Windows Analysis Report
ELECTRONIC RECEIPT_Moog.html

Overview

General Information

Sample name:	ELECTRONIC RECEIPT_Moog.html
Analysis ID:	1448035
MD5:	e15bac5e50862ac0fce3d7c719de4b06
SHA1:	34b2d5da9e07ce99bb772f624359c2dc0ce059fd
SHA256:	7e563f01f01e627347f9083ab724269df8d038a32d6b7a2f1625d2e4becabd15
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected javascript redirector / loader

HTML IFrame injector detected

HTML document with suspicious name

HTML document with suspicious title

HTML page contains hidden URLs or javascript code

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Stores files to the Windows start menu directory

Classification

Signatures

AV Detection

Antivirus detection for URL or domain

Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=avolm%40moog.com

SlashNext: Label: Credential Stealing type: Phishing & Social Engineering

Phishing

Detected javascript redirector / loader

Source: ELECTRONIC RECEIPT_Moog.html

HTTP Parser: Low number of body elements: 0

HTML IFrame injector detected

Source: file:///C:/Users/user/Desktop/ELECTRONIC%20RECEIPT_Moog.html

HTTP Parser: New IFrame, src: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=avolm%40moog.com

HTML document with suspicious title

Source: file:///C:/Users/user/Desktop/ELECTRONIC%20RECEIPT_Moog.html

Tab title: ELECTRONIC RECEIPT_Moog.html

HTML page contains hidden URLs or javascript code

Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=avolm%40moog.com

HTTP Parser: Base64 decoded: a[href="http://www.salidzini.lv/"][style="display: block; width: 88px; height: 31px; overflow: hidden; position: relative;"]

Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE&co=aHR0cHM6Ly9iN2xna3FkdnpkNGU0ZTcyeHR2cG83aXNxdmpvMWt6cHMwZXZkbXpkaHJkdmM0cXBjbjJ2bGVhM3FvOW52Mi5jb25zdWx0aW5nZXhwZXJ0aXNlaW5jLmNvbTo0NDM.&hl=en&v=joHA60MeME-PNviL59xVH9zs&size=normal&cb=eou73fpnjxim	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE&co=aHR0cHM6Ly9iN2xna3FkdnpkNGU0ZTcyeHR2cG83aXNxdmpvMWt6cHMwZXZkbXpkaHJkdmM0cXBjbjJ2bGVhM3FvOW52Mi5jb25zdWx0aW5nZXhwZXJ0aXNlaW5jLmNvbTo0NDM.&hl=en&v=joHA60MeME-PNviL59xVH9zs&size=normal&cb=eou73fpnjxim	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=joHA60MeME-PNviL59xVH9zs&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=joHA60MeME-PNviL59xVH9zs&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.43.61.160:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.43.61.160:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49756 version: TLS 1.2

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: EONIX-COMMUNICATIONS-ASBLOCK-62904US EONIX-COMMUNICATIONS-ASBLOCK-62904US

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103

Source: global traffic	HTTP traffic detected: GET /?v4hgHT=pUepMZ&username=avolm%40moog.com HTTP/1.1Host: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE&co=aHR0cHM6Ly9iN2xna3FkdnpkNGU0ZTcyeHR2cG83aXNxdmpvMWt6cHMwZXZkbXpkaHJkdmM0cXBjbjJ2bGVhM3FvOW52Mi5jb25zdWx0aW5nZXhwZXJ0aXNlaW5jLmNvbTo0NDM.&hl=en&v=joHA60MeME-PNviL59xVH9zs&size=normal&cb=eou73fpnjxim HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=joHA60MeME-PNviL59xVH9zs HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE&co=aHR0cHM6Ly9iN2xna3FkdnpkNGU0ZTcyeHR2cG83aXNxdmpvMWt6cHMwZXZkbXpkaHJkdmM0cXBjbjJ2bGVhM3FvOW52Mi5jb25zdWx0aW5nZXhwZXJ0aXNlaW5jLmNvbTo0NDM.&hl=en&v=joHA60MeME-PNviL59xVH9zs&size=normal&cb=eou73fpnjximAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bg/OS4jJSgmcHxk24mPNVLLuJfLsxLv_4nnTDIIah-C-70.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE&co=aHR0cHM6Ly9iN2xna3FkdnpkNGU0ZTcyeHR2cG83aXNxdmpvMWt6cHMwZXZkbXpkaHJkdmM0cXBjbjJ2bGVhM3FvOW52Mi5jb25zdWx0aW5nZXhwZXJ0aXNlaW5jLmNvbTo0NDM.&hl=en&v=joHA60MeME-PNviL59xVH9zs&size=normal&cb=eou73fpnjximAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=joHA60MeME-PNviL59xVH9zs&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=KepE2n4oOYauPaP&MD=WRH732tM HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA6x4fXiacDLQQ45eX6rsu-bzH4a8m-nt-RkCfmT1j5X8KgapqaS5vzPHVsUq5H-2R6XcpNFYBlYx_OV-lMtM2f1ptFM-16uVUsZZXf96-MsYX7JP0d5uN9j3FO8mzhteoRDwHDz-9HfLWxV-4pCqHV-jI6Y3bz5UkUVpQZdrq2QmeQxneaSy4KV7VteJdLuSpcfvuQJ&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=joHA60MeME-PNviL59xVH9zs&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTEAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AOBYsJX7DPVBpwucJs7lKlwi7_i2U2m7HgCW3CtE_MTafBtRRQ9iRehj6iT6Y8eWz-FUVTOnsaFPfWRvK1qHtdU
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/reload?k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AOBYsJX7DPVBpwucJs7lKlwi7_i2U2m7HgCW3CtE_MTafBtRRQ9iRehj6iT6Y8eWz-FUVTOnsaFPfWRvK1qHtdU
Source: global traffic	HTTP traffic detected: GET /js/bg/qnm01WqSoqK7Jyx1yaELvF3K6C5BI8IwwjZQJfkFqNo.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=joHA60MeME-PNviL59xVH9zs&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTEAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA6x4fXiacDLQQ45eX6rsu-bzH4a8m-nt-RkCfmT1j5X8KgapqaS5vzPHVsUq5H-2R6XcpNFYBlYx_OV-lMtM2f1ptFM-16uVUsZZXf96-MsYX7JP0d5uN9j3FO8mzhteoRDwHDz-9HfLWxV-4pCqHV-jI6Y3bz5UkUVpQZdrq2QmeQxneaSy4KV7VteJdLuSpcfvuQJ&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AOBYsJX7DPVBpwucJs7lKlwi7_i2U2m7HgCW3CtE_MTafBtRRQ9iRehj6iT6Y8eWz-FUVTOnsaFPfWRvK1qHtdU
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=KepE2n4oOYauPaP&MD=WRH732tM HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /recaptcha/api2/reload?k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE HTTP/1.1Host: www.google.comConnection: keep-aliveContent-Length: 7698sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-protobufferAccept: */*Origin: https://www.google.comX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=joHA60MeME-PNviL59xVH9zs&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTEAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_108.2.dr, chromecache_105.2.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_108.2.dr, chromecache_105.2.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_108.2.dr, chromecache_105.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_108.2.dr, chromecache_105.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_108.2.dr, chromecache_105.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_105.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_105.2.dr	String found in binary or memory: https://recaptcha.net
Source: chromecache_105.2.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_108.2.dr, chromecache_105.2.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_108.2.dr, chromecache_105.2.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_108.2.dr, chromecache_105.2.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_108.2.dr, chromecache_105.2.dr	String found in binary or memory: https://www.apache.org/licenses/
Source: chromecache_113.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js
Source: chromecache_108.2.dr, chromecache_105.2.dr, chromecache_107.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_108.2.dr, chromecache_105.2.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/joHA60MeME-PNviL59xVH9zs/recaptcha__.
Source: chromecache_116.2.dr, chromecache_107.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/joHA60MeME-PNviL59xVH9zs/recaptcha__en.js

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: unknown	HTTPS traffic detected: 23.43.61.160:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.43.61.160:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49756 version: TLS 1.2

System Summary

HTML document with suspicious name

Source: Name includes: ELECTRONIC RECEIPT_Moog.html

Initial sample: receipt

Source: classification engine

Classification label: mal64.phis.winHTML@29/46@10/6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\ELECTRONIC RECEIPT_Moog.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1964,i,16018429883479536494,16696770965177379140,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1964,i,16018429883479536494,16696770965177379140,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	unknown	United States	15169	GOOGLEUS	false
142.250.185.164	unknown	United States	15169	GOOGLEUS	false
170.130.165.102	b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com	United States	62904	EONIX-COMMUNICATIONS-ASBLOCK-62904US	true

