2022 12:04:08.926584959 CEST	63548	53	192.168.2.3	8.8.8.8
May 26, 2022 12:04:08.945158005 CEST	53	63548	8.8.8.8	192.168.2.3
May 26, 2022 12:04:16.835279942 CEST	63147	443	192.168.2.3	216.58.215.238
May 26, 2022 12:04:16.864763021 CEST	443	63147	216.58.215.238	192.168.2.3
May 26, 2022 12:04:16.865339041 CEST	63147	443	192.168.2.3	216.58.215.238
May 26, 2022 12:04:16.894689083 CEST	443	63147	216.58.215.238	192.168.2.3
May 26, 2022 12:04:16.894726038 CEST	443	63147	216.58.215.238	192.168.2.3
May 26, 2022 12:04:16.894750118 CEST	443	63147	216.58.215.238	192.168.2.3
May 26, 2022 12:04:16.894768000 CEST	443	63147	216.58.215.238	192.168.2.3
May 26, 2022 12:04:16.908294916 CEST	63147	443	192.168.2.3	216.58.215.238
May 26, 2022 12:04:16.918232918 CEST	63147	443	192.168.2.3	216.58.215.238
May 26, 2022 12:04:16.924998045 CEST	443	63147	216.58.215.238	192.168.2.3
May 26, 2022 12:04:16.925028086 CEST	443	63147	216.58.215.238	192.168.2.3
May 26, 2022 12:04:16.939178944 CEST	63147	443	192.168.2.3	216.58.215.238
May 26, 2022 12:04:16.975074053 CEST	63147	443	192.168.2.3	216.58.215.238
May 26, 2022 12:04:16.975543022 CEST	63147	443	192.168.2.3	216.58.215.238
May 26, 2022 12:04:17.004793882 CEST	443	63147	216.58.215.238	192.168.2.3
May 26, 2022 12:04:17.017544985 CEST	443	63147	216.58.215.238	192.168.2.3
May 26, 2022 12:04:17.021456003 CEST	443	63147	216.58.215.238	192.168.2.3
May 26, 2022 12:04:17.021492004 CEST	443	63147	216.58.215.238	192.168.2.3
May 26, 2022 12:04:17.021514893 CEST	443	63147	216.58.215.238	192.168.2.3
May 26, 2022 12:04:17.035074949 CEST	443	63147	216.58.215.238	192.168.2.3
May 26, 2022 12:04:17.095910072 CEST	443	63147	216.58.215.238	192.168.2.3
May 26, 2022 12:04:17.216491938 CEST	443	63147	216.58.215.238	192.168.2.3
May 26, 2022 12:04:17.297203064 CEST	63147	443	192.168.2.3	216.58.215.238
May 26, 2022 12:04:17.297909975 CEST	63147	443	192.168.2.3	216.58.215.238
May 26, 2022 12:04:17.298010111 CEST	63147	443	192.168.2.3	216.58.215.238
May 26, 2022 12:04:17.298099995 CEST	63147	443	192.168.2.3	216.58.215.238
May 26, 2022 12:04:17.313860893 CEST	443	63147	216.58.215.238	192.168.2.3
May 26, 2022 12:04:17.314166069 CEST	63147	443	192.168.2.3	216.58.215.238

Timestamp	kBytes transferred	Direction	Data
2022-05-26 10:04:07 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-26 10:04:07 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-cdCpIz3x6fOToVTJvLfE3A' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 26 May 2022 10:04:07 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5624 X-Daystart: 11047 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-05-26 10:04:07 UTC	2	IN	Data Raw: 33 36 64 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 32 34 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 31 31 30 34 37 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 36d<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5624" elapsed_seconds="11047"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-05-26 10:04:07 UTC	2	IN	Data Raw: 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 70 Data Ascii: mhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><ap
2022-05-26 10:04:07 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-05-26 10:04:07 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-26 10:04:07 UTC	1	OUT	Data Raw: 20 Data Ascii:
2022-05-26 10:04:07 UTC	3	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 26 May 2022 10:04:07 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-0tsXd52XD_-tDQwYFoyxkw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-0tsXd52XD_-tDQwYFoyxkw' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin; report-to="IdentityListAccountsHttp" Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Report-To: {"group":"IdentityListAccountsHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external"}]} Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-05-26 10:04:07 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-05-26 10:04:07 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-05-26 10:04:09 UTC	4	OUT	GET /v3/__http://localhost/Purchase_Order.zip__;!!EhqYCQ!dfjX4iJSROwj9YE4jHYZJtYnLYdDz3YaC1Gypry5xWistWssa08NbP9PG2PZpLmDV5PD4kC_H5CeLBILP_3fBSo$ HTTP/1.1 Host: urldefense.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-05-26 10:04:09 UTC	5	IN	HTTP/1.1 302 Found Date: Thu, 26 May 2022 10:04:09 GMT Content-Length: 0 Connection: close Location: http://localhost/Purchase_Order.zip Strict-Transport-Security: max-age=31536000 X-Robots-Tag: noindex, nofollow

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Purchase_Order.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\15629ad9-7a25-4453-b7a5-63adc39a41f9.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\1d367d86-c9f7-4dc0-8812-f2674cd2958c.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\1f22300f-820c-4c55-8b8e-fd660b1a8d89.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\24f18242-4ea6-48e2-bb15-1171f3bf8ee5.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\2bafccba-aeae-456e-b2a2-b4dc8014d722.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\2c765641-b2d5-483a-a97f-b3f12f4a5fd4.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\7e9808c1-6345-4a07-a6c7-116bbe580c1e.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\240a8cad-7973-4c42-b470-df0ba6747dc8.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\2df451b2-5e8b-4c04-bc0e-74528288d4a0.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\59fa8107-0add-4996-9ba7-72b3dff01fbb.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\5f31331d-5cb4-4adf-8c01-ae52a0781427.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\80120ee8-7c94-4706-94df-69aac86e5105.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\98cd6bfc-5ffb-4475-a8e3-9681e41fe1a5.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\868cb552-c630-4332-95b1-5ea2363f0cf4.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\4d8da041-e247-4ca7-8733-90098c4f5123.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1

Windows Analysis Report
Purchase_Order.html

Target ID:	0
Start time:	12:04:01
Start date:	26/05/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\Purchase_Order.html
Imagebase:	0x7ff7f6290000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	1
Start time:	12:04:03
Start date:	26/05/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1516,15318958304467380805,2454794286047497187,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1916 /prefetch:8
Imagebase:	0x7ff73c930000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre