Joe Sandbox Cloud Basic Analysis Report
Edit tour

Windows Analysis Report
https://smbc-iukhu.shop/

Overview

General Information

Sample URL:https://smbc-iukhu.shop/
Analysis ID:1340118
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Stores files to the Windows start menu directory
Creates files inside the system directory
Uses insecure TLS / SSL version for HTTPS connection

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64
  • chrome.exe (PID: 7116 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 1816 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2252,i,11701247828171321703,6774614834618121191,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 6564 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://smbc-iukhu.shop/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

  • • AV Detection
  • • Compliance
  • • Networking
  • • System Summary
  • • Boot Survival

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: https://smbc-iukhu.shop/Avira URL Cloud: detection malicious, Label: phishing
Source: https://smbc-iukhu.shop/favicon.icoAvira URL Cloud: Label: phishing
Source: unknownHTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49720 version: TLS 1.0
Source: unknownHTTPS traffic detected: 104.107.104.160:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.107.104.160:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49720 version: TLS 1.0
Source: unknownDNS traffic detected: queries for: clients2.google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49706
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 104.107.104.160
Source: unknownTCP traffic detected without corresponding DNS query: 104.107.104.160
Source: unknownTCP traffic detected without corresponding DNS query: 104.107.104.160
Source: unknownTCP traffic detected without corresponding DNS query: 104.107.104.160
Source: unknownTCP traffic detected without corresponding DNS query: 104.107.104.160
Source: unknownTCP traffic detected without corresponding DNS query: 104.107.104.160
Source: unknownTCP traffic detected without corresponding DNS query: 104.107.104.160
Source: unknownTCP traffic detected without corresponding DNS query: 104.107.104.160
Source: unknownTCP traffic detected without corresponding DNS query: 104.107.104.160
Source: unknownTCP traffic detected without corresponding DNS query: 104.107.104.160
Source: unknownTCP traffic detected without corresponding DNS query: 104.107.104.160
Source: unknownTCP traffic detected without corresponding DNS query: 104.107.104.160
Source: unknownTCP traffic detected without corresponding DNS query: 104.107.104.160
Source: unknownTCP traffic detected without corresponding DNS query: 104.107.104.160
Source: unknownTCP traffic detected without corresponding DNS query: 104.107.104.160
Source: unknownTCP traffic detected without corresponding DNS query: 104.107.104.160
Source: unknownTCP traffic detected without corresponding DNS query: 104.107.104.160
Source: unknownTCP traffic detected without corresponding DNS query: 104.107.104.160
Source: unknownTCP traffic detected without corresponding DNS query: 104.107.104.160
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknownTCP traffic detected without corresponding DNS query: 20.12.23.50
Source: global trafficHTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: smbc-iukhu.shopConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: smbc-iukhu.shopConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://smbc-iukhu.shop/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=ffg1olhqc0ajs2o0d2l1fvrfq8
Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ofrByAh6YlcXdyw&MD=d7EhSazc HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ofrByAh6YlcXdyw&MD=d7EhSazc HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Nov 2023 23:51:16 GMTServer: ApacheExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: PHPSESSID=ffg1olhqc0ajs2o0d2l1fvrfq8; path=/Upgrade: h2Connection: Upgrade, closeVary: Accept-EncodingTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 09 Nov 2023 23:51:17 GMTServer: ApacheContent-Length: 262Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: unknownHTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: unknownHTTPS traffic detected: 104.107.104.160:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.107.104.160:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_BITS_7116_1852498186Jump to behavior
Source: classification engineClassification label: mal56.win@16/7@8/6
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2252,i,11701247828171321703,6774614834618121191,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://smbc-iukhu.shop/
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2252,i,11701247828171321703,6774614834618121191,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: Google Drive.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnkJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpactResource DevelopmentReconnaissance
Valid AccountsWindows Management Instrumentation1
Registry Run Keys / Startup Folder		1
Process Injection		11
Masquerading		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local SystemExfiltration Over Other Network Medium1
Encrypted Channel		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationAbuse Accessibility FeaturesAcquire InfrastructureGather Victim Identity Information
Default AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
Registry Run Keys / Startup Folder		1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth4
Non-Application Layer Protocol		SIM Card SwapObtain Device Cloud BackupsNetwork Denial of ServiceDomainsCredentials
Domain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration5
Application Layer Protocol		Data Encrypted for ImpactDNS ServerEmail Addresses
Local AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureTraffic Duplication3
Ingress Tool Transfer		Data DestructionVirtual Private ServerEmployee Names

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1340118 URL: https://smbc-iukhu.shop/ Startdate: 10/11/2023 Architecture: WINDOWS Score: 56 24 Antivirus detection for URL or domain 2->24 26 Antivirus / Scanner detection for submitted sample 2->26 6 chrome.exe 9 2->6         started        9 chrome.exe 2->9         started        process3 dnsIp4 14 192.168.2.5, 443, 49231, 49703 unknown unknown 6->14 16 239.255.255.250 unknown Reserved 6->16 11 chrome.exe 6->11         started        process5 dnsIp6 18 accounts.google.com 142.250.217.77, 443, 49706 GOOGLEUS United States 11->18 20 clients.l.google.com 142.251.211.238, 443, 49705 GOOGLEUS United States 11->20 22 3 other IPs or domains 11->22

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://smbc-iukhu.shop/100%Avira URL Cloudphishing

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://smbc-iukhu.shop/favicon.ico100%Avira URL Cloudphishing

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
accounts.google.com
142.250.217.77
truefalse
    		high
    smbc-iukhu.shop
    		134.122.188.254
    		truefalse
      		unknown
      www.google.com
      		142.251.215.228
      		truefalse
        		high
        clients.l.google.com
        		142.251.211.238
        		truefalse
          		high
          clients2.google.com
          		unknown
          		unknownfalse
            		high

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            https://smbc-iukhu.shop/true
              		unknown
              https://smbc-iukhu.shop/false
                		unknown
                https://smbc-iukhu.shop/favicon.icofalse
                • Avira URL Cloud: phishing
                		unknown
                https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1false
                  		high
                  https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardfalse
                    		high

                    World Map of Contacted IPs

                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs

                    Public IPs

                    IPDomainCountryFlagASNASN NameMalicious
                    142.251.215.228
                    		www.google.comUnited States
                    		15169GOOGLEUSfalse
                    239.255.255.250
                    		unknownReserved
                    		unknownunknownfalse
                    142.250.217.77
                    		accounts.google.comUnited States
                    		15169GOOGLEUSfalse
                    142.251.211.238
                    		clients.l.google.comUnited States
                    		15169GOOGLEUSfalse
                    134.122.188.254
                    		smbc-iukhu.shopUnited States
                    		64050BCPL-SGBGPNETGlobalASNSGfalse

                    Private

                    IP
                    192.168.2.5

                    General Information

                    Joe Sandbox Version:38.0.0 Ammolite
                    Analysis ID:1340118
                    Start date and time:2023-11-10 00:50:18 +01:00
                    Joe Sandbox Product:CloudBasic
                    Overall analysis duration:0h 3m 0s
                    Hypervisor based Inspection enabled:false
                    Report type:light
                    Cookbook file name:browseurl.jbs
                    Sample URL:https://smbc-iukhu.shop/
                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                    Number of analysed new started processes analysed:7
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:0
                    Technologies:
                    • HCA enabled
                    • EGA enabled
                    • AMSI enabled
                    Analysis Mode:default
                    Analysis stop reason:Timeout
                    Detection:MAL
                    Classification:mal56.win@16/7@8/6
                    EGA Information:Failed
                    HCA Information:
                    • Successful, ratio: 100%
                    • Number of executed functions: 0
                    • Number of non-executed functions: 0
                    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                    • TCP Packets have been reduced to 100
                    • Excluded IPs from analysis (whitelisted): 142.251.33.67, 34.104.35.123, 8.253.133.112, 192.229.211.108, 69.164.40.8, 142.250.217.67
                    • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, update.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com
                    • Not all processes where analyzed, report is missing behavior information
                    • VT rate limit hit for: https://smbc-iukhu.shop/

