Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://laurabingham.org/wp-content/plugins/wp-recipe-maker/downexcel.php

Overview

General Information

Sample URL:https://laurabingham.org/wp-content/plugins/wp-recipe-maker/downexcel.php
Analysis ID:1446519
Infos:

Detection

Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Machine Learning detection for dropped file
Detected non-DNS traffic on DNS port
Drops PE files
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections
Stores files to the Windows start menu directory

Classification

Process Tree

  • System is w10x64_ra
  • chrome.exe (PID: 6148 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://laurabingham.org/wp-content/plugins/wp-recipe-maker/downexcel.php MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 6456 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1828,i,17497539352936221100,5725822133758323697,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • EXCEL.EXE (PID: 7792 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" -xlls "C:\Users\user\Downloads\22-May-24-document-63501ce1.xll" MD5: 4A871771235598812032C822E6F68F19)
      • splwow64.exe (PID: 1960 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)
    • EXCEL.EXE (PID: 7816 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" -xlls "C:\Users\user\Downloads\22-May-24-document-63501ce1.xll" MD5: 4A871771235598812032C822E6F68F19)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Excel Network Connections
Source: Network ConnectionAuthor: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 13.107.213.67, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 7792, Protocol: tcp, SourceIp: 192.168.2.16, SourceIsIpv6: false, SourcePort: 54369
Sigma detected: Suspicious Office Outbound Connections
Source: Network ConnectionAuthor: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.16, DestinationIsIpv6: false, DestinationPort: 54369, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 7792, Protocol: tcp, SourceIp: 13.107.213.67, SourceIsIpv6: false, SourcePort: 443

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: https://laurabingham.org/wp-content/plugins/wp-recipe-maker/downexcel.phpAvira URL Cloud: detection malicious, Label: malware
Multi AV Scanner detection for domain / URL
Source: laurabingham.orgVirustotal: Detection: 6%Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\Downloads\Unconfirmed 695193.crdownload (copy)Virustotal: Detection: 10%Perma Link
Source: C:\Users\user\Downloads\22-May-24-document-63501ce1.xll (copy)ReversingLabs: Detection: 29%
Source: C:\Users\user\Downloads\22-May-24-document-63501ce1.xll (copy)Virustotal: Detection: 15%Perma Link
Multi AV Scanner detection for submitted file
Source: https://laurabingham.org/wp-content/plugins/wp-recipe-maker/downexcel.phpVirustotal: Detection: 6%Perma Link
Machine Learning detection for dropped file
Source: C:\Users\user\Downloads\22-May-24-document-63501ce1.xll.crdownloadJoe Sandbox ML: detected
Source: unknownHTTPS traffic detected: 40.126.32.133:443 -> 192.168.2.16:49702 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.126.32.133:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.213.67:443 -> 192.168.2.16:54372 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.213.67:443 -> 192.168.2.16:54373 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.213.67:443 -> 192.168.2.16:54370 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.213.67:443 -> 192.168.2.16:54371 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.213.67:443 -> 192.168.2.16:54369 version: TLS 1.2
Source: excel.exeMemory has grown: Private usage: 6MB later: 73MB
Source: chrome.exeMemory has grown: Private usage: 1MB later: 31MB
Source: global trafficTCP traffic: 192.168.2.16:54367 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.16:54367 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.16:54367 -> 1.1.1.1:53
Source: global trafficTCP traffic: 192.168.2.16:54367 -> 1.1.1.1:53
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknownTCP traffic detected without corresponding DNS query: 40.126.32.133
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: global trafficDNS traffic detected: DNS query: laurabingham.org
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 54370 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49702 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 54376 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 54378
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 54374 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 54377
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 54376
Source: unknownNetwork traffic detected: HTTP traffic on port 54372 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 54377 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49688 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 54369 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 54371 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 54375 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 54373 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 54369
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 54371
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 54370
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 54375
Source: unknownNetwork traffic detected: HTTP traffic on port 54378 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 54374
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 54373
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 54372
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49706
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49702
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownHTTPS traffic detected: 40.126.32.133:443 -> 192.168.2.16:49702 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.126.32.133:443 -> 192.168.2.16:49724 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.213.67:443 -> 192.168.2.16:54372 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.213.67:443 -> 192.168.2.16:54373 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.213.67:443 -> 192.168.2.16:54370 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.213.67:443 -> 192.168.2.16:54371 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.213.67:443 -> 192.168.2.16:54369 version: TLS 1.2
Source: classification engineClassification label: mal76.win@27/10@4/139
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\Downloads\fcac7eb4-7f07-4e12-95b3-363028033eb2.tmp
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\{2DF18481-BCDC-4A97-8205-C2A26039DB6E} - OProcSessId.dat
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEFile read: C:\Users\desktop.ini
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://laurabingham.org/wp-content/plugins/wp-recipe-maker/downexcel.php
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1828,i,17497539352936221100,5725822133758323697,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1828,i,17497539352936221100,5725822133758323697,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" -xlls "C:\Users\user\Downloads\22-May-24-document-63501ce1.xll"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" -xlls "C:\Users\user\Downloads\22-May-24-document-63501ce1.xll"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" -xlls "C:\Users\user\Downloads\22-May-24-document-63501ce1.xll"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" -xlls "C:\Users\user\Downloads\22-May-24-document-63501ce1.xll"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\Downloads\22-May-24-document-63501ce1.xll.crdownloadJump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\Downloads\85383247-1691-41bf-a177-430a1ce7cd3e.tmpJump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\Downloads\fcac7eb4-7f07-4e12-95b3-363028033eb2.tmpJump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exeThread delayed: delay time: 120000
Source: C:\Windows\splwow64.exeThread delayed: delay time: 120000
Source: C:\Windows\splwow64.exeThread delayed: delay time: 120000
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEProcess information queried: ProcessInformation
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
Registry Run Keys / Startup Folder		1
Process Injection		1
Masquerading		OS Credential Dumping1
Security Software Discovery		Remote ServicesData from Local System2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
Registry Run Keys / Startup Folder		1
Virtualization/Sandbox Evasion		LSASS Memory1
Process Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
Extra Window Memory Injection		1
Process Injection		Security Account Manager1
Virtualization/Sandbox Evasion		SMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
Extra Window Memory Injection		NTDS1
File and Directory Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA Secrets2
System Information Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
https://laurabingham.org/wp-content/plugins/wp-recipe-maker/downexcel.php100%Avira URL Cloudmalware
https://laurabingham.org/wp-content/plugins/wp-recipe-maker/downexcel.php6%VirustotalBrowse

