Edit tour

Windows Analysis Report
https://www.bing.com/ck/a?!&&p=850bd6cd427a19cdJmltdHM9MTY4NjA5NjAwMCZpZ3VpZD0xNTQ1NWMwOS1iMjE5LTYwZTEtM2RhMi00ZWNiYjNkOTYxOTEmaW5zaWQ9NTI2MQ&ptn=3&hsh=3&fclid=15455c09-b219-60e1-3da2-4ecbb3d96191&u=a1aHR0cHM6Ly9wbmNjLm9yZy5ucC9pbnRlcm5hdGlvbmFsLXBhcnRuZXJzLw#YWRvbGZvLm1vbGVyb0BqdW50YWRlYW5kYWx1Y2lh

Overview

General Information

Sample URL:	https://www.bing.com/ck/a?!&&p=850bd6cd427a19cdJmltdHM9MTY4NjA5NjAwMCZpZ3VpZD0xNTQ1NWMwOS1iMjE5LTYwZTEtM2RhMi00ZWNiYjNkOTYxOTEmaW5zaWQ9NTI2MQ&ptn=3&hsh=3&fclid=15455c09-b219-60e1-3da2-4ecbb3d96191&u=a
Analysis ID:	884722

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish10

Performs DNS queries to domains with low reputation

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 4940 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.bing.com/ck/a?!&&p=850bd6cd427a19cdJmltdHM9MTY4NjA5NjAwMCZpZ3VpZD0xNTQ1NWMwOS1iMjE5LTYwZTEtM2RhMi00ZWNiYjNkOTYxOTEmaW5zaWQ9NTI2MQ&ptn=3&hsh=3&fclid=15455c09-b219-60e1-3da2-4ecbb3d96191&u=a1aHR0cHM6Ly9wbmNjLm9yZy5ucC9pbnRlcm5hdGlvbmFsLXBhcnRuZXJzLw#YWRvbGZvLm1vbGVyb0BqdW50YWRlYW5kYWx1Y2lhLmVz MD5: 7BC7B4AEDC055BB02BCB52710132E9E1)

chrome.exe (PID: 6044 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1772,i,5036928649876551155,15814908881413374154,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 7BC7B4AEDC055BB02BCB52710132E9E1)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
1.1.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
1.2.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

Phishing

Phishing site detected (based on favicon image match)

Source: https://pncc.org.np/international-partners/#YWRvbGZvLm1vbGVyb0BqdW50YWRlYW5kYWx1Y2lhLmVz	Matcher: Template: microsoft matched with high similarity
Source: https://boomcleanfreen.xyz/org/dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095/verify?L29yZy9kZDRhYzJjMmIzYjYyNTQ1YjA0MGI4YTgxOTI0NjRiODgwM2ZkYjFhMDEwMjAxMjkwMTQzMDk1ZGQ0YWMyYzJiM2I2MjU0NWIwNDBiOGE4MTkyNDY0Yjg4MDNmZGIxYTAxMDIwMTI5MDE0MzA5NWRkNGFjMmMyYjNiNjI1NDViMDQwYjhhODE5MjQ2NGI4ODAzZmRiMWEwMTAyMDEyOTAxNDMwOTVkZDRhYzJjMmIzYjYyNTQ1YjA0MGI4YTgxOTI0NjRiODgwM2ZkYjFhMDEwMjAxMjkwMTQzMDk1L2dVTmtSeU9UT25URXJVRGVvRE9MSQ==jkwP16y7-Tz85-9SX5-fHja-asYIh0xBTVHL_sT7icEngIQfLNYrV13MGJlphzOomdbDtZK98PeHkqywSFXWu5v4xGAFqfrQgPtDJNjTv2uyKoMSHmi9V3aBEWUCXeI06lwYzZpchNAx0IUVoL7XRZ91zsavgWSupkFDd43ctOKrqj2nTJGM5mPlbHh&data=adolfo.molero%40juntadeandalucia.es	Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish10

Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 1.2.pages.csv, type: HTML

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Networking

Performs DNS queries to domains with low reputation

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: boomcleanfreen.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: boomcleanfreen.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: boomcleanfreen.xyz

Source: unknown

DNS traffic detected: queries for: accounts.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: classification engine

Classification label: mal60.phis.troj.win@25/45@14/183

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\GoogleUpdater

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.bing.com/ck/a?!&&p=850bd6cd427a19cdJmltdHM9MTY4NjA5NjAwMCZpZ3VpZD0xNTQ1NWMwOS1iMjE5LTYwZTEtM2RhMi00ZWNiYjNkOTYxOTEmaW5zaWQ9NTI2MQ&ptn=3&hsh=3&fclid=15455c09-b219-60e1-3da2-4ecbb3d96191&u=a1aHR0cHM6Ly9wbmNjLm9yZy5ucC9pbnRlcm5hdGlvbmFsLXBhcnRuZXJzLw#YWRvbGZvLm1vbGVyb0BqdW50YWRlYW5kYWx1Y2lhLmVz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1772,i,5036928649876551155,15814908881413374154,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1772,i,5036928649876551155,15814908881413374154,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	2 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://www.bing.com/ck/a?!&&p=850bd6cd427a19cdJmltdHM9MTY4NjA5NjAwMCZpZ3VpZD0xNTQ1NWMwOS1iMjE5LTYwZTEtM2RhMi00ZWNiYjNkOTYxOTEmaW5zaWQ9NTI2MQ&ptn=3&hsh=3&fclid=15455c09-b219-60e1-3da2-4ecbb3d96191&u=a1aHR0cHM6Ly9wbmNjLm9yZy5ucC9pbnRlcm5hdGlvbmFsLXBhcnRuZXJzLw#YWRvbGZvLm1vbGVyb0BqdW50YWRlYW5kYWx1Y2lhLmVz	0%	Virustotal		Browse
https://www.bing.com/ck/a?!&&p=850bd6cd427a19cdJmltdHM9MTY4NjA5NjAwMCZpZ3VpZD0xNTQ1NWMwOS1iMjE5LTYwZTEtM2RhMi00ZWNiYjNkOTYxOTEmaW5zaWQ9NTI2MQ&ptn=3&hsh=3&fclid=15455c09-b219-60e1-3da2-4ecbb3d96191&u=a1aHR0cHM6Ly9wbmNjLm9yZy5ucC9pbnRlcm5hdGlvbmFsLXBhcnRuZXJzLw#YWRvbGZvLm1vbGVyb0BqdW50YWRlYW5kYWx1Y2lhLmVz	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://pncc.org.np/international-partners/#YWRvbGZvLm1vbGVyb0BqdW50YWRlYW5kYWx1Y2lhLmVz	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cs1100.wpc.omegacdn.net	152.199.23.37	true	false	unknown
nnsiacpoi6k7cnhy84mlnwmywogpfoxc84p1i0zs.ibonus-rtfkt.com	104.21.55.241	true	false	unknown
accounts.google.com	142.250.186.77	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
www.google.com	142.250.186.132	true	false	high
pncc.org.np	23.106.120.176	true	false	unknown
clients.l.google.com	172.217.18.14	true	false	high
cs1025.wpc.upsiloncdn.net	152.199.23.72	true	false	unknown
boomcleanfreen.xyz	104.21.53.248	true	true	unknown
aadcdn.msauthimages.net	unknown	unknown	false	unknown
clients2.google.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://boomcleanfreen.xyz/org/dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095/verify?L29yZy9kZDRhYzJjMmIzYjYyNTQ1YjA0MGI4YTgxOTI0NjRiODgwM2ZkYjFhMDEwMjAxMjkwMTQzMDk1ZGQ0YWMyYzJiM2I2MjU0NWIwNDBiOGE4MTkyNDY0Yjg4MDNmZGIxYTAxMDIwMTI5MDE0MzA5NWRkNGFjMmMyYjNiNjI1NDViMDQwYjhhODE5MjQ2NGI4ODAzZmRiMWEwMTAyMDEyOTAxNDMwOTVkZDRhYzJjMmIzYjYyNTQ1YjA0MGI4YTgxOTI0NjRiODgwM2ZkYjFhMDEwMjAxMjkwMTQzMDk1L2dVTmtSeU9UT25URXJVRGVvRE9MSQ==jkwP16y7-Tz85-9SX5-fHja-asYIh0xBTVHL_sT7icEngIQfLNYrV13MGJlphzOomdbDtZK98PeHkqywSFXWu5v4xGAFqfrQgPtDJNjTv2uyKoMSHmi9V3aBEWUCXeI06lwYzZpchNAx0IUVoL7XRZ91zsavgWSupkFDd43ctOKrqj2nTJGM5mPlbHh&data=adolfo.molero%40juntadeandalucia.es	true		unknown
https://pncc.org.np/international-partners/#YWRvbGZvLm1vbGVyb0BqdW50YWRlYW5kYWx1Y2lhLmVz	true	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	unknown	United States	15169	GOOGLEUS	false
142.250.186.35	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
34.104.35.123	unknown	United States	15169	GOOGLEUS	false
152.199.23.72	cs1025.wpc.upsiloncdn.net	United States	15133	EDGECASTUS	false
104.21.55.241	nnsiacpoi6k7cnhy84mlnwmywogpfoxc84p1i0zs.ibonus-rtfkt.com	United States	13335	CLOUDFLARENETUS	false
172.217.18.14	clients.l.google.com	United States	15169	GOOGLEUS	false
104.21.53.248	boomcleanfreen.xyz	United States	13335	CLOUDFLARENETUS	true
23.106.120.176	pncc.org.np	Singapore	59253	LEASEWEB-APAC-SIN-11LeasewebAsiaPacificpteltdSG	false
142.250.185.202	unknown	United States	15169	GOOGLEUS	false
142.250.181.227	unknown	United States	15169	GOOGLEUS	false
172.67.221.31	unknown	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.100	unknown	United States	15169	GOOGLEUS	false
152.199.23.37	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
216.58.212.163	unknown	United States	15169	GOOGLEUS	false
23.53.43.123	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.186.77	accounts.google.com	United States	15169	GOOGLEUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.184.234	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	884722
Start date and time:	2023-06-09 09:06:26 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://www.bing.com/ck/a?!&&p=850bd6cd427a19cdJmltdHM9MTY4NjA5NjAwMCZpZ3VpZD0xNTQ1NWMwOS1iMjE5LTYwZTEtM2RhMi00ZWNiYjNkOTYxOTEmaW5zaWQ9NTI2MQ&ptn=3&hsh=3&fclid=15455c09-b219-60e1-3da2-4ecbb3d96191&u=a1aHR0cHM6Ly9wbmNjLm9yZy5ucC9pbnRlcm5hdGlvbmFsLXBhcnRuZXJzLw#YWRvbGZvLm1vbGVyb0BqdW50YWRlYW5kYWx1Y2lhLmVz
Analysis system description:	Windows 10 64 bit version 1909 (MS Office 2019, IE 11, Chrome 104, Firefox 88, Adobe Reader DC 21, Java 8 u291, 7-Zip)
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.troj.win@25/45@14/183

Warnings

Exclude process from analysis (whitelisted): svchost.exe, WindowsInternal.ComposableShell.Experiences.TextInput.InputApp.exe
Excluded IPs from analysis (whitelisted): 23.53.43.123, 23.53.43.162, 23.53.43.139, 23.53.43.144, 23.53.43.122, 23.53.43.146, 23.53.43.153, 23.53.43.137, 23.53.43.121, 142.250.181.227, 23.53.43.104, 23.53.43.114, 23.53.43.106, 23.53.43.98, 23.53.43.96, 23.37.226.106, 34.104.35.123, 142.250.184.234, 142.250.184.195, 216.58.212.163
Excluded domains from analysis (whitelisted): www.bing.com, fonts.googleapis.com, e86303.dscx.akamaiedge.net, www.bing.com.edgekey.net, edgedl.me.gvt1.com, login.live.com, fonts.gstatic.com, aadcdn.azureedge.net, aadcdn.ec.azureedge.net, clientservices.googleapis.com, www-www.bing.com.trafficmanager.net
Not all processes where analyzed, report is missing behavior information

Created / dropped Files

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Reputation:	low
URL:	https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	TrueType Font data, 17 tables, 1st "GDEF", 8 names, Microsoft, language 0x409, Digitized data copyright \251 2010-2011, Google Corporation.Open SansRegular1.10;1ASC;OpenSans-R
Category:	downloaded
Size (bytes):	27088
Entropy (8bit):	6.674086833825345
Encrypted:	false
SSDEEP:
MD5:	049A929C5D81988B3AE6D2F985CA7AA5
SHA1:	1116611D79F1B71936B8987BC1CA3D6DE5E99F14
SHA-256:	5669CA033AB68625C0CAE6BCF1ABB2722C02EA43A0D65323B2F7B023C7AFA35E
SHA-512:	56B8226A7FC4D1EA9C174036067A21F6DE30A90A8B986B0ED7D1A6ED1C7F53523D807E09F9F4161ED492AE1B6BEE300377B6D5BE97AEA1F292CCDBB4C4DB02C3
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/opensans/v16/mem8YaGs126MiZpBA-UFVZ0e.ttf
Preview:	............GDEF......i4....GPOS......iL....GSUB.....i\...tOS/2~]....Z....`cmap.X....Z`....cvt .M....d,....fpgm~a....[l....gasp...#..i$....glyf..]......S.head..cp..V....6hhea......Y....$hmtx..[$..VL....loca.f....TD....maxp......T$... name&:A...d.....post.U....f....xprepC.....c ............................../2/3./3/310.!.!7!.!..I..h.y.....Jh.................+@...............OY.....??+...9./...9.33.310.#.3.432....#"&.Fi3..x:?@94D...#...FB@G?.................@...............?3.2...99.3.310..#.!.#..?(i).+)h)..............3............@U.......................................!....... !.....NY........NY...O..O............./3?3.99//]].33+..33.33+..33...99..3..99.3...9...9.3...922.3...910..!.!.#.!.#.!5!.!5!.3.!.3.!..!.!..B....T.T..R.P....D...+R.R.1T.T...../B........R...R....T....L...L....T........... .&.-.f@5'.%.......!......../%...MY..$..LY.+...MY..........//.99//.92+..3.3+..3.3+..3....9.3.3333.333.310.....#5"&'5..3.&&546753....&'....4&'.6...........p.CS.Y.....4....J.Y....Zocf.......

