Edit tour

Windows Analysis Report
https://gabrielamartinez.hosted.phplist.com/lists/lt.php?tid=ehpRUwdcC1FXB05UUgRXS1BQBQEVWwgBV0wGB1EFBFVTVwdRDg9EUVIABVRRVwRLVAJRVhUNXlkNTAYDDAIZUwJXU1cEXAELDQcGHgAAVAQCCQYCFVsBXQZMUAEEBxldUFdTT1UMWQMMBQYGUwxRUg

Overview

General Information

Sample URL:	https://gabrielamartinez.hosted.phplist.com/lists/lt.php?tid=ehpRUwdcC1FXB05UUgRXS1BQBQEVWwgBV0wGB1EFBFVTVwdRDg9EUVIABVRRVwRLVAJRVhUNXlkNTAYDDAIZUwJXU1cEXAELDQcGHgAAVAQCCQYCFVsBXQZMUAEEBxldUFdTT1UMWQM
Analysis ID:	1496838
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 5968 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gabrielamartinez.hosted.phplist.com/lists/lt.php?tid=ehpRUwdcC1FXB05UUgRXS1BQBQEVWwgBV0wGB1EFBFVTVwdRDg9EUVIABVRRVwRLVAJRVhUNXlkNTAYDDAIZUwJXU1cEXAELDQcGHgAAVAQCCQYCFVsBXQZMUAEEBxldUFdTT1UMWQMMBQYGUwxRUg MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6784 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1892,i,8697526396574075182,1368684247268558061,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.240.158:443 -> 192.168.2.16:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.74:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.74:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.240.158:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.240.158:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.240.158:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.104.136.2:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.104.136.2:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49730 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.240.158
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.240.158
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.240.158
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.240.158
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.240.158
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.240.158
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.240.158
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74

Source: global traffic	HTTP traffic detected: GET /lists/lt.php?tid=ehpRUwdcC1FXB05UUgRXS1BQBQEVWwgBV0wGB1EFBFVTVwdRDg9EUVIABVRRVwRLVAJRVhUNXlkNTAYDDAIZUwJXU1cEXAELDQcGHgAAVAQCCQYCFVsBXQZMUAEEBxldUFdTT1UMWQMMBQYGUwxRUg HTTP/1.1Host: gabrielamartinez.hosted.phplist.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lists/?p=unsubscribe&uid=322c05b3ce432b963439dd85aa4a3238 HTTP/1.1Host: gabrielamartinez.hosted.phplist.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WebblerSession=loc83rsvsro6dfs5rm01136gff
Source: global traffic	HTTP traffic detected: GET /lists/styles/subscribe.css HTTP/1.1Host: gabrielamartinez.hosted.phplist.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://gabrielamartinez.hosted.phplist.com/lists/?p=unsubscribe&uid=322c05b3ce432b963439dd85aa4a3238Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WebblerSession=loc83rsvsro6dfs5rm01136gff
Source: global traffic	HTTP traffic detected: GET /lists/styles/color.css HTTP/1.1Host: gabrielamartinez.hosted.phplist.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://gabrielamartinez.hosted.phplist.com/lists/?p=unsubscribe&uid=322c05b3ce432b963439dd85aa4a3238Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WebblerSession=loc83rsvsro6dfs5rm01136gff
Source: global traffic	HTTP traffic detected: GET /lists/images/phplist.ico HTTP/1.1Host: gabrielamartinez.hosted.phplist.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://gabrielamartinez.hosted.phplist.com/lists/?p=unsubscribe&uid=322c05b3ce432b963439dd85aa4a3238Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WebblerSession=loc83rsvsro6dfs5rm01136gff
Source: global traffic	HTTP traffic detected: GET /lists/images/page_bk_nomenu.png HTTP/1.1Host: gabrielamartinez.hosted.phplist.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://gabrielamartinez.hosted.phplist.com/lists/styles/color.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WebblerSession=loc83rsvsro6dfs5rm01136gff
Source: global traffic	HTTP traffic detected: GET /lists/images/phplist.ico HTTP/1.1Host: gabrielamartinez.hosted.phplist.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WebblerSession=loc83rsvsro6dfs5rm01136gff
Source: global traffic	HTTP traffic detected: GET /lists/images/page_bk_nomenu.png HTTP/1.1Host: gabrielamartinez.hosted.phplist.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WebblerSession=loc83rsvsro6dfs5rm01136gff
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=L1HwzfYzopse42e&MD=sHabYTsN HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=L1HwzfYzopse42e&MD=sHabYTsN HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: gabrielamartinez.hosted.phplist.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gabrielamartinez.hosted.phplist.com/lists/lt.php?tid=ehpRUwdcC1FXB05UUgRXS1BQBQEVWwgBV0wGB1EFBFVTVwdRDg9EUVIABVRRVwRLVAJRVhUNXlkNTAYDDAIZUwJXU1cEXAELDQcGHgAAVAQCCQYCFVsBXQZMUAEEBxldUFdTT1UMWQMMBQYGUwxRUg
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1892,i,8697526396574075182,1368684247268558061,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1892,i,8697526396574075182,1368684247268558061,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://gabrielamartinez.hosted.phplist.com/lists/styles/color.css	0%	Avira URL Cloud	safe
https://gabrielamartinez.hosted.phplist.com/lists/styles/subscribe.css	0%	Avira URL Cloud	safe
https://gabrielamartinez.hosted.phplist.com/lists/images/page_bk_nomenu.png	0%	Avira URL Cloud	safe
https://gabrielamartinez.hosted.phplist.com/lists/images/phplist.ico	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
gabrielamartinez.hosted.phplist.com	45.33.16.218	true	false		unknown
www.google.com	142.250.185.132	true	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
45.33.16.218	gabrielamartinez.hosted.phplist.com	United States	63949	LINODE-APLinodeLLCUS	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1496838
Start date and time:	2024-08-21 19:29:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://gabrielamartinez.hosted.phplist.com/lists/lt.php?tid=ehpRUwdcC1FXB05UUgRXS1BQBQEVWwgBV0wGB1EFBFVTVwdRDg9EUVIABVRRVwRLVAJRVhUNXlkNTAYDDAIZUwJXU1cEXAELDQcGHgAAVAQCCQYCFVsBXQZMUAEEBxldUFdTT1UMWQMMBQYGUwxRUg
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@14/16@6/4

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Aug 21 16:29:39 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.991093703600812
Encrypted:	false
SSDEEP:	48:8jdnT/7AHridAKZdA1FehwiZUklqehRy+3:8l/s+y
MD5:	A3055FB977D66B6AAA6057C662CCF9BF
SHA1:	711F9D5F7340BECA210983AD10DBA5F607F172D5
SHA-256:	7D851FFDB42902A1C1F1F22332F539EF9A175619C990F130196B76F39F51BDE4
SHA-512:	C32CC198FB901E9C1D7B8115EF592941F3B02E45EC9EEC3C9F73A03A5681D15644A8BAC0BB23F278EA3060052ABB96A19C45CCD7610175A788215B637A85FFCA
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......`.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........t..;.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Name	Malicious	Antivirus Detection	Reputation
https://gabrielamartinez.hosted.phplist.com/lists/styles/color.css	false	Avira URL Cloud: safe	unknown
https://gabrielamartinez.hosted.phplist.com/lists/?p=unsubscribe&uid=322c05b3ce432b963439dd85aa4a3238	false		unknown
https://gabrielamartinez.hosted.phplist.com/lists/lt.php?tid=ehpRUwdcC1FXB05UUgRXS1BQBQEVWwgBV0wGB1EFBFVTVwdRDg9EUVIABVRRVwRLVAJRVhUNXlkNTAYDDAIZUwJXU1cEXAELDQcGHgAAVAQCCQYCFVsBXQZMUAEEBxldUFdTT1UMWQMMBQYGUwxRUg	false		unknown
https://gabrielamartinez.hosted.phplist.com/lists/styles/subscribe.css	false	Avira URL Cloud: safe	unknown
https://gabrielamartinez.hosted.phplist.com/lists/images/page_bk_nomenu.png	false	Avira URL Cloud: safe	unknown
https://gabrielamartinez.hosted.phplist.com/lists/images/phplist.ico	false	Avira URL Cloud: safe	unknown

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 21, 2024 19:29:37.704180002 CEST	53	59414	1.1.1.1	192.168.2.16
Aug 21, 2024 19:29:37.757800102 CEST	54598	53	192.168.2.16	1.1.1.1
Aug 21, 2024 19:29:37.757941008 CEST	52822	53	192.168.2.16	1.1.1.1
Aug 21, 2024 19:29:37.767945051 CEST	53	56308	1.1.1.1	192.168.2.16
Aug 21, 2024 19:29:37.781809092 CEST	53	54598	1.1.1.1	192.168.2.16
Aug 21, 2024 19:29:37.894110918 CEST	53	52822	1.1.1.1	192.168.2.16
Aug 21, 2024 19:29:38.772371054 CEST	53	60612	1.1.1.1	192.168.2.16
Aug 21, 2024 19:29:40.878683090 CEST	54910	53	192.168.2.16	1.1.1.1
Aug 21, 2024 19:29:40.878854990 CEST	58251	53	192.168.2.16	1.1.1.1
Aug 21, 2024 19:29:40.901384115 CEST	53	58251	1.1.1.1	192.168.2.16
Aug 21, 2024 19:29:41.352797985 CEST	53	54910	1.1.1.1	192.168.2.16
Aug 21, 2024 19:29:42.577553988 CEST	62859	53	192.168.2.16	1.1.1.1
Aug 21, 2024 19:29:42.577693939 CEST	65228	53	192.168.2.16	1.1.1.1
Aug 21, 2024 19:29:42.585552931 CEST	53	62859	1.1.1.1	192.168.2.16
Aug 21, 2024 19:29:42.585568905 CEST	53	65228	1.1.1.1	192.168.2.16
Aug 21, 2024 19:29:55.683115959 CEST	53	63610	1.1.1.1	192.168.2.16
Aug 21, 2024 19:30:14.484349966 CEST	53	52825	1.1.1.1	192.168.2.16
Aug 21, 2024 19:30:37.245299101 CEST	53	63523	1.1.1.1	192.168.2.16
Aug 21, 2024 19:30:37.705318928 CEST	53	64288	1.1.1.1	192.168.2.16
Aug 21, 2024 19:30:47.147062063 CEST	138	138	192.168.2.16	192.168.2.255
Aug 21, 2024 19:31:06.114051104 CEST	53	63704	1.1.1.1	192.168.2.16

Timestamp	Bytes transferred	Direction	Data
2024-08-21 17:29:38 UTC	845	OUT	GET /lists/lt.php?tid=ehpRUwdcC1FXB05UUgRXS1BQBQEVWwgBV0wGB1EFBFVTVwdRDg9EUVIABVRRVwRLVAJRVhUNXlkNTAYDDAIZUwJXU1cEXAELDQcGHgAAVAQCCQYCFVsBXQZMUAEEBxldUFdTT1UMWQMMBQYGUwxRUg HTTP/1.1 Host: gabrielamartinez.hosted.phplist.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-21 17:29:38 UTC	580	IN	HTTP/1.1 303 See Other Date: Wed, 21 Aug 2024 17:29:38 GMT Server: Apache/2.4.59 Strict-Transport-Security: max-age=15638400; Set-Cookie: WebblerSession=loc83rsvsro6dfs5rm01136gff; path=/; domain=phplist.com; secure; HttpOnly; SameSite=Strict Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Location: https://gabrielamartinez.hosted.phplist.com/lists/?p=unsubscribe&uid=322c05b3ce432b963439dd85aa4a3238 X-Frame-Options: sameorigin Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Timestamp	Bytes transferred	Direction	Data
2024-08-21 17:29:39 UTC	786	OUT	GET /lists/?p=unsubscribe&uid=322c05b3ce432b963439dd85aa4a3238 HTTP/1.1 Host: gabrielamartinez.hosted.phplist.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: WebblerSession=loc83rsvsro6dfs5rm01136gff
2024-08-21 17:29:39 UTC	400	IN	HTTP/1.1 200 OK Date: Wed, 21 Aug 2024 17:29:39 GMT Server: Apache/2.4.59 Strict-Transport-Security: max-age=15638400; Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Vary: Accept-Encoding X-Frame-Options: sameorigin Content-Length: 1889 Connection: close Content-Type: text/html; charset=UTF-8
2024-08-21 17:29:39 UTC	1889	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 20 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 70 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 2f 3e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd" ><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr"><head><meta http-equiv="pragma" content="no-cache" />

Timestamp	Bytes transferred	Direction	Data
2024-08-21 17:29:39 UTC	703	OUT	GET /lists/styles/subscribe.css HTTP/1.1 Host: gabrielamartinez.hosted.phplist.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://gabrielamartinez.hosted.phplist.com/lists/?p=unsubscribe&uid=322c05b3ce432b963439dd85aa4a3238 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: WebblerSession=loc83rsvsro6dfs5rm01136gff
2024-08-21 17:29:40 UTC	338	IN	HTTP/1.1 200 OK Date: Wed, 21 Aug 2024 17:29:40 GMT Server: Apache/2.4.59 Strict-Transport-Security: max-age=15638400; Last-Modified: Wed, 31 May 2023 20:37:39 GMT ETag: "10ef-5fd034a73b4a5" Accept-Ranges: bytes Content-Length: 4335 Vary: Accept-Encoding X-Frame-Options: sameorigin Connection: close Content-Type: text/css
2024-08-21 17:29:40 UTC	4335	IN	Data Raw: 2f 2a 20 73 74 61 72 74 20 66 69 6c 65 3a 2f 6c 69 73 74 73 2f 73 74 79 6c 65 73 2f 73 75 62 73 63 72 69 62 65 2e 63 73 73 20 20 20 2a 2f 0a 0a 2f 2a 20 3d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 47 6c 6f 62 61 6c 20 52 65 73 65 74 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2a 2f 0a 0a 68 74 6d 6c 2c 20 62 6f 64 79 2c 20 64 69 76 2c 20 73 70 61 6e 2c 20 61 70 70 6c 65 74 2c 20 6f 62 6a 65 63 74 2c 20 70 72 65 2c 0a 69 66 72 61 6d 65 2c 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 68 34 2c 20 68 35 2c 20 68 36 2c 20 62 6c 6f 63 6b 71 75 6f 74 65 2c 0a 70 2c 20 61 2c 20 61 62 62 72 2c 20 61 63 72 6f 6e 79 6d 2c 20 61 64 64 72 65 73 73 2c 20 62 69 67 2c 20 63 69 74 65 2c 0a 63 6f 64 65 2c 20 64 65 6c 2c 20 64 66 6e 2c 20 65 6d 2c 20 66 6f 6e 74 2c 20 69 6d 67 2c 20 69 Data Ascii: /* start file:/lists/styles/subscribe.css // =-------------- Global Reset ----------*/html, body, div, span, applet, object, pre,iframe, h1, h2, h3, h4, h5, h6, blockquote,p, a, abbr, acronym, address, big, cite,code, del, dfn, em, font, img, i