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\Downloads\fcac7eb4-7f07-4e12-95b3-363028033eb2.tmp100%Joe Sandbox ML
C:\Users\user\Downloads\Unconfirmed 695193.crdownload (copy)11%VirustotalBrowse
C:\Users\user\Downloads\Unconfirmed 695193.crdownload (copy)8%ReversingLabs
C:\Users\user\Downloads\fcac7eb4-7f07-4e12-95b3-363028033eb2.tmp100%Joe Sandbox ML
C:\Users\user\Downloads\22-May-24-document-63501ce1.xll.crdownload100%Joe Sandbox ML
C:\Users\user\Downloads\22-May-24-document-63501ce1.xll (copy)29%ReversingLabsWin64.Downloader.Darkgate
C:\Users\user\Downloads\22-May-24-document-63501ce1.xll (copy)15%VirustotalBrowse

Unpacked PE Files

⊘No Antivirus matches

Domains

SourceDetectionScannerLabelLink
laurabingham.org6%VirustotalBrowse
www.google.com0%VirustotalBrowse

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
part-0039.t-0009.t-msedge.net
13.107.213.67
truefalse
    		unknown
    laurabingham.org
    		92.205.17.86
    		truetrueunknown
    www.google.com
    		142.250.186.68
    		truefalseunknown

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    142.250.186.68
    		www.google.comUnited States
    		15169GOOGLEUSfalse
    52.113.194.132
    		unknownUnited States
    		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
    142.250.186.35
    		unknownUnited States
    		15169GOOGLEUSfalse
    2.19.244.127
    		unknownEuropean Union
    		16625AKAMAI-ASUSfalse
    142.250.186.78
    		unknownUnited States
    		15169GOOGLEUSfalse
    34.104.35.123
    		unknownUnited States
    		15169GOOGLEUSfalse
    1.1.1.1
    		unknownAustralia
    		13335CLOUDFLARENETUSfalse
    108.177.15.84
    		unknownUnited States
    		15169GOOGLEUSfalse
    92.205.17.86
    		laurabingham.orgGermany
    		8972GD-EMEA-DC-SXB1DEtrue
    216.58.206.46
    		unknownUnited States
    		15169GOOGLEUSfalse
    20.50.80.213
    		unknownUnited States
    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
    13.107.213.67
    		part-0039.t-0009.t-msedge.netUnited States
    		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
    239.255.255.250
    		unknownReserved
    		unknownunknownfalse
    52.109.32.97
    		unknownUnited States
    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
    142.250.185.195
    		unknownUnited States
    		15169GOOGLEUSfalse

    Private

    IP
    192.168.2.16
    192.168.2.5

    General Information

    Joe Sandbox version:40.0.0 Tourmaline
    Analysis ID:1446519
    Start date and time:2024-05-23 15:49:03 +02:00
    Joe Sandbox product:CloudBasic
    Overall analysis duration:
    Hypervisor based Inspection enabled:false
    Report type:full
    Cookbook file name:defaultwindowsinteractivecookbook.jbs
    Sample URL:https://laurabingham.org/wp-content/plugins/wp-recipe-maker/downexcel.php
    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
    Number of analysed new started processes analysed:18
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • EGA enabled
    Analysis Mode:stream
    Analysis stop reason:Timeout
    Detection:MAL
    Classification:mal76.win@27/10@4/139

    Warnings

    • Exclude process from analysis (whitelisted): svchost.exe
    • Excluded IPs from analysis (whitelisted): 142.250.185.195, 216.58.206.46, 108.177.15.84, 34.104.35.123
    • Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, clientservices.googleapis.com, clients.l.google.com
    • Not all processes where analyzed, report is missing behavior information
    • Report size getting too big, too many NtCreateKey calls found.
    • Report size getting too big, too many NtQueryValueKey calls found.

    Created / dropped Files

    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu May 23 12:49:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
    Category:dropped
    Size (bytes):2673
    Entropy (8bit):3.978651312782535
    Encrypted:false
    SSDEEP:
    MD5:D164E4DC0DF7C5BEA8E95CA17FAB1A2B
    SHA1:9298B260FCAE5F495A0BAFA86CB6137249359120
    SHA-256:82FE84D7AAB399EBC59842543E3E86750A550578ECBE60FEE8F74360E6DEE0E7
    SHA-512:A524324A83C785FDDF8A9CCFC99B2EF0773753464AE7EE3A809519E05A1934ACD43D1E4C1F0EE950397163BFCBF5ABDB82EE65E4D3ADAF1377FE0C5A1EDB244F
    Malicious:false
    Reputation:unknown
    Preview:L..................F.@.. ...$+.,......2.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X'n....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X1n....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X1n....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X1n..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X2n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..........._.~......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu May 23 12:49:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
    Category:dropped
    Size (bytes):2675
    Entropy (8bit):3.9940912261236106
    Encrypted:false
    SSDEEP:
    MD5:588F87435E6E829AF1351F9DE69E2415
    SHA1:DB040C92AA4859709213276072BD95BBE5C7383D
    SHA-256:CECF623D55D9D906F9D91A091E8EAF20414225F3E8AB4984B92A1282CCF8C7C5
    SHA-512:5E86FF531F136761C96070D26F10BE66A3337C9F51C7965328451F6445919A6D1699019FFD42B7298089378D8FC9D1F4FB09E9ABB9A4C85BBF35C85DD290C596
    Malicious:false
    Reputation:unknown
    Preview:L..................F.@.. ...$+.,......&.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X'n....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X1n....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X1n....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X1n..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X2n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..........._.~......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
    Category:dropped
    Size (bytes):2689
    Entropy (8bit):4.005196936536629
    Encrypted:false
    SSDEEP:
    MD5:B4C62BC0E50F6EFA7311AC6FE95E44DE
    SHA1:C31B5B0C3971C640CC35E624EF53B59ED04D0DF0
    SHA-256:F8D6C00F7996A0E041E1F70D11AEBDD6215A871625B8BBF28F84DE048FEF682F
    SHA-512:6C1E33B9607259B0ED3C39C39EC153AC3D14C53BD57346CF4144648A2A09CCE801B517C00BD0B87DAF4172BE18E9C1E5F716405488081E47C3BA2A1B1DF25DB9
    Malicious:false
    Reputation:unknown
    Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X'n....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X1n....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X1n....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X1n..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..........._.~......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu May 23 12:49:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
    Category:dropped
    Size (bytes):2677
    Entropy (8bit):3.992779173015714
    Encrypted:false
    SSDEEP:
    MD5:BAF0780DB2B7E9637CC2DC859610C334
    SHA1:4A4F7C6A18A58FF77DB3C8DD3814BC9DA809A6B5
    SHA-256:311CA657883126374CE133CBD33F1C72CB5DF02A7B2AF30738A4135206DD6B21
    SHA-512:452121C06A2E5A6058021AC19C63EE6CBA4D1ECC92D0D1974C016E927AD21839888A5BD5160E3A603C25FAE18AAE7DC3D861D244003238A4264A8A35BB7CC2A6
    Malicious:false
    Reputation:unknown
    Preview:L..................F.@.. ...$+.,....}. .....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X'n....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X1n....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X1n....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X1n..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X2n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..........._.~......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu May 23 12:49:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
    Category:dropped
    Size (bytes):2677
    Entropy (8bit):3.9801645866386344
    Encrypted:false
    SSDEEP:
    MD5:284969D03C3AEC6DE1AF5B4BBFCE7573
    SHA1:E5AF5B30F35299028F66F8007032D3C15619D414
    SHA-256:6E9DE6D532884EF439C9511809B2204098784F87B4D69C16CD45CFA56DA002AE
    SHA-512:AFAAF1EAE19BCEB5A114A6371DB37B4186F927036A84762E561EBE956F67D4BBFCB770526313DF5C6DA3D0DA1D95F25A11BF491F13C1C70C83BF77536BE6FF1E
    Malicious:false
    Reputation:unknown
    Preview:L..................F.@.. ...$+.,.....9-.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X'n....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X1n....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X1n....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X1n..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X2n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..........._.~......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu May 23 12:49:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
    Category:dropped
    Size (bytes):2679
    Entropy (8bit):3.9912270156065994
    Encrypted:false
    SSDEEP:
    MD5:0B9FEB61C33382311A584F57EFF48278
    SHA1:217627AB7005EC8C72FF8633F48AEB314959E9BB
    SHA-256:5AC15F90B1A01B56BFE0309BDF1AF2ECB593AA3A7310ECEF54394BB7E41A7918
    SHA-512:B5344EABFB6BAC6E1648F44792A04263707995BAB5A38110D7F40C9E96A3FBCE6B3A87929C99C3693A260D32A1702E80259EA9BD70AC49FDC58BC8DACB193292
    Malicious:false
    Reputation:unknown
    Preview:L..................F.@.. ...$+.,.....*......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X'n....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X1n....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X1n....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X1n..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X2n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..........._.~......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

    C:\Users\user\Downloads\22-May-24-document-63501ce1.xll (copy)

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
    Category:dropped
    Size (bytes):0
    Entropy (8bit):0.0
    Encrypted:false
    SSDEEP:
    MD5:E1EADD37E6E1CE68EE0E01C854A61DE7
    SHA1:DDCDECBDA5815E8E0FE4F9B9C5A6462ECDF5BF3B
    SHA-256:84D0B1F68EFFCE4A4091C4C3A72BD4127DD4FC264DC251C25A33CB8F3442E83F
    SHA-512:76843129C6CB0C0546DF24093C2EE9A2B2784B0226937AB984CB950C9F8BC03DD2A03B0C06F1A3400A2BB790F2424F3945F1C793D4D63E88F6ABBA3BDDF8A762
    Malicious:true
    Antivirus:
    • Antivirus: ReversingLabs, Detection: 29%
    • Antivirus: Virustotal, Detection: 15%, Browse
    Reputation:unknown
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Mf..........."...$.....,......P.....................................................`... .........................................Z....................P..................X........................... A..(...................D................................text...(...........................`.P`.data...@....0......................@.P..rdata..P....@......................@.`@.pdata.......P......................@.0@.xdata..0....`....... ..............@.0@.bss.........p........................`..edata..Z............"..............@.0@.idata...............$..............@.0..CRT....X............*..............@.@..tls.................,..............@.@..reloc..X...........................@.0B........................................................................................................................................................................

    C:\Users\user\Downloads\22-May-24-document-63501ce1.xll.crdownload

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
    Category:dropped
    Size (bytes):12288
    Entropy (8bit):4.284964093654805
    Encrypted:false
    SSDEEP:
    MD5:E1EADD37E6E1CE68EE0E01C854A61DE7
    SHA1:DDCDECBDA5815E8E0FE4F9B9C5A6462ECDF5BF3B
    SHA-256:84D0B1F68EFFCE4A4091C4C3A72BD4127DD4FC264DC251C25A33CB8F3442E83F
    SHA-512:76843129C6CB0C0546DF24093C2EE9A2B2784B0226937AB984CB950C9F8BC03DD2A03B0C06F1A3400A2BB790F2424F3945F1C793D4D63E88F6ABBA3BDDF8A762
    Malicious:true
    Antivirus:
    • Antivirus: Joe Sandbox ML, Detection: 100%
    Reputation:unknown
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Mf..........."...$.....,......P.....................................................`... .........................................Z....................P..................X........................... A..(...................D................................text...(...........................`.P`.data...@....0......................@.P..rdata..P....@......................@.`@.pdata.......P......................@.0@.xdata..0....`....... ..............@.0@.bss.........p........................`..edata..Z............"..............@.0@.idata...............$..............@.0..CRT....X............*..............@.@..tls.................,..............@.@..reloc..X...........................@.0B........................................................................................................................................................................

    C:\Users\user\Downloads\22-May-24-document-9a63f7cb.xll (copy)

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
    Category:dropped
    Size (bytes):0
    Entropy (8bit):0.0
    Encrypted:false
    SSDEEP:
    MD5:A0F2FE08D6972F11245D230F8065283A
    SHA1:873463E1FBF9B730AB4310DD6C080E4660A24977
    SHA-256:94D57C4718A07B3F0511DC9DD7A992824B8C6E428552ADE374079E4C94BDEEDB
    SHA-512:ECAAE8D0EE18E3D88F03C7F86FDC0F078FDB6F6048C7A941469791860DFA341757940EBAEC60BB15EA75F62AC0506DCEA3545E79B6AA680B19AECC555A8013DF
    Malicious:true
    Reputation:unknown
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Mf..........."...$.....,......P..........N....................................@0....`... .........................................Z....................P..................X........................... A..(...................D................................text...(...........................`.P`.data...@....0......................@.P..rdata..P....@......................@.`@.pdata.......P......................@.0@.xdata..0....`....... ..............@.0@.bss.........p........................`..edata..Z............"..............@.0@.idata...............$..............@.0..CRT....X............*..............@.@..tls.................,..............@.@..reloc..X...........................@.0B........................................................................................................................................................................

    C:\Users\user\Downloads\85383247-1691-41bf-a177-430a1ce7cd3e.tmp

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
    Category:dropped
    Size (bytes):7924
    Entropy (8bit):5.162773553896766
    Encrypted:false
    SSDEEP:
    MD5:B7CBFCFF4FF72968192F0CBE32302B48
    SHA1:06E9DEF3F7713E7ABFAC272F7C185E03B0432118
    SHA-256:82F40FC5A4B4FD72AB7211AEA7300BBEA28C6DB10ED529D6E0E113E43A2D19CD
    SHA-512:E2735C28BF5A8A6109F9F41259E6CE2E07DC23BD4EA4D8B536816E589084E3C5EAE345CB69F8A34BFF592CC823DAF0F6F7DE6ACED4351C44E4F011D530F4EAAB
    Malicious:true
    Reputation:unknown
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Mf..........."...$.....,......P.....................................................`... .........................................Z....................P..................X........................... A..(...................D................................text...(...........................`.P`.data...@....0......................@.P..rdata..P....@......................@.`@.pdata.......P......................@.0@.xdata..0....`....... ..............@.0@.bss.........p........................`..edata..Z............"..............@.0@.idata...............$..............@.0..CRT....X............*..............@.@..tls.................,..............@.@..reloc..X...........................@.0B........................................................................................................................................................................

    C:\Users\user\Downloads\Unconfirmed 695193.crdownload (copy)

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
    Category:dropped
    Size (bytes):0
    Entropy (8bit):0.0
    Encrypted:false
    SSDEEP:
    MD5:A0F2FE08D6972F11245D230F8065283A
    SHA1:873463E1FBF9B730AB4310DD6C080E4660A24977
    SHA-256:94D57C4718A07B3F0511DC9DD7A992824B8C6E428552ADE374079E4C94BDEEDB
    SHA-512:ECAAE8D0EE18E3D88F03C7F86FDC0F078FDB6F6048C7A941469791860DFA341757940EBAEC60BB15EA75F62AC0506DCEA3545E79B6AA680B19AECC555A8013DF
    Malicious:true
    Antivirus:
    • Antivirus: Virustotal, Detection: 11%, Browse
    • Antivirus: ReversingLabs, Detection: 8%
    Reputation:unknown
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Mf..........."...$.....,......P..........N....................................@0....`... .........................................Z....................P..................X........................... A..(...................D................................text...(...........................`.P`.data...@....0......................@.P..rdata..P....@......................@.`@.pdata.......P......................@.0@.xdata..0....`....... ..............@.0@.bss.........p........................`..edata..Z............"..............@.0@.idata...............$..............@.0..CRT....X............*..............@.@..tls.................,..............@.@..reloc..X...........................@.0B........................................................................................................................................................................

    C:\Users\user\Downloads\fcac7eb4-7f07-4e12-95b3-363028033eb2.tmp

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
    Category:dropped
    Size (bytes):12288
    Entropy (8bit):4.287569184419966
    Encrypted:false
    SSDEEP:
    MD5:A0F2FE08D6972F11245D230F8065283A
    SHA1:873463E1FBF9B730AB4310DD6C080E4660A24977
    SHA-256:94D57C4718A07B3F0511DC9DD7A992824B8C6E428552ADE374079E4C94BDEEDB
    SHA-512:ECAAE8D0EE18E3D88F03C7F86FDC0F078FDB6F6048C7A941469791860DFA341757940EBAEC60BB15EA75F62AC0506DCEA3545E79B6AA680B19AECC555A8013DF
    Malicious:true
    Antivirus:
    • Antivirus: Joe Sandbox ML, Detection: 100%
    • Antivirus: Joe Sandbox ML, Detection: 100%
    Reputation:unknown
    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Mf..........."...$.....,......P..........N....................................@0....`... .........................................Z....................P..................X........................... A..(...................D................................text...(...........................`.P`.data...@....0......................@.P..rdata..P....@......................@.`@.pdata.......P......................@.0@.xdata..0....`....... ..............@.0@.bss.........p........................`..edata..Z............"..............@.0@.idata...............$..............@.0..CRT....X............*..............@.@..tls.................,..............@.@..reloc..X...........................@.0B........................................................................................................................................................................

    Chrome Cache Entry: 154

    Download File
    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
    File Type:ASCII text, with very long lines (3456)
    Category:downloaded
    Size (bytes):3461
    Entropy (8bit):5.838833814248292
    Encrypted:false
    SSDEEP:
    MD5:A8474350CDD2756D5DE5693E839B6027
    SHA1:7FD11E104667B974F089F1F514C29858BC19DC5A
    SHA-256:BA231794A48D67DE119133ACAF78618A86C4A0263697BE1F42A280C2E335FCFE
    SHA-512:0CAB1552392A0254C1C43463760947A53710BE0E388973050EED87A8702AED8165BBEB36E10B7A71FFC29A9C37D9C47280C423EA825BDEED0EC4FF87DAB056FA
    Malicious:false
    Reputation:unknown
    URL:https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
    Preview:)]}'.["",["golfer scottie scheffler","roblox classic event games","redeem codes wuthering waves","amtrak nj transit delays","centerpoint energy power outages","spacex rocket launch tonight","the chosen streaming","sonos headphones ace"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"CgsvbS8wMTBsa2x4NBIcQW1lcmljYW4gcHJvZmVzc2lvbmFsIGdvbGZlcjKvDmRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBRUFBUUFNQklnQUNFUUVERVFIL3hBQWFBQUFDQXdFQkFBQUFBQUFBQUFBQUFBQURCZ1FGQndJSS84UUFOaEFBQWdFREF3RUZCZ01JQXdBQUFBQUFBUUlEQUFRUkJSSWhNUVlUUVZGaEluR0JrYUd4RkVMUkpESlNjcExCOFBFSEZTUC94QUFaQVFBREFRRUJBQUFBQUFBQ

    Static File Info

    ⊘No static file info