                    Simulations

                    Behavior and APIs

                    ⊘No simulations

                    Joe Sandbox View / Context

                    IPs

                    ⊘No context

                    Domains

                    ⊘No context

                    ASNs

                    ⊘No context

                    JA3 Fingerprints

                    ⊘No context

                    Dropped Files

                    ⊘No context

                    Created / dropped Files

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 9 22:51:14 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2677
                    Entropy (8bit):3.961397985317389
                    Encrypted:false
                    SSDEEP:48:8Pad6TG2xEHHidAKZdA19ehwiZUklqehTy+3:8rHxAoy
                    MD5:D9F2FEB6545403A3CD4425F900D09A01
                    SHA1:24D8A81CB7246F934E3658E2E3EB73A990E91998
                    SHA-256:2753FD04C22E3E47A1E77323679434F161FBBE21356792C9302FCAB9463C521D
                    SHA-512:72264C53E474FDC2E02799E83343D9485CF426A9972758403953D00F2D9CAE6DC0EF8E6F73A30FEA83BA6B309BED537D8A80AB26EE9BA02FBB7E72FD59B1E019
                    Malicious:false
                    Reputation:low
                    Preview:L..................F.@.. ...$+.,.....e..g...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IiWe.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.ViWe.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.ViWe.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.ViWe............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.ViWg............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............XY......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 9 22:51:14 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2679
                    Entropy (8bit):3.9781556611970688
                    Encrypted:false
                    SSDEEP:48:8Fad6TG2xEHHidAKZdA1weh/iZUkAQkqehYy+2:8NHx69Q1y
                    MD5:EEBF04CF37481BE1D2E7C6E8C9F4413A
                    SHA1:445E1D271404A4226201D9C252A05ADB8E635235
                    SHA-256:18ADAAD8C3302611863F4B869A219968A0F3240913B54E5EB36819F48AA88CCC
                    SHA-512:7D88D812DBCC640B3EE216B309DF080701A01C64FF1DD47EA0F5C7B8364209C7740CE642195D3E9C0FC34BBDE8C12E0B301B411C24FD8A67DC19D3C4A01CB9BE
                    Malicious:false
                    Reputation:low
                    Preview:L..................F.@.. ...$+.,.....,..g...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IiWe.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.ViWe.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.ViWe.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.ViWe............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.ViWg............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............XY......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2693
                    Entropy (8bit):3.9906531944039427
                    Encrypted:false
                    SSDEEP:48:8xXd6TG2sHHidAKZdA14tseh7sFiZUkmgqeh7sSy+BX:8xMHKnsy
                    MD5:E4CAFBCA1B15E8BE78F9C8CBC739F020
                    SHA1:5C9E1802D23FA641B170EC1BC31A0C52219EFC82
                    SHA-256:48DCE1CE6D30E0F8DFA432A27396FB5466F27D713A6D5F1FA77DBDE63492145B
                    SHA-512:4F4442B4C9535BBF8074448D0FA0DF0BB50F7B83FEF1CCCA6FAB2CDC1673433787C7EF312351075950C26EC551518825AB9A742AFA207A518978F4EE5FDFC72E
                    Malicious:false
                    Reputation:low
                    Preview:L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IiWe.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.ViWe.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.ViWe.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.ViWe............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............XY......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 9 22:51:13 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2681
                    Entropy (8bit):3.97492389540256
                    Encrypted:false
                    SSDEEP:48:8rad6TG2xEHHidAKZdA1vehDiZUkwqeh0y+R:8HHxhay
                    MD5:FA0E49905756B442022553E1CEE8F0E9
                    SHA1:F7287086B23B741584D18992212552B0040930A0
                    SHA-256:62F189599B5E8281FEB5CD73E68B2BFE1E7C73EC60B83499A206BD9603EB42EB
                    SHA-512:8001D86A40171606FC24B91438A36A98C4C0CCAD3441CAEFA97B08D0E19D3F7A6E41E7C8C975F2D30DC54A575E1A708BF2C1D3D7246E8FAB9DBEE956D500AEE6
                    Malicious:false
                    Reputation:low
                    Preview:L..................F.@.. ...$+.,.....s..g...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IiWe.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.ViWe.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.ViWe.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.ViWe............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.ViWg............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............XY......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 9 22:51:14 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2681
                    Entropy (8bit):3.964860744015915
                    Encrypted:false
                    SSDEEP:48:85ad6TG2xEHHidAKZdA1hehBiZUk1W1qehGy+C:8hHxh9my
                    MD5:9871DF27BD2756961A66B40CFFFFE56F
                    SHA1:276AD19EEA4862317C43719A51D7CCBDD9A6F36B
                    SHA-256:037D18304F4F30649393B801497B8C020CEAD5907ADF00E031EBBFBF881CA0B0
                    SHA-512:9D212131C86854918B5B8E4229A39FFF235691D60B1D8E11E60D7278FDCD0EF076F743062D31D7757C9F45181FCCEA4ACB7020F785A4BF8AC59D0A454753F74C
                    Malicious:false
                    Reputation:low
                    Preview:L..................F.@.. ...$+.,.....}..g...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IiWe.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.ViWe.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.ViWe.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.ViWe............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.ViWg............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............XY......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 9 22:51:13 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2683
                    Entropy (8bit):3.9718512642519612
                    Encrypted:false
                    SSDEEP:48:8fad6TG2xEHHidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbsy+yT+:8bHxdT/TbxWOvTbsy7T
                    MD5:ECC0C66919F35925D91B454E617A12B4
                    SHA1:1BA0B6F13AC3BAADA1E8E7BBA0E5DBC939E41C80
                    SHA-256:9F160071B11BA46E0DB488E0DD68BB83AFDE9F6739F9F3344A2E7F246F2A6AAC
                    SHA-512:5D292B04FD8A44418E6FBD4D196C2AFE342B8A4236DD986865EB108DEDA12A111383A7C9DC087F90B7FABDAEEC9B68081F03273C122F50C121F2CD54790A9103
                    Malicious:false
                    Reputation:low
                    Preview:L..................F.@.. ...$+.,....D0x.g...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IiWe.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.ViWe.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.ViWe.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.ViWe............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.ViWg............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............XY......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    Chrome Cache Entry: 66

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:HTML document, ASCII text
                    Category:downloaded
                    Size (bytes):262
                    Entropy (8bit):5.156537462468349
                    Encrypted:false
                    SSDEEP:6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoIRVFQL38oD:J0+oxBeRmR9etdzRxGezHLO8+
                    MD5:8826F6D1433DBF12A01F5B739B3F9C3E
                    SHA1:70329EFEA6E794463FAD8F27A6D988E58FDD572C
                    SHA-256:8184890882B399895394737209202BF8BA2D45BF630C26D9F1378008EB247C5C
                    SHA-512:4BB4364AB58847D6F06DFBF91A7F4DE9460BB4442814DF35377CF77B97EB347962CB7DE2DC02D952762F5FCE7E40AE1E43E270816913946FCF1F1FD4007D3694
                    Malicious:false
                    Reputation:low
                    URL:https://smbc-iukhu.shop/favicon.ico
                    Preview:<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<hr>.<address>Apache Server at smbc-iukhu.shop Port 443</address>.</body></html>.

                    Static File Info

                    ⊘No static file info

                    Network Behavior

                    Network Port Distribution

                    • Total Packets: 62
                    • • 443 (HTTPS)
                    • • 53 (DNS)
                    TimestampSource PortDest PortSource IPDest IP
                    Nov 10, 2023 00:51:05.685044050 CET49674443192.168.2.523.1.237.91
                    Nov 10, 2023 00:51:05.685050011 CET49675443192.168.2.523.1.237.91
                    Nov 10, 2023 00:51:05.778779984 CET49673443192.168.2.523.1.237.91
                    Nov 10, 2023 00:51:12.697973967 CET49705443192.168.2.5142.251.211.238
                    Nov 10, 2023 00:51:12.698052883 CET44349705142.251.211.238192.168.2.5
                    Nov 10, 2023 00:51:12.698132038 CET49705443192.168.2.5142.251.211.238
                    Nov 10, 2023 00:51:12.698661089 CET49705443192.168.2.5142.251.211.238
                    Nov 10, 2023 00:51:12.698703051 CET44349705142.251.211.238192.168.2.5
                    Nov 10, 2023 00:51:12.699361086 CET49706443192.168.2.5142.250.217.77
                    Nov 10, 2023 00:51:12.699453115 CET44349706142.250.217.77192.168.2.5
                    Nov 10, 2023 00:51:12.699522972 CET49706443192.168.2.5142.250.217.77
                    Nov 10, 2023 00:51:12.699665070 CET49706443192.168.2.5142.250.217.77
                    Nov 10, 2023 00:51:12.699695110 CET44349706142.250.217.77192.168.2.5
                    Nov 10, 2023 00:51:13.044611931 CET44349705142.251.211.238192.168.2.5
                    Nov 10, 2023 00:51:13.045203924 CET49705443192.168.2.5142.251.211.238
                    Nov 10, 2023 00:51:13.045233011 CET44349705142.251.211.238192.168.2.5
                    Nov 10, 2023 00:51:13.046159029 CET44349705142.251.211.238192.168.2.5
                    Nov 10, 2023 00:51:13.046241045 CET49705443192.168.2.5142.251.211.238
                    Nov 10, 2023 00:51:13.047296047 CET44349706142.250.217.77192.168.2.5
                    Nov 10, 2023 00:51:13.047372103 CET44349705142.251.211.238192.168.2.5
                    Nov 10, 2023 00:51:13.047455072 CET49705443192.168.2.5142.251.211.238
                    Nov 10, 2023 00:51:13.047519922 CET49706443192.168.2.5142.250.217.77
                    Nov 10, 2023 00:51:13.047545910 CET44349706142.250.217.77192.168.2.5
                    Nov 10, 2023 00:51:13.049046040 CET44349706142.250.217.77192.168.2.5
                    Nov 10, 2023 00:51:13.049151897 CET49706443192.168.2.5142.250.217.77
                    Nov 10, 2023 00:51:13.049169064 CET49705443192.168.2.5142.251.211.238
                    Nov 10, 2023 00:51:13.049261093 CET44349705142.251.211.238192.168.2.5
                    Nov 10, 2023 00:51:13.049752951 CET49705443192.168.2.5142.251.211.238
                    Nov 10, 2023 00:51:13.049762964 CET44349705142.251.211.238192.168.2.5
                    Nov 10, 2023 00:51:13.050277948 CET49706443192.168.2.5142.250.217.77
                    Nov 10, 2023 00:51:13.050379992 CET44349706142.250.217.77192.168.2.5
                    Nov 10, 2023 00:51:13.050399065 CET49706443192.168.2.5142.250.217.77
                    Nov 10, 2023 00:51:13.097260952 CET44349706142.250.217.77192.168.2.5
                    Nov 10, 2023 00:51:13.157213926 CET49705443192.168.2.5142.251.211.238
                    Nov 10, 2023 00:51:13.157517910 CET49706443192.168.2.5142.250.217.77
                    Nov 10, 2023 00:51:13.157578945 CET44349706142.250.217.77192.168.2.5
                    Nov 10, 2023 00:51:13.266545057 CET49706443192.168.2.5142.250.217.77
                    Nov 10, 2023 00:51:13.361294031 CET44349705142.251.211.238192.168.2.5
                    Nov 10, 2023 00:51:13.361423016 CET44349705142.251.211.238192.168.2.5
                    Nov 10, 2023 00:51:13.361515045 CET49705443192.168.2.5142.251.211.238
                    Nov 10, 2023 00:51:13.361963987 CET49705443192.168.2.5142.251.211.238
                    Nov 10, 2023 00:51:13.361979008 CET44349705142.251.211.238192.168.2.5
                    Nov 10, 2023 00:51:13.372338057 CET44349706142.250.217.77192.168.2.5
                    Nov 10, 2023 00:51:13.372503996 CET49706443192.168.2.5142.250.217.77
                    Nov 10, 2023 00:51:13.372562885 CET44349706142.250.217.77192.168.2.5
                    Nov 10, 2023 00:51:13.372750044 CET44349706142.250.217.77192.168.2.5
                    Nov 10, 2023 00:51:13.372833967 CET49706443192.168.2.5142.250.217.77
                    Nov 10, 2023 00:51:13.373588085 CET49706443192.168.2.5142.250.217.77
                    Nov 10, 2023 00:51:13.373615980 CET44349706142.250.217.77192.168.2.5
                    Nov 10, 2023 00:51:14.879332066 CET49710443192.168.2.5134.122.188.254
                    Nov 10, 2023 00:51:14.879375935 CET44349710134.122.188.254192.168.2.5
                    Nov 10, 2023 00:51:14.879503012 CET49710443192.168.2.5134.122.188.254
                    Nov 10, 2023 00:51:14.879991055 CET49710443192.168.2.5134.122.188.254
                    Nov 10, 2023 00:51:14.880001068 CET44349710134.122.188.254192.168.2.5
                    Nov 10, 2023 00:51:14.880808115 CET49711443192.168.2.5134.122.188.254
                    Nov 10, 2023 00:51:14.880877018 CET44349711134.122.188.254192.168.2.5
                    Nov 10, 2023 00:51:14.880956888 CET49711443192.168.2.5134.122.188.254
                    Nov 10, 2023 00:51:14.881194115 CET49711443192.168.2.5134.122.188.254
                    Nov 10, 2023 00:51:14.881212950 CET44349711134.122.188.254192.168.2.5
                    Nov 10, 2023 00:51:15.079507113 CET49713443192.168.2.5142.251.215.228
                    Nov 10, 2023 00:51:15.079591990 CET44349713142.251.215.228192.168.2.5
                    Nov 10, 2023 00:51:15.079679966 CET49713443192.168.2.5142.251.215.228
                    Nov 10, 2023 00:51:15.079982996 CET49713443192.168.2.5142.251.215.228
                    Nov 10, 2023 00:51:15.080015898 CET44349713142.251.215.228192.168.2.5
                    Nov 10, 2023 00:51:15.299604893 CET49674443192.168.2.523.1.237.91
                    Nov 10, 2023 00:51:15.299626112 CET49675443192.168.2.523.1.237.91
                    Nov 10, 2023 00:51:15.393392086 CET49673443192.168.2.523.1.237.91
                    Nov 10, 2023 00:51:15.405616999 CET44349713142.251.215.228192.168.2.5
                    Nov 10, 2023 00:51:15.405920029 CET49713443192.168.2.5142.251.215.228
                    Nov 10, 2023 00:51:15.405982971 CET44349713142.251.215.228192.168.2.5
                    Nov 10, 2023 00:51:15.407450914 CET44349713142.251.215.228192.168.2.5
                    Nov 10, 2023 00:51:15.407529116 CET49713443192.168.2.5142.251.215.228
                    Nov 10, 2023 00:51:15.412460089 CET49713443192.168.2.5142.251.215.228
                    Nov 10, 2023 00:51:15.412731886 CET44349713142.251.215.228192.168.2.5
                    Nov 10, 2023 00:51:15.456167936 CET49713443192.168.2.5142.251.215.228
                    Nov 10, 2023 00:51:15.456182003 CET44349713142.251.215.228192.168.2.5
                    Nov 10, 2023 00:51:15.503541946 CET49713443192.168.2.5142.251.215.228
                    Nov 10, 2023 00:51:15.562360048 CET44349711134.122.188.254192.168.2.5
                    Nov 10, 2023 00:51:15.562773943 CET49711443192.168.2.5134.122.188.254
                    Nov 10, 2023 00:51:15.562796116 CET44349711134.122.188.254192.168.2.5
                    Nov 10, 2023 00:51:15.563889980 CET44349711134.122.188.254192.168.2.5
                    Nov 10, 2023 00:51:15.563961983 CET49711443192.168.2.5134.122.188.254
                    Nov 10, 2023 00:51:15.568908930 CET49711443192.168.2.5134.122.188.254
                    Nov 10, 2023 00:51:15.569065094 CET44349710134.122.188.254192.168.2.5
                    Nov 10, 2023 00:51:15.569143057 CET44349711134.122.188.254192.168.2.5
                    Nov 10, 2023 00:51:15.569614887 CET49710443192.168.2.5134.122.188.254
                    Nov 10, 2023 00:51:15.569643974 CET44349710134.122.188.254192.168.2.5
                    Nov 10, 2023 00:51:15.569701910 CET49711443192.168.2.5134.122.188.254
                    Nov 10, 2023 00:51:15.569716930 CET44349711134.122.188.254192.168.2.5
                    Nov 10, 2023 00:51:15.570719957 CET44349710134.122.188.254192.168.2.5
                    Nov 10, 2023 00:51:15.570785046 CET49710443192.168.2.5134.122.188.254
                    Nov 10, 2023 00:51:15.574377060 CET49710443192.168.2.5134.122.188.254
                    Nov 10, 2023 00:51:15.574441910 CET44349710134.122.188.254192.168.2.5
                    Nov 10, 2023 00:51:15.612116098 CET49711443192.168.2.5134.122.188.254
                    Nov 10, 2023 00:51:15.628565073 CET49710443192.168.2.5134.122.188.254
                    Nov 10, 2023 00:51:15.628582001 CET44349710134.122.188.254192.168.2.5
                    Nov 10, 2023 00:51:15.672353029 CET49710443192.168.2.5134.122.188.254
                    Nov 10, 2023 00:51:16.575999975 CET44349711134.122.188.254192.168.2.5
                    Nov 10, 2023 00:51:16.576194048 CET44349711134.122.188.254192.168.2.5
                    Nov 10, 2023 00:51:16.576384068 CET49711443192.168.2.5134.122.188.254
                    TimestampSource PortDest PortSource IPDest IP
                    Nov 10, 2023 00:51:12.544295073 CET5889253192.168.2.51.1.1.1
                    Nov 10, 2023 00:51:12.544490099 CET5910553192.168.2.51.1.1.1
                    Nov 10, 2023 00:51:12.545030117 CET6086853192.168.2.51.1.1.1
                    Nov 10, 2023 00:51:12.545314074 CET5280753192.168.2.51.1.1.1
                    Nov 10, 2023 00:51:12.656135082 CET53632391.1.1.1192.168.2.5
                    Nov 10, 2023 00:51:12.697160959 CET53588921.1.1.1192.168.2.5
                    Nov 10, 2023 00:51:12.697386026 CET53591051.1.1.1192.168.2.5
                    Nov 10, 2023 00:51:12.697976112 CET53528071.1.1.1192.168.2.5
                    Nov 10, 2023 00:51:12.698405981 CET53608681.1.1.1192.168.2.5
                    Nov 10, 2023 00:51:13.564239979 CET53492311.1.1.1192.168.2.5
                    Nov 10, 2023 00:51:14.072614908 CET5175653192.168.2.51.1.1.1
                    Nov 10, 2023 00:51:14.072827101 CET5528053192.168.2.51.1.1.1
                    Nov 10, 2023 00:51:14.865958929 CET53517561.1.1.1192.168.2.5
                    Nov 10, 2023 00:51:14.878551006 CET53552801.1.1.1192.168.2.5
                    Nov 10, 2023 00:51:14.924968958 CET5749353192.168.2.51.1.1.1
                    Nov 10, 2023 00:51:14.925282955 CET5024253192.168.2.51.1.1.1
                    Nov 10, 2023 00:51:15.077838898 CET53574931.1.1.1192.168.2.5
                    Nov 10, 2023 00:51:15.077861071 CET53502421.1.1.1192.168.2.5
                    Nov 10, 2023 00:51:30.614343882 CET53583991.1.1.1192.168.2.5
                    Nov 10, 2023 00:51:49.626811981 CET53497521.1.1.1192.168.2.5
                    Nov 10, 2023 00:52:12.169095993 CET53504771.1.1.1192.168.2.5
                    Nov 10, 2023 00:52:12.468657017 CET53533491.1.1.1192.168.2.5

                    DNS Queries

                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                    Nov 10, 2023 00:51:12.544295073 CET192.168.2.51.1.1.10xe73eStandard query (0)clients2.google.comA (IP address)IN (0x0001)false
                    Nov 10, 2023 00:51:12.544490099 CET192.168.2.51.1.1.10x5d6dStandard query (0)clients2.google.com65IN (0x0001)false
                    Nov 10, 2023 00:51:12.545030117 CET192.168.2.51.1.1.10x43e1Standard query (0)accounts.google.comA (IP address)IN (0x0001)false
                    Nov 10, 2023 00:51:12.545314074 CET192.168.2.51.1.1.10xa28bStandard query (0)accounts.google.com65IN (0x0001)false
                    Nov 10, 2023 00:51:14.072614908 CET192.168.2.51.1.1.10x4802Standard query (0)smbc-iukhu.shopA (IP address)IN (0x0001)false
                    Nov 10, 2023 00:51:14.072827101 CET192.168.2.51.1.1.10x690Standard query (0)smbc-iukhu.shop65IN (0x0001)false
                    Nov 10, 2023 00:51:14.924968958 CET192.168.2.51.1.1.10xe06bStandard query (0)www.google.comA (IP address)IN (0x0001)false
                    Nov 10, 2023 00:51:14.925282955 CET192.168.2.51.1.1.10x5d8dStandard query (0)www.google.com65IN (0x0001)false

                    DNS Answers

                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                    Nov 10, 2023 00:51:12.697160959 CET1.1.1.1192.168.2.50xe73eNo error (0)clients2.google.comclients.l.google.comCNAME (Canonical name)IN (0x0001)false
                    Nov 10, 2023 00:51:12.697160959 CET1.1.1.1192.168.2.50xe73eNo error (0)clients.l.google.com142.251.211.238A (IP address)IN (0x0001)false
                    Nov 10, 2023 00:51:12.697386026 CET1.1.1.1192.168.2.50x5d6dNo error (0)clients2.google.comclients.l.google.comCNAME (Canonical name)IN (0x0001)false
                    Nov 10, 2023 00:51:12.698405981 CET1.1.1.1192.168.2.50x43e1No error (0)accounts.google.com142.250.217.77A (IP address)IN (0x0001)false
                    Nov 10, 2023 00:51:14.865958929 CET1.1.1.1192.168.2.50x4802No error (0)smbc-iukhu.shop134.122.188.254A (IP address)IN (0x0001)false
                    Nov 10, 2023 00:51:15.077838898 CET1.1.1.1192.168.2.50xe06bNo error (0)www.google.com142.251.215.228A (IP address)IN (0x0001)false
                    Nov 10, 2023 00:51:15.077861071 CET1.1.1.1192.168.2.50x5d8dNo error (0)www.google.com65IN (0x0001)false

                    HTTP Request Dependency Graph

                    • clients2.google.com
                    • accounts.google.com
                    • smbc-iukhu.shop
                    • https:
                    • fs.microsoft.com
                    • slscr.update.microsoft.com

                    Statistics

                    Behavior

                    All data are 0.

                    System Behavior

                    General

                    Target ID:0
                    Start time:00:51:06
                    Start date:10/11/2023
                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                    Wow64 process (32bit):false
                    Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
                    Imagebase:0x7ff715980000
                    File size:3'242'272 bytes
                    MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:low
                    Has exited:false
                    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                    General

                    Target ID:2
                    Start time:00:51:10
                    Start date:10/11/2023
                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                    Wow64 process (32bit):false
                    Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2252,i,11701247828171321703,6774614834618121191,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                    Imagebase:0x7ff715980000
                    File size:3'242'272 bytes
                    MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:low
                    Has exited:false
                    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                    General

                    Target ID:3
                    Start time:00:51:13
                    Start date:10/11/2023
                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                    Wow64 process (32bit):false
                    Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" "https://smbc-iukhu.shop/
                    Imagebase:0x7ff715980000
                    File size:3'242'272 bytes
                    MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:low
                    Has exited:true

                    Disassembly

                    ⊘No disassembly