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	96336
Entropy (8bit):	5.237139828082104
Encrypted:	false
SSDEEP:
MD5:	9F94F80A5DC09BB962778175292195BC
SHA1:	A7F2E32B422AC9654F39EA870E403599791FCE1C
SHA-256:	1CF4B3AD7ABF3189E78C1B3BD07308C92A03FA795FDBC5821FCDE24030CFEAD0
SHA-512:	85BADDE06E879CBF558163B123BD6A35D58498F15013B981EDB849699C31FC1915B2494595C6FF0E146365413E007C2D3AB32BC83AC70632E64EE08B2B040E44
Malicious:	false
Reputation:	low
URL:	https://boomcleanfreen.xyz/org/dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095/css/style.css
Preview:	html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:700}dfn{font-style:italic}h1{font-size:2em;margin:.67em 0}mark{background:#ff0;color:#000}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sup{top:-.5em}sub{bottom:-.25em}img{border:0}svg:not(:root){overflow:hidden}figure{margin:1em 40px}hr{-moz-box-sizing:content-box;box-sizing:content-box;height:0}pre{overflow:auto}code,kbd,pre,samp{font-family:monospace,monospace;font-size:1em}button,input,optgroup,select,textarea{color:inherit;font:inherit;margin:0}button{overflow:visible}but

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (7323)
Category:	downloaded
Size (bytes):	14810
Entropy (8bit):	5.533546871428101
Encrypted:	false
SSDEEP:
MD5:	50CDDDE01E9F8549DDC6A5CF3562822B
SHA1:	C4EDC5FF8ADE77A190C9AA8BB95C34F121DA4053
SHA-256:	3C3447E74134AC1A5678F3441109F5FD04A612CF43F130D1D4EE2BAD6A9F1DA3
SHA-512:	40D659CC70A5A83CFE69AA9F40CFFAA05169F180408217B449903E8F3BAFEC980DC0342201AB656D63FDEB2D0ED2C0196F4E3976A661E189E29AEDE4BE9E3F18
Malicious:	false
Reputation:	low
URL:	https://pncc.org.np/international-partners/
Preview:	<html lang="en-US">. <link type="text/css" id="dark-mode" rel="stylesheet" href="">. <style type="text/css" id="dark-mode-custom-style"></style>. <head>. <title>Just a moment...</title>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">. <meta http-equiv="X-UA-Compatible" content="IE=Edge">. <meta name="robots" content="noindex,nofollow">. <meta name="viewport" content="width=device-width,initial-scale=1">. <link rel="shortcut icon" href="https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico">. <script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js"></script>.. <style>*{box-sizing:border-box;margin:0;padding:0}html{line-height:1.15;-webkit-text-size-adjust:100%;color:#313131}button,html{font-family:system-ui,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 800 x 800, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	26383
Entropy (8bit):	7.78613498938164
Encrypted:	false
SSDEEP:
MD5:	A8B6905DD4D4F76EE3F473F722D970AA
SHA1:	ADB8B26DDFF48439BB50F06B15D4DE6BB8750601
SHA-256:	B7E088868C2B924585EAFDC7037DD344619FC0938971FFED253FAE7DD9A1FF2F
SHA-512:	E9EA5B9915EF15654AC7AB49FE2C330988E829E0FA7EC12F81643D8A372DD995AFBC1897F9A358DC9F8E6132C8F800EE0444C23EA855EF1F5FC5B508BB918C9D
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... ......p.h....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD............f&IDATx...w..u.........P#M...M..n.p.b...R...$....w.}.n%[.0.@.{!z.G....b.nV.c....P.)d..\....,..-3.y=....p.f.u.\...5.$.....................................................................................................................................................................................................................................................................................................................................................................................b$...R....3C?..Rj.....o..-...b.$...(.?:.4q.%\|.y.FKN.........u....?f.._j!\|..>m..i.P....R.....`.M...P..(..........x........Yp..YXL......f./...i...R.....`.l.....A....>$....f.P.....`...@...s.6.e....UKN:.:..@......m.p.%\|z.wH!..k...............>..6..^.qq..,HP.....`..........!..W.......S.....`...>M...q.3}....,...@Q1.....:........r..C.......rJ....q..(.......-.i..N....z...;$..........

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	513
Entropy (8bit):	4.720499940334011
Encrypted:	false
SSDEEP:
MD5:	A9CC2824EF3517B6C4160DCF8FF7D410
SHA1:	8DB9AEBAD84CA6E4225BFDD2458FF3821CC4F064
SHA-256:	34F9DB946E89F031A80DFCA7B16B2B686469C9886441261AE70A44DA1DFA2D58
SHA-512:	AA3DDAB0A1CFF9533F9A668ABA4FB5E3D75ED9F8AFF8A1CAA4C29F9126D85FF4529E82712C0119D2E81035D1CE1CC491FF9473384D211317D4D00E0E234AD97F
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24"><title>assets</title><path d="M18,11.578v.844H7.617l3.921,3.928-.594.594L6,12l4.944-4.944.594.594L7.617,11.578Z" fill="#404040"/><path d="M10.944,7.056l.594.594L7.617,11.578H18v.844H7.617l3.921,3.928-.594.594L6,12l4.944-4.944m0-.141-.071.07L5.929,11.929,5.858,12l.071.071,4.944,4.944.071.07.071-.07.594-.595.071-.07-.071-.071L7.858,12.522H18.1V11.478H7.858l3.751-3.757.071-.071-.071-.07-.594-.595-.071-.07Z" fill="#404040"/></svg>

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:
MD5:	6C6DD839EC2A04A7D973D9509A894F25
SHA1:	F11C4716FB8A8F25CA46371BD17F9AD8F735F485
SHA-256:	4E965D01A9B096CC949C96C63BC2433EF1DED67A660F6A69EAC4E59FCDD5A23E
SHA-512:	E71FE6E2A07CCABE01A3C64D2AC450277B08ED2B7D311C9BC282B0655556AF9771879CB03CBE512A538453B99DCDF1BBD51C600FB2D4A1FBCFD53B7F8F3A139F
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTA0LjAuNTExMi4xMDISEAlscVRqJb0GNRIFDYyatNs=?alt=proto
Preview:	CgkKBw2MmrTbGgA=

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 188 x 46, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4297
Entropy (8bit):	7.928194078421239
Encrypted:	false
SSDEEP:
MD5:	D672D1DADCBAED8B73ABE377DD624D2F
SHA1:	B8CB97EF329A840E992AC6E654EAE2F9C8AB2809
SHA-256:	8B1AFE4F51FD839B24BA4F059B92455D82AED6545E94A68AD6BDF743A9DEE0B0
SHA-512:	B360536E667AE451B7C3246C03BC5F476D7704399A30BB43EB0F18E349F9863F300BE9919FC76C4D64835DFB740FB6EE233EE12ABB5791ABAEA8B14C706FDBBD
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauthimages.net/c1c6b6c8-pz1szom-3zr0nvr-k6qvui-b-rnlfgh9nb-svhqviwe/logintenantbranding/0/bannerlogo?ts=637297220069781763
Preview:	.PNG........IHDR...............s.....sRGB.........gAMA......a.....pHYs..........o.d...^IDATx^..x.U...K$".pE..OJ.)..)EQ.e...H...+..@`)B>@\D..A.)Aa.,.TQ..H.-@.!...8.~.w.y/...n..~...[...s.=3/....y.....)8.w.....A.._....UI........k..R...<....\..~_....I.....c...r.....t....8.)^.Nl-...%..j...`..."...+.k...._.O(3q....R]n...Q..}.JP..d..C..wpS.....'.....\V.N....B....Se...PRR...r...G..O.l.:)...^d/0....W[n....5.#.'.w:p..#.O..,M.w.";....J...i./..,.B....7..&...+..Z>._f`C..r..)...9.W.7.."\|...zv.........+....[.N..."...w..........d..r..F^d/.QC...E..."\|@....`..^.....q..+Wr...1.IEv_<T.v...D...#U.[J>[H...Z..sN,. K ....?K.z.....Jm..4.=f..6..+..$;.......w&..#..U. <..u.z.O9y...."...j..W.j.....(.`.X?Jn.`E\|\|.DDD....lY..<(...DEE...`...R.fMy...d.u.....>9......i.IOn..r{N....4."\|..U.....m^....M.6......{.g..&...~.D...J.B..G9.}...\.rr..Jll..J.p..1..{.U.V...@? c..u.c\|...^....\|..m.6..#G...{X.....f....I{...o;..wX.*A.......%.aBZ.n...{.n.Y..k...K.b.T...?..g{..T.RJ6.Y.

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1238)
Category:	downloaded
Size (bytes):	1239
Entropy (8bit):	5.068464054671174
Encrypted:	false
SSDEEP:
MD5:	9E8F56E8E1806253BA01A95CFC3D392C
SHA1:	A8AF90D7482E1E99D03DE6BF88FED2315C5DD728
SHA-256:	2595496FE48DF6FCF9B1BC57C29A744C121EB4DD11566466BC13D2E52E6BBCC8
SHA-512:	63F0F6F94FBABADC3F774CCAA6A401696E8A7651A074BC077D214F91DA080B36714FD799EB40FED64154972008E34FC733D6EE314AC675727B37B58FFBEBEBEE
Malicious:	false
Reputation:	low
URL:	https://boomcleanfreen.xyz/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Preview:	!function(){"use strict";function e(e){try{if("undefined"==typeof console)return;"error"in console?console.error(e):console.log(e)}catch(e){}}function t(e){return d.innerHTML='<a href="'+e.replace(/"/g,""")+'"></a>',d.childNodes[0].getAttribute("href")\|\|""}function r(e,t){var r=e.substr(t,2);return parseInt(r,16)}function n(n,c){for(var o="",a=r(n,c),i=c+2;i<n.length;i+=2){var l=r(n,i)^a;o+=String.fromCharCode(l)}try{o=decodeURIComponent(escape(o))}catch(u){e(u)}return t(o)}function c(t){for(var r=t.querySelectorAll("a"),c=0;c<r.length;c++)try{var o=r[c],a=o.href.indexOf(l);a>-1&&(o.href="mailto:"+n(o.href,a+l.length))}catch(i){e(i)}}function o(t){for(var r=t.querySelectorAll(u),c=0;c<r.length;c++)try{var o=r[c],a=o.parentNode,i=o.getAttribute(f);if(i){var l=n(i,0),d=document.createTextNode(l);a.replaceChild(d,o)}}catch(h){e(h)}}function a(t){for(var r=t.querySelectorAll("template"),n=0;n<r.length;n++)try{i(r[n].content)}catch(c){e(c)}}function i(t){try{c(t),o(t),a(t)}catch(r){e(r

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	21186
Entropy (8bit):	5.443356477522194
Encrypted:	false
SSDEEP:
MD5:	380F2F20BB735CB8051873E6BE014EB9
SHA1:	F2F529A1CBA19A43D3DD57ABD8ED4BBA09451A08
SHA-256:	A021E5EF7022A556C759CCA4E248F10383D65A1CD4DF600DAE57EA37CA481073
SHA-512:	27B39C6C7DAF20454888FA47E28673CBDE406AA8E60A2E2CE420A020C7F33CBA21EB058924BBB3B91AFC51CF832C2B08C4ABA055DAA6D969153FBA83149A27EA
Malicious:	false
Reputation:	low
URL:	https://fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v12/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa2JL7SUc.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v12/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa0ZL7SUc.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v12/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa2ZL7SUc.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100;. font-display: swa

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 69 x 34, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	902
Entropy (8bit):	7.5760721199160015
Encrypted:	false
SSDEEP:
MD5:	4F2A1D382216546E2C3BC620497FD4E3
SHA1:	F785EC5967B5666387304F779306F9C3E3359FF4
SHA-256:	105C03D3360CDB953585482374B2CC953D090741037502B0609629F5BB0135B7
SHA-512:	6307ADD035382E50C1B8751E567810AF9C258D8A126C536A9582D2B80C6BEDB87308E991519C7BA07041B9F108C058FF80D90BCC3E36E1FA965C287097522473
Malicious:	false
Reputation:	low
URL:	https://boomcleanfreen.xyz/org/dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095/images/passwrd.png
Preview:	.PNG........IHDR...E..."......\|......sRGB.........gAMA......a.....pHYs..........+......IDAThC.r.0...n............e1..#..E.....a....aX..o.-.r..c.~3......3....L.-... .. .. .. .. .. .. .. .. .. ...OcH.4.[.TNo..H....X.Q..v.X.e{..T..i.n.e{..w..u(.w.0\|6.2s.K#.?.'r....".X.S...J:...v..A.P.c;>...1..;.lLc.d.m....d.H....2.M..x.7\|..C.{.<.e8a{.n...P.+.ZJ....zi.......z/...C..?...-..3..cw=a.?......YJ}>..XFpQ...n.i..ZJ.Un....D...kZ+C.>6........gCY.....(....32...I.g.^.MJ0{.L.#...s.F:.;.p]..(.`........F1%..w...."#.Y].. ..}..T..X.n0..=8.e0N..{0.v_!.#n>.....n.x..u......R.L..=...y..n.e...\|&.Y....g..7...<gN.1Z..:.C..k...".W\|)Z...[u.*.Qf.JHq.V.J...GxnA...0..'.v..'....e....c. ...M.`SR.qn.k.....n.Wm.p..&nJb.{....UE.....^.m..?..w..T..#._....g..p.L.......V.H....a..6[.c...8.....x.....6..=.....J.c..R.7W.......O.........x..x..x..x..x..x..x..x..\|......Z=..z....IEND.B`.

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 2280, version 1.0
Category:	downloaded
Size (bytes):	2280
Entropy (8bit):	7.637852843004151
Encrypted:	false
SSDEEP:
MD5:	DB2E9FF14CAA4E15F4E39EF4E10D34B8
SHA1:	16A11D60FD4B69F3FE7BF7BFB09475A5967124D9
SHA-256:	9DD630E7CBF1A068B89A5A134E248FF63F2D452081BF86684AEB4B7F73712B76
SHA-512:	C8F20DA1AC4DE7845F5ECBF67CC507D93AD53F0402CE16E721C90D95E53D0F1C3F77C51AD0E4E29986179651F6F3395837E06B451E30863EC6DD5BDC28F81024
Malicious:	false
Reputation:	low
URL:	https://boomcleanfreen.xyz/org/dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095/fonts/tsd.woff2
Preview:	wOF2..............0h.............................T.V..b.Pu.6.$...... ......./%c.V.q..\|..E........s...E..r4..wOeCI(b>.. .qK...A.}.w.#8.n.....V........r.D.....}I>......M....z9...r......E...;7..I..Q<.>......EXY..qy....0........~Au.(..P#..f..@.....Q.......8..H0.7...E$.0...1..').q.N..d.A@...+5.z3.....q.-..R!...I...EC.<..K....f.Pt.L.....l.'.U..Z..\|(K.Z.f.]....Ox.`..........7.e......u!`...J..(.........d.}..W.K.]..>\|.ep...0.v.A..Pq:.c.'.@..=.K.L.....+..R.].....r.....`.....J1#.(.2...ec..^0.F...DCh...Q4.....DSh..Y4....ZDKh...U......D[h..].....:DGE.Y.....t...9.@...]..t...=z@...=.....;.@............~...........@..D.9. ..X..bK.=q ..8...J.;. ..x...K..?.i...!4.F.(.C.h.M.)4.f.,.C.h.-.%..V.ZC.h.m.-..v...C.....#t.N.):C...].+t.n.-.C...=.'.^.+zC..{..}D..g..}E..w...D..o...E.......DCh...Q4.....DSh..Y4....ZDKh...U......D[h..].....:DG....St.....DW...[t....zDO....W...E..{..}D..g..}E..w...D..o...E...%....\|.!@.. !D..".(!F....$!EH.2.,!G....".D(...F....&.Eh.:...G....!aD..&.)aF...

Chrome Cache Entry: 150

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	915
Entropy (8bit):	3.8525277758130154
Encrypted:	false
SSDEEP:
MD5:	2B5D393DB04A5E6E1F739CB266E65B4C
SHA1:	6A435DF5CAC3D58CCAD655FE022CCF3DD4B9B721
SHA-256:	16C3F6531D0FA5B4D16E82ABF066233B2A9F284C068C663699313C09F5E8D6E6
SHA-512:	3A692635EE8EBD7B15930E78D9E7E808E48C7ED3ED79003B8CA6F9290FA0E2B0FA3573409001489C00FB41D5710E75D17C3C4D65D26F9665849FB7406562A406
Malicious:	false
Reputation:	low
URL:	https://boomcleanfreen.xyz/org/dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095/images/ellipsis_grey.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16"><title>assets</title><path fill="#777777" d="M1.143,6.857a1.107,1.107,0,0,1,.446.089,1.164,1.164,0,0,1,.607.607,1.161,1.161,0,0,1,0,.893,1.164,1.164,0,0,1-.607.607,1.107,1.107,0,0,1-.446.089A1.107,1.107,0,0,1,.7,9.054a1.164,1.164,0,0,1-.607-.607,1.161,1.161,0,0,1,0-.893A1.164,1.164,0,0,1,.7,6.946a1.107,1.107,0,0,1,.446-.089M8,6.857a1.107,1.107,0,0,1,.446.089,1.164,1.164,0,0,1,.607.607,1.161,1.161,0,0,1,0,.893,1.164,1.164,0,0,1-.607.607,1.161,1.161,0,0,1-.893,0,1.164,1.164,0,0,1-.607-.607,1.161,1.161,0,0,1,0-.893,1.164,1.164,0,0,1,.607-.607A1.107,1.107,0,0,1,8,6.857m6.857,0a1.107,1.107,0,0,1,.446.089,1.164,1.164,0,0,1,.607.607,1.161,1.161,0,0,1,0,.893,1.164,1.164,0,0,1-.607.607,1.161,1.161,0,0,1-.893,0,1.164,1.164,0,0,1-.607-.607,1.161,1.161,0,0,1,0-.893,1.164,1.164,0,0,1,.607-.607A1.107,1.107,0,0,1,14.857,6.857Z"/></svg>

