Create Interactive Tour

Windows Analysis Report
http://lb.eu-1-id5-sync.com

Overview

General Information

Sample URL:	http://lb.eu-1-id5-sync.com
Analysis ID:	689308
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5912 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 6268 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1956 --field-trial-handle=1772,i,9005736120201163710,3359527925968780076,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 6804 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 --field-trial-handle=1772,i,9005736120201163710,3359527925968780076,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 6008 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6128 --field-trial-handle=1772,i,9005736120201163710,3359527925968780076,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 6840 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3748 --field-trial-handle=1772,i,9005736120201163710,3359527925968780076,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 6844 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4168 --field-trial-handle=1772,i,9005736120201163710,3359527925968780076,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 5652 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3812 --field-trial-handle=1772,i,9005736120201163710,3359527925968780076,131072 /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 6500 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "http://lb.eu-1-id5-sync.com MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

cleanup

Joe Sandbox Signatures

• Networking
• System Summary
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: lb.eu-1-id5-sync.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: accounts.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: manifest.json.1.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 8746a223-3c91-4c67-86f2-59ad062d5a1b_Zone.Identifier.9.dr	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1660568498583&target=OPTIMIZATION_TARGET_
Source: manifest.json.1.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: manifest.json.1.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: manifest.json.1.dr	String found in binary or memory: https://www.google.com/
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.1.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox

Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170
Source: unknown	UDP traffic detected without corresponding DNS query: 142.250.180.170

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\6e8a7542-8e34-4205-9545-9afd94e5f0bb.tmp

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor

Source: classification engine

Classification label: clean0.win@36/116@8/10

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1956 --field-trial-handle=1772,i,9005736120201163710,3359527925968780076,131072 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "http://lb.eu-1-id5-sync.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 --field-trial-handle=1772,i,9005736120201163710,3359527925968780076,131072 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6128 --field-trial-handle=1772,i,9005736120201163710,3359527925968780076,131072 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3748 --field-trial-handle=1772,i,9005736120201163710,3359527925968780076,131072 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4168 --field-trial-handle=1772,i,9005736120201163710,3359527925968780076,131072 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3812 --field-trial-handle=1772,i,9005736120201163710,3359527925968780076,131072 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1956 --field-trial-handle=1772,i,9005736120201163710,3359527925968780076,131072 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 --field-trial-handle=1772,i,9005736120201163710,3359527925968780076,131072 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6128 --field-trial-handle=1772,i,9005736120201163710,3359527925968780076,131072 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3748 --field-trial-handle=1772,i,9005736120201163710,3359527925968780076,131072 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4168 --field-trial-handle=1772,i,9005736120201163710,3359527925968780076,131072 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3812 --field-trial-handle=1772,i,9005736120201163710,3359527925968780076,131072 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-63064F80-1718.pma

Jump to behavior

Source: global-entities_metadata.1.dr	Binary or memory string: VMware
Source: global-entities_metadata.1.dr	Binary or memory string: VMware vSphere
Source: global-entities_metadata.1.dr	Binary or memory string: VMware Horizon

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	2 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://lb.eu-1-id5-sync.com	0%	Virustotal		Browse
http://lb.eu-1-id5-sync.com	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label	Link
http://lb.eu-1-id5-sync.com/	0%	Virustotal		Browse
http://lb.eu-1-id5-sync.com/	0%	Avira URL Cloud	safe
https://lb.eu-1-id5-sync.com/	0%	Virustotal		Browse

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
accounts.google.com	142.250.180.141	true	false	high
www.google.com	142.251.209.4	true	false	high
lb.eu-1-id5-sync.com	162.19.138.119	true	false	unknown
clients.l.google.com	216.58.209.46	true	false	high
dns.google	8.8.4.4	true	false	unknown
clients2.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://lb.eu-1-id5-sync.com/	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://lb.eu-1-id5-sync.com/	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://sandbox.google.com/payments/v4/js/integrator.js	manifest.json.1.dr	false	high
https://www.google.com/	manifest.json.1.dr	false	high
https://payments.google.com/payments/v4/js/integrator.js	manifest.json.1.dr	false	high
https://clients2.google.com/service/update2/crx	manifest.json.1.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.251.209.4	www.google.com	United States	15169	GOOGLEUS	false
8.8.4.4	dns.google	United States	15169	GOOGLEUS	false
216.58.209.46	clients.l.google.com	United States	15169	GOOGLEUS	false
142.250.180.170	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
162.19.138.119	lb.eu-1-id5-sync.com	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
142.250.180.141	accounts.google.com	United States	15169	GOOGLEUS	false
162.19.138.118	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	689308
Start date and time:	2022-08-24 09:18:10 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://lb.eu-1-id5-sync.com
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@36/116@8/10
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.209.3, 142.250.184.78, 172.217.132.166, 80.67.82.211, 80.67.82.235
Excluded domains from analysis (whitelisted): r1.sn-5hne6nzy.gvt1.com, client.wns.windows.com, r1---sn-5hne6nzy.gvt1.com, fs.microsoft.com, redirector.gvt1.com, ctldl.windowsupdate.com, clientservices.googleapis.com, img-prod-cms-rt-microsoft-com.akamaized.net, a1449.dscg2.akamai.net, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	118518
Entropy (8bit):	6.048840444485439
Encrypted:	false
SSDEEP:	3072:CVEbHYUu3H25N5Ug4711NyBTOgd0HhmAnhqj3F:bkXH25N5jEXNyTOpBmAh4F
MD5:	8A6829DDC5DF2FB3AD1FD24B8D3F51A0
SHA1:	9E6601E70141B5727F1FE7E6EF549EA268E54853
SHA-256:	0E32A0509B796389850B3F3EAF61E2E1328CFA0C993CFF77D7AD2B80DC67EEF5
SHA-512:	40B7669F89296A3E53F3235E5E600BB9BF908CDEBE0957717C6FAE443A3A8B0063D4EA42E3525CE2446622BF9C80A5E4E16418072C757E55BDC7C329B0A8F105
Malicious:	false
Reputation:	low
Preview:	{"browser":{"last_redirect_origin":"","last_whats_new_version":104,"shortcut_migration_version":"104.0.5112.81"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"invalidation":{"per_sender_topics_to_handler":{}},"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"network_time":{"network_time_mapping":{"local":1.66135795608316e+12,"network":1.661325558e+12,"ticks":126055310.0,"uncertainty":3862736.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACMBYze0bKMTIhZGR/AW4M5AAAAAAIAAAAAABBmAAAAAQAAIAAAACoSPhbyumSaNjLuAHEna2OUDn+rpXOk+H/ONjHe5ZwbAAAAAA6AAAAAAgAAIAAAADezR1ii2QiPYGPz0Jd0ZQiE5jKOKMttbbwwADHJYDpEMAAAACuIP4EJtfud3aEFZzvijkFSTP1RNwcy8fFg19xXfiV1Q9wriZb5iS+jYbOXKVX44kAAAAByJv8rXU2wt9ZoSemiGl7Rv1MeHwgrJRvbYcUfMpjLAz2bh77nWHOppVpZzR2K2uw89vs6aWrPX

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 24, 2022 09:19:17.217854023 CEST	192.168.2.6	8.8.8.8	0x27e9	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)
Aug 24, 2022 09:19:17.220824957 CEST	192.168.2.6	8.8.8.8	0xe1ed	Standard query (0)	lb.eu-1-id5-sync.com	A (IP address)	IN (0x0001)
Aug 24, 2022 09:19:17.223542929 CEST	192.168.2.6	8.8.8.8	0x865f	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)
Aug 24, 2022 09:19:17.510485888 CEST	192.168.2.6	8.8.8.8	0xcc7e	Standard query (0)	lb.eu-1-id5-sync.com	A (IP address)	IN (0x0001)
Aug 24, 2022 09:19:19.718051910 CEST	192.168.2.6	8.8.8.8	0xa938	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Aug 24, 2022 09:19:19.831371069 CEST	192.168.2.6	8.8.8.8	0xa544	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Aug 24, 2022 09:19:20.243112087 CEST	192.168.2.6	8.8.8.8	0xe79e	Standard query (0)	dns.google	A (IP address)	IN (0x0001)
Aug 24, 2022 09:20:11.121773005 CEST	192.168.2.6	8.8.8.8	0x97e6	Standard query (0)	dns.google	A (IP address)	IN (0x0001)

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Aug 24, 2022 09:19:17.242827892 CEST	8.8.8.8	192.168.2.6	0xe1ed	No error (0)	lb.eu-1-id5-sync.com		162.19.138.119	A (IP address)	IN (0x0001)
Aug 24, 2022 09:19:17.242827892 CEST	8.8.8.8	192.168.2.6	0xe1ed	No error (0)	lb.eu-1-id5-sync.com		141.95.33.111	A (IP address)	IN (0x0001)
Aug 24, 2022 09:19:17.242827892 CEST	8.8.8.8	192.168.2.6	0xe1ed	No error (0)	lb.eu-1-id5-sync.com		162.19.138.118	A (IP address)	IN (0x0001)
Aug 24, 2022 09:19:17.242827892 CEST	8.8.8.8	192.168.2.6	0xe1ed	No error (0)	lb.eu-1-id5-sync.com		162.19.138.120	A (IP address)	IN (0x0001)
Aug 24, 2022 09:19:17.245153904 CEST	8.8.8.8	192.168.2.6	0x27e9	No error (0)	accounts.google.com		142.250.180.141	A (IP address)	IN (0x0001)
Aug 24, 2022 09:19:17.263796091 CEST	8.8.8.8	192.168.2.6	0x865f	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)
Aug 24, 2022 09:19:17.263796091 CEST	8.8.8.8	192.168.2.6	0x865f	No error (0)	clients.l.google.com		216.58.209.46	A (IP address)	IN (0x0001)
Aug 24, 2022 09:19:17.531680107 CEST	8.8.8.8	192.168.2.6	0xcc7e	No error (0)	lb.eu-1-id5-sync.com		162.19.138.118	A (IP address)	IN (0x0001)
Aug 24, 2022 09:19:17.531680107 CEST	8.8.8.8	192.168.2.6	0xcc7e	No error (0)	lb.eu-1-id5-sync.com		162.19.138.120	A (IP address)	IN (0x0001)
Aug 24, 2022 09:19:17.531680107 CEST	8.8.8.8	192.168.2.6	0xcc7e	No error (0)	lb.eu-1-id5-sync.com		162.19.138.119	A (IP address)	IN (0x0001)
Aug 24, 2022 09:19:17.531680107 CEST	8.8.8.8	192.168.2.6	0xcc7e	No error (0)	lb.eu-1-id5-sync.com		141.95.33.111	A (IP address)	IN (0x0001)
Aug 24, 2022 09:19:19.735579014 CEST	8.8.8.8	192.168.2.6	0xa938	No error (0)	www.google.com		142.251.209.4	A (IP address)	IN (0x0001)
Aug 24, 2022 09:19:19.859287024 CEST	8.8.8.8	192.168.2.6	0xa544	No error (0)	www.google.com		142.251.209.4	A (IP address)	IN (0x0001)
Aug 24, 2022 09:19:20.261663914 CEST	8.8.8.8	192.168.2.6	0xe79e	No error (0)	dns.google		8.8.4.4	A (IP address)	IN (0x0001)
Aug 24, 2022 09:19:20.261663914 CEST	8.8.8.8	192.168.2.6	0xe79e	No error (0)	dns.google		8.8.8.8	A (IP address)	IN (0x0001)
Aug 24, 2022 09:20:11.144452095 CEST	8.8.8.8	192.168.2.6	0x97e6	No error (0)	dns.google		8.8.4.4	A (IP address)	IN (0x0001)
Aug 24, 2022 09:20:11.144452095 CEST	8.8.8.8	192.168.2.6	0x97e6	No error (0)	dns.google		8.8.8.8	A (IP address)	IN (0x0001)

Target ID:	1
Start time:	09:19:11
Start date:	24/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff6f9750000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	3
Start time:	09:19:13
Start date:	24/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1956 --field-trial-handle=1772,i,9005736120201163710,3359527925968780076,131072 /prefetch:8
Imagebase:	0x7ff6f9750000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	4
Start time:	09:19:14
Start date:	24/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "http://lb.eu-1-id5-sync.com
Imagebase:	0x7ff6f9750000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	5
Start time:	09:19:20
Start date:	24/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 --field-trial-handle=1772,i,9005736120201163710,3359527925968780076,131072 /prefetch:8
Imagebase:	0x7ff6f9750000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	9
Start time:	09:19:32
Start date:	24/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6128 --field-trial-handle=1772,i,9005736120201163710,3359527925968780076,131072 /prefetch:8
Imagebase:	0x7ff6f9750000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	10
Start time:	09:19:40
Start date:	24/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3748 --field-trial-handle=1772,i,9005736120201163710,3359527925968780076,131072 /prefetch:8
Imagebase:	0x7ff6f9750000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	13
Start time:	09:19:43
Start date:	24/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4168 --field-trial-handle=1772,i,9005736120201163710,3359527925968780076,131072 /prefetch:8
Imagebase:	0x7ff6f9750000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	14
Start time:	09:19:47
Start date:	24/08/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3812 --field-trial-handle=1772,i,9005736120201163710,3359527925968780076,131072 /prefetch:8
Imagebase:	0x7ff6f9750000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	94076
Entropy (8bit):	3.7442695945770685
Encrypted:	false
SSDEEP:	384:EK2OPxF6C8aFDc7+jRNyrHvmu31+UpHk9Gpwr7oyuDxzX/oLrzq0xLYSW+1OQUGC:Z2ObGphij9SQe8X3j2OKEOWwt
MD5:	7C9A462F5B08F60693A7CC385AE05CF1
SHA1:	648CFE9203DE2DAB604EF106F57038D97C8A6F25
SHA-256:	5FC786B2BE2EE81A8D57C23DE2B7E8870FD21146881280C4173E6192C6228A04
SHA-512:	A4AA45D7566798F6E86E2681F40A6CAA9665EE8F56E62C44680D9F3E0C053A43CBB68C0DC2C84ED32305D74A9C272F37E6D7AE4BF83F20CFB33974558B3F71E5
Malicious:	false
Reputation:	low
Preview:	xo.................C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....e8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://lb.eu-1-id5-sync.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Networking

System Summary

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Google\Chrome\User Data\6b5da058-3fe2-463b-bab3-84c4c3f189cb.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\6ba86e94-9b13-4259-94da-58790bb015d2.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\747ff967-00fe-4a57-b48f-ea21d9b548a7.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\375a53f8-d98c-4137-ab37-93e0c0369932.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\3792bec3-76c6-4299-9a16-27cb015fbaa1.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\40fcc12f-47a2-4712-94b9-bc7bcf4851ab.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\5ab3fa7f-df3a-4f7a-9fe7-70d3b623481e.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\9e06a448-7a84-4b62-9f95-e0bcd27014e2.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files\2314ecaf-1d09-479b-abd7-af99bbfedfde

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files\2314ecaf-1d09-479b-abd7-af99bbfedfde:Zone.Identifier

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files\25448501-9388-49ed-94cf-5f6efe9fa936

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files\25448501-9388-49ed-94cf-5f6efe9fa936:Zone.Identifier

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files\8746a223-3c91-4c67-86f2-59ad062d5a1b

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files\8746a223-3c91-4c67-86f2-59ad062d5a1b:Zone.Identifier

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files\da6f59d6-a9a1-4014-8c68-f6b4dc284f04

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files\da6f59d6-a9a1-4014-8c68-f6b4dc284f04:Zone.Identifier

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\08052193-1359-4023-89a5-946efae12fb0.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\333df6c5-4f35-4e5e-968b-b79c48db1bd3.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Trusted Vault (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\c31d1e8b-b589-4b66-9e41-3b2883d6705b.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\edda8218-665c-470c-887d-76cad2c50a82.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\06e7a940-e212-406d-aa99-7ccd35735ec2\model.tflite (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\3e185f46-06a1-4228-aab2-298e5d198a57\model.tflite (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\eea84894-dbd9-462d-a437-d00f0d65e414\model.tflite (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\f1e26334-f59a-4a0a-9934-c61c930fda49\global-entities_metadata (copy)

Windows Analysis Report
http://lb.eu-1-id5-sync.com