Timestamp	Bytes transferred	Direction	Data
2024-08-21 17:29:39 UTC	699	OUT	GET /lists/styles/color.css HTTP/1.1 Host: gabrielamartinez.hosted.phplist.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://gabrielamartinez.hosted.phplist.com/lists/?p=unsubscribe&uid=322c05b3ce432b963439dd85aa4a3238 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: WebblerSession=loc83rsvsro6dfs5rm01136gff
2024-08-21 17:29:40 UTC	336	IN	HTTP/1.1 200 OK Date: Wed, 21 Aug 2024 17:29:40 GMT Server: Apache/2.4.59 Strict-Transport-Security: max-age=15638400; Last-Modified: Wed, 31 May 2023 20:37:39 GMT ETag: "3d2-5fd034a73b4a5" Accept-Ranges: bytes Content-Length: 978 Vary: Accept-Encoding X-Frame-Options: sameorigin Connection: close Content-Type: text/css
2024-08-21 17:29:40 UTC	978	IN	Data Raw: 2f 2a 20 73 74 61 72 74 20 66 69 6c 65 3a 20 2f 6c 69 73 74 73 2f 73 74 79 6c 65 73 2f 63 6f 6c 6f 72 2e 63 73 73 20 20 20 2a 2f 0a 0a 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 22 2e 2e 2f 69 6d 61 67 65 73 2f 70 61 67 65 5f 62 6b 5f 6e 6f 6d 65 6e 75 2e 70 6e 67 22 29 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 36 36 36 0a 7d 0a 0a 2e 70 61 6e 65 6c 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 36 36 36 3b 0a 7d 0a 0a 2e 70 61 6e 65 6c 20 2e 63 6f 6e 74 65 6e 74 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 32 46 32 46 32 0a 7d 0a 0a 68 33 20 7b 0a 20 20 20 20 63 Data Ascii: /* start file: /lists/styles/color.css */body { background-color: #FFF; background-image: url("../images/page_bk_nomenu.png"); color: #666}.panel { border-color: #666;}.panel .content { background-color: #F2F2F2}h3 { c

Timestamp	Bytes transferred	Direction	Data
2024-08-21 17:29:40 UTC	747	OUT	GET /lists/images/phplist.ico HTTP/1.1 Host: gabrielamartinez.hosted.phplist.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://gabrielamartinez.hosted.phplist.com/lists/?p=unsubscribe&uid=322c05b3ce432b963439dd85aa4a3238 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: WebblerSession=loc83rsvsro6dfs5rm01136gff
2024-08-21 17:29:40 UTC	332	IN	HTTP/1.1 200 OK Date: Wed, 21 Aug 2024 17:29:40 GMT Server: Apache/2.4.59 Strict-Transport-Security: max-age=15638400; Last-Modified: Wed, 31 May 2023 20:37:39 GMT ETag: "27a1-5fd034a73a505" Accept-Ranges: bytes Content-Length: 10145 X-Frame-Options: sameorigin Connection: close Content-Type: image/vnd.microsoft.icon
2024-08-21 17:29:40 UTC	7860	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 0e 00 00 01 0e 08 06 00 00 00 78 b1 f9 a5 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 09 70 48 59 73 00 00 0d d7 00 00 0d d7 01 42 28 9b 78 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 77 77 77 2e 69 6e 6b 73 63 61 70 65 2e 6f 72 67 9b ee 3c 1a 00 00 20 00 49 44 41 54 78 9c ed 9d 79 74 55 e5 d9 b7 7f 27 c3 81 cc 21 90 80 18 c6 90 40 90 20 f3 6c 18 a4 0c 61 28 62 71 75 b9 a8 2e bf be 88 2d b5 bc 20 d5 5a 1c 78 3b 58 15 a7 b4 a2 08 b5 0a 14 6d 71 4e 44 04 91 41 41 02 02 8a 0c 32 28 49 20 04 12 42 92 93 79 3c f7 f7 c7 ce 69 63 1a 20 7b 7c 9e b3 f7 7d ad 75 2d 6a 49 f6 b9 9f 61 ff d8 67 4f 0f c0 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 f8 25 2e Data Ascii: PNGIHDRxsBIT\|dpHYsB(xtEXtSoftwarewww.inkscape.org< IDATxytU'!@ la(bqu.- Zx;XmqNDAA2(I By<ic {\|}u-jIagO000000000%.
2024-08-21 17:29:40 UTC	2285	IN	Data Raw: 46 06 26 4c 98 d0 da 5f bf 0b e5 b5 9e 7e cb 4c 48 70 33 8e 15 8e 1e 3d 5a f5 0d 3e b2 ae 90 96 99 99 a9 aa 1d 99 99 99 c2 6b f6 47 43 43 43 69 fb f6 ed aa e7 4d 73 2a 2b 2b e9 d6 5b 6f 6d be dd 46 00 03 61 03 f6 40 82 41 32 db 98 98 18 d5 83 fe e0 83 0f 0a af bb a5 41 41 41 e4 f1 78 54 b5 e3 d9 67 9f 15 5e b7 bf 6a 54 78 34 7b b6 65 03 6c c2 10 28 29 28 7c 90 cc 56 ed 3a ad 07 0e 1c 10 5e 73 4b d3 d2 d2 54 4f dc 7b ee b9 47 78 dd fe 6c 68 68 28 7d f2 c9 27 aa fb bd 39 95 95 95 34 79 f2 e4 1a 00 b6 ba 1b ef 35 48 30 40 66 fb c6 1b 6f a8 1e f0 b6 2e 20 6d 95 ff fa d7 bf 54 b7 a1 57 af 5e c2 eb f6 77 43 42 42 68 db b6 6d aa fb be 39 d5 d5 d5 55 44 64 f6 b9 4b 4b e9 0c c0 03 09 06 c8 4c b5 3c 92 fe fa eb af 0b af db 67 9f 3e 7d 54 3f 19 7b f6 ec 59 e1 75 db Data Ascii: F&L_~LHp3=Z>kGCCCiMs*++[omFa@A2AAAxTg^jTx4{el()(\|V:^sKTO{Gxlhh(}'94y5H0@fo. mTW^wCBBhm9UDdKKL<g>}T?{Yu

Timestamp	Bytes transferred	Direction	Data
2024-08-21 17:29:40 UTC	719	OUT	GET /lists/images/page_bk_nomenu.png HTTP/1.1 Host: gabrielamartinez.hosted.phplist.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://gabrielamartinez.hosted.phplist.com/lists/styles/color.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: WebblerSession=loc83rsvsro6dfs5rm01136gff
2024-08-21 17:29:40 UTC	314	IN	HTTP/1.1 200 OK Date: Wed, 21 Aug 2024 17:29:40 GMT Server: Apache/2.4.59 Strict-Transport-Security: max-age=15638400; Last-Modified: Wed, 31 May 2023 20:37:39 GMT ETag: "2fd-5fd034a73a505" Accept-Ranges: bytes Content-Length: 765 X-Frame-Options: sameorigin Connection: close Content-Type: image/png
2024-08-21 17:29:40 UTC	765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 0a 00 00 00 6a 08 06 00 00 00 85 c6 c0 e7 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 02 9f 49 44 41 54 78 da ec 57 d9 6e db 30 10 e4 d0 b2 25 39 1f 53 14 7d 4b d1 c7 fe ff ff 14 45 a7 16 b9 17 a9 a6 59 14 7e 29 10 23 87 1d 8d f6 98 9d 59 2a f8 f4 f9 0b 4b e2 b5 fc fa f9 23 83 2b b5 24 5f 1f c0 e9 85 77 80 76 9d ef 00 f9 af 35 42 81 f8 1b 00 21 e2 1b a9 40 f9 41 4b 8d 72 8a 0a b9 ce a1 46 7a 0a bc dd 50 6f 86 3c 03 30 03 11 ae e0 0c d0 7b 2a 2c f3 51 38 46 3e d1 ef 3c de 56 af 10 d2 aa 02 14 cc 76 a9 a5 a6 51 01 09 ce 82 78 23 85 c7 16 a0 a5 f5 f8 d4 9a 28 35 1e 28 8b d8 82 71 1c 3c 7a 8c 1a a9 00 70 1e 1f fb fb 1a 6f a6 e6 91 Data Ascii: PNGIHDRjtEXtSoftwareAdobe ImageReadyqe<IDATxWn0%9S}KEY~)#YK#+$_wv5B!@AKrFzPo<0{,Q8F><VvQx#(5(q<zpo

Timestamp	Bytes transferred	Direction	Data
2024-08-21 17:29:41 UTC	434	OUT	GET /lists/images/phplist.ico HTTP/1.1 Host: gabrielamartinez.hosted.phplist.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: WebblerSession=loc83rsvsro6dfs5rm01136gff
2024-08-21 17:29:42 UTC	332	IN	HTTP/1.1 200 OK Date: Wed, 21 Aug 2024 17:29:41 GMT Server: Apache/2.4.59 Strict-Transport-Security: max-age=15638400; Last-Modified: Wed, 31 May 2023 20:37:39 GMT ETag: "27a1-5fd034a73a505" Accept-Ranges: bytes Content-Length: 10145 X-Frame-Options: sameorigin Connection: close Content-Type: image/vnd.microsoft.icon
2024-08-21 17:29:42 UTC	7860	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 0e 00 00 01 0e 08 06 00 00 00 78 b1 f9 a5 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 09 70 48 59 73 00 00 0d d7 00 00 0d d7 01 42 28 9b 78 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 77 77 77 2e 69 6e 6b 73 63 61 70 65 2e 6f 72 67 9b ee 3c 1a 00 00 20 00 49 44 41 54 78 9c ed 9d 79 74 55 e5 d9 b7 7f 27 c3 81 cc 21 90 80 18 c6 90 40 90 20 f3 6c 18 a4 0c 61 28 62 71 75 b9 a8 2e bf be 88 2d b5 bc 20 d5 5a 1c 78 3b 58 15 a7 b4 a2 08 b5 0a 14 6d 71 4e 44 04 91 41 41 02 02 8a 0c 32 28 49 20 04 12 42 92 93 79 3c f7 f7 c7 ce 69 63 1a 20 7b 7c 9e b3 f7 7d ad 75 2d 6a 49 f6 b9 9f 61 ff d8 67 4f 0f c0 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 30 0c c3 f8 25 2e Data Ascii: PNGIHDRxsBIT\|dpHYsB(xtEXtSoftwarewww.inkscape.org< IDATxytU'!@ la(bqu.- Zx;XmqNDAA2(I By<ic {\|}u-jIagO000000000%.
2024-08-21 17:29:42 UTC	2285	IN	Data Raw: 46 06 26 4c 98 d0 da 5f bf 0b e5 b5 9e 7e cb 4c 48 70 33 8e 15 8e 1e 3d 5a f5 0d 3e b2 ae 90 96 99 99 a9 aa 1d 99 99 99 c2 6b f6 47 43 43 43 69 fb f6 ed aa e7 4d 73 2a 2b 2b e9 d6 5b 6f 6d be dd 46 00 03 61 03 f6 40 82 41 32 db 98 98 18 d5 83 fe e0 83 0f 0a af bb a5 41 41 41 e4 f1 78 54 b5 e3 d9 67 9f 15 5e b7 bf 6a 54 78 34 7b b6 65 03 6c c2 10 28 29 28 7c 90 cc 56 ed 3a ad 07 0e 1c 10 5e 73 4b d3 d2 d2 54 4f dc 7b ee b9 47 78 dd fe 6c 68 68 28 7d f2 c9 27 aa fb bd 39 95 95 95 34 79 f2 e4 1a 00 b6 ba 1b ef 35 48 30 40 66 fb c6 1b 6f a8 1e f0 b6 2e 20 6d 95 ff fa d7 bf 54 b7 a1 57 af 5e c2 eb f6 77 43 42 42 68 db b6 6d aa fb be 39 d5 d5 d5 55 44 64 f6 b9 4b 4b e9 0c c0 03 09 06 c8 4c b5 3c 92 fe fa eb af 0b af db 67 9f 3e 7d 54 3f 19 7b f6 ec 59 e1 75 db Data Ascii: F&L_~LHp3=Z>kGCCCiMs*++[omFa@A2AAAxTg^jTx4{el()(\|V:^sKTO{Gxlhh(}'94y5H0@fo. mTW^wCBBhm9UDdKKL<g>}T?{Yu

Timestamp	Bytes transferred	Direction	Data
2024-08-21 17:29:49 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-21 17:29:49 UTC	494	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=83570 Date: Wed, 21 Aug 2024 17:29:49 GMT Connection: close X-CID: 2

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://gabrielamartinez.hosted.phplist.com/lists/lt.php?tid=ehpRUwdcC1FXB05UUgRXS1BQBQEVWwgBV0wGB1EFBFVTVwdRDg9EUVIABVRRVwRLVAJRVhUNXlkNTAYDDAIZUwJXU1cEXAELDQcGHgAAVAQCCQYCFVsBXQZMUAEEBxldUFdTT1UMWQMMBQYGUwxRUg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 5968, Parent PID: 3588

General

Windows Analysis Report
https://gabrielamartinez.hosted.phplist.com/lists/lt.php?tid=ehpRUwdcC1FXB05UUgRXS1BQBQEVWwgBV0wGB1EFBFVTVwdRDg9EUVIABVRRVwRLVAJRVhUNXlkNTAYDDAIZUwJXU1cEXAELDQcGHgAAVAQCCQYCFVsBXQZMUAEEBxldUFdTT1UMWQMMBQYGUwxRUg

Timestamp	Bytes transferred	Direction	Data
2024-08-21 17:29:50 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-21 17:29:50 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=83551 Date: Wed, 21 Aug 2024 17:29:50 GMT Content-Length: 55 Connection: close X-CID: 2
2024-08-21 17:29:50 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-08-21 17:29:51 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=L1HwzfYzopse42e&MD=sHabYTsN HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-21 17:29:52 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: b8784b88-9b53-43a0-ac26-1c2180d613d7 MS-RequestId: 3287abdb-0096-48d6-8815-ebabcfceb0a4 MS-CV: XbRbmgg6uE+q4Vqm.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 21 Aug 2024 17:29:51 GMT Connection: close Content-Length: 24490
2024-08-21 17:29:52 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-08-21 17:29:52 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2024-08-21 17:29:53 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-08-21 17:29:53 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-21 17:29:54 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 21 Aug 2024 17:28:54 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BL2 x-ms-request-id: a92614d9-33ea-40e6-a375-6d563db01948 PPServer: PPV: 30 H: BL02EPF0001D7AB V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 21 Aug 2024 17:29:53 GMT Connection: close Content-Length: 11389
2024-08-21 17:29:54 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-08-21 17:29:55 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4710 Host: login.live.com
2024-08-21 17:29:55 UTC	4710	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-21 17:29:55 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 21 Aug 2024 17:28:55 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_SN1 x-ms-request-id: 3bbb3135-0304-407e-8aae-7f32148f29c4 PPServer: PPV: 30 H: SN1PEPF0004014E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 21 Aug 2024 17:29:54 GMT Connection: close Content-Length: 10173
2024-08-21 17:29:55 UTC	10173	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-08-21 17:30:30 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=L1HwzfYzopse42e&MD=sHabYTsN HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-21 17:30:30 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 7f13d098-8168-40d8-9cd2-f00a722e0ef7 MS-RequestId: da3c2fa3-bbde-4f13-bb2a-0ec57903170f MS-CV: ZwOonqBOeUeUIwXY.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 21 Aug 2024 17:30:29 GMT Connection: close Content-Length: 30005
2024-08-21 17:30:30 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-08-21 17:30:30 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Target ID:	0
Start time:	13:29:36
Start date:	21/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gabrielamartinez.hosted.phplist.com/lists/lt.php?tid=ehpRUwdcC1FXB05UUgRXS1BQBQEVWwgBV0wGB1EFBFVTVwdRDg9EUVIABVRRVwRLVAJRVhUNXlkNTAYDDAIZUwJXU1cEXAELDQcGHgAAVAQCCQYCFVsBXQZMUAEEBxldUFdTT1UMWQMMBQYGUwxRUg
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre