Joe Sandbox Cloud Basic Analysis Report
Edit tour

Windows Analysis Report
http://www.tobramedical.com

Overview

General Information

Sample URL:http://www.tobramedical.com
Analysis ID:17679

Detection

Score:56
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

System process connects to network (likely due to code injection or exploit)
Snort IDS alert for network traffic
Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64_ra
  • chrome.exe (PID: 5720 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.tobramedical.com/ MD5: 7BC7B4AEDC055BB02BCB52710132E9E1)
    • conhost.exe (PID: 3176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: C5E9B1D1103EDCEA2E408E9497A5A88F)
    • chrome.exe (PID: 6156 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1856,i,3460433724106303124,14854753042134970485,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 7BC7B4AEDC055BB02BCB52710132E9E1)
    • chrome.exe (PID: 1868 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5988 --field-trial-handle=1856,i,3460433724106303124,14854753042134970485,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 7BC7B4AEDC055BB02BCB52710132E9E1)
  • wscript.exe (PID: 7068 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\eyup\AppData\Local\Temp\Temp1_U?dateInst?ller.zip\Version.105.5374.38.js" MD5: 563EDAE37876138FDFF47F3E7A9A78FD)
  • wscript.exe (PID: 7092 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\eyup\AppData\Local\Temp\Temp1_U?dateInst?ller.zip\Version.105.5374.38.js" MD5: 563EDAE37876138FDFF47F3E7A9A78FD)
  • cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

Timestamp:62.233.50.75192.168.2.2443498042852970 03/02/23-21:01:17.951743
SID:2852970
Source Port:443
Destination Port:49804
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:88.119.169.146192.168.2.2443498182852898 03/02/23-21:01:22.541811
SID:2852898
Source Port:443
Destination Port:49818
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.21.1.1.152968532042998 03/02/23-21:01:18.196826
SID:2042998
Source Port:52968
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:62.233.50.75192.168.2.2443498042853529 03/02/23-21:01:17.951776
SID:2853529
Source Port:443
Destination Port:49804
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.21.1.1.154552532044369 03/02/23-21:01:51.622507
SID:2044369
Source Port:54552
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.21.1.1.155981532043159 03/02/23-21:01:16.431307
SID:2043159
Source Port:55981
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.21.1.1.149378532044369 03/02/23-21:02:26.600778
SID:2044369
Source Port:49378
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected

Joe Sandbox Signatures

  • • Compliance
  • • Software Vulnerabilities
  • • Networking
  • • System Summary
  • • Hooking and other Techniques for Hiding and Protection
  • • Malware Analysis System Evasion
  • • HIPS / PFW / Operating System Protection Evasion
  • • Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\GoogleUpdater
Source: unknownHTTPS traffic detected: 193.243.147.167:443 -> 192.168.2.2:49866 version: TLS 1.2
Source: unknownHTTPS traffic detected: 193.243.147.167:443 -> 192.168.2.2:49906 version: TLS 1.2
Source: chrome.exeMemory has grown: Private usage: 1MB later: 31MB

Networking

barindex
Source: C:\Windows\System32\wscript.exeNetwork Connect: 193.243.147.167 443
Source: TrafficSnort IDS: 2852970 ETPRO TROJAN Keitaro Set-Cookie Inbound to SocGholish (fa5f0) 62.233.50.75:443 -> 192.168.2.2:49804
Source: TrafficSnort IDS: 2853529 ETPRO TROJAN SocGholish Stage 1 Connection M12 62.233.50.75:443 -> 192.168.2.2:49804
Source: TrafficSnort IDS: 2043159 ET TROJAN SocGholish Domain in DNS Lookup (kinematics .starmidwest .com) 192.168.2.2:55981 -> 1.1.1.1:53
Source: TrafficSnort IDS: 2042998 ET TROJAN SocGholish Domain in DNS Lookup (office .cdsigner .com) 192.168.2.2:52968 -> 1.1.1.1:53
Source: TrafficSnort IDS: 2852898 ETPRO TROJAN SocGholish Stage 1 Connection M11 88.119.169.146:443 -> 192.168.2.2:49818
Source: TrafficSnort IDS: 2044369 ET TROJAN SocGholish CnC Domain in DNS Lookup (* .stuff .libertydentalcourse .ca) 192.168.2.2:54552 -> 1.1.1.1:53
Source: TrafficSnort IDS: 2044369 ET TROJAN SocGholish CnC Domain in DNS Lookup (* .stuff .libertydentalcourse .ca) 192.168.2.2:49378 -> 1.1.1.1:53
Source: unknownDNS traffic detected: queries for: clients2.google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49912 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49826 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49906 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49866 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49893 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49840
Source: unknownNetwork traffic detected: HTTP traffic on port 49819 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49835
Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
Source: unknownNetwork traffic detected: HTTP traffic on port 49887 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
Source: unknownNetwork traffic detected: HTTP traffic on port 49941 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49826
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49821
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49941
Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49833 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49819
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49818
Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49815
Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49814
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49811
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49897
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49893
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49897 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49809
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49807
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49805
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49803
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49887
Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 49821 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49840 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49824 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49809 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49912
Source: unknownNetwork traffic detected: HTTP traffic on port 49818 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49835 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49906
Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49866
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 193.243.147.167
Source: unknownTCP traffic detected without corresponding DNS query: 193.243.147.167
Source: unknownTCP traffic detected without corresponding DNS query: 193.243.147.167
Source: unknownTCP traffic detected without corresponding DNS query: 193.243.147.167
Source: unknownTCP traffic detected without corresponding DNS query: 193.243.147.167
Source: unknownTCP traffic detected without corresponding DNS query: 193.243.147.167
Source: unknownTCP traffic detected without corresponding DNS query: 193.243.147.167
Source: unknownTCP traffic detected without corresponding DNS query: 193.243.147.167
Source: unknownTCP traffic detected without corresponding DNS query: 193.243.147.167
Source: unknownTCP traffic detected without corresponding DNS query: 193.243.147.167
Source: unknownTCP traffic detected without corresponding DNS query: 193.243.147.167
Source: unknownTCP traffic detected without corresponding DNS query: 193.243.147.167
Source: unknownTCP traffic detected without corresponding DNS query: 193.243.147.167
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.184.227
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.184.227
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: www.tobramedical.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: unknownHTTPS traffic detected: 193.243.147.167:443 -> 192.168.2.2:49866 version: TLS 1.2
Source: unknownHTTPS traffic detected: 193.243.147.167:443 -> 192.168.2.2:49906 version: TLS 1.2
Source: C:\Windows\System32\wscript.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: classification engineClassification label: mal56.evad.win@34/2@16/235
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.tobramedical.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1856,i,3460433724106303124,14854753042134970485,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5988 --field-trial-handle=1856,i,3460433724106303124,14854753042134970485,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1856,i,3460433724106303124,14854753042134970485,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: unknownProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\eyup\AppData\Local\Temp\Temp1_U?dateInst?ller.zip\Version.105.5374.38.js"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5988 --field-trial-handle=1856,i,3460433724106303124,14854753042134970485,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: unknownProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\eyup\AppData\Local\Temp\Temp1_U?dateInst?ller.zip\Version.105.5374.38.js"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32
Source: C:\Windows\System32\wscript.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\wscript.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\wscript.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\wscript.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Program Files\Google\GoogleUpdater
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\eyup\Downloads\2334a4b6-e909-406b-8c83-6dad3e55edc4.tmp
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exeDirectory created: C:\Program Files\Google\GoogleUpdater
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-Timer

HIPS / PFW / Operating System Protection Evasion

barindex
Source: C:\Windows\System32\wscript.exeNetwork Connect: 193.243.147.167 443
Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid Accounts1
Scripting		Path Interception11
Process Injection		3
Masquerading		OS Credential Dumping2
System Information Discovery		Remote ServicesData from Local SystemExfiltration Over Other Network Medium2
Encrypted Channel		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
Extra Window Memory Injection		11
Process Injection		LSASS Memory1
Remote System Discovery		Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth2
Non-Application Layer Protocol		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)1
Scripting		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration3
Application Layer Protocol		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)1
Extra Window Memory Injection		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled Transfer1
Ingress Tool Transfer		SIM Card SwapCarrier Billing Fraud

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
http://www.tobramedical.com0%Avira URL Cloudsafe
http://www.tobramedical.com0%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://www.tobramedical.com/0%Avira URL Cloudsafe
http://www.tobramedical.com/0%VirustotalBrowse
https://tobramedical.com/0%VirustotalBrowse

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
stats.wp.com
192.0.76.3
truefalse
    		high
    secure.gravatar.com
    		192.0.73.2
    		truefalse
      		high
      accounts.google.com
      		172.217.16.205
      		truefalse
        		high
        kinematics.starmidwest.com
        		141.255.161.75
        		truefalse
          		unknown
          office.cdsigner.com
          		88.119.169.146
          		truetrue
            		unknown
            www.tobramedical.com
            		104.21.20.139
            		truefalse
              		unknown
              youtube-ui.l.google.com
              		142.250.184.206
              		truefalse
                		high
                pixel.wp.com
                		192.0.76.3
                		truefalse
                  		high
                  lb.wordpress.com
                  		192.0.78.12
                  		truefalse
                    		high
                    www.google.com
                    		142.250.184.228
                    		truefalse
                      		high
                      clients.l.google.com
                      		142.250.184.206
                      		truefalse
                        		high
                        tobramedical.com
                        		104.21.20.139
                        		truefalse
                          		unknown
                          jqueryns.com
                          		62.233.50.75
                          		truetrue
                            		unknown
                            clients2.google.com
                            		unknown
                            		unknownfalse
                              		high
                              code.jquery.com
                              		unknown
                              		unknownfalse
                                		high
                                www.youtube.com
                                		unknown
                                		unknownfalse
                                  		high
                                  v0.wordpress.com
                                  		unknown
                                  		unknownfalse
                                    		high

                                    Contacted URLs

                                    NameMaliciousAntivirus DetectionReputation
                                    https://tobramedical.com/falseunknown
                                    data:text/html;base64,PGh0bWw+PGhlYWQ+PC9oZWFkPjxib2R5PjxzY3JpcHQgc3JjPSdodHRwczovL29mZmljZS5jZHNpZ25lci5jb20vbGJHaUdXWWxlMGlEbmxkNzVxU054bFBEa0JHZUxQekxNaDFYMFRsUDNOMCszdTg0V0E2allwU0pxQ0lkWUlxWk93cVlnVXYzRUtwbGEzQ1oyM2t2ZVE9PSc+PC9zY3JpcHQ+PC9ib2R5PjwvaHRtbD4=false
                                      		low
                                      http://www.tobramedical.com/false
                                      • 0%, Virustotal, Browse
                                      • Avira URL Cloud: safe
                                      		unknown

                                      World Map of Contacted IPs

                                      • No. of IPs < 25%
                                      • 25% < No. of IPs < 50%
                                      • 50% < No. of IPs < 75%
                                      • 75% < No. of IPs

                                      Public IPs

                                      IPDomainCountryFlagASNASN NameMalicious
                                      142.250.186.67
                                      		unknownUnited States
                                      		15169GOOGLEUSfalse
                                      34.104.35.123
                                      		unknownUnited States
                                      		15169GOOGLEUSfalse
                                      88.119.169.146
                                      		office.cdsigner.comLithuania
                                      		61272IST-ASLTtrue
                                      172.217.16.205
                                      		accounts.google.comUnited States
                                      		15169GOOGLEUSfalse
                                      193.243.147.167
                                      		unknownPoland
                                      		3246TDCSONGTele2BusinessTDCSwedenSEtrue
                                      192.0.76.3
                                      		stats.wp.comUnited States
                                      		2635AUTOMATTICUSfalse
                                      141.255.161.75
                                      		kinematics.starmidwest.comSwitzerland
                                      		51852PLI-ASCHfalse
                                      216.239.32.36
                                      		unknownUnited States
                                      		15169GOOGLEUSfalse
                                      142.250.185.227
                                      		unknownUnited States
                                      		15169GOOGLEUSfalse
                                      62.233.50.75
                                      		jqueryns.comunknown
                                      		15583DivisionWRSBEtrue
                                      69.16.175.42
                                      		unknownUnited States
                                      		20446HIGHWINDS3USfalse
                                      104.21.20.139
                                      		www.tobramedical.comUnited States
                                      		13335CLOUDFLARENETUSfalse
                                      239.255.255.250
                                      		unknownReserved
                                      		unknownunknownfalse
                                      142.251.143.35
                                      		unknownUnited States
                                      		15169GOOGLEUSfalse
                                      142.250.186.164
                                      		unknownUnited States
                                      		15169GOOGLEUSfalse
                                      172.67.192.242
                                      		unknownUnited States
                                      		13335CLOUDFLARENETUSfalse
                                      142.250.184.227
                                      		unknownUnited States
                                      		15169GOOGLEUSfalse
                                      142.250.184.206
                                      		youtube-ui.l.google.comUnited States
                                      		15169GOOGLEUSfalse
                                      142.250.186.136
                                      		unknownUnited States
                                      		15169GOOGLEUSfalse
                                      142.250.184.234
                                      		unknownUnited States
                                      		15169GOOGLEUSfalse
                                      172.217.16.142
                                      		unknownUnited States
                                      		15169GOOGLEUSfalse

                                      Private

                                      IP
                                      192.168.2.1
                                      127.0.0.1

                                      General Information

                                      Joe Sandbox Version:37.0.0 Beryl
                                      Analysis ID:17679
                                      Start date and time:2023-03-02 21:00:28 +01:00
                                      Joe Sandbox Product:CloudBasic
                                      Overall analysis duration:
                                      Hypervisor based Inspection enabled:false
                                      Report type:full
                                      Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                      Sample URL:http://www.tobramedical.com
                                      Analysis system description:Windows 10 64 bit version 1909 (MS Office 2019, IE 11, Chrome 104, Firefox 88, Adobe Reader DC 21, Java 8 u291, 7-Zip)
                                      Number of analysed new started processes analysed:16
                                      Number of new started drivers analysed:0
                                      Number of existing processes analysed:0
                                      Number of existing drivers analysed:0
                                      Number of injected processes analysed:0
                                      Technologies:
                                      • EGA enabled
                                      Analysis Mode:stream
                                      Analysis stop reason:Timeout
                                      Detection:MAL
                                      Classification:mal56.evad.win@34/2@16/235
                                      • Exclude process from analysis (whitelisted): audiodg.exe, SIHClient.exe, SgrmBroker.exe, svchost.exe
                                      • Excluded IPs from analysis (whitelisted): 20.190.159.73, 40.126.31.67, 20.190.159.71, 20.190.159.4, 20.190.159.68, 40.126.31.73, 40.126.31.69, 20.190.159.0, 142.250.186.67, 34.104.35.123, 69.16.175.42, 69.16.175.10, 172.217.16.142, 142.250.184.234, 142.250.186.99, 142.250.185.227, 142.250.184.202, 142.250.186.136, 216.239.32.36, 216.239.34.36
                                      • Excluded domains from analysis (whitelisted): cds.s5x3j6q5.hwcdn.net, fonts.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, clientservices.googleapis.com, login.msa.msidentity.com, www.tm.a.prd.aadg.trafficmanager.net, region1.google-analytics.com, prda.aadg.msidentity.com, edgedl.me.gvt1.com, login.live.com, www.googletagmanager.com, www.tm.lg.prod.aadmsa.trafficmanager.net, www.google-analytics.com
                                      • Not all processes where analyzed, report is missing behavior information
                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                      • Report size getting too big, too many NtQueryValueKey calls found.

                                      Created / dropped Files

                                      C:\Users\eyup\Downloads\2334a4b6-e909-406b-8c83-6dad3e55edc4.tmp

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                      Category:dropped
                                      Size (bytes):9678
                                      Entropy (8bit):7.972642419979499
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:D999FAA9097C1E579FB6BE6BE2C70CED
                                      SHA1:EF6DB3BDFA7421E656A0775F72AFE1C0AC9110D8
                                      SHA-256:8C82E5858B1056CE9CC68C5B057F1AC47745B6EC7C293EE45561DB262B523F6B
                                      SHA-512:92D2207F1BB0DFF1BD1A583E21537A58955125A3FC5E89DEC7272686C9E0FC7C6391D78F87BFFC3533714D9381DAE73AB3E8E45CC54B117548C71AD1CE0213C7
                                      Malicious:false
                                      Reputation:low
                                      Preview:PK..........bV..K.@%..........Version.105.5374.38.js.=kw.H...kg.......Q..L^.;v.v...Z...D@.Il.o.U.R.$....s...............+..~{....(4...jA..,..&./"hz.V...S....W..i..........o...[.......}...|.>&...j.^x\?....e|q..a..||n....../........)..V.............<...#|n..&.._...u...=....<w...).;._.....0hP.......)...........E....B:e3xq.ph...>.O... ..o.......a......v...>.G.*.lJ..v#<.d..&..f^.....#.nZ]......>.e..;h.F.f....<H..).L....^.RU..&.UFwW..h..;;.K.....\...{..S...E.j..).UE.jR...[*....?+.a...........,.&U..Ae.5..e.0.P...m.a...J(...A.Ip...c....m...HL...9.nUl;.8N7..s......n.....*.F.I..7...n0^.%.}...r1*_...(..xe...7!#..z.&....Z....!.m......K....G...4.-%.h1`..^..&..|l....?./[V%.vh3=bY..6b._...q.lKh..O..0...0.ts=. ..m...v.-[vv.k3.....f.;...Q..kqa}.....X........M...P1..P.qpp..3#....j6...6....7.Q9.d.-..NU.X..........v.)1'.....rL..l..m..@d.....-u.|].| N.!....-..<......&{.u-n f....p....4..-..,....Y.L...+.....eV&.'[....f...........m..6+..........\.m.-.

                                      C:\Users\eyup\Downloads\U@dateInst0ller.zip.crdownload (copy)

                                      Download File
                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                      File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                      Category:dropped
                                      Size (bytes):9678
                                      Entropy (8bit):7.972642419979499
                                      Encrypted:false
                                      SSDEEP:
                                      MD5:D999FAA9097C1E579FB6BE6BE2C70CED
                                      SHA1:EF6DB3BDFA7421E656A0775F72AFE1C0AC9110D8
                                      SHA-256:8C82E5858B1056CE9CC68C5B057F1AC47745B6EC7C293EE45561DB262B523F6B
                                      SHA-512:92D2207F1BB0DFF1BD1A583E21537A58955125A3FC5E89DEC7272686C9E0FC7C6391D78F87BFFC3533714D9381DAE73AB3E8E45CC54B117548C71AD1CE0213C7
                                      Malicious:false
                                      Reputation:low
                                      Preview:PK..........bV..K.@%..........Version.105.5374.38.js.=kw.H...kg.......Q..L^.;v.v...Z...D@.Il.o.U.R.$....s...............+..~{....(4...jA..,..&./"hz.V...S....W..i..........o...[.......}...|.>&...j.^x\?....e|q..a..||n....../........)..V.............<...#|n..&.._...u...=....<w...).;._.....0hP.......)...........E....B:e3xq.ph...>.O... ..o.......a......v...>.G.*.lJ..v#<.d..&..f^.....#.nZ]......>.e..;h.F.f....<H..).L....^.RU..&.UFwW..h..;;.K.....\...{..S...E.j..).UE.jR...[*....?+.a...........,.&U..Ae.5..e.0.P...m.a...J(...A.Ip...c....m...HL...9.nUl;.8N7..s......n.....*.F.I..7...n0^.%.}...r1*_...(..xe...7!#..z.&....Z....!.m......K....G...4.-%.h1`..^..&..|l....?./[V%.vh3=bY..6b._...q.lKh..O..0...0.ts=. ..m...v.-[vv.k3.....f.;...Q..kqa}.....X........M...P1..P.qpp..3#....j6...6....7.Q9.d.-..NU.X..........v.)1'.....rL..l..m..@d.....-u.|].| N.!....-..<......&{.u-n f....p....4..-..,....Y.L...+.....eV&.'[....f...........m..6+..........\.m.-.

                                      Static File Info

                                      ⊘No static file info