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.895279695172972
Encrypted:	false
SSDEEP:
MD5:	7CDD5A7E87E82D145E7F82358F9EBD04
SHA1:	265104CAD00300E4094F8CE6A9EDC86E54812EAD
SHA-256:	5D91563B6ACD54468AE282083CF9EE3D2C9B2DAA45A8DE9CB661C2195B9F6CBF
SHA-512:	407919CB23D24FD8EA7646C941F4DCEE922B9B4021B6975DD30C738E61E1A147E10A473956A8FBB2DDF7559695E540F2CDF8535DB2C66FA6C7DECDA38BB1B112
Malicious:	false
Reputation:	low
Preview:	............ .h.......(....... ..... ...........................P..$..%..%..%..%.."...}.....9e..<h..<h..<h..<h..;f..c....2.....................f.w....K...N...N...N...N...L..Iq...3.....................g.w....L...O...O...O...O...N..Jr...3.....................g.w....L...O...O...O...O...N..Jr...3.....................g.w....L...O...O...O...O...N..Jr...3.....................g.w....L...O...O...O...O...N..Jr...2.....................f.u....I...L...L...L...L...K..Gp.......g...i...i...i...i...f........................................f...g...g...g...g...e...........g..i..i..i..i..h....../...........................j...d....{...}...}...}...}...\|.6..0...........................k...f....}...................~.8..0...........................k...f....}...................~.8..0...........................k...f....}...................~.8..0...........................k...f....}...................~.8../...........................j...e....\|...

Chrome Cache Entry: 154

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32014)
Category:	downloaded
Size (bytes):	86351
Entropy (8bit):	5.367752216095235
Encrypted:	false
SSDEEP:
MD5:	05E51B1DB558320F1939F9789CCF5C8F
SHA1:	C72C1735B4D903D90DD51225EBEFB8C74EBBC51F
SHA-256:	702B9E051E82B32038FFDB33A4F7EB5F7B38F4CF6F514E4182D8898F4EB0B7FB
SHA-512:	AB3AD9A98FE431508461EBBF8029BC536F34D16CFEF8B4C62B8A62B56FE2B30A426E3C3186C994C2578BD585DA1C89A9B421C6D2F27053B2F2ED13B0DD9428C3
Malicious:	false
Reputation:	low
URL:	https://cdnjs.cloudflare.com/ajax/libs/jquery/3.1.0/jquery.min.js
Preview:	/! jQuery v3.1.0 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b\|\|d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.1.0",r=function(a,b){return new r.fn.init(a,b)},s=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,t=/^-ms-/,u=/-([a-z])/g,v=function(a,b){return b.toUpperCase()};r.fn=r.prototype={jquery:q,constructor:r,length:0,toArray:function(){return f.call(this)},get:function(a){return null!=a?a<0?this[a+this.length]:this[a]:f.call(this)},pushStack:function(a){var b=r.merge(this.con

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 108 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	736
Entropy (8bit):	7.584671380578728
Encrypted:	false
SSDEEP:
MD5:	681B83E88BA6AACCC72705FBF9F2257B
SHA1:	D69957C47026108511225160BE9BD15788D26E14
SHA-256:	F32A760F15530284447282AF5C7D0825BABF8BC4739E073928F6128830819F7A
SHA-512:	393795EAC16AFBEFA38034360C7C886FEA65016A5CEB55E1A91718474B0AE8F3AE7DFC0EA7F6C1C97334C1C6269B702A1C85236A398B78E16D19E696F2135216
Malicious:	false
Reputation:	low
URL:	https://boomcleanfreen.xyz/org/dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095dd4ac2c2b3b62545b040b8a8192464b8803fdb1a010201290143095/images/sigin.png
Preview:	.PNG........IHDR...l... .............sRGB.........gAMA......a.....pHYs..........+.....uIDAThC.AK.A...)Th...!...^....x.......S{K.'.O...[.'...K".I.K...Pj.B(T.$...tf..M"....}?.2ofv..?...!.z...;.+0A.c.......".3D0f.`....1....Z..M..!g_U.p........X..aX...Y.+../K.91l9{.....h..>...;...".P..V..*.">Cv....8.$.V.8.%.v..bJ...Sw:c..]D:.LcT.6...[.}N.wi....1.t.#....O.a..E.....\|...n.p..i....v.3..$.^...\|.;-e;s.g..Y.F...c......u. .L..........1jd.h.w&v6.T.>..A...nXVk\|i..{Wx..1.i}a...n.5]ok....<...z..+h..3U=n..OqX.j.....j.......m.x.E..\|T.U..LFK0.......:`...of....c....._.Kgb.Z.l.C...wu.\.>u.]..z00+....4......7.!.0.2K.XY...O:.Rw...M..7...y...3.FtBb.....3...7....D..e.\|....!1x.`....!.1C.c.......".+...\|..z......IEND.B`.

Static File Info

⊘No static file info

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

Chrome Cache Entry: 131

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 149

Chrome Cache Entry: 150

Chrome Cache Entry: 151

Chrome Cache Entry: 154

Chrome Cache Entry: 155

Static File Info