Private

IP
192.168.2.5

Contacted Domains

Name	IP	Active
b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com	170.130.165.102	true
www.google.com	142.250.186.68	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
file:///C:/Users/user/Desktop/ELECTRONIC%20RECEIPT_Moog.html	true	Avira URL Cloud: safe	unknown
https://www.google.com/js/bg/qnm01WqSoqK7Jyx1yaELvF3K6C5BI8IwwjZQJfkFqNo.js	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/api2/reload?k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/api2/bframe?hl=en&v=joHA60MeME-PNviL59xVH9zs&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE	false		unknown
https://www.google.com/recaptcha/api.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/js/bg/OS4jJSgmcHxk24mPNVLLuJfLsxLv_4nnTDIIah-C-70.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=joHA60MeME-PNviL59xVH9zs	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/api2/payload?p=06AFcWeA6x4fXiacDLQQ45eX6rsu-bzH4a8m-nt-RkCfmT1j5X8KgapqaS5vzPHVsUq5H-2R6XcpNFYBlYx_OV-lMtM2f1ptFM-16uVUsZZXf96-MsYX7JP0d5uN9j3FO8mzhteoRDwHDz-9HfLWxV-4pCqHV-jI6Y3bz5UkUVpQZdrq2QmeQxneaSy4KV7VteJdLuSpcfvuQJ&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE	false	Avira URL Cloud: safe	unknown
about:blank	false	Avira URL Cloud: safe	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon May 27 12:07:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	43F50F476C65D8F3B17FE506191D2549	69C68D0487E8987A3EABB81C1822E782B869F64D	583CA286534C1AE1CB74CBE13443C1CF8489614D76A177F8D1C020E91ED47FCC
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon May 27 12:07:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	71667BC4C6581B5CCB8A2C9CC32979B1	20D6C9DBB907D406234B3E29F8296164B6E8490B	F6627D1362EF3DA964F36BB4096CB652BD6000C8543DC2836226BF75E7356882
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	32009CDFC7786C3A30E1052FF5FC1F4D	8C17502A8F7DC50F5676BAFC832B9E085A39B466	3E6843358BE88D1BEE06342B1EFE5BB5303337CDC3E5CB0453B5D608BB396117
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon May 27 12:07:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	D92713C91E53DF15654B632CB35D3A9D	014994B577496F2CD86871A5CFB9B7414E7F1898	AFC7A5C8C02D01C6BEA50BB9A46C304852B202402FC18B8DAD6077B438774792
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon May 27 12:07:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	CB6DF2F7CDBA00A45F01E1F38227C8D2	A0B90F4B10C6408F88F59CF6AD2446812382D075	4105C22D8908C0B1DA7C0F08D858976D1907093C1EE266B98B54E34B30B40D5B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon May 27 12:07:31 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	86F8398B6B73FAC2C93EFD30A379FC59	A8ACC98D6388EE50253316D89FFF41A024986769	00E1062C3E57C1165F38BD78AA37C636CA19D0F930119EE6451388E4641644A2
Chrome Cache Entry: 100	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced	07BF314AAB04047B9E9A959EE6F63DA3	17BEF6602672E2FD9956381E01356245144003E5	55EAF62CB05DA20088DC12B39D7D254D046CB1FD61DDF3AE641F1439EFD0A5EE
Chrome Cache Entry: 101	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced	0F2A4639B8A4CB30C76E8333C00D30A6	57E273A270BB864970D747C74B3F0A7C8E515B13	44B988703019CD6BFA86C91840FECF2A42B611B364E3EEA2F4EB63BF62714E98
Chrome Cache Entry: 102	HTML document, ASCII text	B54D0452E2FDB8C0D91C455D1C5495F9	DDD85730B9CB4CB9905B1D7E7643F595D2F33CB8	F4138D99EC6E17514BB87CEEAD1C1D2A204219C970864FC85BFF00949EE18082
Chrome Cache Entry: 103	ASCII text, with no line terminators	AFB69DF47958EB78B4E941270772BD6A	D9FE9A625E906FF25C1F165E7872B1D9C731E78E	874809FB1235F80831B706B9E9B903D80BD5662D036B7712CC76F8C684118878
Chrome Cache Entry: 104	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced	07BF314AAB04047B9E9A959EE6F63DA3	17BEF6602672E2FD9956381E01356245144003E5	55EAF62CB05DA20088DC12B39D7D254D046CB1FD61DDF3AE641F1439EFD0A5EE
Chrome Cache Entry: 105	ASCII text, with very long lines (855)	4668E74B2B2A58381399E91A61B6D63D	89EBF54E996E46F4B1E26F6DCDA93BAD74FC0A1C	B0E3ACC54460721385D2E472DDA7288382F2766A06B38D2E732D034619F9B929
Chrome Cache Entry: 106	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	EF9941290C50CD3866E2BA6B793F010D	4736508C795667DCEA21F8D864233031223B7832	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
Chrome Cache Entry: 107	ASCII text, with very long lines (1414), with no line terminators	40CFAE3B5462CABE5C2CFAFA279227CB	56CD07648D373760809DBF9515F6E5376DFF04A4	CD22C5327CD617FB47A47DF6E46DD055B0B5A4775D22B394B5968284D2CFFE91
Chrome Cache Entry: 108	ASCII text, with very long lines (855)	4668E74B2B2A58381399E91A61B6D63D	89EBF54E996E46F4B1E26F6DCDA93BAD74FC0A1C	B0E3ACC54460721385D2E472DDA7288382F2766A06B38D2E732D034619F9B929
Chrome Cache Entry: 109	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced	0F2A4639B8A4CB30C76E8333C00D30A6	57E273A270BB864970D747C74B3F0A7C8E515B13	44B988703019CD6BFA86C91840FECF2A42B611B364E3EEA2F4EB63BF62714E98
Chrome Cache Entry: 110	Web Open Font Format (Version 2), TrueType, length 15340, version 1.0	19B7A0ADFDD4F808B53AF7E2CE2AD4E5	81D5D4C7B5035AD10CCE63CF7100295E0C51FDDA	C912A9CE0C3122D4B2B29AD26BFE06B0390D1A5BDAA5D6128692C0BEFD1DFBBD
Chrome Cache Entry: 111	Web Open Font Format (Version 2), TrueType, length 15552, version 1.0	285467176F7FE6BB6A9C6873B3DAD2CC	EA04E4FF5142DDD69307C183DEF721A160E0A64E	5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
Chrome Cache Entry: 112	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	EF9941290C50CD3866E2BA6B793F010D	4736508C795667DCEA21F8D864233031223B7832	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
Chrome Cache Entry: 113	HTML document, ASCII text, with very long lines (65461)	415C98AD45F69D495B171716E75F733A	1B29A42FC9257E06EE8D2FFFC6C148BD5E889647	1A55F7B07076B00F2968CCFB97331A18A1FEDF55949322F5D691340BA12CCEE1
Chrome Cache Entry: 114	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 450x450, components 3	558481C6FC4898AFC83076D16D1D9C3E	F188F719644D19BEBD185C7E8CA18D337AE5A0E5	B75D2271F5C5EDA37E7418A75865D4812C613118BB1D87D2047AB80D9FACF6DB
Chrome Cache Entry: 115	ASCII text, with very long lines (17638)	7956FB6FDEE3E761D049A2A171226AAD	6BE6AB99BE5E3D572932B4AFE89EB52667F021B1	AA79B4D56A92A2A2BB272C75C9A10BBC5DCAE82E4123C230C2365025F905A8DA
Chrome Cache Entry: 116	ASCII text, with no line terminators	56A0C97CFE5E8CD218E9F86E41A4302E	0311FF3FB6A8DBE8C69F16940C9B97E2342EE028	57C96A071246A616D90DB2A3FF16B6CFB67C016A2BED92215B1B936151B03995
Chrome Cache Entry: 117	ASCII text, with very long lines (17595)	CA8639A3A35EA45476E335A995C28CFE	17D5E059D1B7784463048D9CF02F0A1137E24B64	392E23252826707C64DB898F3552CBB897CBB312EFFF89E74C32086A1F82FBBD
Chrome Cache Entry: 118	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced	88E0F42C9FA4F94AA8BCD54D1685C180	5AD9D47A49B82718BAA3BE88550A0B3350270C42	89C62095126FCA89EA1511CF35B49B8306162946B0C26D6F60C5506C51D85992
Chrome Cache Entry: 96	ASCII text, with very long lines (56401), with no line terminators	5208F5E6C617977A89CF80522B53A899	6869036A2ED590AAEEEEAB433BE01967549A44D0	487D9C5DEF62BC08F6C5D65273F9AAECE71F070134169A6A6BC365055BE5A92D
Chrome Cache Entry: 97	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 450x450, components 3	558481C6FC4898AFC83076D16D1D9C3E	F188F719644D19BEBD185C7E8CA18D337AE5A0E5	B75D2271F5C5EDA37E7418A75865D4812C613118BB1D87D2047AB80D9FACF6DB
Chrome Cache Entry: 98	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0	5D4AEB4E5F5EF754E307D7FFAEF688BD	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
Chrome Cache Entry: 99	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced	88E0F42C9FA4F94AA8BCD54D1685C180	5AD9D47A49B82718BAA3BE88550A0B3350270C42	89C62095126FCA89EA1511CF35B49B8306162946B0C26D6F60C5506C51D85992

AV Detection

Antivirus detection for URL or domain

Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=avolm%40moog.com

SlashNext: Label: Credential Stealing type: Phishing & Social Engineering

Phishing

Detected javascript redirector / loader

Source: ELECTRONIC RECEIPT_Moog.html

HTTP Parser: Low number of body elements: 0

HTML IFrame injector detected

Source: file:///C:/Users/user/Desktop/ELECTRONIC%20RECEIPT_Moog.html

HTTP Parser: New IFrame, src: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=avolm%40moog.com

HTML document with suspicious title

Source: file:///C:/Users/user/Desktop/ELECTRONIC%20RECEIPT_Moog.html

Tab title: ELECTRONIC RECEIPT_Moog.html

HTML page contains hidden URLs or javascript code

Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=avolm%40moog.com

HTTP Parser: Base64 decoded: a[href="http://www.salidzini.lv/"][style="display: block; width: 88px; height: 31px; overflow: hidden; position: relative;"]

Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE&co=aHR0cHM6Ly9iN2xna3FkdnpkNGU0ZTcyeHR2cG83aXNxdmpvMWt6cHMwZXZkbXpkaHJkdmM0cXBjbjJ2bGVhM3FvOW52Mi5jb25zdWx0aW5nZXhwZXJ0aXNlaW5jLmNvbTo0NDM.&hl=en&v=joHA60MeME-PNviL59xVH9zs&size=normal&cb=eou73fpnjxim	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE&co=aHR0cHM6Ly9iN2xna3FkdnpkNGU0ZTcyeHR2cG83aXNxdmpvMWt6cHMwZXZkbXpkaHJkdmM0cXBjbjJ2bGVhM3FvOW52Mi5jb25zdWx0aW5nZXhwZXJ0aXNlaW5jLmNvbTo0NDM.&hl=en&v=joHA60MeME-PNviL59xVH9zs&size=normal&cb=eou73fpnjxim	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=joHA60MeME-PNviL59xVH9zs&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=joHA60MeME-PNviL59xVH9zs&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 23.43.61.160:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.43.61.160:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49756 version: TLS 1.2

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: EONIX-COMMUNICATIONS-ASBLOCK-62904US EONIX-COMMUNICATIONS-ASBLOCK-62904US

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103

Source: global traffic	HTTP traffic detected: GET /?v4hgHT=pUepMZ&username=avolm%40moog.com HTTP/1.1Host: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE&co=aHR0cHM6Ly9iN2xna3FkdnpkNGU0ZTcyeHR2cG83aXNxdmpvMWt6cHMwZXZkbXpkaHJkdmM0cXBjbjJ2bGVhM3FvOW52Mi5jb25zdWx0aW5nZXhwZXJ0aXNlaW5jLmNvbTo0NDM.&hl=en&v=joHA60MeME-PNviL59xVH9zs&size=normal&cb=eou73fpnjxim HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=joHA60MeME-PNviL59xVH9zs HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE&co=aHR0cHM6Ly9iN2xna3FkdnpkNGU0ZTcyeHR2cG83aXNxdmpvMWt6cHMwZXZkbXpkaHJkdmM0cXBjbjJ2bGVhM3FvOW52Mi5jb25zdWx0aW5nZXhwZXJ0aXNlaW5jLmNvbTo0NDM.&hl=en&v=joHA60MeME-PNviL59xVH9zs&size=normal&cb=eou73fpnjximAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bg/OS4jJSgmcHxk24mPNVLLuJfLsxLv_4nnTDIIah-C-70.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE&co=aHR0cHM6Ly9iN2xna3FkdnpkNGU0ZTcyeHR2cG83aXNxdmpvMWt6cHMwZXZkbXpkaHJkdmM0cXBjbjJ2bGVhM3FvOW52Mi5jb25zdWx0aW5nZXhwZXJ0aXNlaW5jLmNvbTo0NDM.&hl=en&v=joHA60MeME-PNviL59xVH9zs&size=normal&cb=eou73fpnjximAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=joHA60MeME-PNviL59xVH9zs&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=KepE2n4oOYauPaP&MD=WRH732tM HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA6x4fXiacDLQQ45eX6rsu-bzH4a8m-nt-RkCfmT1j5X8KgapqaS5vzPHVsUq5H-2R6XcpNFYBlYx_OV-lMtM2f1ptFM-16uVUsZZXf96-MsYX7JP0d5uN9j3FO8mzhteoRDwHDz-9HfLWxV-4pCqHV-jI6Y3bz5UkUVpQZdrq2QmeQxneaSy4KV7VteJdLuSpcfvuQJ&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=joHA60MeME-PNviL59xVH9zs&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTEAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AOBYsJX7DPVBpwucJs7lKlwi7_i2U2m7HgCW3CtE_MTafBtRRQ9iRehj6iT6Y8eWz-FUVTOnsaFPfWRvK1qHtdU
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/reload?k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AOBYsJX7DPVBpwucJs7lKlwi7_i2U2m7HgCW3CtE_MTafBtRRQ9iRehj6iT6Y8eWz-FUVTOnsaFPfWRvK1qHtdU
Source: global traffic	HTTP traffic detected: GET /js/bg/qnm01WqSoqK7Jyx1yaELvF3K6C5BI8IwwjZQJfkFqNo.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=joHA60MeME-PNviL59xVH9zs&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTEAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/payload?p=06AFcWeA6x4fXiacDLQQ45eX6rsu-bzH4a8m-nt-RkCfmT1j5X8KgapqaS5vzPHVsUq5H-2R6XcpNFYBlYx_OV-lMtM2f1ptFM-16uVUsZZXf96-MsYX7JP0d5uN9j3FO8mzhteoRDwHDz-9HfLWxV-4pCqHV-jI6Y3bz5UkUVpQZdrq2QmeQxneaSy4KV7VteJdLuSpcfvuQJ&k=6LcH7dcpAAAAALREVATCFIqXY6Mp4TFo_EdbvKTE HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AOBYsJX7DPVBpwucJs7lKlwi7_i2U2m7HgCW3CtE_MTafBtRRQ9iRehj6iT6Y8eWz-FUVTOnsaFPfWRvK1qHtdU
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=KepE2n4oOYauPaP&MD=WRH732tM HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

Source: chromecache_108.2.dr, chromecache_105.2.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_108.2.dr, chromecache_105.2.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_108.2.dr, chromecache_105.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_108.2.dr, chromecache_105.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_108.2.dr, chromecache_105.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_105.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_105.2.dr	String found in binary or memory: https://recaptcha.net
Source: chromecache_105.2.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_108.2.dr, chromecache_105.2.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_108.2.dr, chromecache_105.2.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_108.2.dr, chromecache_105.2.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_108.2.dr, chromecache_105.2.dr	String found in binary or memory: https://www.apache.org/licenses/
Source: chromecache_113.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js
Source: chromecache_108.2.dr, chromecache_105.2.dr, chromecache_107.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_108.2.dr, chromecache_105.2.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/joHA60MeME-PNviL59xVH9zs/recaptcha__.
Source: chromecache_116.2.dr, chromecache_107.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/joHA60MeME-PNviL59xVH9zs/recaptcha__en.js

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: unknown	HTTPS traffic detected: 23.43.61.160:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.43.61.160:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49756 version: TLS 1.2

System Summary

HTML document with suspicious name

Source: Name includes: ELECTRONIC RECEIPT_Moog.html

Initial sample: receipt

Source: classification engine

Classification label: mal64.phis.winHTML@29/46@10/6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\ELECTRONIC RECEIPT_Moog.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1964,i,16018429883479536494,16696770965177379140,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1964,i,16018429883479536494,16696770965177379140,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1448035
Product:	CloudBasic
Start time:	15:06:39
Start date:	27.05.2024
Sample:	ELECTRONIC RECEIPT_Moog.html
Cookbook:	defaultwindowshtmlcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	e15bac5e50862ac0fce3d7c719de4b06
SHA1:	34b2d5da9e07ce99bb772f624359c2dc0ce059fd
SHA256:	7e563f01f01e627347f9083ab724269df8d038a32d6b7a2f1625d2e4becabd15
Filetype:	HyperText Markup Language (13003/1) 100.00%

Windows Analysis Report
ELECTRONIC RECEIPT_Moog.html

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report ELECTRONIC RECEIPT_Moog.html

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
ELECTRONIC RECEIPT_Moog.html