Edit tour

Windows Analysis Report
https://www.research.net/r/8BZPWB2

Overview

General Information

Sample URL:	https://www.research.net/r/8BZPWB2
Analysis ID:	1490271

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Detected non-DNS traffic on DNS port

HTML page contains hidden javascript code

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 3016 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.research.net/r/8BZPWB2 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5712 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1908,i,3560242343669076562,1311281938150589448,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://orange-seal-ldgztk.mystrikingly.com/

LLM: Score: 9 Reasons: The domain 'orange-seal-ldgztk.mystrikingly.com' does not match the brand name 'Secure', and the domain'mystrikingly.com' is a known domain provider for creating free websites, which raises concerns about the authenticity and security of the site. DOM: 4.2.pages.csv

Source: https://orange-seal-ldgztk.mystrikingly.com/

HTTP Parser: Base64 decoded: djg5GBPdTZKBVkVAd1UGPU851f2juvohBWzS8Llkvo4fipN9DZcCdGaXl6BMCZ1ZPjhCLEJNPcL577C2PlJH3Fm0He6eO3azpg+4j9vjZ6CkrsuEBavrmqJjBXdOI2Ao3Nw/sngTvEPcKLU68P2TIC89bmmdzCd18m2hDwaxXDE=--teoF/kZy+3MYpge+ZsYLRg==

Source: https://www.research.net/r/8BZPWB2	HTTP Parser: No favicon
Source: https://www.research.net/r/8BZPWB2	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:59571 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:59572 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:59580 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:59709 version: TLS 1.2

Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:59569 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.research.net
Source: global traffic	DNS traffic detected: DNS query: prod.smassets.net
Source: global traffic	DNS traffic detected: DNS query: secure.surveymonkey.com
Source: global traffic	DNS traffic detected: DNS query: cdn.smassets.net
Source: global traffic	DNS traffic detected: DNS query: cdn.signalfx.com
Source: global traffic	DNS traffic detected: DNS query: bam-cell.nr-data.net
Source: global traffic	DNS traffic detected: DNS query: surveymonkey-assets.s3.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: orange-seal-ldgztk.mystrikingly.com
Source: global traffic	DNS traffic detected: DNS query: static-fonts-css.strikinglycdn.com
Source: global traffic	DNS traffic detected: DNS query: static-assets.strikinglycdn.com
Source: global traffic	DNS traffic detected: DNS query: assets.strikingly.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: static-fonts.strikinglycdn.com
Source: global traffic	DNS traffic detected: DNS query: d26b395fwzu5fz.cloudfront.net

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.research.net/r/8BZPWB2
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1908,i,3560242343669076562,1311281938150589448,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1908,i,3560242343669076562,1311281938150589448,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Name	IP	Active	Malicious	Reputation
dukt9g6vj8lpb.cloudfront.net	52.84.150.39	true	false	unknown
d29twgdo50231s.cloudfront.net	18.245.46.89	true	false	unknown
fastly-tls12-bam-cell.nr-data.net	162.247.243.30	true	false	unknown
d15akbylw3vqc5.cloudfront.net	18.238.243.20	true	false	unknown
s3-w.us-east-1.amazonaws.com	16.182.67.137	true	false	unknown
d26b395fwzu5fz.cloudfront.net	18.238.248.87	true	false	unknown
d2yx97y2ukjhui.cloudfront.net	18.244.18.42	true	false	unknown
dy7t0zkjx7o42.cloudfront.net	13.224.189.23	true	false	unknown
cdnjs.cloudflare.com	104.17.24.14	true	false	unknown
cdn.signalfx.com	18.165.183.26	true	false	unknown
www.google.com	216.58.206.68	true	false	unknown
d2redq3h1nilmz.cloudfront.net	18.66.147.104	true	false	unknown
d3t35iddbz3muz.cloudfront.net	18.66.102.17	true	false	unknown
cdn.smassets.net	unknown	unknown	false	unknown
static-assets.strikinglycdn.com	unknown	unknown	false	unknown
static-fonts.strikinglycdn.com	unknown	unknown	false	unknown
surveymonkey-assets.s3.amazonaws.com	unknown	unknown	false	unknown
prod.smassets.net	unknown	unknown	false	unknown
assets.strikingly.com	unknown	unknown	false	unknown
orange-seal-ldgztk.mystrikingly.com	unknown	unknown	true	unknown
static-fonts-css.strikinglycdn.com	unknown	unknown	false	unknown
www.research.net	unknown	unknown	false	unknown
bam-cell.nr-data.net	unknown	unknown	false	unknown
secure.surveymonkey.com	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://orange-seal-ldgztk.mystrikingly.com/	true		unknown
https://www.research.net/r/8BZPWB2	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.78	unknown	United States	15169	GOOGLEUS	false
142.250.186.67	unknown	United States	15169	GOOGLEUS	false
18.244.18.42	d2yx97y2ukjhui.cloudfront.net	United States	16509	AMAZON-02US	false
18.239.18.88	unknown	United States	16509	AMAZON-02US	false
18.66.102.17	d3t35iddbz3muz.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
18.66.102.128	unknown	United States	3	MIT-GATEWAYSUS	false
162.247.243.30	fastly-tls12-bam-cell.nr-data.net	United States	13335	CLOUDFLARENETUS	false
18.238.243.20	d15akbylw3vqc5.cloudfront.net	United States	16509	AMAZON-02US	false
172.217.23.99	unknown	United States	15169	GOOGLEUS	false
18.173.205.26	unknown	United States	3	MIT-GATEWAYSUS	false
142.250.186.110	unknown	United States	15169	GOOGLEUS	false
142.250.184.206	unknown	United States	15169	GOOGLEUS	false
18.245.46.89	d29twgdo50231s.cloudfront.net	United States	16509	AMAZON-02US	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
18.66.147.104	d2redq3h1nilmz.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
18.238.248.138	unknown	United States	16509	AMAZON-02US	false
34.104.35.123	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
18.165.183.26	cdn.signalfx.com	United States	3	MIT-GATEWAYSUS	false
3.5.27.166	unknown	United States	14618	AMAZON-AESUS	false
142.250.185.234	unknown	United States	15169	GOOGLEUS	false
13.224.189.23	dy7t0zkjx7o42.cloudfront.net	United States	16509	AMAZON-02US	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false
142.250.181.227	unknown	United States	15169	GOOGLEUS	false
64.233.167.84	unknown	United States	15169	GOOGLEUS	false
16.182.67.137	s3-w.us-east-1.amazonaws.com	United States	unknown	unknown	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
18.238.243.34	unknown	United States	16509	AMAZON-02US	false
18.238.248.87	d26b395fwzu5fz.cloudfront.net	United States	16509	AMAZON-02US	false
142.250.184.238	unknown	United States	15169	GOOGLEUS	false
52.84.150.39	dukt9g6vj8lpb.cloudfront.net	United States	16509	AMAZON-02US	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1490271
Start date and time:	2024-08-08 23:27:37 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://www.research.net/r/8BZPWB2
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.phis.win@20/133@44/301

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Aug 8 20:28:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9890337819855897
Encrypted:	false
SSDEEP:
MD5:	9D1265780DE5B095B3927B9427FA2993
SHA1:	7D54F312F7B60D721E5C6F7C6551C49B018FA4C8
SHA-256:	A93FC710D2A1E466F3CA93262CA6A64373B129CDED2592A07E8CBC87FCB08B4B
SHA-512:	FA7D62A0FD9F30A118AC458FADB15AB175BEB9AAE10F7C9C6295DA531FBA6901287765AEA6392FB8F16935D2071FA3ECB03D78C2D6289337B4C63AE51C977B0A
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......s.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Yy.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........2.uw.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Aug 8 20:28:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.005191474266918
Encrypted:	false
SSDEEP:
MD5:	A0200CE88235B1C7E47FBE0E49569ACE
SHA1:	EC4B2A81FE18F77C6C00F2B766E328CFDC49D2A3
SHA-256:	CB8641673D0BEC530428E6EBEC86873F166E8FDA9CC16B2925584ABDD6A24410
SHA-512:	B9267566C2CEA2660A32CEB355D7C0D35D4B2E74012261AFDDE7DA6A26F5D521A130EAA8E41CF07BA21F5DC98A20A47556A24ABD9125D4D688777001F95DB293
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....kg.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Yy.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........2.uw.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Input	Output
URL: https://www.research.net/r/8BZPWB2 Model: jbxai	{"result":false,"interest_score":"0.064"}
	{"result":false,"interest_score":"0.064"}
URL: https://orange-seal-ldgztk.mystrikingly.com/ Model: jbxai	{"phishing_score":9,"brand_name":"Secure","reasons":"The domain 'orange-seal-ldgztk.mystrikingly.com' does not match the brand name 'Secure', and the domain'mystrikingly.com' is a known domain provider for creating free websites, which raises concerns about the authenticity and security of the site.","interest_score":"0.980"}

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://www.research.net/r/8BZPWB2

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 286

Chrome Cache Entry: 287

Chrome Cache Entry: 289

Chrome Cache Entry: 292

Chrome Cache Entry: 293

Chrome Cache Entry: 295

Chrome Cache Entry: 296

Chrome Cache Entry: 297

Chrome Cache Entry: 299

Chrome Cache Entry: 300

Chrome Cache Entry: 303

Chrome Cache Entry: 304

Chrome Cache Entry: 306

Chrome Cache Entry: 307

Chrome Cache Entry: 308

Chrome Cache Entry: 309

Chrome Cache Entry: 311

Chrome Cache Entry: 313

Chrome Cache Entry: 314

Chrome Cache Entry: 317

Chrome Cache Entry: 318

Chrome Cache Entry: 320

Chrome Cache Entry: 322

Chrome Cache Entry: 323

Chrome Cache Entry: 324

Chrome Cache Entry: 326

Chrome Cache Entry: 328

Chrome Cache Entry: 330

Chrome Cache Entry: 332

Chrome Cache Entry: 335

Chrome Cache Entry: 337

Chrome Cache Entry: 340

Windows Analysis Report
https://www.research.net/r/8BZPWB2