Windows Analysis Report
https://lx-cancer-star-mail.qiye.163.com/api/j/re?c=https%3A%2F%2Flx-virgo-star-mail.qiye.163.com%2Funsubscribe_en.html%3Fhost%3Dlx-virgo-star-mail.qiye.163.com%26sign%3DV2.ajzqPKmIuPSUtjI49cnckmTYmpRUMxctJi1hQWQQ4r48hQ4SYIdCZ53u_UJD9Kwudt4_TGR-q8QGlNW2lifYow30Lmqfrm9BtpqSiq7XoI_i4CfXEdDCXLiubh9D0QG

Overview

General Information

Sample URL:	https://lx-cancer-star-mail.qiye.163.com/api/j/re?c=https%3A%2F%2Flx-virgo-star-mail.qiye.163.com%2Funsubscribe_en.html%3Fhost%3Dlx-virgo-star-mail.qiye.163.com%26sign%3DV2.ajzqPKmIuPSUtjI49cnckmTYmpR
Analysis ID:	1544795
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

URL contains potential PII (phishing indication)

Uses insecure TLS / SSL version for HTTPS connection

Classification

Signatures

URL contains potential PII (phishing indication)

Source: https://lx-cancer-star-mail.qiye.163.com/api/j/re?c=https%3A%2F%2Flx-virgo-star-mail.qiye.163.com%2Funsubscribe_en.html%3Fhost%3Dlx-virgo-star-mail.qiye.163.com%26sign%3DV2.ajzqPKmIuPSUtjI49cnckmTYmpRUMxctJi1hQWQQ4r48hQ4SYIdCZ53u_UJD9Kwudt4_TGR-q8QGlNW2lifYow30Lmqfrm9BtpqSiq7XoI_i4CfXEdDCXLiubh9D0QGWClQ_SIVh_Vc9mJbQ0YXk8sjzfFvPZxfrLiol5Ij2fJA%26from%3Dfelix@mexxwin.com

Sample URL: PII: https%3A%2F%2Flx-virgo-star-mail.qiye.163.com%2Funsubscribe_en.html%3Fhost%3Dlx-virgo-star-mail.qiye.163.com%26sign%3DV2.ajzqPKmIuPSUtjI49cnckmTYmpRUMxctJi1hQWQQ4r48hQ4SYIdCZ53u_UJD9Kwudt4_TGR-q8QGlNW2lifYow30Lmqfrm9BtpqSiq7XoI_i4CfXEdDCXLiubh9D0QGWClQ_SIVh_Vc9mJbQ0YXk8sjzfFvPZxfrLiol5Ij2fJA%26from%3Dfelix@mexxwin.com

Source: https://lx-virgo-star-mail.qiye.163.com/unsubscribe_en.html?host=lx-virgo-star-mail.qiye.163.com&sign=V2.ajzqPKmIuPSUtjI49cnckmTYmpRUMxctJi1hQWQQ4r48hQ4SYIdCZ53u_UJD9Kwudt4_TGR-q8QGlNW2lifYow30Lmqfrm9BtpqSiq7XoI_i4CfXEdDCXLiubh9D0QGWClQ_SIVh_Vc9mJbQ0YXk8sjzfFvPZxfrLiol5Ij2fJA&from=felix@mexxwin.com&origin=https%3A%2F%2Flx-virgo-star-mail.qiye.163.com%2Funsubscribe_en.html%3Fhost%3Dlx-virgo-star-mail.qiye.163.com%26sign%3DV2.ajzqPKmIuPSUtjI49cnckmTYmpRUMxctJi1hQWQQ4r48hQ4SYIdCZ53u_UJD9Kwudt4_TGR-q8QGlNW2lifYow30Lmqfrm9BtpqSiq7XoI_i4CfXEdDCXLiubh9D0QGWClQ_SIVh_Vc9mJbQ0YXk8sjzfFvPZxfrLiol5Ij2fJA%26from%3Dfelix%40mexxwin.com	HTTP Parser: No favicon
Source: https://lx-virgo-star-mail.qiye.163.com/unsubscribe_en.html?host=lx-virgo-star-mail.qiye.163.com&sign=V2.ajzqPKmIuPSUtjI49cnckmTYmpRUMxctJi1hQWQQ4r48hQ4SYIdCZ53u_UJD9Kwudt4_TGR-q8QGlNW2lifYow30Lmqfrm9BtpqSiq7XoI_i4CfXEdDCXLiubh9D0QGWClQ_SIVh_Vc9mJbQ0YXk8sjzfFvPZxfrLiol5Ij2fJA&from=felix@mexxwin.com&origin=https%3A%2F%2Flx-virgo-star-mail.qiye.163.com%2Funsubscribe_en.html%3Fhost%3Dlx-virgo-star-mail.qiye.163.com%26sign%3DV2.ajzqPKmIuPSUtjI49cnckmTYmpRUMxctJi1hQWQQ4r48hQ4SYIdCZ53u_UJD9Kwudt4_TGR-q8QGlNW2lifYow30Lmqfrm9BtpqSiq7XoI_i4CfXEdDCXLiubh9D0QGWClQ_SIVh_Vc9mJbQ0YXk8sjzfFvPZxfrLiol5Ij2fJA%26from%3Dfelix%40mexxwin.com	HTTP Parser: No favicon

