Edit tour

Windows Analysis Report
test@somewhere.com.html

Overview

General Information

Sample Name:	test@somewhere.com.html
Analysis ID:	655631
MD5:	2d475c74396d3a17455856e03750e639
SHA1:	8be111091be27e9caa1902c9aa38e6469985dcaf
SHA256:	1dffbbe9eb7c804144f3fd8744cee452450d7c6bbf0209f258e7507c08d2ef6b
Infos:

Detection

HTMLPhisher

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish44

Snort IDS alert for network traffic

HTML body contains low number of good links

None HTTPS page querying sensitive user data (password, username or email)

No HTML title found

Classification

Process Tree

System is start

chrome.exe (PID: 2452 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation --single-argument C:\Users\alfredo\Desktop\test@somewhere.com.html MD5: 74859601FB4BEEA84B40D874CCB56CAB)

chrome.exe (PID: 7724 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,15277383464472110615,3560837105709000163,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:8 MD5: 74859601FB4BEEA84B40D874CCB56CAB)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
test@somewhere.com.html	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security

Snort Signatures

ET DNS Query for .to TLD - Source IP: 192.168.2.3 - Destination IP: 1.1.1.1

Timestamp:	192.168.2.31.1.1.152544532027757 07/01/22-11:29:02.198300
SID:	2027757
Source Port:	52544
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

HTTP traffic detected: GET / HTTP/1.1Host: www.somewhere.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: file:///C:/Users/alfredo/Desktop/test@somewhere.com.html	HTTP Parser: Number of links: 0
Source: file:///C:/Users/alfredo/Desktop/test@somewhere.com.html	HTTP Parser: Number of links: 0

Source: file:///C:/Users/alfredo/Desktop/test@somewhere.com.html	HTTP Parser: Has password / email / username input fields
Source: file:///C:/Users/alfredo/Desktop/test@somewhere.com.html	HTTP Parser: Has password / email / username input fields

Source: file:///C:/Users/alfredo/Desktop/test@somewhere.com.html	HTTP Parser: HTML title missing
Source: file:///C:/Users/alfredo/Desktop/test@somewhere.com.html	HTTP Parser: HTML title missing

Source: file:///C:/Users/alfredo/Desktop/test@somewhere.com.html	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/alfredo/Desktop/test@somewhere.com.html	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/alfredo/Desktop/test@somewhere.com.html	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/alfredo/Desktop/test@somewhere.com.html	HTTP Parser: No <meta name="copyright".. found

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56916
Source: unknown	Network traffic detected: HTTP traffic on port 60760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51463
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61949
Source: unknown	Network traffic detected: HTTP traffic on port 56916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50770
Source: unknown	Network traffic detected: HTTP traffic on port 54819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59107
Source: unknown	Network traffic detected: HTTP traffic on port 54892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56512
Source: unknown	Network traffic detected: HTTP traffic on port 49195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50820
Source: unknown	Network traffic detected: HTTP traffic on port 51009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49453
Source: unknown	Network traffic detected: HTTP traffic on port 61351 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63581
Source: unknown	Network traffic detected: HTTP traffic on port 53750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64317 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57420
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58114
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53462
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52491
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61351
Source: unknown	Network traffic detected: HTTP traffic on port 53543 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51009
Source: unknown	Network traffic detected: HTTP traffic on port 59135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51463 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52491 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53543
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61609
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57308
Source: unknown	Network traffic detected: HTTP traffic on port 64306 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64317
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51130
Source: unknown	Network traffic detected: HTTP traffic on port 56512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51692
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60760
Source: unknown	Network traffic detected: HTTP traffic on port 51130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54892
Source: unknown	Network traffic detected: HTTP traffic on port 50820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63581 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61609 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54290
Source: unknown	Network traffic detected: HTTP traffic on port 50770 -> 443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation --single-argument C:\Users\alfredo\Desktop\test@somewhere.com.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,15277383464472110615,3560837105709000163,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,15277383464472110615,3560837105709000163,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	2 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Extra Window Memory Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
us-east-1.route-1.000webhost.awex.io	1%	Virustotal		Browse
www.somewhere.com	0%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
gstaticadssl.l.google.com	142.250.187.163	true	false		high
stackpath.bootstrapcdn.com	104.18.11.207	true	false		high
embed.tawk.to	172.67.38.66	true	false		high
d26p066pn2w0s0.cloudfront.net	13.224.189.91	true	false		high
accounts.google.com	172.217.16.205	true	false		high
cdnjs.cloudflare.com	104.17.24.14	true	false		high
maxcdn.bootstrapcdn.com	104.18.10.207	true	false		high
www.applicationsecurity.ninja	192.34.58.29	true	false		unknown
clients.l.google.com	142.250.181.238	true	false		high
us-east-1.route-1.000webhost.awex.io	145.14.144.140	true	false	1%, Virustotal, Browse	unknown
clients2.google.com	unknown	unknown	false		high
ka-f.fontawesome.com	unknown	unknown	false		high
code.jquery.com	unknown	unknown	false		high
kit.fontawesome.com	unknown	unknown	false		high
www.somewhere.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
deflation-community.000webhostapp.com	unknown	unknown	false		high
logo.clearbit.com	unknown	unknown	false		high

Name	Malicious	Antivirus Detection	Reputation
http://www.somewhere.com/	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
file:///C:/Users/alfredo/Desktop/test@somewhere.com.html	true		low

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.150.137	unknown	United States	13335	CLOUDFLARENETUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
34.104.35.123	unknown	United States	15169	GOOGLEUS	false
104.18.10.207	maxcdn.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
142.250.187.163	gstaticadssl.l.google.com	United States	15169	GOOGLEUS	false
172.217.16.205	accounts.google.com	United States	15169	GOOGLEUS	false
142.250.185.202	unknown	United States	15169	GOOGLEUS	false
104.18.11.207	stackpath.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
69.16.175.42	unknown	United States	20446	HIGHWINDS3US	false
142.250.185.170	unknown	United States	15169	GOOGLEUS	false
142.250.181.238	clients.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.163	unknown	United States	15169	GOOGLEUS	false
13.224.189.91	d26p066pn2w0s0.cloudfront.net	United States	16509	AMAZON-02US	false
145.14.144.140	us-east-1.route-1.000webhost.awex.io	Netherlands	204915	AWEXUS	false
104.18.23.52	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.38.66	embed.tawk.to	United States	13335	CLOUDFLARENETUS	false
192.34.58.29	www.applicationsecurity.ninja	United States	14061	DIGITALOCEAN-ASNUS	false

IP
192.168.2.1
127.0.0.1

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	655631
Start date and time: 01/07/202211:27:46	2022-07-01 11:27:46 +02:00
Joe Sandbox Product:	CloudBasic
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	test@somewhere.com.html
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.winHTML@22/75@12/89
Cookbook Comments:	Found application associated with file extension: .html Adjust boot time Enable AMSI

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	112061
Entropy (8bit):	6.032837857038768
Encrypted:	false
SSDEEP:
MD5:	AF552FA4C0D0B8DD97833568437DD6C5
SHA1:	10E00BB6BFC21230A50AFBD0E3BCD47E20CCD523
SHA-256:	2E8B70C70D80CE352041FE45F35FF0AD752575ED9EC7C43C19996B6C874B694A
SHA-512:	3218F40F0229DFB18371BD81D2B3306F2C5F6CC66994A741A4A9654E0D895610628484E27CD12BF922C0F89B339A50B5A85B22617D9F8C864724397C8C93FF5C
Malicious:	false
Reputation:	low
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"91.0.4472.77"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.656700107519781e+12,"network":1.656667708e+12,"ticks":174420361.0,"uncertainty":3725115.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABBQ7WxpM2gT7fMNkY5iRxkAAAAAAIAAAAAABBmAAAAAQAAIAAAALDWDwoLRYqp0NkiPsTxUN2QcOPsitaJrdacpo+ULE2PAAAAAA6AAAAAAgAAIAAAAOIeKQBWbQSCqXv1OSNS2lIZGHfAdJRwvbkapN4/FWvwMAAAAPz8I/w07KQb4Ut8ObsBGVgFwbuU88R362cCGZpNEtOEILJDMaKWOA4Y9ejBRTt5kEAAAADq8RkIezfgqGPgEaEMkhoGd9qhyBeyucXcRUPEI7mgYIxaDt8C5FJrjkEhV5EOUcUmR2SCzqYelImLnfOlbhRQ"},"policy":{"last_statistics_update":"13301173704098823"},"profile":{"info_cache":{"Default":{"active_time":1656700105.909056,"avatar_icon":"chrom

File type:	HTML document, ISO-8859 text, with very long lines, with CRLF line terminators
Entropy (8bit):	3.4407530316650954
TrID:
File name:	test@somewhere.com.html
File size:	431900
MD5:	2d475c74396d3a17455856e03750e639
SHA1:	8be111091be27e9caa1902c9aa38e6469985dcaf
SHA256:	1dffbbe9eb7c804144f3fd8744cee452450d7c6bbf0209f258e7507c08d2ef6b
SHA512:	2ca0c26d4725293dc3e2d2831bdaa52e3076a053e997eeb5e5972e6eb321a1890a449a369b9e37eae81866ae62d90451bb892b57d8ccd7dd5de28a9013d13b3d
SSDEEP:	1536:6LFKC9Bu59svDU7jDqlvlx3oc1pT9bfx+Bx2pX1fTuhHv8u4PlwCgYT13K313t31:OuhHv8u4PlwCr1y1d8K
TLSH:	DF94A23C6302CC4DAD776A7FFCA46B115018AF57EDCAB7C8086D80972AE09BA35147D6
File Content Preview:	<script language="javascript">.. ..// == Begin Free HTML Source Code Obfuscation Protection from https://snapbuilder.com == //..document.write(unescape('%3C%21%64%6F%63%74%79%70%65%20%68%74%6D%6C%3E%0A%3C%68%74%6D%6C%20%6C%61%6E%67%3D%22%65%6E%22%3E%0A

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report test@somewhere.com.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Initial Sample

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Software Vulnerabilities

Networking

System Summary

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\0f78a17b-9996-400f-b421-0a7a1f967db2.tmp

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\414ccee9-2cf0-45c1-bb36-d9c83977e708.tmp

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\1f1fe6c4-ff10-4a04-9b2a-80167bf3ee2d.tmp

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\383315f1-4424-4c10-a80f-51361525d0b1.tmp

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\398277b2-f9b9-4d0b-92cc-7f0287f61020.tmp

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\4580db1d-2ccd-48d9-a039-e424fbc2f45f.tmp

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\5d90d01d-bc05-40cc-b33f-a6838389ba07.tmp

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\7a0d8a11-0cce-469c-b939-58201d6e6967.tmp

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\8aa0e452-8ccd-4ec0-b7a9-35a13d916e4e.tmp

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico (copy)

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\History

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13301173707165807

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13301173708720801

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage\leveldb\LOG

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\TransportSecurity (copy)

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\Visited Links

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\Web Data

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\cccec9b9-da4e-4700-a3fa-b754474ae6d3.tmp

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000006.dbtmp

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT (copy)

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\dda4d149-5076-4fa0-a2c0-abce23289ca1.tmp

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\e704e804-c1a7-4116-a9b7-70aa1fc9725b.tmp

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\f129bee2-386e-47f6-ba47-14271f33047b.tmp

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

C:\Users\alfredo\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG

Windows Analysis Report
test@somewhere.com.html