Edit tour

Windows Analysis Report
https://we.tl/t-J9PcqXV8XE

Overview

General Information

Sample URL:	https://we.tl/t-J9PcqXV8XE
Analysis ID:	1648041
Infos:

Detection

Score:	52
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Downloads suspicious files via Chrome

Creates files inside the system directory

Deletes files inside the Windows folder

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6380 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6976 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2120,i,200407010641660730,7757674318590756446,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2156 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7300 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2120,i,200407010641660730,7757674318590756446,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3740 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 4088 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-pre-read-main-dll --field-trial-handle=2120,i,200407010641660730,7757674318590756446,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=6008 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7564 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://we.tl/t-J9PcqXV8XE" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Joe Sandbox Signatures

• Phishing
• System Summary

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://citationcanada.wetransfer.com/checkout?tier=ultimate&billing=monthly&redirect=transfer&lsid=2cc80a21-5f6c-497a-a888-e2d575bf6ef7&t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_s=download_link&t_ts=1742838506&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&paywall=pricing_page&trigger=download_page_opened	Joe Sandbox AI: Score: 7 Reasons: The URL 'wetransfer.com' is a legitimate and well-known domain associated with the file transfer service WeTransfer., The subdomain 'citationcanada' does not match the brand 'Google' and appears to be a custom subdomain, which is common for services like WeTransfer., The brand 'Google' is not associated with the domain 'wetransfer.com', indicating a potential mismatch., The presence of a subdomain does not inherently indicate phishing, but the mismatch between the brand and domain is suspicious., The input field for 'Email address' is common for legitimate services but can also be used in phishing attempts. DOM: 3.26.pages.csv
Source: https://citationcanada.wetransfer.com/checkout?tier=ultimate&billing=monthly&redirect=transfer&lsid=2cc80a21-5f6c-497a-a888-e2d575bf6ef7&t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_s=download_link&t_ts=1742838506&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&paywall=pricing_page&trigger=download_page_opened	Joe Sandbox AI: Score: 7 Reasons: The brand 'WeTransfer' is a known file transfer service., The URL 'citationcanada.wetransfer.com' uses a subdomain of 'wetransfer.com', which is the legitimate domain for WeTransfer., The presence of input fields for card information is unusual for WeTransfer, which typically does not require such information for its primary service., The subdomain 'citationcanada' is not typically associated with WeTransfer's services and could be used to mislead users., The use of a legitimate domain with a suspicious subdomain is a common tactic in phishing attempts. DOM: 3.34.pages.csv

Source: https://citationcanada.wetransfer.com/checkout?tier=ultimate&billing=monthly&redirect=transfer&lsid=2cc80a21-5f6c-497a-a888-e2d575bf6ef7&t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_s=download_link&t_ts=1742838506&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&paywall=pricing_page&trigger=download_page_opened

HTTP Parser: Number of links: 0

Source: https://citationcanada.wetransfer.com/downloads/d46d3e193e4b493c263d86f386640d0120250324174826/b5a87d?t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&t_s=download_link&t_ts=1742838506