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.206.229.209:443 -> 192.168.2.9:49725 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49722 version: TLS 1.2

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.206.229.209:443 -> 192.168.2.9:49725 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: global traffic	HTTP traffic detected: GET /api/j/re?c=https%3A%2F%2Flx-virgo-star-mail.qiye.163.com%2Funsubscribe_en.html%3Fhost%3Dlx-virgo-star-mail.qiye.163.com%26sign%3DV2.ajzqPKmIuPSUtjI49cnckmTYmpRUMxctJi1hQWQQ4r48hQ4SYIdCZ53u_UJD9Kwudt4_TGR-q8QGlNW2lifYow30Lmqfrm9BtpqSiq7XoI_i4CfXEdDCXLiubh9D0QGWClQ_SIVh_Vc9mJbQ0YXk8sjzfFvPZxfrLiol5Ij2fJA%26from%3Dfelix@mexxwin.com HTTP/1.1Host: lx-cancer-star-mail.qiye.163.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /unsubscribe_en.html?host=lx-virgo-star-mail.qiye.163.com&sign=V2.ajzqPKmIuPSUtjI49cnckmTYmpRUMxctJi1hQWQQ4r48hQ4SYIdCZ53u_UJD9Kwudt4_TGR-q8QGlNW2lifYow30Lmqfrm9BtpqSiq7XoI_i4CfXEdDCXLiubh9D0QGWClQ_SIVh_Vc9mJbQ0YXk8sjzfFvPZxfrLiol5Ij2fJA&from=felix@mexxwin.com&origin=https%3A%2F%2Flx-virgo-star-mail.qiye.163.com%2Funsubscribe_en.html%3Fhost%3Dlx-virgo-star-mail.qiye.163.com%26sign%3DV2.ajzqPKmIuPSUtjI49cnckmTYmpRUMxctJi1hQWQQ4r48hQ4SYIdCZ53u_UJD9Kwudt4_TGR-q8QGlNW2lifYow30Lmqfrm9BtpqSiq7XoI_i4CfXEdDCXLiubh9D0QGWClQ_SIVh_Vc9mJbQ0YXk8sjzfFvPZxfrLiol5Ij2fJA%26from%3Dfelix%40mexxwin.com HTTP/1.1Host: lx-virgo-star-mail.qiye.163.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: lx-virgo-star-mail.qiye.163.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lx-virgo-star-mail.qiye.163.com/unsubscribe_en.html?host=lx-virgo-star-mail.qiye.163.com&sign=V2.ajzqPKmIuPSUtjI49cnckmTYmpRUMxctJi1hQWQQ4r48hQ4SYIdCZ53u_UJD9Kwudt4_TGR-q8QGlNW2lifYow30Lmqfrm9BtpqSiq7XoI_i4CfXEdDCXLiubh9D0QGWClQ_SIVh_Vc9mJbQ0YXk8sjzfFvPZxfrLiol5Ij2fJA&from=felix@mexxwin.com&origin=https%3A%2F%2Flx-virgo-star-mail.qiye.163.com%2Funsubscribe_en.html%3Fhost%3Dlx-virgo-star-mail.qiye.163.com%26sign%3DV2.ajzqPKmIuPSUtjI49cnckmTYmpRUMxctJi1hQWQQ4r48hQ4SYIdCZ53u_UJD9Kwudt4_TGR-q8QGlNW2lifYow30Lmqfrm9BtpqSiq7XoI_i4CfXEdDCXLiubh9D0QGWClQ_SIVh_Vc9mJbQ0YXk8sjzfFvPZxfrLiol5Ij2fJA%26from%3Dfelix%40mexxwin.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /api/pub/edm/unsubscribe?sign=V2.ajzqPKmIuPSUtjI49cnckmTYmpRUMxctJi1hQWQQ4r48hQ4SYIdCZ53u_UJD9Kwudt4_TGR-q8QGlNW2lifYow30Lmqfrm9BtpqSiq7XoI_i4CfXEdDCXLiubh9D0QGWClQ_SIVh_Vc9mJbQ0YXk8sjzfFvPZxfrLiol5Ij2fJA HTTP/1.1Host: lx-virgo-star-mail.qiye.163.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://lx-virgo-star-mail.qiye.163.com/unsubscribe_en.html?host=lx-virgo-star-mail.qiye.163.com&sign=V2.ajzqPKmIuPSUtjI49cnckmTYmpRUMxctJi1hQWQQ4r48hQ4SYIdCZ53u_UJD9Kwudt4_TGR-q8QGlNW2lifYow30Lmqfrm9BtpqSiq7XoI_i4CfXEdDCXLiubh9D0QGWClQ_SIVh_Vc9mJbQ0YXk8sjzfFvPZxfrLiol5Ij2fJA&from=felix@mexxwin.com&origin=https%3A%2F%2Flx-virgo-star-mail.qiye.163.com%2Funsubscribe_en.html%3Fhost%3Dlx-virgo-star-mail.qiye.163.com%26sign%3DV2.ajzqPKmIuPSUtjI49cnckmTYmpRUMxctJi1hQWQQ4r48hQ4SYIdCZ53u_UJD9Kwudt4_TGR-q8QGlNW2lifYow30Lmqfrm9BtpqSiq7XoI_i4CfXEdDCXLiubh9D0QGWClQ_SIVh_Vc9mJbQ0YXk8sjzfFvPZxfrLiol5Ij2fJA%26from%3Dfelix%40mexxwin.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/pub/edm/unsubscribe?sign=V2.ajzqPKmIuPSUtjI49cnckmTYmpRUMxctJi1hQWQQ4r48hQ4SYIdCZ53u_UJD9Kwudt4_TGR-q8QGlNW2lifYow30Lmqfrm9BtpqSiq7XoI_i4CfXEdDCXLiubh9D0QGWClQ_SIVh_Vc9mJbQ0YXk8sjzfFvPZxfrLiol5Ij2fJA HTTP/1.1Host: lx-virgo-star-mail.qiye.163.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: lx-cancer-star-mail.qiye.163.com
Source: global traffic	DNS traffic detected: DNS query: lx-virgo-star-mail.qiye.163.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Tue, 29 Oct 2024 17:52:57 GMTContent-Length: 0Connection: close

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49722 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@16/8@8/6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1912,i,17293050707104362883,3219657520128468775,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://lx-cancer-star-mail.qiye.163.com/api/j/re?c=https%3A%2F%2Flx-virgo-star-mail.qiye.163.com%2Funsubscribe_en.html%3Fhost%3Dlx-virgo-star-mail.qiye.163.com%26sign%3DV2.ajzqPKmIuPSUtjI49cnckmTYmpRUMxctJi1hQWQQ4r48hQ4SYIdCZ53u_UJD9Kwudt4_TGR-q8QGlNW2lifYow30Lmqfrm9BtpqSiq7XoI_i4CfXEdDCXLiubh9D0QGWClQ_SIVh_Vc9mJbQ0YXk8sjzfFvPZxfrLiol5Ij2fJA%26from%3Dfelix@mexxwin.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1912,i,17293050707104362883,3219657520128468775,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
8.210.226.45	lx-virgo-star-mail.qiye.163.com	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
8.218.107.249	lx-cancer-star-mail.qiye.163.com	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17
192.168.2.9

Contacted Domains

Name	IP	Active
www.google.com	142.250.185.100	true
lx-virgo-star-mail.qiye.163.com	8.210.226.45	true
fp2e7a.wpc.phicdn.net	192.229.221.95	true
lx-cancer-star-mail.qiye.163.com	8.218.107.249	true

Contacted URLs

Name	Malicious	Reputation
https://lx-cancer-star-mail.qiye.163.com/api/j/re?c=https%3A%2F%2Flx-virgo-star-mail.qiye.163.com%2Funsubscribe_en.html%3Fhost%3Dlx-virgo-star-mail.qiye.163.com%26sign%3DV2.ajzqPKmIuPSUtjI49cnckmTYmpRUMxctJi1hQWQQ4r48hQ4SYIdCZ53u_UJD9Kwudt4_TGR-q8QGlNW2lifYow30Lmqfrm9BtpqSiq7XoI_i4CfXEdDCXLiubh9D0QGWClQ_SIVh_Vc9mJbQ0YXk8sjzfFvPZxfrLiol5Ij2fJA%26from%3Dfelix@mexxwin.com	false	unknown
https://lx-virgo-star-mail.qiye.163.com/api/pub/edm/unsubscribe?sign=V2.ajzqPKmIuPSUtjI49cnckmTYmpRUMxctJi1hQWQQ4r48hQ4SYIdCZ53u_UJD9Kwudt4_TGR-q8QGlNW2lifYow30Lmqfrm9BtpqSiq7XoI_i4CfXEdDCXLiubh9D0QGWClQ_SIVh_Vc9mJbQ0YXk8sjzfFvPZxfrLiol5Ij2fJA	false	unknown
https://lx-virgo-star-mail.qiye.163.com/unsubscribe_en.html?host=lx-virgo-star-mail.qiye.163.com&sign=V2.ajzqPKmIuPSUtjI49cnckmTYmpRUMxctJi1hQWQQ4r48hQ4SYIdCZ53u_UJD9Kwudt4_TGR-q8QGlNW2lifYow30Lmqfrm9BtpqSiq7XoI_i4CfXEdDCXLiubh9D0QGWClQ_SIVh_Vc9mJbQ0YXk8sjzfFvPZxfrLiol5Ij2fJA&from=felix@mexxwin.com&origin=https%3A%2F%2Flx-virgo-star-mail.qiye.163.com%2Funsubscribe_en.html%3Fhost%3Dlx-virgo-star-mail.qiye.163.com%26sign%3DV2.ajzqPKmIuPSUtjI49cnckmTYmpRUMxctJi1hQWQQ4r48hQ4SYIdCZ53u_UJD9Kwudt4_TGR-q8QGlNW2lifYow30Lmqfrm9BtpqSiq7XoI_i4CfXEdDCXLiubh9D0QGWClQ_SIVh_Vc9mJbQ0YXk8sjzfFvPZxfrLiol5Ij2fJA%26from%3Dfelix%40mexxwin.com	false	unknown
https://lx-virgo-star-mail.qiye.163.com/favicon.ico	false	unknown

ID:	1544795
Product:	CloudBasic
Start time:	18:51:48
Start date:	29.10.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 16:52:51 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide	29E891E59D56A00DFF017CA355045BEA	35A0B808351DD439704AE7F196D0B8D475B02062	C300C4F2A44A928D556D76BF401B954192B7E58887245ED0C971EAF2459BB980
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 16:52:51 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide	709590A613190E3581762620ED39FE36	F40E09960A2DC2A13CB01632B266502D89A9BA50	F65C01325FBA474BE578002A2A003ED592784E0705A9787AF6A3E898B0CBEF36
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:56:51 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide	733E2B28C0E9549F3969315CD054FC4E	D3B3ACCDE1F5DEDCAB017D214A91D5C64912C223	5C234F4955FEE1604C1BBD33D4E512140BB49BE7FDF833A410557E4E298D429A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 16:52:51 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide	BFA1EA0C19ED3ECF98304512EF79297E	E567DDB49E443AAE274B1BA7376D15F18046DAC7	3F03AA5600DCF790A5570F4CF720CCBEEDC3157DA1F7C50C0833CB7639AFB5B5
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 16:52:51 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide	3139C4308625C4470753112D1B3EA3C2	D56403216E632C28DE88B37C769CE30C00C3279E	B63279406BCC59645DFBF698A6099D753886979DED81A5399B8CDDE3D7744C10
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 29 16:52:51 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide	CE487F8CFC5639681166E20A0910ED47	29683FF3BA8E2165ACE64B9F0F7FB19639A949B5	898DFDC87B6F60FBBCD45F81CF2AC54780FF09B1C58F23C0D20969203D09975A
Chrome Cache Entry: 59	ASCII text, with no line terminators	418FBC40DEEBD999D02A91F3BC9850B9	A04AB7C83CB2CDF175711BF34C27A0C32F801DC2	E85E233CE28065F9DE8A6429A42B6BFC4752340EDB2F66AF1B79F1B805549771

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs