Joe Sandbox Cloud Basic Analysis Report
Edit tour

Windows Analysis Report
http://hj5ozcalb.puzztake.com

Overview

General Information

Sample URL:http://hj5ozcalb.puzztake.com
Analysis ID:1348704
Infos:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Stores files to the Windows start menu directory
Creates files inside the system directory
Uses insecure TLS / SSL version for HTTPS connection

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64
  • chrome.exe (PID: 6412 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
    • chrome.exe (PID: 6172 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2252,i,5313747941541486293,13996371138421335699,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
  • chrome.exe (PID: 7096 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "http://hj5ozcalb.puzztake.com MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

  • • Phishing
  • • Compliance
  • • Networking
  • • System Summary
  • • Boot Survival

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: http://hj5ozcalb.puzztake.com/HTTP Parser: No favicon
Source: unknownHTTPS traffic detected: 23.206.229.209:443 -> 192.168.2.9:49722 version: TLS 1.0
Source: unknownHTTPS traffic detected: 23.209.58.93:443 -> 192.168.2.9:49718 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.209.58.93:443 -> 192.168.2.9:49719 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.9:49720 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.9:49723 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.206.229.209:443 -> 192.168.2.9:49722 version: TLS 1.0
Source: unknownDNS traffic detected: queries for: clients2.google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49676 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49704 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49677 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49704
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknownTCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknownTCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknownTCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknownTCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknownTCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknownTCP traffic detected without corresponding DNS query: 23.209.58.93
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknownTCP traffic detected without corresponding DNS query: 23.206.229.209
Source: global trafficHTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.134&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.134Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=4YnxsaV1dv2wA8X&MD=wokG3ErR HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=4YnxsaV1dv2wA8X&MD=wokG3ErR HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: hj5ozcalb.puzztake.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: hj5ozcalb.puzztake.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://hj5ozcalb.puzztake.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundaccess-control-allow-origin: *access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorizationaccess-control-allow-credentials: truep3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"access-control-allow-methods: GET, HEAD, OPTIONS, POSTcontent-type: application/json; charset=utf-8content-length: 43date: Mon, 27 Nov 2023 15:44:21 GMTkeep-alive: timeout=5Data Raw: 7b 22 73 74 61 74 75 73 43 6f 64 65 22 3a 34 30 34 2c 22 6d 65 73 73 61 67 65 22 3a 22 43 61 6e 6e 6f 74 20 47 45 54 20 2f 22 7d Data Ascii: {"statusCode":404,"message":"Cannot GET /"}
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundaccess-control-allow-origin: *access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorizationaccess-control-allow-credentials: truep3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"access-control-allow-methods: GET, HEAD, OPTIONS, POSTcontent-type: application/json; charset=utf-8content-length: 54date: Mon, 27 Nov 2023 15:44:21 GMTkeep-alive: timeout=5Data Raw: 7b 22 73 74 61 74 75 73 43 6f 64 65 22 3a 34 30 34 2c 22 6d 65 73 73 61 67 65 22 3a 22 43 61 6e 6e 6f 74 20 47 45 54 20 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 7d Data Ascii: {"statusCode":404,"message":"Cannot GET /favicon.ico"}
Source: unknownHTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=k9tT3q7Yfh1nx_FSl06F5UE_vdaFQreiGKe1aDN83MeveD7PL1RZXva4s-nFc9waQi9LtKavuTIba8MUkoGu58E8E81gwB_TWJ4Ng-LfCvzhem7rNrhZQ2aGvJZ9g2TYhqx2W2O4E7uHQzPk3vuLvMLxFXZsqE6NdAViQDECGpo
Source: unknownHTTPS traffic detected: 23.209.58.93:443 -> 192.168.2.9:49718 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.209.58.93:443 -> 192.168.2.9:49719 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.9:49720 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.9:49723 version: TLS 1.2
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\chrome_BITS_6412_1459514310Jump to behavior
Source: classification engineClassification label: clean1.win@16/8@8/7
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2252,i,5313747941541486293,13996371138421335699,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "http://hj5ozcalb.puzztake.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2252,i,5313747941541486293,13996371138421335699,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: Google Drive.lnk.2.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnkJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpactResource DevelopmentReconnaissance
Valid AccountsWindows Management Instrumentation1
Registry Run Keys / Startup Folder		1
Process Injection		11
Masquerading		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local SystemExfiltration Over Other Network Medium1
Encrypted Channel		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationAbuse Accessibility FeaturesAcquire InfrastructureGather Victim Identity Information
Default AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
Registry Run Keys / Startup Folder		1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth4
Non-Application Layer Protocol		SIM Card SwapObtain Device Cloud BackupsNetwork Denial of ServiceDomainsCredentials
Domain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration5
Application Layer Protocol		Data Encrypted for ImpactDNS ServerEmail Addresses
Local AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureTraffic Duplication3
Ingress Tool Transfer		Data DestructionVirtual Private ServerEmployee Names

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1348704 URL: http://hj5ozcalb.puzztake.com Startdate: 27/11/2023 Architecture: WINDOWS Score: 1 5 chrome.exe 9 2->5         started        8 chrome.exe 2->8         started        dnsIp3 13 192.168.2.6 unknown unknown 5->13 15 192.168.2.9, 138, 443, 49704 unknown unknown 5->15 17 239.255.255.250 unknown Reserved 5->17 10 chrome.exe 5->10         started        process4 dnsIp5 19 accounts.google.com 142.250.31.84, 443, 49709 GOOGLEUS United States 10->19 21 clients.l.google.com 142.251.179.138, 443, 49708 GOOGLEUS United States 10->21 23 3 other IPs or domains 10->23

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
http://hj5ozcalb.puzztake.com0%Avira URL Cloudsafe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://hj5ozcalb.puzztake.com/favicon.ico0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
accounts.google.com
142.250.31.84
truefalse
    		high
    www.google.com
    		172.253.122.147
    		truefalse
      		high
      clients.l.google.com
      		142.251.179.138
      		truefalse
        		high
        hj5ozcalb.puzztake.com
        		204.48.28.157
        		truefalse
          		unknown
          clients2.google.com
          		unknown
          		unknownfalse
            		high

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            http://hj5ozcalb.puzztake.com/favicon.icofalse
            • Avira URL Cloud: safe
            		unknown
            http://hj5ozcalb.puzztake.com/false
              		unknown
              https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.134&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1false
                		high
                http://hj5ozcalb.puzztake.com/false
                  		unknown
                  https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standardfalse
                    		high

                    World Map of Contacted IPs

                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs

                    Public IPs

                    IPDomainCountryFlagASNASN NameMalicious
                    239.255.255.250
                    		unknownReserved
                    		unknownunknownfalse
                    204.48.28.157
                    		hj5ozcalb.puzztake.comUnited States
                    		14061DIGITALOCEAN-ASNUSfalse
                    172.253.122.147
                    		www.google.comUnited States
                    		15169GOOGLEUSfalse
                    142.251.179.138
                    		clients.l.google.comUnited States
                    		15169GOOGLEUSfalse
                    142.250.31.84
                    		accounts.google.comUnited States
                    		15169GOOGLEUSfalse

                    Private

                    IP
                    192.168.2.9
                    192.168.2.6

                    General Information

                    Joe Sandbox Version:38.0.0 Ammolite
                    Analysis ID:1348704
                    Start date and time:2023-11-27 16:43:27 +01:00
                    Joe Sandbox Product:CloudBasic
                    Overall analysis duration:0h 3m 10s
                    Hypervisor based Inspection enabled:false
                    Report type:light
                    Cookbook file name:browseurl.jbs
                    Sample URL:http://hj5ozcalb.puzztake.com
                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                    Number of analysed new started processes analysed:12
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:0
                    Technologies:
                    • HCA enabled
                    • EGA enabled
                    • AMSI enabled
                    Analysis Mode:default
                    Analysis stop reason:Timeout
                    Detection:CLEAN
                    Classification:clean1.win@16/8@8/7
                    EGA Information:Failed
                    HCA Information:
                    • Successful, ratio: 100%
                    • Number of executed functions: 0
                    • Number of non-executed functions: 0
                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
                    • TCP Packets have been reduced to 100
                    • Excluded IPs from analysis (whitelisted): 8.252.81.126, 8.249.223.254, 8.253.139.120, 8.252.64.254, 8.253.131.121, 192.229.211.108, 142.251.16.94, 34.104.35.123
                    • Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, fs.microsoft.com, ocsp.digicert.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, update.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, wu-bg-shim.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
                    • Not all processes where analyzed, report is missing behavior information
                    • VT rate limit hit for: http://hj5ozcalb.puzztake.com

                    Simulations

                    Behavior and APIs

                    ⊘No simulations

                    Joe Sandbox View / Context

                    IPs

                    ⊘No context

                    Domains

                    ⊘No context

                    ASNs

                    ⊘No context

                    JA3 Fingerprints

                    ⊘No context

                    Dropped Files

                    ⊘No context

                    Created / dropped Files

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 27 14:44:20 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2673
                    Entropy (8bit):3.9837966200019537
                    Encrypted:false
                    SSDEEP:48:8jdwTYCHjidAKZdA1P4ehwiZUklqehJy+3:8+kqOCy
                    MD5:593ADBD11A19B6E68B2905758ECC42E1
                    SHA1:298CBDC11E45F659E78A0885E73E91592B0427B2
                    SHA-256:B3CFEADBB686B7E9BF037396D0ABBD8E108E7E54C72F9AC7FE0A69BF34CE3F3A
                    SHA-512:D364713FCC9D542DDB58D5CAFD71AB8F15A9CBD05CD68C21AED263B3CE888AE3ABDD26E42793C1832DB9EC58D2A1641558DAB1D5DBF4EFEC37CD7CEC5B0CFA71
                    Malicious:false
                    Reputation:low
                    Preview:L..................F.@.. ...$+.,....x.W.H!....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I{W.}....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V{W.}....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V{W.}....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V{W.}.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V{W.}...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............[.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 27 14:44:20 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2675
                    Entropy (8bit):4.004735043871614
                    Encrypted:false
                    SSDEEP:48:8rdwTYCHjidAKZdA1+4eh/iZUkAQkqehyy+2:8GkrF9Qjy
                    MD5:8296B0693D569C696E8BC7E6F9773F2E
                    SHA1:7100EFA37FC226B1143C86388FEE81F4C8E63E00
                    SHA-256:117DD87D61B49B85F1132DFA6B4B22DBD0AA7FCE16DCCC861302886F891EFE25
                    SHA-512:54E54729978D98EA73CEB3C2F617AF9F335A1E2936BA0A74534FE9FC71DA4B9B76B0AE3F9559304BE44F84221CBA6C3A94ED23B4A59A7C1B7EAD8D595435CF24
                    Malicious:false
                    Reputation:low
                    Preview:L..................F.@.. ...$+.,.....,H.H!....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I{W.}....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V{W.}....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V{W.}....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V{W.}.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V{W.}...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............[.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:56:51 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2689
                    Entropy (8bit):4.008941804126596
                    Encrypted:false
                    SSDEEP:48:8wdwTYVHjidAKZdA1404eh7sFiZUkmgqeh7sky+BX:8fkvInmy
                    MD5:289D856273DDBE3F847D8B1E3D196E60
                    SHA1:6709CE893E1D0F6242DBFB88C33B73ADCE49F9F8
                    SHA-256:DAA2BEFBA1A1CF60896F7CD9A7AA1328EDE157B8C625C1199C1D159F09F0CA18
                    SHA-512:AD02795F7C1F20FD57BA5FBD680003FF1133A6E3090B81206D41BA53AE1C9D4A409D1B4E43ACC00643905928DFE0B565BFA85C0A568C58AFBBE53B76CA8D20AD
                    Malicious:false
                    Reputation:low
                    Preview:L..................F.@.. ...$+.,.....<}.i.....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I{W.}....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V{W.}....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V{W.}....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V{W.}.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VEW.F...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............[.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 27 14:44:20 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2677
                    Entropy (8bit):4.001629758699932
                    Encrypted:false
                    SSDEEP:48:8UdwTYCHjidAKZdA1p4ehDiZUkwqeh+y+R:8Tkc58y
                    MD5:4A3F2600EEBD3FFE3E9C618AFBBE2C44
                    SHA1:276B28C4B243FE5BAB3FB265C04FDD1B556335C4
                    SHA-256:C01D6FDC04763A646C85B618B22281FE21D910212D1804B01C694BF2266B1F47
                    SHA-512:8F0D7D8359942EDF94BBC335749A4932A4AE47D4BE51BBD4D94F0F6E70A10DD35006CA1E7617524C353AE3EACC75456D81E09F8D1AA920D6B54E6FD9AC86B528
                    Malicious:false
                    Reputation:low
                    Preview:L..................F.@.. ...$+.,....[.=.H!....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I{W.}....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V{W.}....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V{W.}....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V{W.}.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V{W.}...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............[.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 27 14:44:20 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2677
                    Entropy (8bit):3.98731895437227
                    Encrypted:false
                    SSDEEP:48:8QdwTYCHjidAKZdA1X4ehBiZUk1W1qeh4y+C:8/kyb9Yy
                    MD5:3428AC7E603A0D9C474F16215583D504
                    SHA1:2E803C41DE9936D18D1384301989C11FBC915DBE
                    SHA-256:CD9E20AA3B5842100EE25C3CF9FB901A7343785BBA456630F548B1ACFFE70423
                    SHA-512:39645B63D0A355416195E87066A9BDC98CC88A6DCC255EF132AB1F1B8148EC108F6ED7AB59F005E26DA2B2DB3AADAE9563AB223BD034F77C48C827B74FBC707E
                    Malicious:false
                    Reputation:low
                    Preview:L..................F.@.. ...$+.,....BaP.H!....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I{W.}....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V{W.}....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V{W.}....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V{W.}.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V{W.}...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............[.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 27 14:44:20 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2679
                    Entropy (8bit):3.99992098195212
                    Encrypted:false
                    SSDEEP:48:8jXdwTYCHjidAKZdA1duTc4ehOuTbbiZUk5OjqehOuTbmy+yT+:8jSkXTcJTbxWOvTbmy7T
                    MD5:C62D1C5822E8DE3E1319708F4083D797
                    SHA1:2E8D389FB9339F58A7F9C1B9E543095A0F31082F
                    SHA-256:E29B9E59A9AE407E6594DA8ADBC2194F83958114A3EFA409ECD1C4D28C908C07
                    SHA-512:100CC1EFE9C65899AD83164FB598051C651BB2128B6FF4732C1F8B051AB33FF490602BF9C27EA1AD1F6FD30D6BDEB10A492C05CC511B259865E1BB05EC2A4C49
                    Malicious:false
                    Reputation:low
                    Preview:L..................F.@.. ...$+.,....D.-.H!....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I{W.}....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V{W.}....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V{W.}....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V{W.}.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V{W.}...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............[.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    Chrome Cache Entry: 57

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:JSON data
                    Category:downloaded
                    Size (bytes):43
                    Entropy (8bit):4.268719696310996
                    Encrypted:false
                    SSDEEP:3:YWR4h2zd6GE/Ke8K4:YWyQK/Wp
                    MD5:00BA9076E508F641510D4EE2EA53CDEF
                    SHA1:45BE3EB6FEE73B32DFA9747C24C83BF613D9D6C4
                    SHA-256:14DAFCBC80A313470C03A4239E13F1454BA483C4D049484C415E3E00CB5D4DFD
                    SHA-512:630245CEF9837E83EF003995591F8E2C0D0D0E191D49E8EBD960D44E600C58F409AABECE7352F4496FC46BCD79A765BE877104AAB487B9517A22E6D6FFC85814
                    Malicious:false
                    Reputation:low
                    URL:http://hj5ozcalb.puzztake.com/
                    Preview:{"statusCode":404,"message":"Cannot GET /"}

                    Chrome Cache Entry: 58

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:JSON data
                    Category:downloaded
                    Size (bytes):54
                    Entropy (8bit):4.536842363074259
                    Encrypted:false
                    SSDEEP:3:YWR4h2zd6GE/Ke8KDETqLLMi:YWyQK/WiLMi
                    MD5:F724EB23297A894BF726D26649E8E26C
                    SHA1:8E22F926F08C02D69E2704923124FFF8E4B30025
                    SHA-256:F639D54D7FE79AAF505BDDC5DABF737662C61D3993BF03E6D6B3B5F5453EAB69
                    SHA-512:DA8FEC16AEC8321C7A0F22E7E1E97FBFBEFF88CF328EF2E8329B2B142DD3AB772A660630DE7855476E043267B6CFE2C0443DB0D3DFAF4A8A8D99689DDCACADA1
                    Malicious:false
                    Reputation:low
                    URL:http://hj5ozcalb.puzztake.com/favicon.ico
                    Preview:{"statusCode":404,"message":"Cannot GET /favicon.ico"}

                    Static File Info

                    ⊘No static file info

                    Network Behavior

                    Network Port Distribution

                    • Total Packets: 67
                    • • 443 (HTTPS)
                    • • 80 (HTTP)
                    • • 53 (DNS)
                    TimestampSource PortDest PortSource IPDest IP
                    Nov 27, 2023 16:44:11.790194988 CET49677443192.168.2.920.189.173.11
                    Nov 27, 2023 16:44:12.102272987 CET49677443192.168.2.920.189.173.11
                    Nov 27, 2023 16:44:12.711632967 CET49677443192.168.2.920.189.173.11
                    Nov 27, 2023 16:44:12.727267027 CET49673443192.168.2.9204.79.197.203
                    Nov 27, 2023 16:44:13.180401087 CET49676443192.168.2.923.206.229.209
                    Nov 27, 2023 16:44:13.180464029 CET49675443192.168.2.923.206.229.209
                    Nov 27, 2023 16:44:13.446139097 CET49674443192.168.2.923.206.229.209
                    Nov 27, 2023 16:44:13.914788961 CET49677443192.168.2.920.189.173.11
                    Nov 27, 2023 16:44:16.336654902 CET49677443192.168.2.920.189.173.11
                    Nov 27, 2023 16:44:20.143146992 CET49708443192.168.2.9142.251.179.138
                    Nov 27, 2023 16:44:20.143170118 CET44349708142.251.179.138192.168.2.9
                    Nov 27, 2023 16:44:20.143271923 CET49708443192.168.2.9142.251.179.138
                    Nov 27, 2023 16:44:20.143615961 CET49708443192.168.2.9142.251.179.138
                    Nov 27, 2023 16:44:20.143627882 CET44349708142.251.179.138192.168.2.9
                    Nov 27, 2023 16:44:20.144251108 CET49709443192.168.2.9142.250.31.84
                    Nov 27, 2023 16:44:20.144274950 CET44349709142.250.31.84192.168.2.9
                    Nov 27, 2023 16:44:20.144320011 CET49709443192.168.2.9142.250.31.84
                    Nov 27, 2023 16:44:20.144543886 CET49709443192.168.2.9142.250.31.84
                    Nov 27, 2023 16:44:20.144556999 CET44349709142.250.31.84192.168.2.9
                    Nov 27, 2023 16:44:20.354552031 CET44349708142.251.179.138192.168.2.9
                    Nov 27, 2023 16:44:20.354846001 CET49708443192.168.2.9142.251.179.138
                    Nov 27, 2023 16:44:20.354866982 CET44349708142.251.179.138192.168.2.9
                    Nov 27, 2023 16:44:20.355392933 CET44349708142.251.179.138192.168.2.9
                    Nov 27, 2023 16:44:20.355479956 CET49708443192.168.2.9142.251.179.138
                    Nov 27, 2023 16:44:20.356820107 CET44349708142.251.179.138192.168.2.9
                    Nov 27, 2023 16:44:20.356874943 CET49708443192.168.2.9142.251.179.138
                    Nov 27, 2023 16:44:20.356951952 CET44349709142.250.31.84192.168.2.9
                    Nov 27, 2023 16:44:20.357599974 CET49709443192.168.2.9142.250.31.84
                    Nov 27, 2023 16:44:20.357624054 CET44349709142.250.31.84192.168.2.9
                    Nov 27, 2023 16:44:20.358419895 CET49708443192.168.2.9142.251.179.138
                    Nov 27, 2023 16:44:20.358505964 CET44349708142.251.179.138192.168.2.9
                    Nov 27, 2023 16:44:20.358606100 CET49708443192.168.2.9142.251.179.138
                    Nov 27, 2023 16:44:20.358613014 CET44349708142.251.179.138192.168.2.9
                    Nov 27, 2023 16:44:20.359081984 CET44349709142.250.31.84192.168.2.9
                    Nov 27, 2023 16:44:20.359144926 CET49709443192.168.2.9142.250.31.84
                    Nov 27, 2023 16:44:20.360272884 CET49709443192.168.2.9142.250.31.84
                    Nov 27, 2023 16:44:20.360356092 CET44349709142.250.31.84192.168.2.9
                    Nov 27, 2023 16:44:20.360456944 CET49709443192.168.2.9142.250.31.84
                    Nov 27, 2023 16:44:20.360465050 CET44349709142.250.31.84192.168.2.9
                    Nov 27, 2023 16:44:20.495358944 CET49708443192.168.2.9142.251.179.138
                    Nov 27, 2023 16:44:20.496202946 CET49709443192.168.2.9142.250.31.84
                    Nov 27, 2023 16:44:20.555979967 CET44349708142.251.179.138192.168.2.9
                    Nov 27, 2023 16:44:20.556154966 CET44349708142.251.179.138192.168.2.9
                    Nov 27, 2023 16:44:20.556212902 CET49708443192.168.2.9142.251.179.138
                    Nov 27, 2023 16:44:20.556767941 CET49708443192.168.2.9142.251.179.138
                    Nov 27, 2023 16:44:20.556785107 CET44349708142.251.179.138192.168.2.9
                    Nov 27, 2023 16:44:20.581624985 CET44349709142.250.31.84192.168.2.9
                    Nov 27, 2023 16:44:20.581775904 CET44349709142.250.31.84192.168.2.9
                    Nov 27, 2023 16:44:20.581840992 CET49709443192.168.2.9142.250.31.84
                    Nov 27, 2023 16:44:20.582376003 CET49709443192.168.2.9142.250.31.84
                    Nov 27, 2023 16:44:20.582396030 CET44349709142.250.31.84192.168.2.9
                    Nov 27, 2023 16:44:21.335547924 CET49677443192.168.2.920.189.173.11
                    Nov 27, 2023 16:44:21.447407961 CET4971280192.168.2.9204.48.28.157
                    Nov 27, 2023 16:44:21.448786974 CET4971380192.168.2.9204.48.28.157
                    Nov 27, 2023 16:44:21.546814919 CET8049712204.48.28.157192.168.2.9
                    Nov 27, 2023 16:44:21.546936035 CET4971280192.168.2.9204.48.28.157
                    Nov 27, 2023 16:44:21.547200918 CET4971280192.168.2.9204.48.28.157
                    Nov 27, 2023 16:44:21.548312902 CET8049713204.48.28.157192.168.2.9
                    Nov 27, 2023 16:44:21.551445007 CET4971380192.168.2.9204.48.28.157
                    Nov 27, 2023 16:44:21.647877932 CET8049712204.48.28.157192.168.2.9
                    Nov 27, 2023 16:44:21.692161083 CET4971280192.168.2.9204.48.28.157
                    Nov 27, 2023 16:44:21.792937994 CET8049712204.48.28.157192.168.2.9
                    Nov 27, 2023 16:44:21.922605038 CET49715443192.168.2.9172.253.122.147
                    Nov 27, 2023 16:44:21.922641039 CET44349715172.253.122.147192.168.2.9
                    Nov 27, 2023 16:44:21.922837019 CET49715443192.168.2.9172.253.122.147
                    Nov 27, 2023 16:44:21.922940969 CET49715443192.168.2.9172.253.122.147
                    Nov 27, 2023 16:44:21.922956944 CET44349715172.253.122.147192.168.2.9
                    Nov 27, 2023 16:44:21.994955063 CET4971280192.168.2.9204.48.28.157
                    Nov 27, 2023 16:44:22.124586105 CET44349715172.253.122.147192.168.2.9
                    Nov 27, 2023 16:44:22.125278950 CET49715443192.168.2.9172.253.122.147
                    Nov 27, 2023 16:44:22.125302076 CET44349715172.253.122.147192.168.2.9
                    Nov 27, 2023 16:44:22.126920938 CET44349715172.253.122.147192.168.2.9
                    Nov 27, 2023 16:44:22.127042055 CET49715443192.168.2.9172.253.122.147
                    Nov 27, 2023 16:44:22.128483057 CET49715443192.168.2.9172.253.122.147
                    Nov 27, 2023 16:44:22.128583908 CET44349715172.253.122.147192.168.2.9
                    Nov 27, 2023 16:44:22.182450056 CET49715443192.168.2.9172.253.122.147
                    Nov 27, 2023 16:44:22.182476044 CET44349715172.253.122.147192.168.2.9
                    Nov 27, 2023 16:44:22.231621027 CET49715443192.168.2.9172.253.122.147
                    Nov 27, 2023 16:44:22.338593960 CET49673443192.168.2.9204.79.197.203
                    Nov 27, 2023 16:44:22.791672945 CET49676443192.168.2.923.206.229.209
                    Nov 27, 2023 16:44:22.791692019 CET49675443192.168.2.923.206.229.209
                    Nov 27, 2023 16:44:23.058613062 CET49674443192.168.2.923.206.229.209
                    Nov 27, 2023 16:44:24.457220078 CET4434970423.206.229.209192.168.2.9
                    Nov 27, 2023 16:44:24.457463026 CET49704443192.168.2.923.206.229.209
                    Nov 27, 2023 16:44:24.878371000 CET49718443192.168.2.923.209.58.93
                    Nov 27, 2023 16:44:24.878416061 CET4434971823.209.58.93192.168.2.9
                    Nov 27, 2023 16:44:24.878496885 CET49718443192.168.2.923.209.58.93
                    Nov 27, 2023 16:44:24.889786005 CET49718443192.168.2.923.209.58.93
                    Nov 27, 2023 16:44:24.889810085 CET4434971823.209.58.93192.168.2.9
                    Nov 27, 2023 16:44:25.097980022 CET4434971823.209.58.93192.168.2.9
                    Nov 27, 2023 16:44:25.098145008 CET49718443192.168.2.923.209.58.93
                    Nov 27, 2023 16:44:25.104029894 CET49718443192.168.2.923.209.58.93
                    Nov 27, 2023 16:44:25.104047060 CET4434971823.209.58.93192.168.2.9
                    Nov 27, 2023 16:44:25.104532003 CET4434971823.209.58.93192.168.2.9
                    Nov 27, 2023 16:44:25.158437967 CET49718443192.168.2.923.209.58.93
                    Nov 27, 2023 16:44:25.217145920 CET49718443192.168.2.923.209.58.93
                    Nov 27, 2023 16:44:25.261253119 CET4434971823.209.58.93192.168.2.9
                    Nov 27, 2023 16:44:25.316723108 CET4434971823.209.58.93192.168.2.9
                    Nov 27, 2023 16:44:25.316807985 CET4434971823.209.58.93192.168.2.9
                    Nov 27, 2023 16:44:25.316910028 CET49718443192.168.2.923.209.58.93
                    TimestampSource PortDest PortSource IPDest IP
                    Nov 27, 2023 16:44:20.018515110 CET5550753192.168.2.91.1.1.1
                    Nov 27, 2023 16:44:20.018752098 CET6028253192.168.2.91.1.1.1
                    Nov 27, 2023 16:44:20.019157887 CET5980053192.168.2.91.1.1.1
                    Nov 27, 2023 16:44:20.019315958 CET6494253192.168.2.91.1.1.1
                    Nov 27, 2023 16:44:20.122963905 CET53563761.1.1.1192.168.2.9
                    Nov 27, 2023 16:44:20.142008066 CET53602821.1.1.1192.168.2.9
                    Nov 27, 2023 16:44:20.142431974 CET53555071.1.1.1192.168.2.9
                    Nov 27, 2023 16:44:20.143110991 CET53598001.1.1.1192.168.2.9
                    Nov 27, 2023 16:44:20.143372059 CET53649421.1.1.1192.168.2.9
                    Nov 27, 2023 16:44:20.735337019 CET53572091.1.1.1192.168.2.9
                    Nov 27, 2023 16:44:21.313443899 CET5804753192.168.2.91.1.1.1
                    Nov 27, 2023 16:44:21.313848972 CET5769353192.168.2.91.1.1.1
                    Nov 27, 2023 16:44:21.438473940 CET53580471.1.1.1192.168.2.9
                    Nov 27, 2023 16:44:21.439620018 CET53576931.1.1.1192.168.2.9
                    Nov 27, 2023 16:44:21.796756983 CET5653953192.168.2.91.1.1.1
                    Nov 27, 2023 16:44:21.797014952 CET5271353192.168.2.91.1.1.1
                    Nov 27, 2023 16:44:21.921065092 CET53527131.1.1.1192.168.2.9
                    Nov 27, 2023 16:44:21.921087980 CET53565391.1.1.1192.168.2.9
                    Nov 27, 2023 16:44:37.794042110 CET53622311.1.1.1192.168.2.9
                    Nov 27, 2023 16:44:56.627481937 CET53558061.1.1.1192.168.2.9
                    Nov 27, 2023 16:45:11.223356009 CET138138192.168.2.9192.168.2.255
                    Nov 27, 2023 16:45:19.395904064 CET53538291.1.1.1192.168.2.9
                    Nov 27, 2023 16:45:19.403381109 CET53576971.1.1.1192.168.2.9

                    DNS Queries

                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                    Nov 27, 2023 16:44:20.018515110 CET192.168.2.91.1.1.10xd872Standard query (0)clients2.google.comA (IP address)IN (0x0001)false
                    Nov 27, 2023 16:44:20.018752098 CET192.168.2.91.1.1.10x8d44Standard query (0)clients2.google.com65IN (0x0001)false
                    Nov 27, 2023 16:44:20.019157887 CET192.168.2.91.1.1.10xdcf8Standard query (0)accounts.google.comA (IP address)IN (0x0001)false
                    Nov 27, 2023 16:44:20.019315958 CET192.168.2.91.1.1.10xf0c8Standard query (0)accounts.google.com65IN (0x0001)false
                    Nov 27, 2023 16:44:21.313443899 CET192.168.2.91.1.1.10x9e1eStandard query (0)hj5ozcalb.puzztake.comA (IP address)IN (0x0001)false
                    Nov 27, 2023 16:44:21.313848972 CET192.168.2.91.1.1.10x50c9Standard query (0)hj5ozcalb.puzztake.com65IN (0x0001)false
                    Nov 27, 2023 16:44:21.796756983 CET192.168.2.91.1.1.10x6ea7Standard query (0)www.google.comA (IP address)IN (0x0001)false
                    Nov 27, 2023 16:44:21.797014952 CET192.168.2.91.1.1.10xf5b3Standard query (0)www.google.com65IN (0x0001)false

                    DNS Answers

                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                    Nov 27, 2023 16:44:20.142008066 CET1.1.1.1192.168.2.90x8d44No error (0)clients2.google.comclients.l.google.comCNAME (Canonical name)IN (0x0001)false
                    Nov 27, 2023 16:44:20.142431974 CET1.1.1.1192.168.2.90xd872No error (0)clients2.google.comclients.l.google.comCNAME (Canonical name)IN (0x0001)false
                    Nov 27, 2023 16:44:20.142431974 CET1.1.1.1192.168.2.90xd872No error (0)clients.l.google.com142.251.179.138A (IP address)IN (0x0001)false
                    Nov 27, 2023 16:44:20.142431974 CET1.1.1.1192.168.2.90xd872No error (0)clients.l.google.com142.251.179.102A (IP address)IN (0x0001)false
                    Nov 27, 2023 16:44:20.142431974 CET1.1.1.1192.168.2.90xd872No error (0)clients.l.google.com142.251.179.113A (IP address)IN (0x0001)false
                    Nov 27, 2023 16:44:20.142431974 CET1.1.1.1192.168.2.90xd872No error (0)clients.l.google.com142.251.179.101A (IP address)IN (0x0001)false
                    Nov 27, 2023 16:44:20.142431974 CET1.1.1.1192.168.2.90xd872No error (0)clients.l.google.com142.251.179.100A (IP address)IN (0x0001)false
                    Nov 27, 2023 16:44:20.142431974 CET1.1.1.1192.168.2.90xd872No error (0)clients.l.google.com142.251.179.139A (IP address)IN (0x0001)false
                    Nov 27, 2023 16:44:20.143110991 CET1.1.1.1192.168.2.90xdcf8No error (0)accounts.google.com142.250.31.84A (IP address)IN (0x0001)false
                    Nov 27, 2023 16:44:21.438473940 CET1.1.1.1192.168.2.90x9e1eNo error (0)hj5ozcalb.puzztake.com204.48.28.157A (IP address)IN (0x0001)false
                    Nov 27, 2023 16:44:21.438473940 CET1.1.1.1192.168.2.90x9e1eNo error (0)hj5ozcalb.puzztake.com159.89.233.44A (IP address)IN (0x0001)false
                    Nov 27, 2023 16:44:21.921065092 CET1.1.1.1192.168.2.90xf5b3No error (0)www.google.com65IN (0x0001)false
                    Nov 27, 2023 16:44:21.921087980 CET1.1.1.1192.168.2.90x6ea7No error (0)www.google.com172.253.122.147A (IP address)IN (0x0001)false
                    Nov 27, 2023 16:44:21.921087980 CET1.1.1.1192.168.2.90x6ea7No error (0)www.google.com172.253.122.105A (IP address)IN (0x0001)false
                    Nov 27, 2023 16:44:21.921087980 CET1.1.1.1192.168.2.90x6ea7No error (0)www.google.com172.253.122.103A (IP address)IN (0x0001)false
                    Nov 27, 2023 16:44:21.921087980 CET1.1.1.1192.168.2.90x6ea7No error (0)www.google.com172.253.122.106A (IP address)IN (0x0001)false
                    Nov 27, 2023 16:44:21.921087980 CET1.1.1.1192.168.2.90x6ea7No error (0)www.google.com172.253.122.104A (IP address)IN (0x0001)false
                    Nov 27, 2023 16:44:21.921087980 CET1.1.1.1192.168.2.90x6ea7No error (0)www.google.com172.253.122.99A (IP address)IN (0x0001)false

                    HTTP Request Dependency Graph

                    • clients2.google.com
                    • accounts.google.com
                    • fs.microsoft.com
                    • slscr.update.microsoft.com
                    • https:
                      • www.bing.com
                    • hj5ozcalb.puzztake.com

                    Statistics

                    Behavior

                    All data are 0.

                    System Behavior

                    General

                    Target ID:2
                    Start time:16:44:14
                    Start date:27/11/2023
                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                    Wow64 process (32bit):false
                    Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
                    Imagebase:0x7ff6b2cb0000
                    File size:3'242'272 bytes
                    MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:low
                    Has exited:false
                    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                    General

                    Target ID:4
                    Start time:16:44:15
                    Start date:27/11/2023
                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                    Wow64 process (32bit):false
                    Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 --field-trial-handle=2252,i,5313747941541486293,13996371138421335699,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                    Imagebase:0x7ff6b2cb0000
                    File size:3'242'272 bytes
                    MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:low
                    Has exited:false
                    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                    General

                    Target ID:5
                    Start time:16:44:20
                    Start date:27/11/2023
                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                    Wow64 process (32bit):false
                    Commandline:C:\Program Files\Google\Chrome\Application\chrome.exe" "http://hj5ozcalb.puzztake.com
                    Imagebase:0x7ff6b2cb0000
                    File size:3'242'272 bytes
                    MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:low
                    Has exited:true

                    Disassembly

                    ⊘No disassembly