HTTP Parser: Base64 decoded: auth0|67648b2a5bbb24d5f6345252

HTTP Parser: Title: Secure payment input frame does not match URL

Source: https://citationcanada.wetransfer.com/checkout?tier=ultimate&billing=monthly&redirect=transfer&lsid=2cc80a21-5f6c-497a-a888-e2d575bf6ef7&t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_s=download_link&t_ts=1742838506&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&paywall=pricing_page&trigger=download_page_opened	HTTP Parser: Iframe src: https://tagging.wetransfer.com/ns.html?id=GTM-NS54WBW
Source: https://citationcanada.wetransfer.com/checkout?tier=ultimate&billing=monthly&redirect=transfer&lsid=2cc80a21-5f6c-497a-a888-e2d575bf6ef7&t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_s=download_link&t_ts=1742838506&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&paywall=pricing_page&trigger=download_page_opened	HTTP Parser: Iframe src: https://insight.adsrvr.org/track/up?adv=81c3jgn&ref=https%3A%2F%2Fcitationcanada.wetransfer.com%2Fcheckout%3Ftier%3Dultimate%26billing%3Dmonthly%26redirect%3Dtransfer%26lsid%3D2cc80a21-5f6c-497a-a888-e2d575bf6ef7%26t_exp%3D1743097706%26t_lsid%3D12ca2034-7cbb-4ac5-955e-0f7cc123da61%26t_network%3Dlink%26t_s%3Ddownload_link%26t_ts%3D1742838506%26t_rid%3DYXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy%26paywall%3Dpricing_page%26trigger%3Ddownload_page_opened&upid=re36kbe&upv=1.1.0&paapi=1
Source: https://citationcanada.wetransfer.com/checkout?tier=ultimate&billing=monthly&redirect=transfer&lsid=2cc80a21-5f6c-497a-a888-e2d575bf6ef7&t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_s=download_link&t_ts=1742838506&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&paywall=pricing_page&trigger=download_page_opened	HTTP Parser: Iframe src: https://apps.rokt.com/wsdk/controller/index.2.5657.0.html
Source: https://citationcanada.wetransfer.com/checkout?tier=ultimate&billing=monthly&redirect=transfer&lsid=2cc80a21-5f6c-497a-a888-e2d575bf6ef7&t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_s=download_link&t_ts=1742838506&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&paywall=pricing_page&trigger=download_page_opened	HTTP Parser: Iframe src: https://apps.rokt.com/wsdk/plugins/dcui/index.html

Source: https://citationcanada.wetransfer.com/downloads/d46d3e193e4b493c263d86f386640d0120250324174826/b5a87d?t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&t_s=download_link&t_ts=1742838506	HTTP Parser: No favicon
Source: https://citationcanada.wetransfer.com/downloads/d46d3e193e4b493c263d86f386640d0120250324174826/b5a87d?t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&t_s=download_link&t_ts=1742838506	HTTP Parser: No favicon
Source: https://citationcanada.wetransfer.com/downloads/d46d3e193e4b493c263d86f386640d0120250324174826/b5a87d?t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&t_s=download_link&t_ts=1742838506	HTTP Parser: No favicon
Source: https://citationcanada.wetransfer.com/downloads/d46d3e193e4b493c263d86f386640d0120250324174826/b5a87d?t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&t_s=download_link&t_ts=1742838506	HTTP Parser: No favicon
Source: https://citationcanada.wetransfer.com/downloads/d46d3e193e4b493c263d86f386640d0120250324174826/b5a87d?t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&t_s=download_link&t_ts=1742838506	HTTP Parser: No favicon
Source: https://citationcanada.wetransfer.com/downloads/d46d3e193e4b493c263d86f386640d0120250324174826/b5a87d?t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&t_s=download_link&t_ts=1742838506	HTTP Parser: No favicon
Source: https://citationcanada.wetransfer.com/downloads/d46d3e193e4b493c263d86f386640d0120250324174826/b5a87d?t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&t_s=download_link&t_ts=1742838506	HTTP Parser: No favicon
Source: https://citationcanada.wetransfer.com/	HTTP Parser: No favicon
Source: https://citationcanada.wetransfer.com/	HTTP Parser: No favicon
Source: https://citationcanada.wetransfer.com/	HTTP Parser: No favicon
Source: https://citationcanada.wetransfer.com/	HTTP Parser: No favicon
Source: https://citationcanada.wetransfer.com/pricing?trk=WT202005_signup	HTTP Parser: No favicon
Source: https://citationcanada.wetransfer.com/checkout?tier=ultimate&billing=monthly&redirect=transfer&lsid=2cc80a21-5f6c-497a-a888-e2d575bf6ef7&t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_s=download_link&t_ts=1742838506&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&paywall=pricing_page&trigger=download_page_opened	HTTP Parser: No favicon
Source: https://citationcanada.wetransfer.com/checkout?tier=ultimate&billing=monthly&redirect=transfer&lsid=2cc80a21-5f6c-497a-a888-e2d575bf6ef7&t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_s=download_link&t_ts=1742838506&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&paywall=pricing_page&trigger=download_page_opened	HTTP Parser: No favicon
Source: https://citationcanada.wetransfer.com/checkout?tier=ultimate&billing=monthly&redirect=transfer&lsid=2cc80a21-5f6c-497a-a888-e2d575bf6ef7&t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_s=download_link&t_ts=1742838506&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&paywall=pricing_page&trigger=download_page_opened	HTTP Parser: No favicon
Source: https://citationcanada.wetransfer.com/checkout?tier=ultimate&billing=monthly&redirect=transfer&lsid=2cc80a21-5f6c-497a-a888-e2d575bf6ef7&t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_s=download_link&t_ts=1742838506&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&paywall=pricing_page&trigger=download_page_opened	HTTP Parser: No favicon
Source: https://citationcanada.wetransfer.com/checkout?tier=ultimate&billing=monthly&redirect=transfer&lsid=2cc80a21-5f6c-497a-a888-e2d575bf6ef7&t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_s=download_link&t_ts=1742838506&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&paywall=pricing_page&trigger=download_page_opened	HTTP Parser: No favicon
Source: https://citationcanada.wetransfer.com/checkout?tier=ultimate&billing=monthly&redirect=transfer&lsid=2cc80a21-5f6c-497a-a888-e2d575bf6ef7&t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_s=download_link&t_ts=1742838506&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&paywall=pricing_page&trigger=download_page_opened	HTTP Parser: No favicon
Source: https://citationcanada.wetransfer.com/checkout?tier=ultimate&billing=monthly&redirect=transfer&lsid=2cc80a21-5f6c-497a-a888-e2d575bf6ef7&t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_s=download_link&t_ts=1742838506&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&paywall=pricing_page&trigger=download_page_opened	HTTP Parser: No favicon
Source: https://citationcanada.wetransfer.com/checkout?tier=ultimate&billing=monthly&redirect=transfer&lsid=2cc80a21-5f6c-497a-a888-e2d575bf6ef7&t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_s=download_link&t_ts=1742838506&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&paywall=pricing_page&trigger=download_page_opened	HTTP Parser: No favicon
Source: https://citationcanada.wetransfer.com/checkout?tier=ultimate&billing=monthly&redirect=transfer&lsid=2cc80a21-5f6c-497a-a888-e2d575bf6ef7&t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_s=download_link&t_ts=1742838506&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&paywall=pricing_page&trigger=download_page_opened	HTTP Parser: No favicon
Source: https://citationcanada.wetransfer.com/checkout?tier=ultimate&billing=monthly&redirect=transfer&lsid=2cc80a21-5f6c-497a-a888-e2d575bf6ef7&t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_s=download_link&t_ts=1742838506&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&paywall=pricing_page&trigger=download_page_opened	HTTP Parser: No favicon

HTTP Parser: No <meta name="author".. found

Source: https://citationcanada.wetransfer.com/checkout?tier=ultimate&billing=monthly&redirect=transfer&lsid=2cc80a21-5f6c-497a-a888-e2d575bf6ef7&t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_s=download_link&t_ts=1742838506&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&paywall=pricing_page&trigger=download_page_opened	HTTP Parser: No <meta name="copyright".. found
Source: https://citationcanada.wetransfer.com/checkout?tier=ultimate&billing=monthly&redirect=transfer&lsid=2cc80a21-5f6c-497a-a888-e2d575bf6ef7&t_exp=1743097706&t_lsid=12ca2034-7cbb-4ac5-955e-0f7cc123da61&t_network=link&t_s=download_link&t_ts=1742838506&t_rid=YXV0aDB8Njc2NDhiMmE1YmJiMjRkNWY2MzQ1MjUy&paywall=pricing_page&trigger=download_page_opened	HTTP Parser: No <meta name="copyright".. found

System Summary

Downloads suspicious files via Chrome

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File dump: C:\Users\user\Downloads\AODA Customer Service Standards Training (Comprehensive Content) 1_2 C_I.zip (copy)

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir6380_746250361

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir6380_746250361

Jump to behavior

Source: classification engine

Classification label: mal52.phis.win@48/2@0/96

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\ac9c96bf-49f5-4d16-ac05-c1fe43aa17da.tmp

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2120,i,200407010641660730,7757674318590756446,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2156 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2120,i,200407010641660730,7757674318590756446,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3740 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://we.tl/t-J9PcqXV8XE"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-pre-read-main-dll --field-trial-handle=2120,i,200407010641660730,7757674318590756446,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=6008 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2120,i,200407010641660730,7757674318590756446,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2156 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2120,i,200407010641660730,7757674318590756446,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3740 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-pre-read-main-dll --field-trial-handle=2120,i,200407010641660730,7757674318590756446,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=6008 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	Path Interception	1 Process Injection	11 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://we.tl/t-J9PcqXV8XE	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
https://citationcanada.wetransfer.com/	false		unknown
https://citationcanada.wetransfer.com/pricing?trk=WT202005_signup	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.85.61.36	unknown	United States	16509	AMAZON-02US	false
151.101.0.84	unknown	United States	54113	FASTLYUS	false
104.18.187.31	unknown	United States	13335	CLOUDFLARENETUS	false
151.101.0.176	unknown	United States	54113	FASTLYUS	false
34.247.143.102	unknown	United States	16509	AMAZON-02US	false
13.226.94.5	unknown	United States	16509	AMAZON-02US	false
3.168.73.45	unknown	United States	16509	AMAZON-02US	false
108.139.47.48	unknown	United States	16509	AMAZON-02US	false
157.240.241.35	unknown	United States	32934	FACEBOOKUS	false
18.238.49.31	unknown	United States	16509	AMAZON-02US	false
151.101.128.84	unknown	United States	54113	FASTLYUS	false
34.204.109.15	unknown	United States	14618	AMAZON-AESUS	false
108.138.112.90	unknown	United States	16509	AMAZON-02US	false
98.82.157.137	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
52.212.235.241	unknown	United States	16509	AMAZON-02US	false
8.28.7.83	unknown	United States	62713	AS-PUBMATICUS	false
142.250.65.238	unknown	United States	15169	GOOGLEUS	false
142.250.80.3	unknown	United States	15169	GOOGLEUS	false
63.32.252.54	unknown	United States	16509	AMAZON-02US	false
69.173.146.5	unknown	United States	26667	RUBICONPROJECTUS	false
142.251.40.130	unknown	United States	15169	GOOGLEUS	false
104.19.230.21	unknown	United States	13335	CLOUDFLARENETUS	false
108.139.29.62	unknown	United States	16509	AMAZON-02US	false
157.240.241.1	unknown	United States	32934	FACEBOOKUS	false
23.40.179.166	unknown	United States	16625	AKAMAI-ASUS	false
18.238.49.111	unknown	United States	16509	AMAZON-02US	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
108.139.33.128	unknown	United States	16509	AMAZON-02US	false
3.33.220.150	unknown	United States	8987	AMAZONEXPANSIONGB	false
108.138.128.52	unknown	United States	16509	AMAZON-02US	false
142.250.80.38	unknown	United States	15169	GOOGLEUS	false
52.54.252.87	unknown	United States	14618	AMAZON-AESUS	false
50.19.26.15	unknown	United States	14618	AMAZON-AESUS	false
13.35.93.22	unknown	United States	16509	AMAZON-02US	false
54.149.209.136	unknown	United States	16509	AMAZON-02US	false
18.173.132.73	unknown	United States	3	MIT-GATEWAYSUS	false
54.186.23.98	unknown	United States	16509	AMAZON-02US	false
142.250.80.78	unknown	United States	15169	GOOGLEUS	false
151.101.128.176	unknown	United States	54113	FASTLYUS	false
142.251.40.100	unknown	United States	15169	GOOGLEUS	false
31.13.71.7	unknown	Ireland	32934	FACEBOOKUS	false
52.85.61.6	unknown	United States	16509	AMAZON-02US	false
52.92.32.66	unknown	United States	16509	AMAZON-02US	false
108.138.128.109	unknown	United States	16509	AMAZON-02US	false
13.35.93.6	unknown	United States	16509	AMAZON-02US	false
52.223.40.198	unknown	United States	8987	AMAZONEXPANSIONGB	false
68.67.160.132	unknown	United States	29990	ASN-APPNEXUS	false
142.251.41.2	unknown	United States	15169	GOOGLEUS	false
13.226.94.102	unknown	United States	16509	AMAZON-02US	false
142.250.65.202	unknown	United States	15169	GOOGLEUS	false
52.85.61.109	unknown	United States	16509	AMAZON-02US	false
44.242.25.221	unknown	United States	16509	AMAZON-02US	false
151.101.64.84	unknown	United States	54113	FASTLYUS	false
3.5.69.108	unknown	United States	14618	AMAZON-AESUS	false
142.250.80.42	unknown	United States	15169	GOOGLEUS	false
18.173.132.44	unknown	United States	3	MIT-GATEWAYSUS	false
54.187.119.242	unknown	United States	16509	AMAZON-02US	false
150.171.28.10	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.40.195	unknown	United States	15169	GOOGLEUS	false
35.211.202.130	unknown	United States	19527	GOOGLE-2US	false
142.250.64.70	unknown	United States	15169	GOOGLEUS	false
3.248.168.38	unknown	United States	16509	AMAZON-02US	false
108.138.128.3	unknown	United States	16509	AMAZON-02US	false
98.82.154.76	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
64.233.180.84	unknown	United States	15169	GOOGLEUS	false
57.144.180.1	unknown	Belgium	2686	ATGS-MMD-ASUS	false
13.35.93.41	unknown	United States	16509	AMAZON-02US	false
142.250.176.196	unknown	United States	15169	GOOGLEUS	false
52.85.61.89	unknown	United States	16509	AMAZON-02US	false
18.173.132.17	unknown	United States	3	MIT-GATEWAYSUS	false
142.250.65.194	unknown	United States	15169	GOOGLEUS	false
13.35.93.103	unknown	United States	16509	AMAZON-02US	false
54.187.159.182	unknown	United States	16509	AMAZON-02US	false
34.49.212.111	unknown	United States	2686	ATGS-MMD-ASUS	false
104.18.26.193	unknown	United States	13335	CLOUDFLARENETUS	false
13.226.94.53	unknown	United States	16509	AMAZON-02US	false
3.168.73.76	unknown	United States	16509	AMAZON-02US	false
142.250.81.227	unknown	United States	15169	GOOGLEUS	false
54.163.195.10	unknown	United States	14618	AMAZON-AESUS	false
150.171.27.10	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.226.94.19	unknown	United States	16509	AMAZON-02US	false
142.250.65.228	unknown	United States	15169	GOOGLEUS	false
104.19.229.21	unknown	United States	13335	CLOUDFLARENETUS	false
142.251.40.98	unknown	United States	15169	GOOGLEUS	false
3.171.139.107	unknown	United States	16509	AMAZON-02US	false
142.251.35.168	unknown	United States	15169	GOOGLEUS	false
23.44.136.168	unknown	United States	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.8
192.168.2.7
192.168.2.4
192.168.2.5
192.168.2.24
192.168.2.23
192.168.2.13
192.168.2.15
192.168.2.14

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1648041
Start date and time:	2025-03-25 14:04:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://we.tl/t-J9PcqXV8XE
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Detection:	MAL
Classification:	mal52.phis.win@48/2@0/96
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): MpCmdRun.exe, UserOOBEBroker.exe, RuntimeBroker.exe, SIHClient.exe, backgroundTaskHost.exe, audiodg.exe, sppsvc.exe, BackgroundTransferHost.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Skipping network analysis since amount of network traffic is too extensive
VT rate limit hit for: https://we.tl/t-J9PcqXV8XE

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	140200342
Entropy (8bit):	7.999460687899636
Encrypted:	true
SSDEEP:
MD5:	2CE2207EE9E5356B3979C7913D56004E
SHA1:	6B43E75A1AE84238902778FE790FBC9B5416F87D
SHA-256:	709F2E89B727095C6805764871FCDDFF936CC5C6CB6B5275895A87257AE0EDA0
SHA-512:	B8028B61E736F9BC25FD25433B00DC36D3F919B8D48945782F08B1EE8F50491982372CB6D812F626B61CEB6C735499DE0A6B21D9E17E89B1C3B6F5694F75FFB5
Malicious:	true
Reputation:	low
Preview:	PK.........hxZ...F...........story_content/thumbnail.jpg..WX._....BG `."%@......&..H.(.I...Mz.P@ .. .E...H......f.d.ff=G...........w.p..............2@.@NF."#%..@....`.j*j..F:0.+.'.+;;7...7...;...........RP.K+I....g. ...5.5..."...#.............y.D.@bz..A....$../..o........)(...h.. ................ .'e..R'c4...z...RK..4...P.....z.SP2........@a.r.p......ut..&h................_?.................leU5...............a<adtfv......o..[.;.......<;...u......b..i..\....HH.I@...$.....$.<Rd... ./F^.0r.FjiS?....?&[.iJf~.7............"....o.%.51......T.%h........P...&T..i..8..2).^.0x..cMu:U.C..\.h.....9l.@...4..M.2a.S.np9O..G[..&B.$.2.\f..ajRZ.......,W..K...m..f`....^......."..}.7.}g\...L..S....3+)..4j..W&.....=p...2h[.Tr... ..\x.....]....{.[.\|._ku...u...../?d......=].n......$....JT....3...M%8....>9......{o.+Nf~Z..B...:.1d.D..b<A....tS.\...G/.@..1.+z..t4.....0.-R./D...}(....es?(.....I.q...z}....*..r..o.p.S...'..g.k.._._..u. .WkQ.N...v/...}.].%....F..-1..\|ZJ.3.

C:\Users\user\Downloads\AODA Customer Service Standards Training (Comprehensive Content) 1_2 C_I.zip.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	140200342
Entropy (8bit):	7.999460687899636
Encrypted:	true
SSDEEP:
MD5:	2CE2207EE9E5356B3979C7913D56004E
SHA1:	6B43E75A1AE84238902778FE790FBC9B5416F87D
SHA-256:	709F2E89B727095C6805764871FCDDFF936CC5C6CB6B5275895A87257AE0EDA0
SHA-512:	B8028B61E736F9BC25FD25433B00DC36D3F919B8D48945782F08B1EE8F50491982372CB6D812F626B61CEB6C735499DE0A6B21D9E17E89B1C3B6F5694F75FFB5
Malicious:	false
Reputation:	low
Preview:	PK.........hxZ...F...........story_content/thumbnail.jpg..WX._....BG `."%@......&..H.(.I...Mz.P@ .. .E...H......f.d.ff=G...........w.p..............2@.@NF."#%..@....`.j*j..F:0.+.'.+;;7...7...;...........RP.K+I....g. ...5.5..."...#.............y.D.@bz..A....$../..o........)(...h.. ................ .'e..R'c4...z...RK..4...P.....z.SP2........@a.r.p......ut..&h................_?.................leU5...............a<adtfv......o..[.;.......<;...u......b..i..\....HH.I@...$.....$.<Rd... ./F^.0r.FjiS?....?&[.iJf~.7............"....o.%.51......T.%h........P...&T..i..8..2).^.0x..cMu:U.C..\.h.....9l.@...4..M.2a.S.np9O..G[..&B.$.2.\f..ajRZ.......,W..K...m..f`....^......."..}.7.}g\...L..S....3+)..4j..W&.....=p...2h[.Tr... ..\x.....]....{.[.\|._ku...u...../?d......=].n......$....JT....3...M%8....>9......{o.+Nf~Z..B...:.1d.D..b<A....tS.\...G/.@..1.+z..t4.....0.-R./D...}(....es?(.....I.q...z}....*..r..o.p.S...'..g.k.._._..u. .WkQ.N...v/...}.].%....F..-1..\|ZJ.3.

Static File Info

⊘No static file info

File Icon


Icon Hash:	00b29a8e86828200

• chrome.exe
• chrome.exe
• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Memory Usage

• chrome.exe
• chrome.exe
• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Click to jump to process

Target ID:	1
Start time:	09:05:34
Start date:	25/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff6ea470000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	09:05:39
Start date:	25/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2120,i,200407010641660730,7757674318590756446,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2156 /prefetch:3
Imagebase:	0x7ff6ea470000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	09:05:42
Start date:	25/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2120,i,200407010641660730,7757674318590756446,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=3740 /prefetch:8
Imagebase:	0x7ff6ea470000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	09:05:45
Start date:	25/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://we.tl/t-J9PcqXV8XE"
Imagebase:	0x7ff6ea470000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	09:06:30
Start date:	25/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-pre-read-main-dll --field-trial-handle=2120,i,200407010641660730,7757674318590756446,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=6008 /prefetch:8
Imagebase:	0x7ff6ea470000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://we.tl/t-J9PcqXV8XE

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Downloads\AODA Customer Service Standards Training (Comprehensive Content) 1_2 C_I.zip (copy)

C:\Users\user\Downloads\AODA Customer Service Standards Training (Comprehensive Content) 1_2 C_I.zip.crdownload

Static File Info

File Icon

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 6380, Parent PID: 1704

General

File Activities

File Opened

File Created

File Deleted

File Moved

Other File Operations

Registry Activities

Key Deleted

Key Value Deleted

COM Activities

WMI Operations

Process Activities

Process Created

Process Terminated

Thread Activities

Thread Terminated

Memory Activities

Memory Usage Statistics

Timing Activities

Timer set

Windows Analysis Report
https://we.tl/t-J9PcqXV8XE